joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004839
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004859
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055a9
pop esi
pop ebp
ret 8

Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055c9
pop esi
pop ebp
ret 4

Function at 0x100055e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055e9
pop esi
pop ebp
ret 8

Function at 0x100186b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101837c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018788
push esi
push 0x55
pop esi
push esi
push 0x101837d0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018772
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x101837d0], 0x5f
mov cl, 0x2d
je 0x10018712
mov cl, byte [eax*2 + 0x101837d0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001871f
inc eax
cmp eax, esi
jl 0x100186fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call fcn.100c499e
mov esi, eax
pop ecx
test esi, esi
je 0x10018772
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.100c499e
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001876b
push 0x10017f70
push 0x17
mov byte [eax + esi], bl
mov dword [0x101837c8], esi
mov byte [0x101837cc], 1
call fcn.100c499e
pop ecx
jmp 0x10018771
push esi
call fcn.100c499e
pop ecx
mov ecx, dword [0x101837c8]
mov eax, 0x100fef10
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x101837c8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret
Function at 0x100c499e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100c49ad
pop dword [ebp - 0x44]
mov eax, 0x66d97cd6
sub eax, 0x56cd3329
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x71f2a
push 0
mov eax, 0x3a8cf5e5
sub eax, 0x2a7dc4a1
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xf8bc7cd3
sub ecx, 0xf8bc3449
mov edx, eax
mov ebx, 0x21c33ebb
sub ebx, 0x11aa2ebb
add ebx, dword [ebp - 0x44]
mov edi, 0x7fc6a56d
sub edi, 0xf999999c
xor dword [ebp - 0x38], ecx
mov esi, dword [ebx]
xor esi, edi
add dword [ebp - 0x34], edx
mov dword [edx], esi
xor dword [ebp - 0xc], ebx
add edx, 0x42f9f41
sub edx, 0x42f9f3d
add ebx, 0xd3c4b593
add ebx, 0x2c3b4a71
loop 0x100c4a0c
add eax, 0xaba81014
add eax, 0x545904e7
mov ebx, eax
add eax, 0xf87e6b97
add eax, 0x781946e
mov ecx, 0xd8b877a2
add ecx, 0x3747885e
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x10049ef0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1004a0dd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x33000]
push edi
or ebp, 0xffffffff
jmp 0x10049f1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10049f21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10049f10
mov eax, 1
add ebx, ebx
jne 0x10049f33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10049f44
jne 0x10049f63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10049f63
dec eax
add ebx, ebx
jne 0x10049f50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10049f28
add ebx, ebx
jne 0x10049f5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10049fb5
xor ecx, ecx
sub eax, 3
jb 0x10049f7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10049fea
sar eax, 1
mov ebp, eax
jmp 0x10049f86
add ebx, ebx
jne 0x10049f86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10049f54
inc ecx
add ebx, ebx
jne 0x10049f94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10049f54
add ebx, ebx
jne 0x10049fa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10049f96
jne 0x10049fb2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10049f96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10049fd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10049fc6
jmp 0x10049f16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10049fd4
add edi, ecx
jmp 0x10049f16
pop esi
mov edi, esi
mov ecx, 0x775
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10049ff2
cmp byte [edi], 0x11
jne 0x10049ff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10049ff7
lea edi, [esi + 0x45000]
mov eax, dword [edi]
or eax, eax
je 0x1004a06f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4a1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4a270]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1004a024
mov ecx, edi
jns 0x1004a053
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4a274]
or eax, eax
je 0x1004a069
mov dword [ebx], eax
add ebx, 4
jmp 0x1004a041
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1004a0a0
cmp al, 0xef
ja 0x1004a093
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1004a075
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1004a082
mov ebp, dword [esi + 0x4a278]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1004a0d4
sub esp, 0xffffff80
jmp 0x1000f3c3
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401443
pop dword [ebp - 0x30]
mov eax, 0x401443
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xab593ff7
add dword [ebp - 0x40], 0xa2f90554
mov dword [ebp - 0x3c], 0x537d0b26
sub dword [ebp - 0x3c], 0x2149bee1
mov dword [ebp - 0x38], 0x15556412
add dword [ebp - 0x38], 0x36f6e01c
mov dword [ebp - 0x34], 0x7515b1c3
add dword [ebp - 0x34], 0x8aea4e3d
lea eax, [ebp - 0x40]
push eax
mov eax, 0xa75eb3b7
add eax, 0x58e1ccc1
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xe0d80321
sub dword [ebp - 0x40], 0x6c6599cb
mov dword [ebp - 0x3c], 0x7d6b9cab
add dword [ebp - 0x3c], 0xc400c4ca
mov dword [ebp - 0x38], 0xf9ffd036
add dword [ebp - 0x38], 0x696f9c36
mov dword [ebp - 0x34], 0x7e0b00ef
sub dword [ebp - 0x34], 0x7e0b00ef
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xc20e9e75
add eax, 0x3e31e207
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x36e61
push 0
call eax
mov ecx, 0x4217
mov ebx, eax
mov esi, 0xc8a17498
sub esi, 0xc85c6098
add esi, dword [ebp - 0x30]
mov edx, 0x69470cb7
mov dword [ebp - 8], 0xf8b0577b
mov edi, dword [esi]
sub dword [ebp - 0x10], eax
xor edi, edx
xor dword [ebp - 0x14], edi
mov dword [ebx], edi
xor dword [ebp - 0x18], edi
add ebx, 0xd891d622
add ebx, 0x276e29e2
add esi, 4
loop 0x401554
add eax, 0xf7ccea1e
sub eax, 0xf7cbeeef
xor ebx, ebx
add ebx, eax
add eax, 0x6b4146
add eax, 0xff94bebf
mov ecx, 0xd49a1c4f
add ecx, 0x2ba5e3b1
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401443
pop dword [ebp - 0x24]
mov eax, 0x401443
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x755181c
sub dword [ebp - 0x34], 0xb902d2d1
mov dword [ebp - 0x30], 0x89d2eb73
add dword [ebp - 0x30], 0xa86060d2
mov dword [ebp - 0x2c], 0xf2ef3804
add dword [ebp - 0x2c], 0x595d0c2a
mov dword [ebp - 0x28], 0xaf5d6fa7
sub dword [ebp - 0x28], 0xaf5d6fa7
lea eax, [ebp - 0x34]
push eax
mov eax, 0xf7a5e095
add eax, 0x89a90af
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xaca7de92
add dword [ebp - 0x34], 0xc7ca8ac4
mov dword [ebp - 0x30], 0xcf538a74
add dword [ebp - 0x30], 0x7218d701
mov dword [ebp - 0x2c], 0x3bb6fe01
sub dword [ebp - 0x2c], 0xd8479195
mov dword [ebp - 0x28], 0x60a83f73
sub dword [ebp - 0x28], 0x60a83f73
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x1118d55c
sub eax, 0x10d8644c
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38945
push 0
call eax
mov ecx, 0x49f0
xor esi, esi
add esi, eax
mov edx, 0x436000
add edx, dword [ebp - 0x24]
mov edi, 0xe3a1262d
add edi, 0xcc29a57c
add dword [ebp - 0x10], 0xdf541b73
mov ebx, dword [edx]
xor ebx, edi
sub dword [ebp - 0x14], 0x180b91fb
mov dword [esi], ebx
xor dword [ebp - 0x20], edi
add esi, 0x1b3392db
add esi, 0xe4cc6d29
add edx, 0x6ef6c8f3
sub edx, 0x6ef6c8ef
loop 0x401556
add eax, 0xaf9611f1
sub eax, 0xaf94f75e
xor ebx, ebx
add ebx, eax
add eax, 0x715c66d9
add eax, 0x8ea3992c
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd
Function at 0x45e550
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x437015
lea edi, [esi - 0x36015]
push edi
jmp 0x45e56a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45e571
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45e560
mov eax, 1
add ebx, ebx
jne 0x45e583
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45e578
jne 0x45e594
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45e578
xor ecx, ecx
sub eax, 3
jb 0x45e5a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45e61a
mov ebp, eax
add ebx, ebx
jne 0x45e5b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45e5c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45e5e4
inc ecx
add ebx, ebx
jne 0x45e5d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45e5c5
jne 0x45e5e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45e5c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45e604
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45e5f5
jmp 0x45e566
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45e604
add edi, ecx
jmp 0x45e566
pop esi
lea edi, [esi + 0x5c000]
mov eax, dword [edi]
or eax, eax
je 0x45e663
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5e244]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5e29c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45e621
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5e2a4]
or eax, eax
je 0x45e65d
mov dword [ebx], eax
add ebx, 4
jmp 0x45e63e
call dword [esi + 0x5e2a0]
mov ebp, dword [esi + 0x5e2a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45e697
sub esp, 0xffffff80
jmp 0x433da0
Function at 0x1000cac3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x100139e8]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 8], edi
mov esi, dword [eax + esi*4]
mov eax, dword [0x10013e80]
cmp eax, dword [esi + 4]
jg 0x1000cb78
lea eax, [ebx + edi]
cmp eax, ebx
ja 0x1000cb01
mov eax, 0x10dd
jmp 0x1000cb71
mov eax, dword [0x10013e7c]
cmp edi, eax
jbe 0x1000cb0f
push 0x32
pop eax
jmp 0x1000cb71
mov edi, dword [ebp + 8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
lea esi, [eax - 1]
push ecx
not esi
push dword [edi]
and esi, ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x1000cb37
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x1000cb71
mov ecx, dword [0x10013e7c]
mov eax, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 4]
dec eax
add eax, ebx
mov dword [edi], edx
not ecx
and ecx, eax
cmp ecx, esi
je 0x1000cb6c
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
push dword [0x10013e7c]
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1000cb2f
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, 0x10013e80
push esi
call fcn.1000cd54
cmp dword [0x10013e80], 0xffffffff
pop ecx
jne 0x1000caf3
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
push esi
mov dword [0x10013e7c], eax
call fcn.1000cd54
mov edi, dword [ebp - 8]
pop ecx
jmp 0x1000caf3

Function at 0x1000cd54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000cd63
pop dword [ebp - 0x20]
mov eax, 0x1000cd63
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3602b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xe3a350fb
add ecx, 0x1c5ceb06
mov esi, eax
mov edx, 0x832fc4ea
sub edx, 0x732e3eea
add edx, dword [ebp - 0x20]
mov edi, 0x1772f286
sub edi, 0xb3bda60e
mov dword [ebp - 8], 0xe45412d5
mov ebx, dword [edx]
add dword [ebp - 4], esi
xor ebx, edi
add dword [ebp - 0x1c], 0x9733a92b
mov dword [esi], ebx
sub dword [ebp - 0x10], 0x67be2b50
add esi, 4
add edx, 0xc0b4386d
sub edx, 0xc0b43869
loop 0x1000cdb8
add eax, 0x322e4231
add eax, 0xcdd2a0a6
xor ebx, ebx
add ebx, eax
add eax, 0xd0edabca
sub eax, 0xd0edabc5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x100146c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100146d8
pop dword [ebp - 0x34]
mov eax, 0x100146d8
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xed2c86a8
add dword [ebp - 0x44], 0x6125bea3
mov dword [ebp - 0x40], 0x51145f13
add dword [ebp - 0x40], 0xe11eed32
mov dword [ebp - 0x3c], 0x4b9be3bc
add dword [ebp - 0x3c], 0xb06072
mov dword [ebp - 0x38], 0xb3350357
sub dword [ebp - 0x38], 0xb3350357
lea eax, [ebp - 0x44]
push eax
mov eax, 0xbe7b6e96
add eax, 0x5186e1ee
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x472402ae
sub dword [ebp - 0x44], 0xd2b19958
mov dword [ebp - 0x40], 0x1b030037
add dword [ebp - 0x40], 0x2669613e
mov dword [ebp - 0x3c], 0x1e643965
sub dword [ebp - 0x3c], 0xbaf4ccf9
mov dword [ebp - 0x38], 0x334cf52
add dword [ebp - 0x38], 0xfccb30ae
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x2b22dd75
add eax, 0xe4df7307
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37fde
push 0
call eax
mov ecx, 0xecda237a
add ecx, 0x132615b0
xor esi, esi
add esi, eax
mov edx, 0x10030c00
add edx, dword [ebp - 0x34]
mov ebx, 0x8eaa9c5e
sub dword [ebp - 0x20], 0x3b55aed6
mov edi, dword [edx]
xor dword [ebp - 8], edi
xor edi, ebx
add dword [ebp - 0x24], 0x2274eda8
mov dword [esi], edi
add dword [ebp - 0x14], edx
add esi, 4
add edx, 4
loop 0x100147eb
add eax, 0xa0941ff
sub eax, 0xa086a84
mov ebx, eax
add eax, 5
mov ecx, 0x3d40b332
add ecx, 0xd2bf4cce
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x404360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e28f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.00460d49
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x404406
push eax
push esi
call fcn.004611ab
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.00460f21
int3

Function at 0x409900
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ec5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.std::ios_base.0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ebp - 4], 0
mov dword [ecx], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov byte [ecx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x411f40
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xffffffffffffffff
push str.DELETE_FROM_KartStoneGroove_WHERE_ID_IN_SELECT_ID_FROM_KartStone_WHERE_ID_IN_SELECT_ID_FROM__SELECT_ID__COUNT_ID__AS_occurrence_count_FROM_KartStone_GROUP_BY_ID_HAVING_COUNT_ID____3_OR_COUNT_ID____6__AS_subquery___
push dword [0x4d1304]
call dword [sym.imp.sqlite3.dll_sqlite3_prepare_v2]
add esp, 0x14
test eax, eax
jne 0x411f77
push dword [ebp - 4]
call dword [sym.imp.sqlite3.dll_sqlite3_step]
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.sqlite3.dll_sqlite3_finalize]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xffffffffffffffff
push str.DELETE_FROM_KartStone_WHERE_ID_IN_SELECT_ID_FROM_SELECT_ID__COUNT_ID__AS_occurrence_count_FROM_KartStone_GROUP_BY_ID_HAVING_COUNT_ID____3_OR_COUNT_ID____6__AS_subquery__
push dword [0x4d1304]
call dword [sym.imp.sqlite3.dll_sqlite3_prepare_v2]
add esp, 0x18
test eax, eax
jne 0x411fb3
push dword [ebp - 4]
call dword [sym.imp.sqlite3.dll_sqlite3_step]
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.sqlite3.dll_sqlite3_finalize]
add esp, 4
mov esp, ebp
pop ebp
ret