joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002616b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10055060]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push edi
xor eax, eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x5c
lea edi, [ebp - 0x11]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x100261a8
cmp eax, 3
jne 0x100261c0
push ebx
call fcn.10014cdf
pop ecx
cmp eax, 0xffffffff
je 0x100261cd
cmp eax, 7
jne 0x100261c0
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
setne al
mov byte [esi], al
mov al, 1
jmp 0x100261cf
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1002c8b3
leave
ret

Function at 0x100261dc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test edx, edx
je 0x10026200
push esi
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x10056a48]
dec edx
inc ecx
test edx, edx
jne 0x100261e4
pop esi
not eax
ret

Function at 0x100262e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x130
mov eax, dword [0x10055060]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x74]
and dword [ebp - 0xc4], 0
push esi
push edi
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x78]
push 0x3f
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x3f]
push 0
push eax
mov byte [ebp - 0x40], 0
call fcn.10030bf0
mov esi, 0x1004b360
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov al, byte [ebp + ecx - 0x40]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x9c], dl
mov byte [ebp + ecx], al
inc ecx
cmp ecx, 0x40
jb 0x10026330
lea eax, [ebp - 0x5c]
call fcn.1002af99
lea eax, [ebp - 0x9c]
push eax
push 0x40
pop eax
lea esi, [ebp - 0x5c]
call fcn.1002afc4
push dword [ebp - 0xc0]
mov eax, dword [ebp + 0x7c]
call fcn.1002afc4
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.1002b05c
lea eax, [ebp - 0xb8]
call fcn.1002af99
lea eax, [ebp]
push eax
push 0x40
pop eax
lea esi, [ebp - 0xb8]
call fcn.1002afc4
lea eax, [ebp + 0x54]
push eax
push 0x14
pop eax
call fcn.1002afc4
lea eax, [ebp + 0x40]
push eax
mov ecx, esi
call fcn.1002b05c
mov esi, dword [ebp - 0xbc]
add esp, 0x18
push 0x14
lea eax, [ebp + 0x40]
push eax
call fcn.10015ba9
mov ecx, dword [ebp + 0x68]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002c8b3
add ebp, 0x6c
leave
ret
Function at 0x100263da
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x10055060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x144], 0
push esi
push edi
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 0xc]
push 0x3f
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0xa7]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0xa8], 0
call fcn.10030bf0
add esp, 0xc
cmp dword [ebp + 0x14], 0x40
ja 0x1002643f
push dword [ebp + 0x14]
lea eax, [ebp - 0xa8]
push esi
push eax
call fcn.10031120
add esp, 0xc
jmp 0x10026478
lea eax, [ebp - 0x138]
call fcn.1002b11d
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 0x138]
call fcn.1002b15d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x138]
call fcn.1002b1e9
pop ecx
pop ecx
push 0x10
pop ecx
lea esi, [ebp - 0x28]
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov al, byte [ebp + ecx - 0xa8]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x48], dl
mov byte [ebp + ecx - 0x110], al
inc ecx
cmp ecx, 0x40
jb 0x1002647a
lea eax, [ebp - 0xd0]
call fcn.1002b11d
lea eax, [ebp - 0x48]
push eax
push 0x40
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1002b15d
push dword [ebp - 0x13c]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xd0]
call fcn.1002b15d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd0]
call fcn.1002b1e9
lea eax, [ebp - 0xd0]
call fcn.1002b11d
lea eax, [ebp - 0x110]
push eax
push 0x40
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1002b15d
lea eax, [ebp - 0x28]
push eax
push 0x20
pop eax
lea ecx, [ebp - 0xd0]
call fcn.1002b15d
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xd0]
call fcn.1002b1e9
mov esi, dword [ebp - 0x140]
add esp, 0x18
push 0x20
lea eax, [ebp - 0x68]
push eax
call fcn.10015ba9
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002c8b3
leave
ret
Function at 0x10026be8
Capabilities:
Check if file exists

Disassembly:
push 0xa8
mov eax, 0x100435d5
call fcn.1002ddda
mov eax, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x10026c5a
push edi
lea ecx, [ebp - 0x98]
call fcn.10004ef5
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x78], ebx
call fcn.100012fa
