joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458600
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4898c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x48c04c], 0
mov dword [ebp - 0x10], str.libOSMesa.dll
mov dword [ebp - 0xc], str.OSMesa.dll
mov dword [ebp - 8], 0
je 0x458641
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b097
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov eax, str.libOSMesa.dll
push eax
call edi
mov dword [0x48c04c], eax
test eax, eax
jne 0x458689
mov eax, dword [ebp + esi*4 - 0xc]
inc esi
test eax, eax
jne 0x458650
push str.OSMesa:_Library_not_found
push 0x10006
call fcn.00453f20
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b097
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OSMesaCreateContextExt
push eax
call esi
push str.OSMesaCreateContextAttribs
push dword [0x48c04c]
mov dword [0x48c050], eax
call esi
push str.OSMesaDestroyContext
push dword [0x48c04c]
mov dword [0x48c054], eax
call esi
push str.OSMesaMakeCurrent
push dword [0x48c04c]
mov dword [0x48c058], eax
call esi
push str.OSMesaGetColorBuffer
push dword [0x48c04c]
mov dword [0x48c05c], eax
call esi
push str.OSMesaGetDepthBuffer
push dword [0x48c04c]
mov dword [0x48c060], eax
call esi
push str.OSMesaGetProcAddress
push dword [0x48c04c]
mov dword [0x48c064], eax
call esi
cmp dword [0x48c050], 0
mov dword [0x48c068], eax
je 0x45874e
cmp dword [0x48c058], 0
je 0x45874e
cmp dword [0x48c05c], 0
je 0x45874e
cmp dword [0x48c060], 0
je 0x45874e
cmp dword [0x48c064], 0
je 0x45874e
test eax, eax
je 0x45874e
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b097
mov esp, ebp
pop ebp
ret
push str.OSMesa:_Failed_to_load_required_entry_points
push 0x10008
call fcn.00453f20
mov eax, dword [0x48c04c]
add esp, 8
test eax, eax
je 0x45877a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x48c04c], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0045b097
mov esp, ebp
pop ebp
ret
Function at 0x459060
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x4898c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x124]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x6d1
push 0
push 0x48b822
call sub.VCRUNTIME140.dll_memset
mov eax, 0x48b8c2
lea ebx, [ebp - 0x160]
add esp, 0x18
mov dword [ebp - 0x164], eax
mov esi, 0x20
sub ebx, 0x480
nop dword [eax]
movsx edi, word [esi*2 + 0x48b568]
cmp edi, 0xffffffff
je 0x4591f4
cmp esi, 0x140
jb 0x459183
cmp esi, 0x14e
ja 0x459183
mov dword [ebp - 0x160], 0x60
mov dword [ebp - 0x15c], 0x61
mov dword [ebp - 0x158], 0x62
mov dword [ebp - 0x154], 0x63
mov dword [ebp - 0x150], 0x64
mov dword [ebp - 0x14c], 0x65
mov dword [ebp - 0x148], 0x66
mov dword [ebp - 0x144], 0x67
mov dword [ebp - 0x140], 0x68
mov dword [ebp - 0x13c], 0x69
mov dword [ebp - 0x138], 0x6e
mov dword [ebp - 0x134], 0x6f
mov dword [ebp - 0x130], 0x6a
mov dword [ebp - 0x12c], 0x6d
mov dword [ebp - 0x128], 0x6b
mov eax, dword [ebx]
jmp 0x45918c
push 1
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x10
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x168], eax
push ecx
lea ecx, [ebp - 0x124]
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 0xffffffff
jne 0x4591ca
push 0
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x124]
push eax
push edi
push dword [ebp - 0x168]
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jl 0x4591ee
push 0
push 0
push 5
push dword [ebp - 0x164]
lea eax, [ebp - 0x24]
push 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x164]
inc esi
add eax, 5
add ebx, 4
mov dword [ebp - 0x164], eax
cmp esi, 0x15c
jle 0x4590c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045b097
mov esp, ebp
pop ebp
ret
Function at 0x4594d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4898c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x48b150
push 0x489e50
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x459518
push 0x477a1c
push 0x10008
call fcn.00458a00
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b097
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.user32.dll
call ebx
mov dword [0x48bf30], eax
test eax, eax
jne 0x459552
push str.Win32:_Failed_to_load_user32.dll
push 0x10008
call fcn.00458a00
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b097
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessDPIAware
push eax
call edi
push str.ChangeWindowMessageFilterEx
push dword [0x48bf30]
mov dword [0x48bf34], eax
call edi
push str.EnableNonClientDpiScaling
push dword [0x48bf30]
mov dword [0x48bf38], eax
call edi
push str.SetProcessDpiAwarenessContext
push dword [0x48bf30]
mov dword [0x48bf3c], eax
call edi
push str.GetDpiForWindow
push dword [0x48bf30]
mov dword [0x48bf40], eax
call edi
push str.AdjustWindowRectExForDpi
push dword [0x48bf30]
mov dword [0x48bf44], eax
call edi
push str.GetSystemMetricsForDpi
push dword [0x48bf30]
mov dword [0x48bf48], eax
call edi
push str.dinput8.dll
mov dword [0x48bf4c], eax
call ebx
mov dword [0x48bf18], eax
test eax, eax
je 0x4595ef
push str.DirectInput8Create
push eax
call edi
mov dword [0x48bf1c], eax
push esi
mov dword [ebp - 0x1c], str.xinput1_4.dll
xor esi, esi
mov dword [ebp - 0x18], str.xinput1_3.dll
mov eax, str.xinput1_4.dll
mov dword [ebp - 0x14], str.xinput9_1_0.dll
mov dword [ebp - 0x10], str.xinput1_2.dll
mov dword [ebp - 0xc], str.xinput1_1.dll
mov dword [ebp - 8], 0
push eax
call ebx
mov dword [0x48bf24], eax
test eax, eax
jne 0x459638
mov eax, dword [ebp + esi*4 - 0x18]
inc esi
test eax, eax
jne 0x459621
jmp 0x459657
push str.XInputGetCapabilities
push eax
call edi
push str.XInputGetState
push dword [0x48bf24]
mov dword [0x48bf28], eax
call edi
mov dword [0x48bf2c], eax
push str.dwmapi.dll
call ebx
mov dword [0x48bf50], eax
pop esi
test eax, eax
je 0x4596ab
push str.DwmIsCompositionEnabled
push eax
call edi
push str.DwmFlush
push dword [0x48bf50]
mov dword [0x48bf54], eax
call edi
push str.DwmEnableBlurBehindWindow
push dword [0x48bf50]
mov dword [0x48bf58], eax
call edi
push str.DwmGetColorizationColor
push dword [0x48bf50]
mov dword [0x48bf5c], eax
call edi
mov dword [0x48bf60], eax
push str.shcore.dll
call ebx
mov dword [0x48bf64], eax
test eax, eax
je 0x4596da
push str.SetProcessDpiAwareness
push eax
call edi
push str.GetDpiForMonitor
push dword [0x48bf64]
mov dword [0x48bf68], eax
call edi
mov dword [0x48bf6c], eax
push str.ntdll.dll
call ebx
mov dword [0x48bf70], eax
test eax, eax
je 0x4596f7
push str.RtlVerifyVersionInfo
push eax
call edi
mov dword [0x48bf74], eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.0045b097
mov esp, ebp
pop ebp
ret
Function at 0x45b483
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45b4c2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45b4c2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45b4c2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45b4c2
cmp dword [ecx + 0x74], 0xe
jbe 0x45b4c2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a328
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40a337
pop dword [ebp - 0xc]
mov eax, 0x40a337
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x17c5bd88
sub dword [ebp - 0x1c], 0xc973783d
mov dword [ebp - 0x18], 0x72d776b
add dword [ebp - 0x18], 0x2b05d4da
mov dword [ebp - 0x14], 0xba6d1d7f
sub dword [ebp - 0x14], 0x6e20d951
mov dword [ebp - 0x10], 0x14b62b4c
add dword [ebp - 0x10], 0xeb49d4b4
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x5bb34e8f
sub eax, 0x5b6faddf
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x1db78b3c
sub dword [ebp - 0x1c], 0xa94521e6
mov dword [ebp - 0x18], 0xfd23a0fa
add dword [ebp - 0x18], 0x4448c07b
mov dword [ebp - 0x14], 0x51b963a
add dword [ebp - 0x14], 0x5e53d632
mov dword [ebp - 0x10], 0xae2c7935
sub dword [ebp - 0x10], 0xae2c7935
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x1ceb0331
sub eax, 0x1ca762f9
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x400f7
push 0
call eax
mov ecx, 0x4f58
mov edi, eax
mov edx, 0x5124d6d7
sub edx, 0x50df5cd7
add edx, dword [ebp - 0xc]
mov esi, 0x47e932ff
add esi, 0xf6fdf326
xor dword [ebp - 8], esi
mov ebx, dword [edx]
sub dword [ebp - 4], 0x67b8b399
xor ebx, esi
xor dword [ebp - 4], 0x1aa5168d
mov dword [edi], ebx
add dword [ebp - 8], ecx
add edi, 0x6933b06e
sub edi, 0x6933b06a
add edx, 0xd8c3db3e
add edx, 0x273c24c6
loop 0x40a44e
add eax, 0x4725a761
add eax, 0xb8db88d2
xor ebx, ebx
add ebx, eax
add eax, 0xe10bb291
sub eax, 0xe10bb28c
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4028d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4028da
repz ret
jmp fcn.00402af8

Function at 0x4069bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004041ca
and dword [ebp - 0x14], 0
cmp dword [0x4179e4], 0
mov dword [ebp - 0x18], eax
jne 0x406a6e
push 0x402004
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406b16
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401ff8
push ebx
call edi
test eax, eax
je 0x406b16
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x401fe8
push ebx
mov dword [0x4179e4], eax
call edi
push eax
call esi
push 0x401fd4
push ebx
mov dword [0x4179e8], eax
call edi
push eax
call esi
push 0x401fb8
push ebx
mov dword [0x4179ec], eax
call edi
push eax
call esi
mov dword [0x4179f4], eax
test eax, eax
je 0x406a6e
push 0x401fa0
push ebx
call edi
push eax
call esi
mov dword [0x4179f0], eax
mov eax, dword [0x4179f0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406ac7
cmp dword [0x4179f4], ecx
je 0x406ac7
push eax
call esi
push dword [0x4179f4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406ac7
