joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030e4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x412008], 0x8088405
inc edx
mov dword [ebx + 0x412008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41201c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037ac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40378c
xor eax, eax
push ebp
push 0x403785
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40378c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
movzx eax, word [0x41201c]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41201c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41304c], 0
je 0x404551
cmp word [0x413328], 0xd7b2
jne 0x404519
cmp dword [0x413330], 0
jbe 0x404519
mov eax, 0x413324
call dword [0x413340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40457c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x412028], 0
jne 0x40456d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40ba24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40bb5c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40bb46
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40ba81
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bb46
cmp dword [ebp - 0x14], 0
jne 0x40ba98
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404c98
mov bl, 1
jmp 0x40bb46
cmp dword [ebp - 0x14], 0x70000000
jb 0x40baa6
call fcn.00409734
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00404dd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004054ac
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40ba4a
test eax, eax
jne 0x40bb46
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40baf4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bb46
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40bafc
dec esi
test esi, esi
je 0x40bb0b
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x40bafb
cmp dword [ebp - 0x10], 7
jne 0x40bb16
test esi, esi
je 0x40bb16
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404f00
cmp dword [ebp - 0x10], 7
jne 0x40bb39
test esi, esi
je 0x40bb39
lea eax, [ebp - 4]
call fcn.004054ac
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404c98
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb63
lea eax, [ebp - 4]
call fcn.00404c88

Function at 0x40c5a0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d98
mov eax, esi
mov edx, 8
test al, 1
je 0x40c5bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c5be
shr eax, 1
dec edx
jne 0x40c5af
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c5a8
pop esi
ret

Function at 0x40c5d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x417d94], 0
jne 0x40c5f7
call fcn.0040c5a0
push 1
push 0x417d94
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40c622
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x417d98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c5fd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40e4c4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40e51e
inc esi
xor edi, edi
cmp edi, 1
jne 0x40e4ea
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x40e4f8
cmp edi, 1
jle 0x40e4f8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
ret
call fcn.0040e050
test eax, eax
jne 0x40e51e
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40e51e
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40e51e
inc edi
dec esi
jne 0x40e4da
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40e528
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e54c
mov eax, dword [ebp - 4]
jmp 0x40e54f
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x40e554
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x40e5a1
xor ebx, ebx
jmp 0x40e596
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00407af8
test eax, eax
jne 0x40e595
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40e64b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e577
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x40e5ad
je 0x40e5b6
jmp 0x40e5bf
call fcn.0040bba4
mov esi, eax
jmp 0x40e5c1
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x40e5c1
xor esi, esi
test si, si
je 0x40e64b
xor ebx, ebx
jmp 0x40e5e7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x40e5e6
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e64b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e5ce
xor ebx, ebx
jmp 0x40e640
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40e63f
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x40e634
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.0040e528
push eax
mov eax, esi
call fcn.0040e528
pop edx
cmp edx, eax
jne 0x40e63f
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e64b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e5f6
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x10001c70
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10002250
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10001d20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10030a98]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10001de2
cmp byte [esi + 0x3d], 0
je 0x10001de2
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10001dcf
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10001d93
sub eax, 1
je 0x10001d97
sub eax, 2
jne 0x10001dcf
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100194a0
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x10001db7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10001dcf
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100194a0
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100194a0
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.100194a0
add esp, 0x28
ret
Function at 0x100022e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10030a98]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10002310
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100194a0
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10002341
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10002341
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100194a0
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1000244b
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1000236a
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000239f
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.ucrtbased.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100194a0
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10002407
sub eax, 1
je 0x10002407
sub eax, 2
jne 0x1000244b
push dword [esi + 0x4c]
push dword [esp + 0x10]
call fcn.100013b0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100194a0
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x10002427
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000244b
lea eax, [esp + 0xc]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
je 0x1000244b
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100194a0
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100194a0
add esp, 0x30
ret 4
Function at 0x10002ba0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x10]
test eax, eax
jg 0x10002bbf
jl 0x10002bb6
test ebp, ebp
jne 0x10002bbf
pop ebp
xor eax, eax
xor edx, edx
pop ebx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10002bd6
push eax
push ebp
push dword [esp + 0x14]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebp
pop ebx
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x10002c16
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10002c16
mov edi, dword [esp + 0x14]
cmp eax, ebp
mov esi, ebp
cmovb esi, eax
push esi
push ecx
push edi
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x20], edi
add esp, 0xc
mov edi, ebp
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
mov esi, dword [esp + 0x14]
je 0x10002c8c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10002c43
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.ucrtbased.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10002c78
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x10002c9e
cmp edi, eax
mov eax, dword [sym.imp.ucrtbased.dll_fread]
ja 0x10002c52
test ecx, ecx
je 0x10002c8c
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov edx, dword [esp + 0x1c]
sub ebp, ecx
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
mov edx, dword [esp + 0x1c]
sub ebp, edi
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
Function at 0x10002cb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10002cd5
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10002cf8
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10002cfa
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x10002d75
jg 0x10002d0d
test esi, esi
je 0x10002d75
test eax, eax
jl 0x10002d57
jg 0x10002d17
test ebp, ebp
je 0x10002d57
cmp edi, eax
jg 0x10002d27
jl 0x10002d21
cmp esi, ebp
jae 0x10002d27
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x30]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
sub esi, ebp
sbb edi, dword [esp + 0x20]
add ecx, ebp
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
test edi, edi
jl 0x10002d75
jg 0x10002d5b
test esi, esi
je 0x10002d75
jmp 0x10002d5b
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10002d75
push eax
push esi
push 1
push ecx
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x10002d90
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10002e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10003f40
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100041a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x10003f60
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10030a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [eax], 0x8b55ff8b
je 0x10004182
cmp dword [0x10030f24], 1
jne 0x10004020
push 1
push 0x40
push 8
push 0x1001d368
lea ecx, [ebp - 0x174]
call fcn.100014c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nSP_Scan:
push eax
call fcn.10001050
lea eax, [ebp - 0x174]
push 0x1001d38c
push eax
call fcn.10001050
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.10001f00
test eax, eax
jne 0x1000400e
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ab0
cmp dword [0x10030f34], 1
jne 0x100040ff
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1001d3a4
call fcn.100014c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1001d3a8
push eax
call fcn.10001050
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push str.SP_Scan:
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x1001d3c8
push eax
call fcn.10001050
lea eax, [ebp - 0xc4]
push 0x1001d3e0
push eax
call fcn.10001050
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.10001f00
test eax, eax
jne 0x100040e7
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x1001d408
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10001ab0
mov eax, dword [0x10030f28]
push 0
cmp eax, 1
jne 0x10004131
push 0
push 0
push 0x10003ee0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10004141
push 0
push 0
push 0x10003eb0
jmp 0x10004114
cmp eax, 3
jne 0x10004151
push 0
push 0
push 0x10003f10
jmp 0x10004114
cmp eax, 4
jne 0x1000412b
push 0
push 0
push 0x10018d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.SP_Scan
push 0x1001d414
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10004129
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004ab0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
mov eax, dword [0x10030f28]
push ebx
push ebp
push esi
push edi
cmp eax, 1
jne 0x10004b2b
mov dword [esp + 0x10], 0x1001d9d0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10004b0f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10004b09
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10004af3
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10030ea4]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10004b9c
mov dword [esp + 0x10], 0x1001da50
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10004b80
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10004b7a
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10004b64
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10030ea4]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1001dae8
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10004bec
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10004be6
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10004bd0
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10030ea4]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10004f00
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.10005440
mov eax, dword [0x10030f28]
cmp eax, 1
jne 0x10004f80
mov dword [esp + 0x10], 0x1001d7e0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10004f64
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10004f5e
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10004f48
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10030ea4]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10004ff8
mov dword [esp + 0x10], 0x1001d880
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10004fdc
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10004fd6
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10004fc0
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10030ea4]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1001d928
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000504c
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10005046
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10005030
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10030ea4]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]