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
mov dword [ebp - 0x78], 3
jb 0x10026c49
mov eax, dword [eax + 4]
jmp 0x10026c4c
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 0x71], bl
test eax, eax
je 0x10026c5e
mov byte [ebp - 0x71], 0
test byte [ebp - 0x78], 2
je 0x10026c75
and dword [ebp - 0x78], 0xfffffffd
push esi
push ebx
lea esi, [ebp - 0xb4]
call fcn.10005a92
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x78], bl
je 0x10026c8c
push 0
push ebx
lea ecx, [ebp - 0x98]
call fcn.100058ba
cmp byte [ebp - 0x71], 0
je 0x10026c96
xor al, al
jmp 0x10026ce2
lea esi, [ebp - 0x6c]
call fcn.10004ee2
lea esi, [ebp - 0x50]
call fcn.10004ee2
lea esi, [ebp - 0x34]
call fcn.10004ee2
push str.file
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call fcn.1000584c
push edi
mov ecx, esi
mov byte [ebp - 0x70], bl
call fcn.1000584c
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x70]
push eax
add esi, 0x3c
call fcn.1002780d
lea esi, [ebp - 0x70]
call fcn.10026dcb
mov al, bl
call fcn.1002de5d
ret 4
Function at 0x10027f8f
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x10041f27
call fcn.1002ddda
mov eax, dword [ebp + 8]
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov dword [ebp - 4], ebx
xor edi, edi
push ebx
push 0x8000000
push 3
push ebx
push dword [ebp + edi*4 - 0x38]
push 0x80000000
push dword [ebp - 0x28]
call dword [0x100597c8]
push eax
lea esi, [ebp - 0x20]
call fcn.10027f53
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x10027ff8
cmp ecx, 0xffffffff
jne 0x10027ffe
inc edi
cmp edi, 4
jb 0x10027fc8
cmp ecx, ebx
je 0x10028009
or eax, 0xffffffff
cmp ecx, eax
jne 0x10028019
lea eax, [ebp - 0x20]
call fcn.10009c72
xor eax, eax
call fcn.1002de5d
ret
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
push ecx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x1c], 0x70bfbbef
jne 0x10028046
cmp dword [ebp - 0x18], 0x706c646f
je 0x10028052
lea eax, [ebp - 0x20]
call fcn.10009c72
mov eax, ebx
jmp 0x10028013
mov eax, dword [ebp - 0x14]
dec eax
dec eax
je 0x10028061
dec eax
jne 0x10028046
push 3
pop ebx
jmp 0x10028046
push 2
jmp 0x1002805e

Function at 0x10028065
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x190
mov eax, dword [esp + 8]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
add eax, ecx
shr edx, 0x10
xor byte [eax], dl
inc ecx
cmp ecx, 0x1000
jl 0x1002806a
ret
Function at 0x100280c5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
xor esi, esi
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], esi
ja 0x10028102
jb 0x1002821b
cmp eax, 0x1000
jb 0x1002821b
push 1
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
mov dword [ebp - 0x20], edi
call esi
mov dword [ebp - 0x18], eax
xor eax, eax
push eax
push eax
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 0x1000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002814f
cmp dword [ebp - 0x1c], eax
jne 0x1002821b
push eax
jmp 0x10028208
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x10028164
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
cmp dword [ebx], 0x70bfbbef
jne 0x10028202
cmp dword [ebx + 4], 0x706c646f
jne 0x10028202
mov eax, dword [ebx + 8]
cmp eax, 2
je 0x1002818a
cmp eax, 3
jne 0x10028202
push dword [ebx + 0x18c]
push ebx
call fcn.10028065
cmp byte [ebx + 0x4a3], 0
pop ecx
pop ecx
jne 0x100281e3
cmp dword [ebx + 0x1a0], 0x40
ja 0x100281e3
mov eax, 0x270f
cmp word [ebx + 0x190], ax
ja 0x100281e3
movzx eax, word [ebx + 0x192]
cmp ax, 1
jb 0x100281e3
cmp ax, 0xc
ja 0x100281e3
movzx eax, word [ebx + 0x196]
cmp ax, 1
jb 0x100281e3
cmp ax, 0x1f
ja 0x100281e3
xor ebx, ebx
inc ebx
jmp 0x100281e5
xor ebx, ebx
cmp dword [ebp - 0x1c], edi
jne 0x100281fe
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call esi
mov eax, ebx
jmp 0x1002821d
cmp dword [ebp - 0x1c], edi
jne 0x1002821b
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002af99
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x1002b770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x1002b78a
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x1002b786
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002b8a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10055060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.1002ba6b
mov bl, al
mov al, dl
call fcn.1002ba6b
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.1002ba6b
mov bl, al
mov al, byte [esi - 4]
call fcn.1002ba6b
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.1002ba6b
mov bl, al
mov al, byte [esi]
call fcn.1002ba6b
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.1002ba6b
mov bl, al
mov al, byte [esi - 0xc]
call fcn.1002ba6b
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1002b8cd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002c8b3
leave
ret 4
Function at 0x1002b95a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10055060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.1002bae7
push ebx
mov dl, al
call fcn.1002bac0
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.1002ba7b
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.1002ba99
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.1002ba7b
push ebx
mov byte [ebp - 0x15], al
call fcn.1002ba99
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.1002bac0
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.1002bae7
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.1002bac0
mov bl, al
mov al, byte [edi + 4]
call fcn.1002bae7
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.1002ba99
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1002ba7b
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.1002ba99
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.1002ba7b
xor bl, al
mov al, dl
call fcn.1002bae7
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1002bac0
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x1002b986
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002c8b3
leave
ret 4
Function at 0x1002c15d
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x10042202
call fcn.1002ddda
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002c17c
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.100066a4
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x1002c281
jmp 0x1002c1ad
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x1004ba08]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x1002c1c1
cmp al, 0xff
je 0x1002c1ad
cmp al, 0xff
je 0x1002c281
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x1004ba08]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x1002c1e1
cmp cl, 0xff
je 0x1002c1c9
cmp cl, 0xff
je 0x1002c281
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.10015db9
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1002c281
movsx eax, al
mov al, byte [eax + 0x1004ba08]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x1002c221
cmp al, 0xff
je 0x1002c201
cmp al, 0xff
je 0x1002c281
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.10015db9
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1002c281
movsx eax, al
mov cl, byte [eax + 0x1004ba08]
cmp esi, dword [ebp - 0x30]
jae 0x1002c25f
cmp cl, 0xff
je 0x1002c241
cmp cl, 0xff
je 0x1002c281
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.10015db9
cmp esi, dword [ebp - 0x30]
jb 0x1002c1aa
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10004f17
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.100058ba
mov eax, dword [ebp - 0x38]
call fcn.1002de5d
ret
Function at 0x1002c367
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
push ebx
push esi
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 6]
movzx ebx, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
push edi
movzx edi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xc]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
xor esi, 0x677d9197
xor edi, 0xb27022dc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov eax, dword [ecx + 0x1004b940]
xor eax, dword [ebp + ecx - 0x20]
xor eax, dword [ebp + ecx - 0x18]
xor eax, dword [ebp + ecx - 0x1c]
mov edx, eax
shr edx, 0x18
mov ebx, eax
movzx edx, dl
mov dl, byte [edx + 0x1004b830]
shr ebx, 0x10
mov byte [ebp + 0x70], dl
mov byte [ebp + 0x6d], bl
movzx edx, byte [ebp + 0x6d]
mov dl, byte [edx + 0x1004b830]
mov ebx, eax
movzx eax, al
mov al, byte [eax + 0x1004b830]
mov byte [ebp + 0x73], al
movzx eax, byte [ebp + 0x70]
shr ebx, 8
movzx edx, dl
shl eax, 8
or eax, edx
movzx esi, bl
mov bl, byte [esi + 0x1004b830]
shl eax, 8
movzx edx, bl
or eax, edx
movzx edx, byte [ebp + 0x73]
shl eax, 8
or eax, edx
mov edx, eax
rol edx, 0xd
mov esi, eax
ror esi, 9
xor edx, esi
xor edx, dword [ebp + ecx - 0x24]
xor edx, eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + ecx - 0x14], edx
mov dword [ecx + eax], edx
add ecx, 4
cmp ecx, 0x80
jb 0x1002c416
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x1002c8b3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10055060]
jne 0x1002c8bd
repz ret
jmp fcn.1002de7b
Function at 0x100377d2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1002e30f
and dword [ebp - 4], 0
cmp dword [0x10058bb4], 0
mov ebx, eax
jne 0x10037883
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10037934
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10037934
push eax
call fcn.1002e29d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10058bb4], eax
call esi
push eax
call fcn.1002e29d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10058bb8], eax
call esi
push eax
call fcn.1002e29d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10058bbc], eax
call esi
push eax
call fcn.1002e29d
pop ecx
mov dword [0x10058bc4], eax
test eax, eax
je 0x10037883
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1002e29d
pop ecx
mov dword [0x10058bc0], eax
mov eax, dword [0x10058bc0]
cmp eax, ebx
je 0x100378db
cmp dword [0x10058bc4], ebx
je 0x100378db
push eax
call fcn.1002e318
push dword [0x10058bc4]
mov esi, eax
call fcn.1002e318
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100378db
test edi, edi
je 0x100378db
call esi
test eax, eax
je 0x100378d2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100378d2
test byte [ebp - 0xc], 1
jne 0x100378db
or dword [ebp + 0x10], 0x200000
jmp 0x10037914
mov eax, dword [0x10058bb8]
cmp eax, ebx
je 0x10037914
push eax
call fcn.1002e318
pop ecx
test eax, eax
je 0x10037914
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10037914
mov eax, dword [0x10058bbc]
cmp eax, ebx
je 0x10037914
push eax
call fcn.1002e318
pop ecx
test eax, eax
je 0x10037914
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10058bb4]
call fcn.1002e318
pop ecx
test eax, eax
je 0x10037934
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10037936
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000671c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000672b
pop dword [ebp - 0x34]
mov eax, 0x5bf68d34
add eax, 0xb409d9f7
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xa0acec39
sub dword [ebp - 0x44], 0x525aa6ee
mov dword [ebp - 0x40], 0xcd7dc93e
sub dword [ebp - 0x40], 0x9b4a7cf9
mov dword [ebp - 0x3c], 0x657c2940
add dword [ebp - 0x3c], 0xe6d01aee
mov dword [ebp - 0x38], 0x8f3d5a4f
sub dword [ebp - 0x38], 0x8f3d5a4f
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x71a4dc27
add dword [ebp - 0x44], 0x2cd8d2f
mov dword [ebp - 0x40], 0xa49cefb3
add dword [ebp - 0x40], 0x9ccf71c2
mov dword [ebp - 0x3c], 0x17683fdb
sub dword [ebp - 0x3c], 0xb3f8d36f
mov dword [ebp - 0x38], 0x1c5c462d
sub dword [ebp - 0x38], 0x1c5c462d
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x73912409
sub eax, 0x63903361
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x38274
push 0
call eax
mov ecx, 0x4529
xor edx, edx
add edx, eax
mov esi, 0x10023800
add esi, dword [ebp - 0x34]
mov ebx, 0x10b79e6b
sub dword [ebp - 0x14], 0x43e6ae89
mov edi, dword [esi]
add dword [ebp - 0x28], edi
xor edi, ebx
sub dword [ebp - 4], eax
mov dword [edx], edi
sub dword [ebp - 0x28], esi
add edx, 4
add esi, 0xe3163215
sub esi, 0xe3163211
loop 0x10006838
add eax, 0xc839b9e1
sub eax, 0xc838b26a
mov ebx, eax
add eax, 0xf6998312
add eax, 0x9667cf3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x1000b110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b168
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b168
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1000671c
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x10016550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001655f
pop dword [ebp - 0x10]
mov eax, 0x37afe506
sub eax, 0x27ae7fa7
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x4298d
push 0
mov eax, 0xf174fec3
add eax, 0x1e8e6219
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x4b5d93a1
add ecx, 0xb4a2bd0b
mov ebx, eax
mov edx, 0x1003be00
add edx, dword [ebp - 0x10]
mov edi, 0xe9ce0517
add edi, 0xd40cb69b
xor dword [ebp - 0xc], edi
mov esi, dword [edx]
mov dword [ebp - 0xc], 0x42533771
xor esi, edi
mov dword [ebx], esi
xor dword [ebp - 0xc], 0x7ad40385
add ebx, 4
add edx, 4
loop 0x100165b8
add eax, 0xc748ac07
sub eax, 0xc7477684
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.10016550
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10016550
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret