joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d060
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00445430
test al, al
je 0x40d24e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043d080
test al, al
je 0x40d249
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x6265b0ad
mov dword [esp + 8], 0x36388236
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40d0e6
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d260
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40d0c0
mov dword [esp + 4], 0x2ab14717
mov dword [esp + 8], 0xdc896e31
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d136
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d2c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d110
test esi, esi
je 0x40d1e6
mov dword [esp + 4], 0x33323111
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d186
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d340
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d160
mov dword [esp + 4], 0xfb198329
mov dword [esp + 8], 0x51ac589e
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d1e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d3d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d1c0
mov dword [esp + 4], 0x32333031
mov dword [esp + 8], 0x2e2f2c2d
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40d236
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d480
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40d210
call fcn.0040eb40
test al, al
je 0x40d249
call fcn.00411f60
call fcn.004101e0
call fcn.004460e0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x410920
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov esi, dword [0x454e94]
mov dword [esp + 0x40], 0x93659145
mov dword [esp + 0x44], 0xaf57ad26
mov dword [esp + 0x48], 0xab5ea95c
mov dword [esp + 0x4c], 0xa791a545
mov dword [esp + 0x50], 0xa394a16d
mov dword [esp + 0x54], 0xbf9ebd8c
mov dword [esp + 0x58], 0xbb55b980
mov dword [esp + 0x5c], 0xb740b54d
mov dword [esp + 0x60], 0xb345b14c
mov dword [esp + 0x64], 0x4fbd4dc3
mov dword [esp + 0x68], 0x4b9c4968
mov dword [esp + 0x6c], 0x476645a8
mov dword [esp + 0x70], 0x43724171
mov dword [esp + 0x74], 0x5f6e5d6a
mov dword [esp + 0x78], 0x5b7a5993
mov dword [esp + 0x7c], 0x57af55bb
mov dword [esp + 0x80], 0x539c51a6
mov dword [esp + 0x84], 0x6fa56da0
mov dword [esp + 0x88], 0x6be26948
mov dword [esp + 0x8c], 0x67aa65aa
mov dword [esp + 0x90], 0x63426159
mov dword [esp + 0x94], 0x7f8e7dbd
mov dword [esp + 0x98], 0x7b8e7988
mov dword [esp + 0x9c], 0x77997589
mov dword [esp + 0xa0], 0x7390718d
mov dword [esp + 0xa4], 0xff70dd7
mov dword [esp + 0xa8], 0xb3d0984
mov dword [esp + 0xac], 0x73505c9
mov dword [esp + 0xb0], 0x33401cf
mov dword [esp + 0xb4], 0x1fd01d2f
mov dword [esp + 0xb8], 0x1b221938
mov dword [esp + 0xbc], 0x17ce15cf
mov dword [esp + 0xc0], 0x13c711fc
mov dword [esp + 0xc4], 0x2f1a2df8
mov dword [esp + 0xc8], 0x2bde2908
mov dword [esp + 0xcc], 0x27dd25dd
mov dword [esp + 0xd0], 0x230221dd
mov dword [esp + 0xd4], 0x3fc33de3
mov dword [esp + 0xd8], 0x3bc139db
mov dword [esp + 0xdc], 0x370f35c3
mov dword [esp + 0xe0], 0x33f13110
mov dword [esp + 0xe4], 0xcf3ccd34
mov dword [esp + 0xe8], 0xcb3fc93f
mov dword [esp + 0xec], 0xc7f1c539
mov dword [esp + 0xf0], 0xc3f3c1f1
mov dword [esp + 0xf4], 0xdfe8dd15
mov dword [esp + 0xf8], 0xdbecd9e8
mov dword [esp + 0xfc], 0xd7e0d5e4
mov dword [esp + 0x100], 0xd3f2d1e0
mov dword [esp + 0x104], 0xef0fed3f
mov dword [esp + 0x108], 0xeb0be916
mov dword [esp + 0x10c], 0xe71fe516
mov dword [esp + 0x110], 0xe32fe1d7
mov dword [esp + 0x114], 0xff31fdcf
mov dword [esp + 0x118], 0xfbc9f9ce
mov dword [esp + 0x11c], 0xf7f6f53a
mov dword [esp + 0x120], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0xe3
ja 0x410bbd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
movzx eax, byte [esp + eax + 0x40]
push dword [esp + 0xc]
push eax
call fcn.00411af0
add esp, 8
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0xe4
jb 0x410b90
lea ebp, [esp + 0x40]
push 0
push 0
push 0
push 0
push ebp
call esi
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp dword [eax*4 + 0x44fc48]

Function at 0x411f60
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x45037c]
Function at 0x423e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x423e40
cmp eax, 0xffffffdd
jge 0x423e57
mov eax, 0xffffffff
jmp 0x423e5a
add eax, 0x22
push eax
call fcn.0040c920
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0xe16be740
mov dword [esp + 0x1c], 0xdd73e36c
mov dword [esp + 0x20], 0xd97ddf4e
mov dword [esp + 0x24], 0xd545db41
mov dword [esp + 0x28], 0xd14ad770
mov dword [esp + 0x2c], 0xcd4cd34f
mov dword [esp + 0x30], 0xc941cf6f
mov dword [esp + 0x34], 0xc546cb5c
mov word [esp + 0x38], 0xc7c4
mov dword [esp + 0x3a], 0
mov byte [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x26
ja 0x423efb
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00424de0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x27
jb 0x423ed0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x423f21
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x423f10
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x423f51
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423f40
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x9fed99f5
mov dword [esp + 0x1c], 0xa38f9de2
mov dword [esp + 0x20], 0xa7dea1c5
mov dword [esp + 0x24], 0xabcfa5d0
mov dword [esp + 0x28], 0xafd9a9da
mov dword [esp + 0x2c], 0xb3c1adc5
mov dword [esp + 0x30], 0xb799b1c2
mov dword [esp + 0x34], 0xbb95b59b
mov dword [esp + 0x38], 0xbfdcb996
mov dword [esp + 0x3c], 0xc3b5bdc9
mov dword [esp + 0x40], 0xc7b0c1a5
mov dword [esp + 0x44], 0xcbb9c583
mov dword [esp + 0x48], 0xcfbac9ba
mov dword [esp + 0x4c], 0xd3aacda9
mov dword [esp + 0x50], 0xd79fd1a4
mov dword [esp + 0x54], 0xdbe7d5b0
mov dword [esp + 0x58], 0xdfded9f6
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x45
ja 0x424036
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00424e60
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x46
jb 0x424010
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x4244a0
push ecx
push esi
call fcn.004251f0
add esp, 0x10
jmp dword [0x45119c]
Function at 0x42c2a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0042c2c0
add esp, 4
test al, al
je 0x42cb10
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
xor edi, edi
mov esi, 0x20219
mov eax, 1
lea ebx, [esp + 0x5e]
jmp dword [eax*4 + 0x452230]
Function at 0x431580
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ebx, 0xffffffff
nop
nop
nop
cmp byte [ebp + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x4315a0
lea esi, [ebx + 1]
push esi
call fcn.0040c920
add esp, 4
mov dword [esp + 4], edi
mov dword [edi], eax
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov dword [esp], esi
mov ecx, esi
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
jne 0x431603
mov esi, dword [esp]
and esi, 2
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
test ebx, ebx
je 0x4316b4
neg ebx
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
xor eax, edx
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov esi, ecx
shr esi, 1
mov edx, eax
shl edx, 0x1e
sar edx, 0x1f
and edx, 0xedb88320
xor edx, esi
mov edi, eax
shl edi, 0x1d
sar edi, 0x1f
and edi, 0x76dc419
mov esi, eax
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, edi
mov edi, eax
shl edi, 0x1b
sar edi, 0x1f
and edi, 0x1db71064
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor eax, edi
xor eax, esi
mov esi, edx
shr esi, 6
xor eax, esi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0x76dc4190
xor ecx, eax
shl edx, 0x1a
sar edx, 0x1f
and edx, 0xedb88320
xor edx, ecx
inc ebp
inc ebx
jne 0x431610
not edx
mov eax, dword [esp + 4]
mov dword [eax + 4], edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
jmp 0x4316a5
Function at 0x438440
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0041c9b0
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x438479
jmp 0x4385a4
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x4384b5
jmp 0x43859e
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.0040ca30
add esp, 4
mov edx, eax
xor ebx, ebx
cmp edx, 0
je 0x43858d
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov byte [esi], 0xf1
mov byte [esi + 1], 0xdf
mov byte [esi + 2], 0xdd
mov byte [esi + 3], 0xd9
mov byte [esi + 4], 0xd6
mov byte [esi + 5], 0xd6
mov byte [esi + 6], 0xd9
mov byte [esi + 7], 0xcb
mov byte [esi + 8], 0xd8
mov byte [esi + 9], 0x11
mov byte [esi + 0xa], 0xce
mov byte [esi + 0xb], 0xc9
mov byte [esi + 0xc], 0xcc
mov byte [esi + 0xd], 0xbf
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x14
jne 0x438523
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x14
jae 0x43856d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov edi, edx
call fcn.0043cf90
mov edx, edi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x438536
jmp 0x43856f
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d6f0
mov bl, al
and bl, 1
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x43859e
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x449290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx esi, word [eax]
mov dword [esp + 4], 0x97963f2d
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x4492e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0044b2a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x4492c0
xor eax, eax
cmp dword [esp + 4], esi
setne al
xor esi, esi
jmp dword [eax*4 + 0x454cec]
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 0x3c]
mov ebx, dword [eax + edi]
mov dword [esp + 4], 0x393a708c
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x449346
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0044b340
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x449320
xor eax, eax
cmp ebx, dword [esp + 4]
setne al
jmp dword [eax*4 + 0x454cf4]
mov eax, dword [esp + 0x40]
mov ebx, dword [eax + edi + 0x78]
mov edx, dword [eax + edi + 0x7c]
test edx, edx
sete al
test ebx, ebx
sete cl
or cl, al
movzx eax, cl
mov dword [esp + 0xc], ebx
jmp dword [eax*4 + 0x454d0c]
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001f90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push 0x1f4
mov byte [0x1008fd74], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10092140]
push str.UnHooking__n
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
add esp, 8
call fcn.100450b0
cmp dword [0x10092274], 0
je 0x10001ff3
push 0x10092274
push 1
call dword [sym.imp.OPENGL32.dll_glDeleteTextures]
mov eax, dword [0x1008fb10]
mov eax, dword [eax + 0x84]
mov dword [eax], 0
mov dword [0x10092274], 0
call fcn.100109d0
push dword [0x10092264]
push 0xfffffffffffffffc
push dword [0x10092260]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, 0x10092314
call fcn.10001610
mov ecx, 0x100922f8
call fcn.10001610
cmp byte [0x1008ff6c], 0
mov ecx, 0x2e
mov edi, dword [0x10091e64]
mov esi, 0x10092080
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x1009225c]
mov ecx, 0x2b
mov esi, 0x100921b0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x100921a4]
mov ecx, 0x83
mov esi, 0x10091bf0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x100921a8]
mov ecx, 0x19
mov esi, 0x10091e00
rep movsd dword es:[edi], dword [esi]
jne 0x100020bf
mov edi, dword [0x100922c4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x100b858c
push 0x40
push 5
push edi
call esi
mov eax, dword [0x100828a4]
mov dword [edi], eax
mov al, byte [0x100828a8]
push 0x100b858c
mov byte [edi + 4], al
push dword [0x100b858c]
push 5
push edi
call esi
push 5
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov byte [0x1008ff6c], 1
mov eax, dword [0x10091d10]
push str.fakelag
mov byte [0x100b857d], 0
call eax
add esp, 4
test eax, eax
je 0x100020e0
mov dword [eax + 0xc], 0
mov ecx, str.ResetHUD
call fcn.1003d330
mov ecx, str.BombDrop
call fcn.1003d330
mov ecx, str.Battery
call fcn.1003d330
mov ecx, str.Health
call fcn.1003d330
mov ecx, str.DeathMsg
call fcn.1003d330
mov ecx, str.SetFOV
call fcn.1003d330
mov ecx, str.TeamInfo
call fcn.1003d330
mov ecx, str.snapshot
call fcn.10002380
mov ecx, str.screenshot
call fcn.10002380
mov ecx, 0x10095918
call fcn.10001610
mov ecx, 0x100958fc
call fcn.10001610
mov ecx, 0x10095934
call fcn.10001610
push str.UnHooks
push str.___s:_FreeLibraryAndExitThread._n
call fcn.1003d920
add esp, 8
push 0x9c4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [0x1008fd20]
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
Function at 0x10004cf0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x1008f080]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov ebx, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004db3
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [eax]
lea eax, [esp + 0x3c]
push 0x1007a2fc
push eax
call fcn.10048790
add esp, 8
test eax, eax
jne 0x10004da0
push 0x104
push eax
lea eax, [esp + 0x158]
push eax
call fcn.10049290
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x154]
push eax
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x3c]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x10004d85
lea eax, [esp + 0x3c]
push eax
call fcn.10004dd0
add esp, 4
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
jne 0x10004d30
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10046e53
mov esp, ebp
pop ebp
ret
Function at 0x1000dc10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100d209c], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x1000dcca
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x100d2098], eax
inc ebx
cmp ebx, 0x100
jb 0x1000dc30
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x1000dcf6
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100d2098]
sub edi, 1
jne 0x1000dcd5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000dd28
nop dword [eax]
cmp cl, 0x23
jne 0x1000dd0f
cmp byte [esi], cl
jne 0x1000dd0f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100d2098]
test cl, cl
jne 0x1000dd00
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1000e260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x1000e272
mov dword [ebx], 0
mov edx, 0x1007a99c
call fcn.1000e0e0
mov esi, eax
test esi, esi
jne 0x1000e286
pop esi
pop ebx
pop ebp
ret
push edi
push 2
push 0
push esi
call fcn.1004e2a1
add esp, 0xc
test eax, eax
jne 0x1000e34f
push esi
call fcn.100517b5
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x1000e34f
push 0
push 0
push esi
call fcn.1004e2a1
add esp, 0xc
test eax, eax
jne 0x1000e34f
mov eax, dword [0x1008fb10]
inc dword [eax + 0x318]
mov ecx, dword [eax + 0xc0]
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
call ecx
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1000e34f
push esi
push edi
push 1
push eax
call fcn.1004de3b
add esp, 0x10
cmp eax, edi
je 0x1000e320
push esi
call fcn.1004d0cb
mov eax, dword [0x1008fb10]
mov ecx, dword [ebp + 8]
push ecx
dec dword [eax + 0x318]
mov eax, dword [eax + 0xc4]
call eax
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x1000e338
push eax
mov eax, dword [ebp + 8]
add eax, edi
push 0
push eax
call fcn.10049290
add esp, 0xc
push esi
call fcn.1004d0cb
add esp, 4
test ebx, ebx
je 0x1000e347
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.1004d0cb
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002fa80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100704c6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1008f080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 2
mov eax, 0x3f
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x3f800000
call fcn.1002fbe0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret