joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52b200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5e2320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00523260
mov ecx, dword [esi + 0x7e0]
test ecx, ecx
je 0x52b291
lea eax, [ebp - 0x14]
push eax
call fcn.0052a5c0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x52b267
mov ecx, dword [esi + 0x7e0]
push 0
call fcn.00521870
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7e0]
push 0
call fcn.00521870
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x52b2b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5e2320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x52b33b
cmp dword [esi + 0x10], 0
je 0x52b33b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.005608b0
mov ebx, esp
test ebx, ebx
je 0x52b33b
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.005170e0
mov ecx, dword [esi + 0x10]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.0051f260
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0051b590
test al, al
je 0x52b33b
mov ecx, dword [esi + 0x10]
call fcn.00523130
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x52bd80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5e2320]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.005256a0
mov ecx, dword [esi + 0x7e0]
test ecx, ecx
je 0x52be19
lea eax, [ebp - 0x14]
push eax
call fcn.0052a5c0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x52bdef
mov ecx, dword [esi + 0x7e0]
push 0
call fcn.00521870
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7e0]
push 0
call fcn.00521870
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x538b50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.0051ae40
mov edi, eax
add esp, 8
test edi, edi
jne 0x538bf4
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x538be9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
test eax, eax
je 0x538be9
push eax
mov dword [ebp + 8], edi
call fcn.00515e88
add esp, 4
mov edi, eax
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp dword [ebp + 8], eax
je 0x538be5
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x538bf7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push edi
mov ecx, ebx
call fcn.00538c20
push edi
mov esi, eax
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x54dfc0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5e2320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
call fcn.0054df10
test ebx, ebx
je 0x54dff7
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
sub edi, dword [ebx]
sub esi, dword [ebx + 4]
jmp 0x54e026
test esi, esi
je 0x54e014
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
sub edi, dword [ebp - 0x14]
sub esi, dword [ebp - 0x10]
jmp 0x54e026
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
mov esi, eax
test edi, edi
jle 0x54e0db
test esi, esi
jle 0x54e0db
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x54e0db
push eax
mov byte [ebp - 0x15], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x798], eax
test eax, eax
je 0x54e0b9
push esi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x79c], ecx
test ecx, ecx
je 0x54e0b9
push ecx
push dword [eax + 0x798]
mov byte [ebp - 0x15], 1
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x20]
push 0xcc0020
test ebx, ebx
je 0x54e0a0
push dword [ebx + 4]
push dword [ebx]
jmp 0x54e0a4
push 0
push 0
push dword [ebp - 0x1c]
push esi
push edi
push 0
push 0
push dword [ecx + 0x798]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov al, byte [ebp - 0x15]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005600c0
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005600c0
mov esp, ebp
pop ebp
ret 8

Function at 0x5511d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x79c], 0
je 0x55123f
cmp dword [ebp + 8], 0x100
jne 0x55122f
cmp word [ebp + 0xc], 0xd
jne 0x55122f
cmp byte [esi + 0x7a2], 0
je 0x55120e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x55122f
cmp byte [esi + 0x7a3], 0
jne 0x55122f
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x551228
push 1
push 0
push 0
push 0
push str.return
push esi
call fcn.0051f260
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x79c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x558b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x558b37
cmp eax, edi
jge 0x558b2f
push esi
call fcn.00554960
add esp, 4
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x558b60
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x558b43
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x558b7c
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x558b6d
xor dl, dl
jmp 0x558b72
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x558b63
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x558bb1
pop edi
pop esi
mov dword [ebp + 8], str.zlib_corrupt
pop ebp
jmp fcn.00554870
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x558bc9
pop edi
pop esi
mov dword [ebp + 8], str.read_past_buffer
pop ebp
jmp fcn.00554870
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x558be7
push edi
push ecx
push esi
call fcn.0055bd90
add esp, 0xc
test eax, eax
jne 0x558be7
pop edi
pop esi
pop ebp
ret
push edi
push dword [esi]
push dword [esi + 0x10]
call sub.MSVCR120.dll_memcpy
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
pop ebp
ret
Function at 0x55fc50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d6eb
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x5e2320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [eax + 0x7f0], 0
cmp dword [edi + 4], 0
jne 0x55fcfd
lea eax, [ebp - 0xa4]
push eax
call fcn.0055f7a0
mov ecx, dword [edi + 0x10]
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000000
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.0051ae20
push eax
mov ecx, edi
call fcn.00521a70
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00528920
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.0051a8a0
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00517a50
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.00517040
test bl, bl
je 0x55fd41
mov eax, dword [edi + 0x10]
add eax, 0x7e0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, 0x7e0
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005600c0
mov esp, ebp
pop ebp
ret 4

Function at 0x55fd90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5e2320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00523260
mov ecx, dword [esi + 0x7f8]
test ecx, ecx
je 0x55fe21
lea eax, [ebp - 0x14]
push eax
call fcn.0055f7a0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x55fdf7
mov ecx, dword [esi + 0x7f8]
push 0
call fcn.00521870
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7f8]
push 0
call fcn.00521870
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x55ff30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5e2320]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.005256a0
mov ecx, dword [esi + 0x7f8]
test ecx, ecx
je 0x55ffc9
lea eax, [ebp - 0x14]
push eax
call fcn.0055f7a0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x55ff9f
mov ecx, dword [esi + 0x7f8]
push 0
call fcn.00521870
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7f8]
push 0
call fcn.00521870
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005600c0
mov esp, ebp
pop ebp
ret 0x14

Function at 0x404930
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
push esi
push esi
rdtsc
mov esi, dword [esp + 0x10]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop esi
pop edi
ret
Function at 0x1002b440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1002b44f
pop dword [ebp - 0x1c]
mov eax, 0x1002b44f
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xef0b266b
add dword [ebp - 0x2c], 0x5f471ee0
mov dword [ebp - 0x28], 0x77214d9
sub dword [ebp - 0x28], 0xd53ec894
mov dword [ebp - 0x24], 0x7f9bf5c1
add dword [ebp - 0x24], 0xccb04e6d
mov dword [ebp - 0x20], 0x5229d0ae
sub dword [ebp - 0x20], 0x5229d0ae
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xfe9993e0
sub eax, 0xee9573ac
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x311699a7
add dword [ebp - 0x2c], 0x435bcfaf
mov dword [ebp - 0x28], 0x7d631626
sub dword [ebp - 0x28], 0x3bf6b4b1
mov dword [ebp - 0x24], 0x45937cf4
add dword [ebp - 0x24], 0x1ddbef78
mov dword [ebp - 0x20], 0xbc01f54c
sub dword [ebp - 0x20], 0xbc01f54c
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xba868fc3
add eax, 0x557d9089
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x47836
push 0
call eax
mov ecx, 0x8670fcac
add ecx, 0x798f4c41
xor ebx, ebx
add ebx, eax
mov edx, 0x1f61f11b
sub edx, 0xf5c731b
add edx, dword [ebp - 0x1c]
mov edi, 0x6544b44
add edi, 0xc1fe33fb
mov esi, dword [edx]
mov dword [ebp - 0x10], 0xddd6451d
xor esi, edi
sub dword [ebp - 4], 0x4394c0
mov dword [ebx], esi
xor dword [ebp - 0xc], 0x9916186f
add ebx, 4
add edx, 0x834c218
sub edx, 0x834c214
loop 0x1002b56e
add eax, 0x7e8823c8
sub eax, 0x7e870d41
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1002b440
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.1002b440
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1002b440
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700

Function at 0x10001de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10001def
pop dword [ebp - 0x28]
mov eax, 0xf2171b9b
add eax, 0x1de90254
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3cff5
push 0
mov eax, 0x975988ac
sub eax, 0x875796d0
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x12d1042d
add ecx, 0xed2f46c1
xor ebx, ebx
add ebx, eax
mov esi, 0x4379c132
sub esi, 0x3371df32
add esi, dword [ebp - 0x28]
mov edx, 0x2afe3752
xor dword [ebp - 0x14], 0x54080d28
mov edi, dword [esi]
sub dword [ebp - 0x10], ebx
xor edi, edx
xor dword [ebp - 0x24], 0x5c979f88
mov dword [ebx], edi
sub dword [ebp - 0x24], 0x3529e244
add ebx, 4
add esi, 4
loop 0x10001e4a
add eax, 0x5ad4e76c
sub eax, 0x5ad3c8e1
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xcac8631e
add ecx, 0x45379ce2
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x40f22e
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f2cb
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f2cb
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f2cb
push 4
push 0xffffffffffffffff
push esi
push 0x40f9e5
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f2cb
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f296
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f2cb
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f2d1
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f2cd

Function at 0x413ca1
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413cb1
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x413cb7
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x413cdf
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x413cc6
mov esi, ecx
jmp 0x413ce2
movzx esi, si
pop edi
cmp cx, si
je 0x413cff
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x413ce3
mov eax, 0x437338
jmp 0x413d07
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x4164b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4164c0
pop dword [ebp - 0x24]
mov eax, 0xa4957711
sub eax, 0xa4541251
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x45bda
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x78e4442f
sub ecx, 0x78e3f07c
mov ebx, eax
mov edi, 0x200982f8
sub edi, 0x1fc4faf8
add edi, dword [ebp - 0x24]
mov edx, 0x3272f005
sub dword [ebp - 0x14], esi
mov esi, dword [edi]
xor dword [ebp - 0x18], 0xa7bda9c
sub esi, edx
xor dword [ebp - 0x20], 0x280ab0fb
mov dword [ebx], esi
add dword [ebp - 0x10], 0xd618c6df
add ebx, 4
add edi, 0xf68f6494
add edi, 0x9709b70
loop 0x416514
add eax, 0x796d7e0e
sub eax, 0x796c3c6f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret