joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b610
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ecx
mov cl, byte [0x65e041]
mov al, byte [0x65e04e]
or cl, 0xc
push ebx
shr cl, 2
and ecx, 0xff
mov bl, byte [0x65e043]
mov dword [esp + 4], ecx
xor bl, al
fild dword [esp + 4]
mov byte [0x65e043], bl
fdivr qword [0x6619e0]
fadd qword [0x661980]
fstp qword [0x6619e0]
call dword [sym.imp.USER32.dll_GetFocus]
mov dl, byte [0x65e042]
mov bl, byte [str._P_n]
mov ecx, dword [0x65e03c]
xor bl, dl
mov edx, dword [0x65e048]
and ecx, 0xc
and edx, 0xff
mov dword [0x661be4], eax
mov eax, dword [0x65e034]
imul ecx, edx
mov edx, dword [0x65e038]
mov byte [str._P_n], bl
mov ebx, dword [0x65e030]
and eax, 4
add ebx, eax
mov eax, dword [esp + 0xc]
xor edx, ecx
push eax
mov dword [0x65e030], ebx
mov dword [0x65e038], edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [0x661be4], eax
mov eax, dword [0x661be0]
test eax, eax
jne 0x44b749
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push str.user32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x661acc]
mov esi, eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0xa3
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x44b70d
cmp edi, dword [0x661be4]
je 0x44b70d
mov dword [0x661be4], edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetDpiForWindow
push esi
xor edi, edi
call ebx
push str.SetThreadDpiAwarenessContext
push esi
mov dword [0x661ad0], eax
call ebx
push esi
mov dword [0x661bd8], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
mov dword [0x661be0], 1
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0xc]
pop ebx
pop ecx
ret 4
Function at 0x4ac011
Capabilities:
Encode data using xor

Disassembly:
dec eax
imul esi, dword [ecx + 0x26], 0xc5d3dbee
xchg ecx, eax
mov dword [eax - 0x206acf26], edx
sub al, byte [ebx]
pop esi
mov bh, 0xa5
fcmovnbe st(0), st(3)
lds edx, [ecx + 0x30da9089]
fidiv dword [eax]
xchg ebp, eax
fild qword [edx]
add ebx, dword [esi - 0x49]
movsd dword es:[edi], dword [esi]
jge 0x4abfdc
pop ds
outsb dx, byte [esi]
fidivr word [ebx + esi + 0x5dfb54cd]
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
xchg ecx, eax
inc sp
loop 0x4abfe1
push esi
arpl word [edi - 6], bp
shr edi, 0x10
inc edi
rol byte [ecx], 1
cmc
mov edx, 0x4d09a33
add al, 0x5b
add al, 0x5b
lodsd eax, dword ds:[esi]
sbb dh, ch
pop eax
push esp
pushal
sbb dword [eax], edx
scasd eax, dword es:[edi]
sbb eax, 0xeec7fb2b
lodsd eax, dword [esi]
lds edx, [ebx + 0x3d]
cmp dl, byte [ecx]
dec ebp
test dword [edi], edx
cmp eax, 0x854d113a
pop ss
xor ch, dl
dec esi
std
push eax
pop ebx
or eax, 0x9624b48a
sub eax, 0x1a2acb91
jge 0x4ac065
insd dword es:[edi], dx
invalid
je 0x4ac026
fisttp qword [edx - 0x2f]
mov dh, byte [ecx - 0x74]
and dh, byte [ebx - 0x26]
pop ebx
adc dword [ebx + 0x77dca421], ebx
pop esi
pop ss
pop ecx
dec edx
ror dword [edx + 0x73228c71], 1
ficomp dword [ebx + 0x11]
wait
and dword [esp + ebx*8 + 0x59175e77], esp
push esi
jge 0x4ac0a8
mov al, 0xf3
loopne 0x4ac0e1
out dx, eax
scasd eax, dword es:[edi]
jno 0x4abfe7
cmp dword [edi], 0x7987e92a
and eax, 0x7d917587
xlatb
aas
sub ch, cl
xchg dword [ecx + 0x25], edi
xchg dword [ebp - 0x6f], esi
jge 0x4ac048
mov dl, byte [ecx]
xchg ecx, eax
jno 0x4ac08d
inc eax
outsd dx, dword [esi]
nop
sbb al, 0xd0
push es
lodsb al, byte [esi]
salc
sbb edi, 0xffffffa1
xor dword [ecx - 0x4ff57d9a], edx
lodsd eax, dword [esi]
fidivr dword [ecx + 0x4fe16a80]
dec edi
popfd
jp 0x4ac0c3
mov cl, pe_nt_image_headers32
pop ebp
das
dec ebp
das
aaa
xchg byte [ebx], bl
pop edi
mov ch, 0x31
js 0x4ac047
inc ecx
das
movsb byte es:[edi], byte [esi]
sal esp, cl
push cs
xchg edx, eax
mov esi, 0x199dce41
adc byte [eax + 0x21], ch
mov ebx, 0x4a107210
cmp al, 0x26
dec esi
inc ecx
into
popfd
sbb dword [eax], edx
push 0x7210bb21
adc byte [edx + 0x3c], cl
dec esi
dec edx
nop
invalid
add esi, 0xffffffcc
sub edi, ebp
cmpsb byte [esi], byte es:[edi]
push es
and al, 0xc0
jp 0x4ac0cd
jnp 0x4ac0da
jp 0x4ac095
pop eax
movsd dword es:[edi], dword [esi]
add bl, bl
inc esp
pop edi
xlatb
sahf
jne 0x4ac12a
leave
adc eax, 0xb52380cc
jo 0x4ac14a
ficom dword [eax + 0x4eebedb]
mov edx, 0x848e03e0
in eax, 0x6a
clc
mov edx, 0x3b08ad1b
push es
cwde
sbb ebp, dword [ebp - 0x67f9c4f8]
mov ah, 0xe2
jecxz 0x4ac0c0
inc ecx
adc dword [esi - 0x77c56f39], 0x7d3b8c59
scasb al, byte es:[edi]
movsd dword es:[edi], dword [esi]
sbb eax, edx
jg 0x4ac13b
inc edi
pushfd
wait
mov byte [0xa58baf7a], al
mov esp, dword [ebp + 0x2b78a4e9]
invalid
out dx, eax
mov byte [0x81916a27], al
adc dword [0x21556911], esi
lcall 0xbc38, 0x78eff4a9
xchg byte [eax], dl
inc eax
wait
out dx, eax
js 0x4ac185
mov esp, 0x9b401086
jecxz 0x4ac0f0
and byte [edx], cl
loopne 0x4ac173
insd dword es:[edi], dx
mov word [eax - 0x7a], ss
mov al, 0xef
invalid
Function at 0x58bef1
Capabilities:
Encode data using xor

Disassembly:
jle 0x58beff
inc dword [esi - 0x43868821]
rcl dword [esi - 0x73cd53fb], cl
invalid
js 0x58befe
mov byte [eax + edx*4 + 0x5f], ch
adc bl, byte [ebp - 0x5b4c1e11]
invalid
Function at 0x6258d1
Capabilities:
Encode data using xor

Disassembly:
push ds
das
add edx, dword [edx + 0x1be33772]
push eax
jecxz 0x6258a2
les esi, [ecx - 0x6c4c530e]
cmpsb byte [esi], byte es:[edi]
and byte [ecx - 0xe674e08], dl
sar edx, 1
call 0x26f13deb
mov bl, 0x1c
mov ebp, 0xe09ba25a
pushal
sub eax, dword [ecx - 0x2c]
push edx
pop edx
mov byte [0x2b60e09b], al
inc ecx
aam 0x52
loopne 0x6258cb
int1
add edx, dword [ebp + 0x1162d7a5]
jmp 0xffc53f62
outsd dx, dword [esi]
and byte [ecx + 0x2b], bh
xor dword [ecx], 0x1253e0f4
dec eax
inc ecx
loopne 0x6258f7
adc cl, byte [eax + 0x41]
jge 0x625844
and eax, edx
sbb eax, 0xd291dc25
int3
fidiv dword gs:[ebp - 0x7ba3b5db]
lsl esp, word [edi + edi - 0x30]
test byte [edi], cl
add esp, dword [edi + edi - 0x30]
jae 0x625866
sub eax, 0x45a35369
dec ecx
call 0x7e888d14
mov bl, 0xca
jb 0x6258cb
aam 0x52
sbb byte [esi - 0x6d82a0b0], 0xb1
cmpsb byte [esi], byte es:[edi]
and eax, edx
xchg ecx, eax
jno 0x62592d
rol dword [ebx - 0x4e], 1
test byte [edx + edx*8], dl
xchg edx, eax
imul ebp, dword [edi + 0x3e], 0x57
shl byte [ebp + 0x75d73b11], cl
jo 0x62589b
jne 0x625979
xchg ecx, eax
inc esp
or eax, 0xf36dd18d
and bh, byte [ebx]
xchg edx, eax
or dword [ebx], edx
shl byte [edi], 0x69
int1
xlatb
popfd
adc dl, dl
cmp esp, dword [ebp + 0x2081fe71]
mov ch, byte [ebx + 0x7f33b7e6]
add eax, 0xf615c086
invalid
test bh, 0xa
jl 0x6259a2
invalid
cmpsd dword [esi], dword es:[edi]
pop edi
sal byte [ecx], cl
dec ecx
jp 0x625907
add eax, 0x24b64387
xchg dword [ebp + 0x28], eax
push ebp
sub eax, 0xd293543
not ebp
xchg ebx, eax
ret 0x677
ja 0x625953
dec esp
loopne 0x6258d9
invalid
add ecx, ebp
cmpsd dword [esi], dword es:[edi]
rol byte [0x3ce0d780], 0x69
inc esp
jmp 0x37f18843
xlatb
loopne 0x625998
imul eax, dword [ecx + ebp*8 - 0x20], 0x66378f2e
js 0x6259ac
or byte [0xd3629242], cl
insd dword es:[edi], dx
fidivr word [ebx - 0x5e]
jno 0x625947
aam 2
lahf
test bl, bh
mov dword [0xd212d245], eax
jb 0x625942
add bl, byte [edi - 0x5c047b0d]
inc ebp
rcl byte [edx], cl
sal byte [edx - 0x3d], cl
ret
fldenv [edx]
xor byte [eax], bh
mov ecx, 0x3e0243a0
push 6
jo 0x62597e
cmp ch, byte [edi]
inc ebp
sub byte [ecx - 0x157c4c59], 0xf2
xchg edi, eax
xchg edi, eax
loop 0x6259b9
pop ebx
ffree st(3)
aad 0x2f
sar dword [eax - 0x32], 0x76
mov bl, 0xe3
mov dword [0xfd694316], eax
js 0x625972
jbe 0x625959
jecxz 0x62594b
push ss
inc ebx
imul edi, ebp, 0x1fdb637b
jnp 0x625a11
fistp dword [edi]
loop 0x625937
aam 0xe3
mov word [esi - 0x2a], ss
popfd
invalid
enter 0xffffffffffffd8d7, 0x66
int 0x13
iretd
or al, 0xa2
sub al, 0x93
xchg ecx, eax
sub byte [esi*8 + 0x7b47e20a], 0x65
xchg ebx, eax
and eax, 0xbb528546
xchg edx, eax
or al, 0x42
invalid
Function at 0x401000
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push ebx
or dword [ebp - 4], 0xffffffff
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
mov dword [ecx], 0xfffffff6
je 0x4010bc
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4010b3
push edi
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x4010a9
cmp dword [edi], 0x4643534d
jne 0x40109d
push esi
mov esi, dword [edi + 0x10]
add esi, edi
cmp word [edi + 0x1c], bx
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x40109c
mov eax, dword [esi]
add esi, 0x11
add dword [ebp - 4], eax
push esi
call fcn.004075d0
inc dword [ebp + 8]
lea esi, [esi + eax + 1]
mov ax, word [ebp + 8]
pop ecx
cmp ax, word [edi + 0x1c]
jb 0x40107c
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x4010c2
Capabilities:
Terminate process

Disassembly:
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0xc]
call fcn.00401151
add esp, 0xc
mov dword [0x416138], eax
test eax, eax
jne 0x4010ed
call fcn.004023dd
test eax, eax
mov dword [0x416138], eax
je 0x401113
jle 0x40110c
cmp dword [0x4160ec], 0
jne 0x40110c
push 0x10
push 1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call main
add esp, 0x10
call fcn.00404e6e
jmp 0x401145
call fcn.00404e6e
test eax, eax
mov dword [0x416138], eax
je 0x401137
push 0x10
push 1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call main
add esp, 0x10
jmp 0x401145
mov eax, dword [0x416170]
test eax, eax
je 0x401145
mov dword [0x416138], eax
push dword [0x416138]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404669
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 1
and byte [ebp - 0x110], 0
pop edx
push 0x40
xor eax, eax
pop esi
lea edi, [ebp - 0x10f]
mov ecx, esi
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
and dword [ebp - 0xc], 0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push edx
mov dword [ebp - 8], edx
push dword [0x41617c]
stosb byte es:[edi], al
mov edi, str._spftw_d.pkg
lea eax, [ebp - 0x110]
push edi
push eax
call ebx
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004014c2
add esp, 0x18
test eax, eax
je 0x4047d7
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x110]
push eax
call entry0
cmp dword [ebp - 4], 0
pop ecx
pop ecx
jl 0x4046f1
add dword [ebp - 0xc], eax
inc dword [ebp - 8]
jmp 0x4046f7
cmp dword [ebp - 4], 0xfffffff6
je 0x40470a
push dword [ebp - 8]
lea eax, [ebp - 0x110]
push dword [0x41617c]
push edi
push eax
jmp 0x4046b6
and byte [ebp - 0x318], 0
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
and byte [ebp - 0x41c], 0
mov ecx, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x41b]
rep stosd dword es:[edi], eax
and byte [ebp - 0x214], 0
mov ecx, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
lea eax, [ebp - 0x318]
push esi
mov edi, 0x13e
push eax
push edi
push dword [0x4160d8]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x318]
push esi
push eax
push edi
push str.Strings
call fcn.00401457
add esp, 0x10
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x214]
push 4
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x41c]
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x41c]
push 0x10
push dword [0x4161a4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 4], 0xfffffff6
pop edi
pop esi
pop ebx
jne 0x4047e4
xor eax, eax
leave
ret
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.004047f7
add esp, 0xc
leave
ret
Function at 0x4458c8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x445967
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00405fa4
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x4b5a82
call fcn.00406218
add esp, 0xc
test eax, eax
jne 0x445967
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x445964
mov ecx, dword [ebp + 0x10]
mov esi, str.__
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00405ec8
add esp, 8
mov eax, 1
jmp 0x445972
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x4458e7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c86b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x10], eax
xor eax, eax
push eax
mov byte [esp + 4], al
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov word [esp + 0x11], ax
mov byte [esp + 0x13], al
push 2
lea eax, [esp + 8]
push eax
push ecx
call sub.WS2_32.dll_recv
cmp eax, 2
jne 0x100c870a
cmp byte [esp], 0xd
jne 0x100c870a
cmp byte [esp + 1], 0xa
jne 0x100c870a
mov al, 1
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10103a83
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor ecx, esp
xor al, al
call fcn.10103a83
add esp, 0x14
ret

Function at 0x100c9710
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x68
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, ecx
push edi
mov byte [esp + 0x13], 0
test esi, esi
je 0x100c9846
test ebp, ebp
je 0x100c9846
push 0x40000
call fcn.100fe24c
mov edi, eax
add esp, 4
test edi, edi
je 0x100c981e
push 0x101642b4
push esi
call fcn.10102086
mov ebx, eax
xor esi, esi
add esp, 8
cmp ebx, esi
je 0x100c9813
xor eax, eax
mov dword [ebp], eax
push 0x40000
mov dword [ebp + 4], eax
push esi
mov dword [ebp + 8], eax
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
mov dword [ebp + 0xc], eax
call fcn.10109950
push ebx
push 0x40000
push 1
push edi
call fcn.101019ac
add esp, 0x1c
cmp eax, esi
jle 0x100c9803
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100c97d0
push edi
lea ecx, [esp + 0x1c]
call fcn.100cbed0
add esp, 4
push 0x14
call esi
push 0x40000
push 0
push edi
call fcn.10109950
push ebx
push 0x40000
push 1
push edi
call fcn.101019ac
add esp, 0x1c
test eax, eax
jg 0x100c97d0
lea esi, [esp + 0x18]
mov ecx, ebp
call fcn.100cbf80
mov byte [esp + 0x13], 1
push edi
call fcn.100ffe83
add esp, 4
jmp 0x100c9822
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x100c982f
push ebx
call fcn.10101a40
add esp, 4
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.10103a83
add esp, 0x68
ret
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.10103a83
add esp, 0x68
ret
Function at 0x100cbc30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push 0x101636c4
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.101016b9
mov eax, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x100cbc82
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.101019ac
mov edx, dword [esp + 0x10]
push edx
call fcn.10101a40
mov eax, dword [esp + 0x18]
add esp, 0x14
add esp, 8
ret
push 0
call fcn.10103f43
push eax
call fcn.1010011e
call fcn.10100130
push 0x10165abc
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push esi
push eax
call fcn.101016b9
mov eax, dword [esp + 0x14]
add esp, 0x14
test eax, eax
je 0x100cbccf
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.10103ec1
mov edx, dword [esp + 0x10]
push edx
call fcn.10101a40
add esp, 0x14
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x100cbe90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
test edx, edx
jbe 0x100cbec1
mov eax, dword [edi]
push ebx
push ebp
lea ebx, [ebx]
movzx ebx, byte [ecx + esi]
mov ebp, eax
and ebp, 0xff
xor ebx, ebp
shr eax, 8
xor eax, dword [ebx*4 + 0x10192100]
inc ecx
cmp ecx, edx
jb 0x100cbea0
pop ebp
mov dword [edi], eax
pop ebx
ret

Function at 0x100ccc70
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x88
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
push esi
push edi
xor ebx, ebx
push 0x1000000
mov byte [esp + 0x1b], bl
call fcn.100fe24c
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x100ccd31
push 0x1000000
push esi
mov ecx, str.mhelp.dat
call 0x10c111e3
mov edi, eax
cmp edi, ebx
je 0x100ccd22
push 0x27
lea eax, [esp + 0x71]
push ebx
push eax
mov byte [esp + 0x78], bl
call fcn.10109950
add esp, 0xc
push edi
push esi
lea ebx, [esp + 0x20]
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.100cdba0
mov ecx, ebx
push ecx
lea edi, [esp + 0x70]
call fcn.100af8f0
mov edx, edi
push edx
push ebp
call fcn.100ccb70
add esp, 8
test al, al
je 0x100ccd22
mov byte [esp + 0x17], 1
push esi
call fcn.100ffe83
mov al, byte [esp + 0x1b]
add esp, 4
jmp 0x100ccd33
mov al, bl
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10103a83
add esp, 0x88
ret
Function at 0xb8e350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x44], 0x11b22
mov dword [ebp - 0x28], 0x1548b
mov dword [ebp - 0x30], 0x9388
mov dword [ebp - 0x50], 0x12377
mov dword [ebp - 0x54], 0x1268c
mov dword [ebp - 0x34], 0x4465
mov dword [ebp - 0x58], 0xd4c2
mov dword [ebp - 0x5c], 0x44a0
mov dword [ebp - 0x60], 0x16eb
mov dword [ebp - 0x1c], 0xc4c9
mov dword [ebp - 0x64], 0x93e7
mov dword [ebp - 0x2c], 0x91f0
mov dword [ebp - 0x14], 0x16905
mov dword [ebp - 4], 0x7ab0
mov dword [ebp - 0x38], 0xb029
mov dword [ebp - 0x68], 0x3f98
mov dword [ebp - 0xc], 0xa305
mov dword [ebp - 0x6c], 0x10bbf
mov dword [ebp - 0x24], 0x479d
mov dword [ebp - 0x18], 0x1864e
mov dword [ebp - 0x4c], 0x7192
mov dword [ebp - 0x20], 0x5e5a
mov dword [ebp - 0x70], 0xb481
mov dword [ebp - 0x74], 0xf67c
mov dword [ebp - 0x48], 0xffac
mov eax, dword [0x1102a24]
add eax, 0xbaea
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0xa323
push ecx
mov edx, dword [ebp - 0x24]
add edx, 0xbdf2
push edx
mov eax, dword [ebp - 0x28]
sub eax, 0x716f
push eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x1265
push ecx
mov edx, dword [0x1102b40]
add edx, 0x5ed6
push edx
mov eax, dword [ebp - 0xc]
sub eax, 0x3a28
push eax
mov ecx, dword [0x1102e4c]
add ecx, 0x1cf7
push ecx
mov edx, dword [ebp - 0x30]
add edx, 0x2c27
push edx
mov eax, dword [ebp - 0x14]
sub eax, 0xc216
push eax
call fcn.0040e2a0
add esp, 0x28
mov dword [ebp - 8], 0
jmp 0xb8e487
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x4464
cmp dword [ebp - 8], edx
jge 0xb8e4fe
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x40]
jge 0xb8e4bb
mov dword [ebp - 0x10], 1
jmp 0xb8e4c2
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [ebp - 0x10]
je 0xb8e4fc
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x14]
jge 0xb8e4fc
mov eax, dword [0x1102a48]
cmp eax, dword [ebp - 0x44]
jne 0xb8e4fc
mov ecx, dword [0x1102e4c]
cmp ecx, dword [ebp - 0x48]
jne 0xb8e4fc
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 4]
jne 0xb8e4fc
mov eax, dword [0x1102b44]
sub eax, 1
mov dword [0x1102b44], eax
jmp 0xb8e47e
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0xb9b909
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0xb9b948
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xb9b948
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xb9b948
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xb9b948
cmp dword [ecx + 0x74], 0xe
jbe 0xb9b948
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0xba7fb4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0xba7ff3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xba7ff3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xba7ff3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xba7ff3
cmp dword [ecx + 0x74], 0xe
jbe 0xba7ff3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0xbc7c39
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00bc7b0d
Function at 0xbc8734
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x11a0000]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0xbc877f
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00bc8bd4
test al, al
jne 0xbc8779
sub edx, 2
cmp edx, edi
jne 0xbc875f
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0xbc87a1
lea eax, [edi + 2]
cmp edx, eax
je 0xbc87a1
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00bc83fb
add esp, 0x10
jmp 0xbc889b
push esi
lea ecx, [ebp - 0x255]
call fcn.00bc8bd4
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0xbc87e4
push dword [ebp - 0x25c]
jmp 0xbc8791
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0xbc8821
cmp word [ebp - 0x226], 0
je 0xbc8842
cmp word [ebp - 0x226], ax
jne 0xbc8821
cmp word [ebp - 0x224], 0
je 0xbc8842
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00bc83fb
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0xbc888e
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0xbc87fb
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0xbc8876
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0xbc889b
push 0xbc7e4b
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00bd39c0
add esp, 0x10
jmp 0xbc886b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00b9be79
leave
ret