joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4090bc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x439224], 0
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x4090f9
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x4090e4
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4090d6
mov dword [ecx*4 + 0x439220], eax
inc ecx
cmp ecx, 0x100
jne 0x4090cf
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x40911b
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x439220]
jmp 0x409103
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x10001040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 0x10], eax
mov edi, esi
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [edi]
lea edi, [edi + 4]
mov edx, eax
mov dword [ebp - 0xc], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esi + eax*4 + 0x48]
add eax, dword [esi + ecx*4 + 0x448]
movzx ecx, dl
mov edx, ebx
xor eax, dword [esi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [esi + ecx*4 + 0xc48]
xor eax, dword [ebp - 4]
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x10001063
mov ecx, dword [esi + 0x44]
xor ecx, edx
mov edx, dword [ebp - 0x10]
pop edi
mov dword [edx], ecx
mov ecx, dword [esi + 0x40]
xor ecx, eax
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100010d0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
push edi
mov eax, 0x1001ea38
mov dword [ebp - 0x14], ebx
lea edi, [ebx + 0x48]
mov dword [ebp - 4], ebx
sub eax, ebx
mov dword [ebp - 0xc], 0x12
mov ecx, 0x400
mov dword [ebp - 0x10], eax
mov esi, 0x1001ea80
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 1]
xor edi, edi
cmp eax, 0x10
cmovl edi, eax
xor ecx, ecx
lea eax, [edi + 1]
cmp eax, 0x10
cmovl ecx, eax
xor edx, edx
lea eax, [ecx + 1]
cmp eax, 0x10
cmovl edx, eax
mov eax, dword [ebp - 8]
movzx esi, byte [ebx + eax]
mov ebx, eax
shl esi, 8
movzx eax, byte [edi + ebx]
or esi, eax
movzx eax, byte [ecx + ebx]
mov ecx, dword [ebp - 4]
shl esi, 8
or esi, eax
movzx eax, byte [edx + ebx]
shl esi, 8
xor ebx, ebx
or esi, eax
lea eax, [edx + 1]
cmp eax, 0x10
cmovl ebx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ecx]
xor eax, esi
mov dword [ecx], eax
add ecx, 4
sub dword [ebp - 0xc], 1
mov dword [ebp - 4], ecx
jne 0x10001106
mov ebx, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.10001040
mov eax, dword [ebp - 4]
add esp, 4
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x10001182
lea esi, [ebx + 0x4c]
mov dword [ebp - 0xc], 4
mov edi, 0x80
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.10001040
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esi, 8
sub edi, 1
jne 0x100011b7
sub dword [ebp - 0xc], 1
jne 0x100011b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001260
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x10023460
call fcn.100047e0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x1000128b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10001296
bts eax, 6
shr ecx, 1
test cl, 1
je 0x100012a1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x100012ac
bts eax, 4
shr ecx, 1
test cl, 1
je 0x100012b7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x100012c2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x100012cd
bts eax, 1
test cl, 2
je 0x100012d6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x1000136f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10001360
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x10023460], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10001280
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100013a0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1002200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x1001fc34
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
or ebx, 0xffffffff
call fcn.10009d34
add esp, 0xc
test eax, eax
jne 0x100013f1
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002cbb
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.10009f63
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x1000143a
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10023460]
sub edx, 1
jne 0x10001420
cmp edi, 0x400
je 0x100013f3
push dword [ebp - 0x408]
call fcn.10006d51
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.10002cbb
mov esp, ebp
pop ebp
ret 4
Function at 0x10001470
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.10001260
cmp dword [0x10023420], 1
jne 0x1000152a
push str.interface.u
call fcn.100013a0
cmp eax, dword [0x10023454]
je 0x1000152a
push 0x1001fa80
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.10009d34
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Interface.u
push 0x1001fa94
push eax
call fcn.10001200
push dword [ebp - 4]
call fcn.10006d51
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x10
push 0
push str._L2J_Guard_Protection____http:__www.l2jguard.org___n_n___We_find_programs_using_the_same_function_Hackers_Bots._n___Believed_to_be_an_error_._We_inform_or_will_fix._n___Send_folder_L2JGuard__your_system_to_the_Administrator___n_n___Sorry_for_the_inconvenience__we_need_maximum_security_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10023424], 1
jne 0x10001570
push str.interface.xdat
call fcn.100013a0
cmp eax, dword [0x10023458]
je 0x10001570
push 0x1001fa80
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.10009d34
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Interface.xdat
jmp 0x100014bf
cmp dword [0x10023428], 1
jne 0x100015b6
push str.WarGuard_Protect.bmp
call fcn.100013a0
cmp eax, dword [0x1002345c]
je 0x100015b6
push 0x1001fa80
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.10009d34
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Image_Protect_BMP
jmp 0x100014bf
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100015c0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push esi
mov esi, dword [0x1002787c]
push edi
mov edi, dword [0x10027880]
cmp esi, edi
je 0x100015f0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [eax]
push dword [esi]
call ebx
test eax, eax
jne 0x100015f3
add esi, 4
cmp esi, edi
jne 0x100015e0
pop ebx
pop edi
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001740
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100017df
push 0x1001fa80
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.10009d34
push esi
push str._s___TW__n
push dword [ebp - 4]
call fcn.10001200
push dword [ebp - 4]
call fcn.10006d51
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100017f0
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov ecx, str.Process_Explorer_11.33
call fcn.10001740
mov ecx, str.Process_Explorer
call fcn.10001740
mov ecx, str.ArtMoney_PRO_v7.27
call fcn.10001740
mov ecx, str.ArtMoney_SE_v7.31
call fcn.10001740
mov ecx, str.ArtMoney_SE_v7.32
call fcn.10001740
mov ecx, str.Cheat_Engine_5.0
call fcn.10001740
mov ecx, str.Cheat_Engine_5.1
call fcn.10001740
mov ecx, str.Cheat_Engine_5.1.1
call fcn.10001740
mov ecx, str.Cheat_Engine_5.2
call fcn.10001740
mov ecx, str.Cheat_Engine_5.3
call fcn.10001740
mov ecx, str.Cheat_Engine_5.4
call fcn.10001740
mov ecx, str.Cheat_Engine_5.5
call fcn.10001740
mov ecx, str.Cheat_Engine_5.6
call fcn.10001740
mov ecx, str.Cheat_Engine_5.6.1
call fcn.10001740
mov ecx, str.Cheat_Engine_6.0
call fcn.10001740
mov ecx, str.Cheat_Engine_6.1
call fcn.10001740
mov ecx, str.Cheat_Engine_6.4
call fcn.10001740
mov ecx, str.Cheat_Engine
call fcn.10001740
mov ecx, str.Created_processes
call fcn.10001740
mov ecx, str.SandBoxie_Plus_v0.9.3
call fcn.10001740
mov ecx, str.Sandboxie_Control___sandboxie_plus.com
call fcn.10001740
mov ecx, str.Created_processes
call fcn.10001740
mov ecx, str.Lineage2_v1.71
call fcn.10001740
mov ecx, str.XAAAA
jmp fcn.10001740
Function at 0x10001b50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
cmp byte [ebx], 0xe9
jne 0x10001b74
lea ecx, [ebx + 5]
add ecx, dword [ebx + 1]
call fcn.10001b50
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10022d04]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1002788c]
cmp eax, dword [ecx + 4]
jle 0x10001bcc
push 0x1002788c
call fcn.100031e9
add esp, 4
cmp dword [0x1002788c], 0xffffffff
jne 0x10001bcc
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x1002788c
mov dword [0x10027888], eax
call fcn.1000319f
add esp, 4
push esi
mov esi, dword [0x10027888]
push edi
lea edx, [esi + 0x1000]
cmp esi, edx
je 0x10001bf3
nop
lea ecx, [esi + 0x1c]
call fcn.10001b40
test eax, eax
je 0x10001bf5
add esi, 0x20
cmp esi, edx
jne 0x10001be0
xor esi, esi
xor edi, edi
lea ecx, [edi + ebx]
call fcn.10001900
add edi, eax
cmp edi, 5
jl 0x10001bf7
test edi, edi
jle 0x10001c21
mov ecx, esi
sub ebx, esi
mov edx, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10001c10
mov ebx, dword [ebp - 0xc]
lea ecx, [edi + esi]
sub edi, ecx
mov byte [ecx], 0xe9
lea eax, [edi - 5]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add eax, ebx
mov dword [ecx + 1], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call edi
mov eax, dword [ebp - 0x10]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001cd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x1001fa80
lea eax, [ebp - 4]
mov esi, ecx
push str.Protection.log
push eax
call fcn.10009d34
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x10001d0b
push esi
push 0x1001fa94
push eax
call fcn.10001200
push dword [ebp - 4]
call fcn.10006d51
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x108c
call fcn.10018c00
mov eax, dword [0x1002200c]
xor eax, esp
mov dword [esp + 0x1088], eax
mov eax, ecx
mov dword [esp + 0x1060], 0xf2c3870
push ebx
push esi
push edi
movups xmm0, xmmword [eax]
push ecx
lea edx, [esp + 0x1070]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1074], 0x171811fb
mov dword [esp + 0x1078], 0x15012d12
mov dword [esp + 0x107c], 0xef8107a
movups xmmword [esp + 0x1080], xmm0
call fcn.100010d0
lea esi, [esp + 0x1080]
mov dword [esp + 0x18], 3
add esp, 4
mov dword [esp + 0x10], esi
mov ecx, dword [esi + 4]
lea edi, [esp + 0x64]
mov eax, dword [esi]
mov esi, 0x10
mov dword [esp + 0xc], ecx
xor eax, dword [edi]
lea edi, [edi - 4]
mov edx, eax
mov dword [esp + 0x18], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esp + eax*4 + 0x68]
add eax, dword [esp + ecx*4 + 0x468]
movzx ecx, dl
mov edx, ebx
xor eax, dword [esp + ecx*4 + 0x868]
movzx ecx, bl
add eax, dword [esp + ecx*4 + 0xc68]
xor eax, dword [esp + 0xc]
mov dword [esp + 0xc], edx
sub esi, 1
jne 0x10001dc7
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
xor ecx, edx
mov dword [esi], ecx
mov ecx, dword [esp + 0x24]
xor ecx, eax
mov dword [esi + 4], ecx
add esi, 8
sub dword [esp + 0x14], 1
mov dword [esp + 0x10], esi
jne 0x10001db5
mov eax, dword [esp + 0x1c]
movups xmm0, xmmword [esp + 0x107c]
mov ecx, dword [esp + 0x1094]
pop edi
pop esi
pop ebx
xor ecx, esp
movups xmmword [eax], xmm0
call fcn.10002cbb
mov esp, ebp
pop ebp
ret

Function at 0x10001ed0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c88
call fcn.10018c00
mov eax, dword [0x1002200c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x2c88]
mov dword [ebp - 0x2c88], 0x2880
push eax
lea eax, [ebp - 0x2c84]
mov esi, ecx
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x10001f1d
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002cbb
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x2af0], 0
lea eax, [ebp - 0x2c84]
jne 0x10001f68
nop dword [eax]
cmp byte [eax + 0x195], 0
jne 0x10001f68
cmp byte [eax + 0x196], 0
jne 0x10001f68
cmp byte [eax + 0x197], 0
jne 0x10001f68
cmp byte [eax + 0x198], 0
jne 0x10001f68
cmp byte [eax + 0x199], 0
jne 0x10001f68
mov eax, dword [eax]
cmp byte [eax + 0x194], 0
je 0x10001f30
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x404]
push 0x3e8
push eax
call fcn.10001ca0
push 0x3e8
lea eax, [ebp - 0x404]
push eax
push 0x3e8
push esi
push 0
call fcn.1000aae3
mov ecx, dword [ebp - 4]
add esp, 0x38
xor ecx, ebp
mov al, 1
pop esi
call fcn.10002cbb
mov esp, ebp
pop ebp
ret
Function at 0x10002160
Capabilities:
Get common file path
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d24
call fcn.10018c00
mov eax, dword [0x1002200c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100
lea eax, [ebp - 0x204]
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10002273
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.100047e0
push str.._
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1000a802
lea eax, [ebp - 0x204]
mov byte [ebp - 0x202], 0
push eax
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1000ab03
add esp, 0x24
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002273
push 0x2710
lea eax, [ebp - 0x2d14]
mov dword [ebp - 0x2d24], 0
push 0
push eax
mov dword [ebp - 0x2d18], 0
mov dword [ebp - 0x2d20], 0
mov dword [ebp - 0x2d1c], 0
call fcn.100047e0
add esp, 0xc
lea eax, [ebp - 0x2d24]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2d14]
push eax
push 0xc
lea eax, [ebp - 0x2d20]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10002285
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002cbb
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x2cfc]
lea eax, [ebp - 0x604]
push eax
push ecx
lea ecx, [ebp - 0x2d14]
call fcn.10001fe0
push eax
push 0x1001ffcc
lea eax, [ebp - 0x604]
push 0x3e8
push eax
call fcn.10001ca0
push 0x3e8
lea eax, [ebp - 0x604]
push eax
push 0x3e8
push edi
push 0
call fcn.1000aae3
mov ecx, dword [ebp - 4]
add esp, 0x2c
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.10002cbb
mov esp, ebp
pop ebp
ret
Function at 0x1000fb83
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1000f9f9
Function at 0x40607b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422274], 0
push esi
jne 0x4060b2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40608c
mov dword [ecx*4 + 0x422270], eax
inc ecx
cmp ecx, 0x100
jl 0x406087
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4060e3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422270]
xor eax, esi
inc ecx
dec edx
jne 0x4060c5
pop edi
not eax
pop esi
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret