joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104ee772
Capabilities:
Encrypt data using speck

Disassembly:
not edx
mov dword [ebp], edx
jmp fcn.104797b9
dec eax
add ebp, 0xc
xor edx, edx
dec eax
mov dword [esp], 0xaf9efd22
dec ebp
test esp, esp
dec eax
lea esp, [esp + 8]
je 0x104a5543
dec eax
lea esi, [0xfffba728]
inc ecx
mov esi, 0xc13bebba
inc ebp
and dh, dh
inc cx
dec esi
inc esp
movzx esi, byte [ecx]
call fcn.109855cd

Function at 0x104f4d63
Capabilities:
Encrypt data using speck

Disassembly:
mov edi, dword [esp + ebx - 0x2684]
mov dword [esp + ebx*8 - 0x1343c], 0xa2a0e4a4
mov dword [esp + ebx*2 - 0x4d10], ebx
mov ecx, dword [esp + ebx*8 - 0x13438]
mov dword [esp + ebx*2 - 0x4d08], 0xc1808bd
sar ebx, 0x19
ror dword [esp + ebx*2], 0xc5
push dword [esp + 0xc]
popfd
mov dword [esp + ebx + 0xc], ebx
mov ebx, dword [esp + ebx + 0x10]
not byte [esp + 0xd]
call fcn.10553dc7

Function at 0x10527b21
Capabilities:
Encrypt data using speck

Disassembly:
rol cl, 1
call fcn.1041c67c
or al, 0xa7
jecxz 0x10527b2c
loop 0x10527b56
xor esi, ebp
xchg edx, eax
popfd
mov dl, 0xcb
dec ebx
and dword [ebx - 0xdc2a72e], esp
imul ebx, dword [0xf6a70ce7], 0x39
sti
push esp
add al, byte [ecx - 0x661374ab]
not ecx
lea esp, [esp - 0x48]
rcr ecx, cl
sal dl, cl
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
cmp eax, ebp
cmc
push ebx
push esi
sal esi, 0x39
push edi
bsf esi, ebx
mov edi, 1
mov esi, edi
cmp ecx, esi
shl esi, cl
shrd cx, si, 0xa1
ror cl, 0x13
mov ecx, dword [eax + 4]
xor ebx, ebx
clc
mov dword [ebp - 0x20], edx
cmp esp, esi
test ecx, esp
sub esi, edi
cmp ah, 0xaa
mov dword [ebp - 0x44], esi
test ecx, esi
mov esi, edi
clc
shl esi, cl
bt cx, 0x95
mov ecx, dword [ebp + 0xc]
test di, cx
mov dword [ebp - 0x18], ebx
stc
mov byte [ebp - 1], bl
test cl, ah
sub esi, edi
cmp dl, 0x87
clc
cmp eax, esi
mov dword [ebp - 0x48], esi
mov esi, dword [eax]
stc
mov dword [ecx], ebx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
mov ecx, dword [eax + 4]
sar al, 0x3b
lea ecx, [ecx + esi]
mov eax, 0x300
jmp 0x10557782
invalid
add al, 0x33
invalid
shl eax, cl
cmp ecx, ebx
test ebp, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edi
add eax, 0x736
jmp fcn.10449858

Function at 0x105443ad
Capabilities:
Encrypt data using speck

Disassembly:
call 0x1045e40a
not cl
mov dword [esp + ebp - 0x6257582c], edx
xchg edx, ebp
ror dword [esp + edx - 0x6257582c], 0xbe
dec cl
sar edx, 0xd3
jnp 0x1093b96a
call fcn.105dc6f9
div dword [esi + 2]
je 0x1054440e
sub al, byte [ebx + esi*2 + 0x2b]
stc
add bl, byte [0x406c154d]
pop ds
jno 0x105443e9
add dl, byte [ebp + 0x1c]
pushal
sbb dword [edi - 1], edx
cmp byte [esi + 0x1147b8c1], dh
push 0xeec0955
mov ah, 0xc0
shl dword [ebp + 0x8d0f55a], 1
and ch, byte [esi + eax*4 + 0x5e9321ab]
cmp eax, 0x52ceae0d
dec esi
jno 0x10544439
invalid
insd dword es:[edi], dx
xchg esp, eax
jmp 0x105443e3
int 0xba
invalid
xor cl, 0
ror ebp, 0x87
dec cl
lea eax, [edx - 0x6ce274dc]
xadd dword [esp + edx*4 - 0x3128], edx
neg cl
ror cl, 1
lea ebp, [edx + eax*2 - 0x7a7f2843]
or byte [esp + ebp - 0x5e8a3f11], al
add dword [esp + ebp - 0x5e8a3f14], eax
xor bl, cl
xadd dword [esp + ebp - 0x5e8a3f14], ebp
mov dword [esp], esi
push ebx
jae 0x1047da02
Function at 0x105a9601
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.1058680e
xor bl, dl
lea edx, [esp + edx + 0xc]
jmp 0x1054e721

Function at 0x105d3a55
Capabilities:
Encrypt data using speck

Disassembly:
add esi, 2
not al
not cl
and al, cl
mov word [esi], ax
call fcn.103e4a99

Function at 0x105dcf4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebx
jmp 0x106064db
lea esp, [esp + 4]
jne 0x105d8137

Function at 0x106064bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov cl, byte [ebp + ecx - 0x67b4b2fe]
dec eax
add ebp, 2
dec eax
mov dword [esp], 0x5e16698c
dec eax
shr eax, cl
call fcn.105d0a46

Function at 0x1092dc8c
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
jne 0x1096c677
dec ebx
jmp 0x10453d97

Function at 0x1092f7eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jge 0x105483c3
inc esp
pushal
push ds
pop eax
inc esi
sub ch, byte [edi + 0x4d31b305]
mov ebp, 0x4d58f121
inc esi
invalid
jne 0x10577ef1
sysenter
push ebp
mov ebp, 0xb3845ebd
pushfd
sub ebp, 0x6b5c309
mov ebp, dword [esp + ebp + 0x53316450]
mov dword [esp + 4], 0xb46f5ecb
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.109631b7
push 0x10b60386
lea esp, [esp + 4]
jmp fcn.1047c71f
add edi, 4
call fcn.1044f4df
xor edi, dword [eax]
and ebp, dword [ecx - 0x3b449db6]
pop ss
push edi
pop eax
fidivr dword [0x38cff8dd]
call 0x1269ac41
fild qword [eax + 0x7466c427]
ror bh, 0xe2
and dword [eax - 0x23854a72], ecx
adc al, 0xf4
adc al, 0x2a
retf 0xf497
pop edx
mov edx, dword [edi]
mov eax, 0x68257831
dec ax
mov eax, dword [edi + eax - 0x6825782c]
jns 0x104ea2b1
mov word [ebp], ax
push 0xee031f3d
lea esp, [esp + 8]
jmp fcn.104300d5
Function at 0x10935189
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 8]
jmp fcn.10503b99
add esi, 2
shl di, cl
push 0x369aaa09
jmp 0x10964193
mov dword [esp], 0x66285aa9
call fcn.105e53a7
jmp 0x109351b1
jae 0x10966e24
mov di, word [esi]
mov ecx, 0xa0ad801c
add ecx, ecx
mov cl, byte [esi + ecx - 0x415b0036]
push 0x50afb1bb
jle 0x10451e5b
shl dx, cl
mov word [esi], dx
call fcn.105ab48b
or al, 0xa7
in eax, 0x3e
out 0x56, al
out dx, eax
mov byte [edi + edi*4 - 0x4ceca529], ah
jmp 0xce9dde29
push ebp
pushfd
mov ebp, 0x3215378e
and bp, 0xd13
mov ebp, dword [esp + ebp - 0x321504fe]
mov dword [esp + 4], 0x6459501c
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1099034d
dec ecx
movzx cx, byte ss:[eax + ecx*4 - 0x1ba34]
push 0xd2925c12
add edi, 2
mov word [edi], cx
jmp 0x105fc1ed
call fcn.10982498
call fcn.104b86c8
jmp 0x105c8a97
mov eax, 0xfeb78686
lea ecx, [eax + 0x600a0802]
mov ax, word [edi + ecx - 0x5ec18e88]
rol cx, cl
mov cl, byte [edi + ecx - 0x5ec1888c]
jae 0x1059753f
jmp 0x105f6a3e
mov edx, 0x4c3c1e06
cmp al, 0x4c
call fcn.105b076a
pop ecx
dec edi
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
idiv dword [edx - 0x22]
ficom dword [eax + 0x5531e520]
mov eax, dword [0x6541f558]
ja 0x10935175
xchg edx, eax
daa
shl byte [esi], cl
xlatb
cmp ebp, dword [esi + 0x6a]
push 0x25982df8
int1
js 0x109351f3
add dword [edi + ebp*2 + 0x18d792de], 0xbf12efc6
pop edx
xor byte [ecx], bl
nop
cdq
je 0x109351ef
mov byte [0xa29f6df8], al
xor al, bh
fbstp tbyte gs:[ebx]
loop 0x109351b4
insd dword es:[edi], dx
lahf
mov byte [0xdf65c732], al
xor esp, edx
mov bh, 0x7d
mov cl, byte [ecx - 0x3fcd4a62]
and dword [eax + ebp*4 - 0x79], ebx
jge 0x10935189
mov dword [esi + 0x21c032b5], ebx
pop esp
test al, 0x87
idiv dword [ebx + eax*2 - 0x45eac71f]
push es
fucom st(5)
mov al, byte [0xf7781ca1]
cmp al, 0x24
inc eax
int1
pop eax
adc eax, 0x8d86d609
adc dh, al
push 0xffffffffffffffc4
xor byte [0x469b0b11], dh
push cs
mov ebx, 0x3e1a47ab
sub al, 0x9c
push ecx
test ecx, ebp
cmp al, 0x7c
invalid
mov word [esi], di
lea esp, [esp + 8]
jmp fcn.1047c71f
push 0x2f00b23a
adc edi, 2
push 0x708b5022
shr ax, cl
mov word [edi], ax
jmp 0x103dc149
Function at 0x1095347a
Capabilities:
Encode data using xor

