joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100299b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095231
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x100b84c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x230]
push eax
push ecx
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], 0
call fcn.10014270
add esp, 4
mov ecx, eax
call fcn.10033330
mov dword [ebp - 4], 1
cmp dword [ebp - 0x220], 0
jne 0x10029a47
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
lea eax, [ebp - 0x230]
push eax
mov ecx, edi
call fcn.10014c10
mov dword [ebp - 0x264], 1
jmp 0x10029c10
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.10073e30
add esp, 0xc
call esi
push eax
push 0x100a7654
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10070382
add esp, 0x10
lea ecx, [ebp - 0x230]
push 1
push 0x100a3704
call fcn.10014dc0
cmp word [ebp - 0x218], 0
mov esi, eax
jne 0x10029aab
xor ecx, ecx
jmp 0x10029ac3
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10029ab4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.10014dc0
lea ecx, [ebp - 0x230]
call fcn.100296e0
test al, al
je 0x10029b38
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
call fcn.10014ef0
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 2
mov ebx, 2
jmp 0x10029b54
push 0x100a36b4
lea ecx, [ebp - 0x260]
call fcn.10013600
mov dword [ebp - 4], 3
mov ebx, 4
mov dword [ebp - 0x264], ebx
xor ecx, ecx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], cx
push eax
mov ecx, edi
call fcn.10014c10
or ebx, 1
mov dword [ebp - 0x264], ebx
mov dword [ebp - 4], 2
test bl, 4
je 0x10029bc7
and ebx, 0xfffffffb
mov dword [ebp - 0x264], ebx
cmp dword [ebp - 0x24c], 8
jb 0x10029baa
push dword [ebp - 0x260]
call fcn.1006e29c
add esp, 4
xor eax, eax
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
mov dword [ebp - 4], 1
test bl, 2
je 0x10029c10
and ebx, 0xfffffffd
mov dword [ebp - 0x264], ebx
cmp dword [ebp - 0x234], 8
jb 0x10029bf3
push dword [ebp - 0x248]
call fcn.1006e29c
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
mov byte [ebp - 4], 0
cmp dword [ebp - 0x21c], 8
jb 0x10029c2b
push dword [ebp - 0x230]
call fcn.1006e29c
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
Function at 0x1002a1a0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov bl, dl
cmp dword [esi + 0x10], 0
je 0x1002a251
cmp dword [esi + 0x14], 8
jb 0x1002a1be
mov ecx, dword [esi]
call fcn.10028970
cmp eax, 1
sete al
test al, al
je 0x1002a251
mov ecx, esi
call fcn.100292b0
test al, al
je 0x1002a1e4
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x1002a1ee
mov eax, dword [esi]
jmp 0x1002a1f0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1002a251
test bl, bl
je 0x1002a251
cmp dword [esi + 0x14], 8
jb 0x1002a209
mov eax, dword [esi]
jmp 0x1002a20b
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x1002a22d
and eax, 0xfffffffe
cmp dword [esi + 0x14], 8
jb 0x1002a223
mov ecx, dword [esi]
jmp 0x1002a225
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], 8
jb 0x1002a237
mov eax, dword [esi]
jmp 0x1002a239
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1002a251
mov ecx, esi
call fcn.1002ab40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002a7b0
Capabilities:
Move file

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1002a867
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1002a867
cmp dword [esi + 0x14], 8
jb 0x1002a7d5
mov edx, dword [esi]
push eax
push edx
push ecx
push ecx
mov ecx, edi
call fcn.100150d0
test eax, eax
jne 0x1002a7ed
mov eax, 2
pop edi
pop esi
pop ecx
ret
cmp dword [edi + 0x10], 0
je 0x1002a85e
cmp dword [edi + 0x14], 8
jb 0x1002a7fd
mov ecx, dword [edi]
jmp 0x1002a7ff
mov ecx, edi
call fcn.10028970
cmp eax, 1
sete al
test al, al
je 0x1002a85e
cmp dword [esi + 0x10], 0
je 0x1002a838
cmp dword [esi + 0x14], 8
jb 0x1002a81e
mov ecx, dword [esi]
jmp 0x1002a820
mov ecx, esi
call fcn.10028970
cmp eax, 1
sete al
test al, al
je 0x1002a838
mov dl, 1
mov ecx, esi
call fcn.1002a1a0
cmp dword [esi + 0x14], 8
jb 0x1002a840
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x1002a848
mov edi, dword [edi]
push esi
push edi
call fcn.100706e4
add esp, 8
neg eax
sbb eax, eax
and eax, 0xfffffffc
inc eax
pop edi
pop esi
pop ecx
ret
mov eax, 0xfffffffe
pop edi
pop esi
pop ecx
ret
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret
Function at 0x1002bc30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094b5a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100b84c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], 0
lea eax, [edi + 0x70]
mov dword [edi], 0x100a769c
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [ebp - 4], 0
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.10027df0
lea eax, [ebp - 0x14]
lea ebx, [edi + 0x10]
push eax
mov ecx, esi
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0
call fcn.10027d80
mov dword [ebp - 4], 4
push eax
call fcn.1002c870
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1002bd0c
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x1002bd0c
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov ecx, dword [ebp - 0x18]
push 0x20
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x1002bd31
mov eax, dword [esi + 0xc]
or eax, 4
push 0
push eax
mov ecx, esi
call fcn.10027cd0
mov dword [ebp - 4], 5
mov eax, dword [edi]
mov dword [ebp - 0x18], ebx
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, ebx
call fcn.1002c780
mov byte [ebp - 4], 6
lea eax, [ebx + 4]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x14]
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x4c], 0
mov byte [ebx + 0x45], 0
lea ecx, [ebx + 8]
mov dword [ebx + 0x10], ecx
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [0x100bb930]
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002c300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10090b38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100b84c0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x100b84c0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x1002c493
cmp byte [ebx + 0x45], 0
je 0x1002c493
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1002c360
xor al, al
jmp 0x1002c495
mov ecx, 0xf
mov dword [esp + 0x2c], 0
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
jmp 0x1002c3c0
cmp ecx, 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, edx
lea esi, [esp + 0x1c]
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1002c3fb
dec eax
je 0x1002c3ff
sub eax, 2
je 0x1002c45d
xor bl, bl
jmp 0x1002c45f
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x1002c43e
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.100709e4
add esp, 0x10
cmp esi, eax
jne 0x1002c3f7
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp byte [ebx + 0x45], 0
je 0x1002c45d
test esi, esi
jne 0x1002c3c0
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.100205a0
jmp 0x1002c3af
mov bl, 1
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x2c], 0x10
jb 0x1002c47a
push dword [esp + 0x18]
call fcn.1006e29c
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
mov al, bl
jmp 0x1002c495
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
Function at 0x1002dcd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100b84c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.10073e30
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1002de2f
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x1002dd40
cmp dword [ebp - 0x118], 1
jne 0x1002de2f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x1002de21
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x1002dd66
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x1002dd7e
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x1002de09
mov ecx, 0x100a754c
call fcn.10004790
mov edx, str.RtlGetVersion
mov ecx, eax
call fcn.100263f0
test eax, eax
je 0x1002ddf6
lea ecx, [ebp - 0x120]
push ecx
call eax
test eax, eax
jne 0x1002ddf6
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x1002ddd5
cmp dword [ebp - 0x118], 3
jne 0x1002ddf6
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x1002ddf6
cmp dword [ebp - 0x118], 0
jne 0x1002ddf6
mov eax, 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x1002de2f
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x1002de2f
cmp dword [ebp - 0x118], 0
je 0x1002dde3
mov ecx, dword [ebp - 4]
xor ecx, ebp
or eax, 0xffffffff
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
Function at 0x100370d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100bc828], 0
je 0x100370e5
mov eax, 2
pop ebp
ret 8
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.10037570
test eax, eax
js 0x100371e5
push ebx
call fcn.10037690
mov ebx, eax
test ebx, ebx
jg 0x10037111
pop ebx
mov eax, 0xfffffffe
pop edi
pop ebp
ret 8
push esi
push 0x40
push 0x3000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10037132
lea eax, [esi - 3]
pop esi
pop ebx
pop edi
pop ebp
ret 8
push edi
push esi
call fcn.10037710
mov eax, dword [0x100bc830]
cmp dword [eax + 0xa0], 0
jbe 0x10037156
cmp dword [eax + 0xa4], 0
jbe 0x10037156
push esi
call fcn.100372f0
push esi
call fcn.10037390
mov edi, eax
test edi, edi
js 0x100371b9
lea eax, [ebp + 0xc]
push eax
push 0x40
push ebx
push esi
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x100bc830]
mov dword [eax + 0x34], esi
mov eax, dword [0x100bc830]
mov eax, dword [eax + 0x28]
add eax, esi
mov dword [0x100bc824], eax
jne 0x10037197
mov edi, 0xfffffffc
jmp 0x100371d3
push 0
push 1
push esi
call eax
test eax, eax
jne 0x100371a7
lea edi, [eax - 5]
jmp 0x100371be
mov dword [0x100bc828], esi
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret 8
cmp edi, 0xfffffffb
jne 0x100371d3
push 0
push 0
push esi
call dword [0x100bc824]
mov dword [0x100bc824], 0
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
mov eax, edi
pop ebx
pop edi
pop ebp
ret 8

Function at 0x10037570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x40
jb 0x1003767b
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1003767b
mov eax, 0x5a4d
mov dword [0x100bc82c], ecx
cmp ax, word [ecx]
jne 0x10037671
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jae 0x100375b6
mov eax, 0xffffffdf
pop esi
pop ebp
ret 8
add ecx, edx
mov dword [0x100bc830], ecx
je 0x10037667
cmp dword [ecx], 0x4550
jne 0x10037667
movzx edx, word [ecx + 0x16]
mov eax, edx
push edi
and eax, 0x2000
xor edi, edi
cmp di, ax
jne 0x100375ec
lea eax, [edi - 0x23]
pop edi
pop esi
pop ebp
ret 8
test dl, 2
jne 0x100375fc
pop edi
mov eax, 0xffffffdc
pop esi
pop ebp
ret 8
mov eax, 0xe0
cmp ax, word [ecx + 0x14]
je 0x10037612
pop edi
mov eax, 0xffffffdb
pop esi
pop ebp
ret 8
lea eax, [ecx + 0xf8]
mov dword [0x100bc834], eax
test eax, eax
jne 0x1003762c
pop edi
mov eax, 0xffffffda
pop esi
pop ebp
ret 8
movzx edi, word [ecx + 6]
xor edx, edx
test edi, edi
jle 0x10037651
lea ecx, [eax + 0x10]
lea esp, [esp]
mov eax, dword [ecx + 4]
add eax, dword [ecx]
cmp eax, esi
ja 0x1003765c
inc edx
add ecx, 0x28
cmp edx, edi
jl 0x10037640
pop edi
mov eax, 0x1f
pop esi
pop ebp
ret 8
pop edi
mov eax, 0xffffffd9
pop esi
pop ebp
ret 8
mov eax, 0xffffffde
pop esi
pop ebp
ret 8
mov eax, 0xffffffe0
pop esi
pop ebp
ret 8
mov eax, 0xffffffe1
pop esi
pop ebp
ret 8
Function at 0x10037b70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10096da6
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x100b84c0]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
push edi
mov eax, dword [0x100b84c0]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.10014720
mov dword [esp + 0xc0], 0
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x10037c53
lea ecx, [esp + 0x24]
call fcn.100377d0
mov byte [esp + 0xc0], 1
lea ecx, [esp + 0xc]
cmp ecx, eax
je 0x10037c1f
push 0xffffffffffffffff
push 0
push eax
call fcn.10014720
mov byte [esp + 0xc0], 0
cmp dword [esp + 0x38], 0x10
jb 0x10037c3a
push dword [esp + 0x24]
call fcn.1006e29c
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
test esi, esi
je 0x10037cde
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push ecx
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xac], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x44], 0x67452301
mov dword [esp + 0x48], 0xefcdab89
mov dword [esp + 0x4c], 0x98badcfe
mov dword [esp + 0x50], 0x10325476
call fcn.1003d6a0
cmp byte [esp + 0xa4], 0
jne 0x10037cc7
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa4], 1
call fcn.1003d750
push ecx
lea eax, [esp + 0x98]
push eax
mov edx, esi
mov ecx, edi
call fcn.10037960
add esp, 8
mov esi, eax
mov dword [esp + 0xc0], 0xffffffff
cmp dword [esp + 0x20], 0x10
jb 0x10037cfc
push dword [esp + 0xc]
call fcn.1006e29c
add esp, 4
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov eax, esi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret
Function at 0x10038140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b2e30
push 0x10075710
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100b84c0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov edx, ecx
mov dword [ebp - 0x20], edx
mov edi, dword [ebp + 8]
mov dword [edi], 0
xor esi, esi
cmp ebx, 4
jl 0x100382c5
mov eax, ebx
and eax, 0x80000003
jns 0x1003819c
dec eax
or eax, 0xfffffffc
inc eax
jne 0x100382c5
mov dword [ebp - 4], esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
jge 0x100381cc
mov al, byte [ecx + edx]
cmp al, 0x80
jae 0x100382be
movzx eax, al
cmp byte [eax + 0x100b9a00], 0xff
je 0x100382be
inc ecx
jmp 0x100381a7
push ebx
call fcn.1006f1b3
mov dword [ebp - 0x1c], eax
push ebx
push 0
push eax
call fcn.10073e30
add esp, 0x10
mov edx, dword [ebp - 0x1c]
cmp esi, ebx
jge 0x10038291
mov ecx, dword [ebp - 0x20]
movzx eax, byte [esi + ecx]
mov dl, byte [eax + 0x100b9a00]
inc esi
mov dword [ebp - 0x24], esi
movzx eax, byte [esi + ecx]
mov al, byte [eax + 0x100b9a00]
inc esi
mov dword [ebp - 0x24], esi
movzx ecx, al
mov dword [ebp - 0x2c], ecx
shr ecx, 4
and ecx, 3
movzx eax, dl
shl eax, 2
or ecx, eax
mov eax, dword [edi]
mov edx, dword [ebp - 0x1c]
mov byte [edx + eax], cl
inc dword [edi]
mov eax, dword [ebp - 0x20]
mov al, byte [esi + eax]
inc esi
mov dword [ebp - 0x24], esi
cmp al, 0x3d
je 0x10038291
movzx eax, al
mov al, byte [eax + 0x100b9a00]
movzx ecx, al
mov eax, ecx
shr eax, 2
and eax, 0xf
mov edx, dword [ebp - 0x2c]
and edx, 0xf
shl edx, 4
or eax, edx
mov edx, dword [ebp - 0x1c]
mov edi, dword [edi]
mov byte [edi + edx], al
mov edi, dword [ebp + 8]
inc dword [edi]
mov eax, dword [ebp - 0x20]
mov al, byte [esi + eax]
inc esi
mov dword [ebp - 0x24], esi
cmp al, 0x3d
je 0x10038291
movzx eax, al
mov al, byte [eax + 0x100b9a00]
and ecx, 3
shl ecx, 6
movzx eax, al
or ecx, eax
mov eax, dword [edi]
mov byte [eax + edx], cl
inc dword [edi]
jmp 0x100381e4
mov dword [ebp - 4], 0xfffffffe
mov eax, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003cb90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x100a7784
push ecx
mov edi, edx
call fcn.10071629
mov esi, eax
add esp, 8
test esi, esi
je 0x1003cbc7
push esi
push edi
push 1
push dword [ebp + 8]
call fcn.10071cd0
add esp, 0x10
push esi
cmp eax, edi
je 0x1003cbcd
call fcn.10070fd2
add esp, 4
pop edi
xor al, al
pop esi
pop ebp
ret
call fcn.10070fd2
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
ret

Function at 0x1003d570
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov eax, ecx
ret
Function at 0x1003d5a0
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x10048fb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x10048fbb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.10048fd0