joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58865c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x588673
add esp, 0xfffffff0
call fcn.00407838
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004a82b0
mov eax, dword [0x6fcda8]
cmp byte [eax], 0
jne 0x5886a0
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x6fd540]
cmp word [eax + 2], 0
jne 0x5886ba
mov eax, dword [0x6fd540]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0058a8f4
mov eax, dword [0x6fd7e8]
cmp word [eax + 2], 0
jne 0x5886d4
mov eax, dword [0x6fd7e8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0058aaf8
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4cbe48]
call fcn.004d2120
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x58af74
mov dl, 1
mov eax, dword [0x474dac]
call fcn.00407298
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x474dac]
call fcn.00407298
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4d0a24]
call fcn.004db600
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5888bc
mov eax, dword [0x6fd254]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004db9fc
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x58b234
mov dl, 1
mov eax, dword [0x474dac]
call fcn.00407298
mov dword [ebx + 0xb0], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6fd254]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00421130
test eax, eax
je 0x5887ee
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00420f6c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00421114
test eax, eax
je 0x588806
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.00409d74
push ebx
push 0x58a2d0
call fcn.0057e54c
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x6fcda8]
cmp byte [eax], 0
jne 0x588857
mov eax, ebx
call fcn.00588aa0
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.0058b46c
mov eax, ebx
call fcn.0058c0d8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5888b4
call fcn.00407890
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x588de4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x588e86
cmp dword [ebx + 0xac], 0
jne 0x588e80
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x588d20
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x588e80
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x588e46
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x588e80
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.0049706c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x588e55
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5890c4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x7036e0]
cmp dword [eax + 0x188], 0
je 0x58923e
test bl, bl
jne 0x589189
cmp dword [esi + 0xb4], 0
jne 0x58917e
mov eax, esi
call fcn.0058bf28
push eax
push 0x588fb8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x58914f
mov eax, dword [0x7036e0]
cmp byte [eax + 0xeb], 0
je 0x58914f
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x589130
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x58914f
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x589138
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x58917e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.0049706c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x58915e
inc dword [esi + 0xb4]
jmp 0x58923e
cmp dword [esi + 0xb4], 0
jle 0x58923e
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x58923e
cmp dword [esi + 0x58], 0
je 0x5891f3
mov eax, dword [0x7036e0]
cmp byte [eax + 0xeb], 0
je 0x5891f3
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5891d4
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5891f3
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5891dc
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x589222
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.0049706c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x589202
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x57b3b0]
call fcn.0040b2d8
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x589e5c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x589eb9
cmp byte [ebx + 0xeb], 0
jne 0x589eb9
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409074
mov eax, dword [esi]
test eax, eax
je 0x589ea6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x589ec6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004092cc
jmp 0x589ec6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004092cc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x58b654
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x58b6c5
mov eax, esi
call fcn.00501470
test al, al
je 0x58b6c5
mov eax, dword [ebx + 0x98]
call fcn.005010a0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x58b6c5
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x114]
test al, al
je 0x58b6b6
push 0
mov eax, dword [ebx + 0x98]
call fcn.005010a0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.004f8170
jmp 0x58b6c5
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.0058b48c
pop esi
pop ebx
ret
Function at 0x5aad18
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x5aad6a
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0x10]
mov edx, dword [ebp - 4]
xor al, byte [edx]
and eax, 0xff
mov eax, dword [eax*4 + 0x6f8354]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x5aad40
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5c2d18
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5c2d46
mov eax, ebx
call fcn.005c37d4
cmp dword [ebx + 0x40], 0
je 0x5c2d3f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5c2db7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5c2da9
cmp dword [ebx + 8], 0
je 0x5c2d68
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5c2d7a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5c2da9
cmp dword [ebx + 8], 0
je 0x5c2d5b
cmp eax, 3
je 0x5c2d8d
dec eax
jne 0x5c2d5b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5c2d5b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5c2d5b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5c2dd5
cmp dword [ebx + 0x14], 0xcc
je 0x5c2dd5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005c2de0
pop ebx
ret

Function at 0x5d36cc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5ea520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, 0x105
call fcn.00421244
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5ea573
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00409d20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ea57a
mov eax, dword [ebp - 8]
call fcn.00421284
ret
Function at 0x604590
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x724900], 0
jne 0x6045a7
call fcn.0060454c
mov eax, edi
dec eax
test eax, eax
jl 0x6045cf
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x724500]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6045b1
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x60727c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x607316.0
jmp dword [ecx*4 + 0x6072af]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6072e1
sub dl, 8
je 0x6072f0
jmp case.0x607316.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x606f48
jmp case.0x607316.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x606f9c
jmp case.0x607316.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x607316.0
movzx ecx, byte [ecx + 0x60731d]
jmp dword [ecx*4 + 0x60732e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x60703c
jmp case.0x607316.0
cmp dl, 3
jne 0x60735b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x607094
jmp case.0x607316.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x607050
jmp case.0x607316.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6070d8
jmp case.0x607316.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x607386
sub dl, 8
je 0x607392
jmp case.0x607316.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x607104
jmp case.0x607316.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x607168
jmp case.0x607316.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6073b1
sub dl, 8
je 0x6073bd
jmp case.0x607316.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x607218
jmp case.0x607316.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x607240
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x60745f
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00606490
test eax, eax
je 0x60745f
mov eax, ebx
call fcn.00607468
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x6073f8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x607468
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x607499
dec al
je 0x6074d4
dec al
je 0x607511
dec al
je 0x60757a
jmp 0x607604
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x607604
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6074a9
jmp 0x607604
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x607604
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x6074e4
jmp 0x607604
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x607604
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x607540
xor ebp, ebp
jmp 0x607550
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x607559
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x607521
jmp 0x607604
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x607604
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x6075d3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.006045d8
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x60758e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x691d2c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.00408eec
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x691d5d
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.00409074
add esp, 0x24
pop ebx
ret

Function at 0x6b79d4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6b79dc
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b7b91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6b7bac
call fcn.00409f24
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0x1c]
call fcn.006b5bc4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6b7bc0
call fcn.00661990
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6b7a57
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b7a98
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.006b5bc4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b7c28
call fcn.00661990
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00409ecc
mov eax, esi
mov edx, 0x6b7c54
call fcn.00409ecc
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6b7ab0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b7b1e
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b7c68
call fcn.00661990
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.00409ecc
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6b7ae7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b7b12
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b7c98
call fcn.00661990
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.00409ecc
mov eax, esi
mov edx, 0x6b7cc4
call fcn.00409ecc
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6b7b2a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b7b55
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b7cd8
call fcn.00661990
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.00409ecc
mov eax, esi
mov edx, 0x6b7d24
call fcn.00409ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b7b98
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00408f4c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00408f4c
lea eax, [ebp - 4]
call fcn.00408eec
ret
Function at 0x100294d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ba364]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10029573
cmp byte [esi + 0x3d], 0
je 0x10029573
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10029528
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002953a
sub eax, 1
je 0x1002953e
sub eax, 2
je 0x10029573
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100990c9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002955c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10029528
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100990c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100990c9
mov esp, ebp
pop ebp
ret
Function at 0x1002e400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009c570
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ba364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x100f84d4]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [0x100f84d4]
mov dword [eax + 4], eax
mov dword [0x100f84d8], 0
cmp ecx, dword [0x100f84d4]
je 0x1002e469
mov esi, dword [ecx]
push 0x10
push ecx
call fcn.10099636
add esp, 8
mov ecx, esi
cmp esi, dword [0x100f84d4]
jne 0x1002e452
push 8
mov ecx, 0x100f84d0
call fcn.10031560
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x100ee30c]
test ecx, ecx
je 0x1002e5c7
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x1002e5c7
nop dword [eax + eax]
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1002e4b0
xor edx, edx
test eax, eax
je 0x1002e4d1
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x1002e4c0
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x100f84dc]
and edx, dword [0x100f84e8]
mov esi, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x100f84d4]
add ecx, 4
mov eax, esi
mov dword [ebp - 0x10], ecx
nop
cmp esi, edx
jne 0x1002e538
mov ecx, edx
jmp 0x1002e53c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002e550
cmp dword [eax + 8], ebx
je 0x1002e54c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
jmp 0x1002e530
mov ecx, eax
jmp 0x1002e554
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x1002e5af
mov esi, dword [edx]
lea eax, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [esi + 4]
push ecx
push ebx
push esi
call fcn.10032160
mov edx, dword [0x100f84d8]
mov ecx, 0xffffffe
sub ecx, edx
cmp ecx, 1
jb 0x1002e5d9
lea ecx, [edx + 1]
mov dword [0x100f84d8], ecx
mov ecx, 0x100f84d0
mov dword [esi + 4], eax
mov dword [ebx], eax
mov eax, dword [0x100f84d4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10031f40
mov eax, dword [ebp - 0x20]
jmp 0x1002e5b6
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x1002e4a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3