Disassembly:
mov esi, ebp
mov ebp, ebx
lea ebp, [ebp + ebp*4 - 0x3de8d86e]
pop ebx
not ebp
pop ebp
jmp fcn.1047c71f
mov eax, 0x2c8d61aa
inc eax
sar ax, 0x41
mov eax, dword [ebp + ebx*4]
push 0x44b429ae
push 0x1bb786b0
call fcn.1095347a
push 0x69a28893
sar word [esp], 0x8f
movzx ecx, byte [ebp]
mov esi, dword [esp]
lea ebp, [ebp + esi - 0x69a2fffe]
dec si
xor cl, bl
sal esi, 0x2e
inc cl
add si, 0xcc0d
rol cl, 1
or dword [esp], esi
jbe 0x104aac4b
not cl
call fcn.104f67ed
sbb cx, cx
lea ebp, [ebp + ecx - 0x78630000]
or cl, 0x91
movzx ecx, byte [ebp + ecx - 0x7862ffff]
push 0x2f016714
xor cl, bl
jmp 0x1052c13f
jmp 0x10935722
jmp fcn.10503b99
not cl
shr byte [esp + 1], 6
jb 0x10597613
add byte [eax], al
inc edi
je 0x1052c1a8
add byte [edi + 0x65], al
je 0x1052c1a8
jb 0x1052c1c8
imul ebp, dword [edi + 0x6e], 0x417845
inc ebp
js 0x1052c19c
add byte [ecx + 0x8d6], al
add cl, ch
jl 0x1052c158
jmp dword [esi - 0x7f6fda50]
loop 0x1052c14d
out 0x7b, al
sbb dword [edx + 0x1e98712d], ecx
add al, 0xd7
xlatb
ret
dec eax
jmp 0xaa757e5a
and bl, byte [edx - 0x14d9e701]
push edi
dec eax
mov al, 0x4b
mov ah, 0x16
cld
xor ch, byte [ebp + 0x31]
mov dh, dl
jle 0x1052c1fb
out 0xcb, al
test al, bh
js 0x1052c195
cmp al, 0xbe
outsd dx, dword [esi]
jb 0x1052c1a4
popal
xor dword [edx], edi
movsd dword es:[edi], dword [esi]
inc edi
jle 0x1052c161
out dx, eax
jo 0x1052c191
or esp, dword [ebp - 0x11a08287]
stosb byte es:[edi], al
pop ds
mov byte [0xd602ef56], al
rcr al, cl
imul ebp, dword [ebp - 0x27], 0x74d831e5
or dword [ebp + 0x4f1adf6f], ecx
invalid
push ecx
fcmovnbe st(0), st(6)
hlt
dec cl
push 0xf2896319
not cl
sub cl, 0x87
not byte [esp + 1]
xor bl, cl
lea ecx, [esp + ecx + 8]
push 0xfe315e2b
mov byte [ecx], dl
call fcn.10984406
loopne 0x1059763c
mov al, byte [0x72e02ef5]
and ch, ch
mov dword [ebp + 0x580e8bd7], edx
mov ecx, dword [esi]
pop eax
mov ebx, 0xf3b86f82
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
jmp 0x1043e145
mov dword [esp + 8], eax
dec ebx
lea esp, [esp + 8]
jne 0x1045f880
mov eax, dword [ebp]
push 0x239a8825
lea esp, [esp + 4]
call eax
jmp 0x1047ff87
Function at 0x109843f2
Capabilities:
Check for software breakpoints