test ebx, ebx
je 0x406ac7
call edi
test eax, eax
je 0x406abe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406abe
test byte [ebp - 8], 1
jne 0x406ac7
or dword [ebp + 0x10], 0x200000
jmp 0x406afa
mov eax, dword [0x4179e8]
cmp eax, dword [ebp - 0x18]
je 0x406afa
push eax
call esi
test eax, eax
je 0x406afa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406afa
mov eax, dword [0x4179ec]
cmp eax, dword [ebp - 0x18]
je 0x406afa
push eax
call esi
test eax, eax
je 0x406afa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4179e4]
call esi
test eax, eax
je 0x406b16
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406b18
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004028d0
leave
ret

Function at 0x4077d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x417b08
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4077d7
mov ecx, dword [0x402838]
mov edx, dword [0x40283c]
mov dword [eax], ecx
mov ecx, dword [0x402840]
mov dword [eax + 4], edx
mov dl, byte [0x402844]
mov dword [eax + 8], ecx
push 0x417b08
mov byte [eax + 0xc], dl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x41966c]
mov edx, dword [0x41941c]
lea eax, [esp]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x407890
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
cmp edi, 0x1149
jne 0x4078ca
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
xor esi, esi
test edi, edi
jle 0x407912
cmp edi, 0x469
jne 0x4078e2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
call fcn.00407750
xor byte [ebx + esi], al
cmp edi, 0x101e
jne 0x40790d
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
inc esi
cmp esi, edi
jl 0x4078d0
mov ecx, dword [esp + 0x34]
pop esi
xor ecx, esp
call fcn.004028d0
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x5f9f6b90
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42cd70
nop
mov ecx, 0x712007e7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10008bc8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10008c40
cmp byte [esi + 0x3d], 0
je 0x10008c40
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10008c12
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10008c16
sub eax, 1
je 0x10008c1a
dec eax
sub eax, 1
je 0x10008c40
xor al, al
jmp 0x10008c42
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10008c37
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100a7b1b
add esp, 0x10
cmp edi, eax
jne 0x10008c12
cmp byte [esi + 0x3d], 0
sete al
jmp 0x10008c42
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x1000e6d8
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x1000e6f2
xor eax, eax
jmp 0x1000e7c0
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x1000e720
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x1000e720
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x1000e7bf
cmp dword [esi + 0x4c], 0
je 0x1000e7bd
mov ecx, esi
call fcn.1000b0eb
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x1000e74c
push dword [esi + 0x4c]
push eax
call fcn.10002396
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x1000e7bd
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x1000e7bd
cmp eax, 1
jle 0x1000e78e
cmp eax, 3
jne 0x1000e7bd
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x1000e73e
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x1000e7ad
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.100a7b1b
add esp, 0x10
cmp ebp, eax
jne 0x1000e7bd
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x1000e7bf
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x10010324
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10010345
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.100103fd
jmp 0x100103f7
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax]
mov dword [esp + 0x10], ebx
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x10010368
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1001036a
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test ebx, ebx
jl 0x100103e8
jg 0x1001037d
test esi, esi
je 0x100103e8
test eax, eax
jl 0x100103b9
jg 0x10010387
test ebp, ebp
je 0x100103b9
cmp ebx, eax
jg 0x10010397
jl 0x10010391
cmp esi, ebp
jae 0x10010397
mov ebp, esi
mov dword [esp + 0x20], ebx
push ebp
push ecx
push dword [esp + 0x24]
call fcn.1009dca0
mov eax, dword [edi + 0x2c]
add esp, 0xc
add dword [esp + 0x1c], ebp
sub esi, ebp
sbb ebx, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [edi + 0x1c]
add dword [eax], ebp
mov ebp, dword [esp + 0x1c]
test ebx, ebx
jl 0x100103e8
jg 0x100103c7
test esi, esi
je 0x100103e8
cmp dword [edi + 0x4c], 0
je 0x100103e8
mov ecx, edi
call fcn.1000b0eb
push dword [edi + 0x4c]
push esi
push 1
push ebp
call fcn.100a7487
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
pop esi
pop ebp
sbb edx, ebx
pop ebx
pop edi
pop ecx
pop ecx
ret 0xc

Function at 0x100104d1
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100104f2
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.100105a7
jmp 0x100105a1
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10010515
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10010517
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x10010592
jg 0x1001052a
test esi, esi
je 0x10010592
test eax, eax
jl 0x1001056a
jg 0x10010534
test ebp, ebp
je 0x1001056a
cmp edi, eax
jg 0x10010544
jl 0x1001053e
cmp esi, ebp
jae 0x10010544
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.1009dca0
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x1001056e
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x10010592
jg 0x10010578
test esi, esi
je 0x10010592
cmp dword [ebx + 0x4c], 0
je 0x10010592
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.100a7b1b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x10015c0a
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x100c6987
call fcn.1009a804
push ecx
xor eax, eax
mov dword [ebp - 0x10], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], al
xor edi, edi
mov dword [ebp - 4], eax
inc edi
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10015c6c
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x10015c66
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x10015c66
push eax
mov ecx, esi
call fcn.1000b607
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10015c7c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10015cf8
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0x18]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10015ce6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x10015cdc
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
push edi
call fcn.1009dca0
mov eax, dword [ebp + 0x18]
add esp, 0xc
push esi
mov byte [eax + edi], bl
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov bl, 1
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x10015cf7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
lea ecx, [ebp + 8]
call fcn.1000b31a
mov al, bl
pop ebx
pop ebp
ret
Function at 0x1001d6eb
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
cmp byte [edi + 8], 0
je 0x1001d73d
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1001d73d
mov esi, dword [esp + 0x10]
test esi, esi
je 0x1001d73d
push ebx
xor ebx, ebx
test esi, esi
je 0x1001d738
push ebp
lea ebp, [esi - 1]
add ebp, eax
mov ecx, dword [edi]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [edi + 4]
sub ecx, edx
mov al, byte [ecx + eax - 1]
xor al, byte [ebp]
mov ecx, dword [esp + 0x1c]
xor al, dl
xor al, bl
mov byte [ebx + ecx], al
inc ebx
dec ebp
cmp ebx, esi
jb 0x1001d712
pop ebp
mov al, 1
pop ebx
jmp 0x1001d73f
xor al, al
pop edi
pop esi
ret 0xc

Function at 0x10021e68
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x74
mov eax, 0x100c85d9
call fcn.1009a804
sub esp, 0x1a0
push str.core
lea ecx, [ebp + 0x48]
call fcn.10001866
mov ecx, dword [0x101156c0]
lea eax, [ebp]
and dword [ebp - 4], 0
push eax
call fcn.1000da75
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 1
push ecx
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.10007f42
add esp, 0xc
lea ecx, [ebp]
call fcn.1000b340
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 4
call fcn.1000b340
push str..kf
lea ecx, [ebp + 0x30]
call fcn.10001866
lea eax, [ebp + 0x30]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.10007f42
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
push ecx
mov ecx, eax
call fcn.1000ff35
cmp dword [eax + 0x14], 0x10
jb 0x10021f01
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x1ac]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.1000b31a
lea ecx, [ebp - 0x3c]
call fcn.1000b340
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], 4
call fcn.1000b340
cmp esi, 0xffffffff
je 0x10021fbc
push str.Initializing_core_plugins...
call fcn.10080919
pop ecx
lea eax, [ebp - 0x180]
push eax
lea ecx, [ebp + 0x18]
call fcn.10001866
lea eax, [ebp + 0x18]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10007f42
add esp, 0xc
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 8
push ecx
mov ecx, eax
call fcn.1000ff35
cmp dword [eax + 0x14], 0x10
jb 0x10021f80
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x54]
call fcn.1000b31a
lea ecx, [ebp - 0x6c]
call fcn.1000b340
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 4
call fcn.1000b340
lea eax, [ebp - 0x1ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10021f42
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 0x60]
call fcn.1000b340
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
add ebp, 0x78
leave
ret