Disassembly:
adc edi, 8
mov dword fs:[ebp], edx
lea esp, [esp + 4]
jmp fcn.10471042

Function at 0x10984406
Capabilities:
Check for software breakpoints

Disassembly:
add al, 0xe9
cmp al, 0xcc
scasb al, byte es:[edi]
dec dword [ebp - 0x16efdb9c]
lea esp, [esp + 0x10]
jmp fcn.104f4069
call fcn.104b8688
mov esi, 0x57138d11
lea ebp, [esi + ebp - 0x57138d12]
movzx edx, si
inc dx
movzx edx, byte [ebp + edx*2 - 0x11a24]
call fcn.104aad9c
mov dh, 0xb0
jge 0x10984400
std
sub dword [eax - 0x50eb8ef4], esp
push ds
pop edx
out dx, al
rol byte [edi], cl
retf

Function at 0x1098440f
Capabilities:
Check for software breakpoints

Disassembly:
add al, 0xe9
cmp al, 0xcc
scasb al, byte es:[edi]
dec dword [ebp - 0x16efdb9c]
lea esp, [esp + 0x10]
jmp fcn.104f4069
call fcn.104b8688
mov esi, 0x57138d11
lea ebp, [esi + ebp - 0x57138d12]
movzx edx, si
inc dx
movzx edx, byte [ebp + edx*2 - 0x11a24]
call fcn.104aad9c
mov dh, 0xb0
jge 0x10984400
std
sub dword [eax - 0x50eb8ef4], esp
push ds
pop edx
out dx, al
rol byte [edi], cl
retf

Function at 0x109855cd
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, 0x782f589c
dec ecx
dec esp
jmp 0x104a5538
inc esp
xor esi, edx
inc ecx
and esi, 0xff
inc esi
mov esi, dword [esi + esi*4]
shr edx, 8
inc ecx
xor edx, esi
dec eax
inc ecx
jmp 0x105c4c5b

Function at 0x1098efb5
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0x6459501c
call fcn.1099034d

Function at 0xd0a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd0a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
Function at 0xca3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ca31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xca307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca306a
add dl, dl
jne 0xca3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca30dc
xor eax, eax
add dl, dl
jne 0xca3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca317d
add dl, dl
jne 0xca30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xca30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xca3075
mov eax, 1
add dl, dl
jne 0xca30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca30e1
sub eax, ebx
mov ebx, 1
jne 0xca3128
mov ecx, 1
add dl, dl
jne 0xca310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xca3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xca313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xca314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca3136
cmp eax, 0x7d00
jae 0xca316d
cmp eax, 0x500
jb 0xca3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca3075
cmp eax, 0x7f
ja 0xca3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xca319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xca3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
add dword [edx + 0x14ec83ec], eax
imul edi, dword [ebp + 0x10], 0x4f
jl 0x407f03
mov dword [ebp + 0x10], 0x4f004e
fld qword [ebp + 8]
inc edi
sbb eax, 0x40c25f
mov ecx, dword [ebp + 0x19]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
xor esi, esi
push edi
fnstsw ax
mov dword [ebp - 0x3a], esi
pushal
push ecx
mul byte [esi + ebp*4]
mov edi, ebx
jp 0x407f33
fld qword [ebp + 8]
fnstenv [eax - 0x38f7a223]
add dword [ecx], eax
add byte [eax], al
add byte [ebx + 0x558b0c26], cl
mov esp, dword [esi]
or al, 0x8b
push ebp
or byte [ebp + 0x5150d645], cl
push edx
call dword [ecx + 0xfcc118]
fstp qword [ebp + 8]
fld qword [ebp - 0x14]
fcomp qword [0x6c230]
sbb eax, 0x6c230
add esp, 0xc
fnstsw ax
test byte [ebx], 0x44
jnp 0x407fcd
lea esi, [ebx + 0x50]
dec esp
movsb byte es:[edi], byte [esi]
lcall 0x1ddc, 0xec45dd58
xor byte [ecx - 0x1fb3ffc0], dh
test ah, 0x44
dec eax
cmpsd dword [esi], dword es:[edi]
push ss
in al, dx
jg 0x407f4c
adc bl, al
inc eax
add byte [ebp - 0x7caf13bb], cl
in al, dx
or ch, bl
sbb al, 0xf
call dword [0x40c16b]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x40c308]
add esp, 0xc
dec esi
fmul qword [0x40c300]
call 0x7cb4e6
mov esp, dword [eax + 0x20]
mov cl, 0x30
sub al, byte [edx - 0x78]
push cs
mov esi, dword [edx - 0x7c]
jl 0x408031
mov cs, word [ecx - 0x5760569c]
popfd
inc ebx
push eax
cmp ebx, edx
jae 0x40801d
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
invalid
fld qword [esi + 0x301ddc08]
ret 0x40
mov eax, dword [ebp + 0x10]
cmp dh, byte [eax + ebx]
mov ebp, dword [0x75c0a41c]
add eax, dword [ebx]
jne 0x408029
mov ecx, dword [ebp + 0x14]
cmp esi, ebx
jae 0x408047
jae 0x408047
mov ebp, dword [ebx - 0x2708a0e8]
neg eax
mov dword [ecx], eax
call 0xc3cb8044
pop esi
pop ebx
dec edi
in eax, 0xb4
ret
mov edx, dword [ebp - 4]
cmp edi, esi
mov dword [ecx], edx
ja 0x40808c
fld qword [ebp + 8]
lea eax, [ebx - 0x71]
xor al, bh
in eax, 0x30
fmul qword [0x40c2f8]
lea eax, [ebp + 0x5b]
not byte [esp + ebp*8 + 0x241cddea]
jmp [edx + sym.imp.MSVCRT.dll_modf]
lea edx, [ebx + 0x50]
cmp esi, edx
jb 0x408038
pop edi
mov byte [ebx + 0x4f], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40bdc8
pop dword [ebp - 0x18]
mov eax, 0xbf5ba58e
sub eax, 0xbf1ae7c6
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x27075756
sub dword [ebp - 0x28], 0xd8b5120b
mov dword [ebp - 0x24], 0xa7ffdc51
sub dword [ebp - 0x24], 0x75cc900c
mov dword [ebp - 0x20], 0x2584b00e
add dword [ebp - 0x20], 0x26c79420
mov dword [ebp - 0x1c], 0x5163266
add dword [ebp - 0x1c], 0xfae9cd9a
lea eax, [ebp - 0x28]
push eax
mov eax, 0xe9e637a2
sub eax, 0xe9a5674e
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xf4fa9783
sub dword [ebp - 0x28], 0x80882e2d
mov dword [ebp - 0x24], 0x86dc86ba
add dword [ebp - 0x24], 0xba8fdabb
mov dword [ebp - 0x20], 0xdb2053d
add dword [ebp - 0x20], 0x55bd672f
mov dword [ebp - 0x1c], 0x976a982b
sub dword [ebp - 0x1c], 0x976a982b
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x14cf123
add eax, 0xfef3df29
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37152
push 0
call eax
mov ecx, 0x3e40
xor ebx, ebx
add ebx, eax
mov esi, 0xffaa38e9
add esi, 0x977717
add esi, dword [ebp - 0x18]
mov edi, 0x34994541
mov dword [ebp - 8], 0x95d56dea
mov edx, dword [esi]
add dword [ebp - 0x10], edi
add edx, edi
mov dword [ebx], edx
xor dword [ebp - 0x10], ecx
add ebx, 0x37129789
add ebx, 0xc8ed687b
add esi, 0x5c9339e6
sub esi, 0x5c9339e2
loop 0x40bee0
add eax, 0xaedff74b
sub eax, 0xaedf0b78
xor ebx, ebx
add ebx, eax
add eax, 0xd38e8df0
add eax, 0x2c717215
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10006390
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x100063ab
bts eax, 7
shr ecx, 1
test cl, 1
je 0x100063b6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x100063c1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x100063cc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x100063d7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x100063e2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x100063ed
bts eax, 1
test cl, 2
je 0x100063f6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10006492
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10006483
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x100063a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100064c0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10149040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x1013a094
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call fcn.100efd7d
add esp, 0xc
test eax, eax
je 0x10006510
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081279
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.100f00f3
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x10006546
call fcn.100efc7f
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081279
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100effb8
add esp, 0x10
test eax, eax
je 0x1000659b
push esi
nop dword [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10006562
push dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
push 0x400
push 1
push ebx
call fcn.100effb8
add esp, 0x10
test eax, eax
jne 0x10006560
pop esi
push ebx
call fcn.100efdc4
push dword [ebp - 8]
call fcn.100efc7f
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.10081279
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006640
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov dword [esi], vtable.CAntiHack.0
test eax, eax
je 0x1000666c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], 0
test byte [ebp + 8], 1
je 0x1000667d
push 0x64
push esi
call fcn.100815a1
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10006810
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x10006750
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x10006750
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x10006750
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x10006750
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x10006750
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x100068a3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100068f0
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x10149040]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x5045454
push eax
push 0
push 0
push 0x1013a0a4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [esp + 0x3a]
movzx eax, word [esp + 0x38]
shl ecx, 0x10
or ecx, eax
movzx eax, word [esp + 0x16]
xor ecx, 0xb542d8e1
push ecx
movzx ecx, word [esp + 0x1c]
shl ecx, 0x10
or ecx, eax
mov eax, dword [esp + 0x16]
xor eax, 0x5d78a569
xor ecx, 0xf45bc123
push ecx
push eax
mov eax, dword [esp + 0x10]
xor eax, 0x12b586fe
push eax
lea eax, [esi + 4]
push str._08X__08X__08X__08X
push eax
call fcn.10006a30
mov ecx, dword [esp + 0x54]
add esp, 0x18
pop esi
xor ecx, esp
call fcn.10081279
mov esp, ebp
pop ebp
ret

Function at 0x10006a50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov dword [esi], vtable.CAutoClick.0
test eax, eax
je 0x10006a7c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
test byte [ebp + 8], 1
je 0x10006a8d
push 0x14
push esi
call fcn.100815a1
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4