joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104afbe6
Capabilities:
Encode data using base64

Disassembly:
mov dl, byte [edx + ebp - 0x410a0042]
dec cx
inc eax
or ecx, 0x8a1171b1
mov cl, byte [eax + ebp - 0x310d5fb4]
lea ebp, [ebp + eax - 0x310d5fb4]
shl ax, 0x66
sets al
add dl, cl
sal ax, 0x41
call fcn.1046d521
mov edx, dword [esi]
mov ecx, 0x8f0d4a82
add esi, 4
xor edx, ebx
neg edx
lea eax, [ecx*8 - 0x5641d4ff]
sub al, al
xor edx, 0xaf3782b2
push eax
pop ecx
lea edx, [ecx + edx - 0x7adec135]
push eax
bswap edx
inc cx
or eax, ecx
xor ebx, edx
add ebp, edx
lea edx, [ecx + eax - 0x425467cb]
mov dl, byte [edi + ecx*2 - 0x4450fe02]
xchg byte [esp + ecx - 0x22287efe], ah
ror byte [esp + ecx*2 - 0x4450fe02], 0xc1
movzx ax, byte [edi + ecx*2 - 0x4450fe00]
pop ecx
lea edi, [edi + ecx - 0x7f287efe]
inc ecx
imul dl
mov edx, ecx
mov word [edx + edi - 0x7f287f01], ax
and edx, 0x68a6e334
jmp ebp
dec edx
xor ebx, eax
xadd dl, dh
and edx, ecx
adc esi, eax
lea eax, [ecx + ecx*8 - 0x3ed5b4c1]
jmp 0x103ee63a
and dx, 0x18a6
lea ebp, [ebp + edx - 0x3200004]
adc eax, dword [esp + edx - 0x31ffffc]
mov word [edx + ebp - 0x3200002], cx
mov ecx, eax
jnp 0x10420fff
sar byte [esp + eax - 0x138e39f5], 0x24
pop eax
pop eax
pop ecx
jbe fcn.10511f38
mov eax, 0x79824c08
mov eax, dword [edi + eax - 0x79824c08]
mov edx, 0x413eb79f
lea ecx, [edx + edx - 0x276453cb]
lea edi, [ecx + edi - 0x5b191b6f]
sar dx, 9
dec edx
xor eax, ebx
add ecx, edx
jne 0x1052972e
and cl, ch
lea eax, [eax + edx - 0x757d60f6]
xchg ch, cl
add cx, cx
dec cl
not eax
inc cl
rol dl, 0xa7
xor eax, 0xb910f388
ror ecx, 0xc3
sub eax, 0x45271783
jmp 0x1042710d

Function at 0x104b01ce
Capabilities:
Encode data using base64

Disassembly:
xchg word [esp + 4], dx
dec dx
xor cl, bl
rol word [esp + 2], 3
neg dl
or dl, 0x19
adc cl, 0xc
jmp 0x1051b478
add ebp, 2
movzx ecx, byte [edi]
push 0x60a8d11e
mov dword [esp + 4], 0x91a4b02f
mov edx, 0xb8833436
add edi, 1
jmp 0x1040fb17
xor cl, 0x9c
ror cl, 1
inc cl
shr edx, 0x30
xor bl, cl
xor dl, 0x11
jne 0x103ec138
wait
invalid

Function at 0x104beb1a
Capabilities:
Encode data using base64

Disassembly:
ror eax, 3
ror dx, cl
xor eax, 0xbb886810
rol eax, 1
inc eax
xor word [esp + edx*2 - 0x50c017f8], dx
mov dword [esp + ecx - 0xa6], edx
xor ebx, eax
neg dl
jp 0x1048f6c1

Function at 0x104c71a6
Capabilities:
Encode data using base64

Disassembly:
movzx eax, dx
call fcn.1047a701
call fcn.1040b576
pop eax
xor ecx, ebx
mov edx, eax
add ecx, 0x88b14a9f
ror ecx, 1
neg ecx
call fcn.1049586f
Function at 0x104cb598
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xf7
rcl bl, 1
jmp 0xd14b8897
mov eax, dword [0xf7ca8bc9]
invalid
xor bl, al
pop ecx
mov ecx, 0x79b6e532
lea eax, [esp + eax + 4]
xor ecx, ecx
xchg dword [esp + ecx], ecx
or al, 0xc
mov word [eax], dx
ror cl, 0xc1
mov eax, ecx
mov edx, dword [esi]
shr eax, 0xf1
lea esi, [esi + eax - 0x6a09]
rol dword [esp + eax - 0x6a0d], 0x2f
xor edx, ebx
bswap ecx
inc ecx
call fcn.10483d0f
xchg esi, eax
out dx, eax
js 0x104cb5a7
adc byte [esi + 0x50], al
je 0x104cb55b
jo 0x104cb620
push eax
mov byte [0x486fbb79], al
inc eax
mov esp, 0x21d04016
mov eax, dword [0xb9d04562]
jecxz 0x104cb585
dec edi
adc byte [eax + esi*2 - 0x3f], dh
mov dl, 0x2f
xchg ebp, eax
wait
aad 0x4c
adc byte [eax + ebp], dh
mov ah, 0x2f
and byte [ebp + ecx*2 + 0x62], ah
mov eax, 0x5693156f
nop
sbb eax, 0x118cb806
pop ecx
cmp eax, 0xccbaea3
sub ecx, dword [ebx + 0x12269925]
push eax
das
imul edx, dword [edi + 0x67], 0x1b60f0da
fcmovb st(0), st(1)
invalid
invalid

Function at 0x104cc40e
Capabilities:
Encode data using base64

Disassembly:
rol eax, 2
xchg dh, dl
neg eax
shr edx, cl
lea eax, [eax + edx + 0x7844a6a]
neg dx
mov dword [esp + ecx - 5], edx
ror eax, 3
push ecx
xor ebx, eax
shr edx, cl
neg cx
add edi, eax
pop edx
pop edx
jmp fcn.10511f38

Function at 0x104ce4dd
Capabilities:
Encode data using base64

Disassembly:
push eax
dec edx
jmp 0x104fa83c
pop ecx
add eax, 0x18b73a7
jmp 0x1051003c
movsx ecx, dl
call fcn.10477c8a
xor edx, ebx
mov eax, ecx
jmp 0x10477822
call fcn.104bb36b
shr edx, 0xb1
rol eax, 1
jmp 0x104cea7c

Function at 0x104d0592
Capabilities:
Encode data using base64

Disassembly:
jnp 0x104d8fc6
not ecx
push edx
and eax, ecx
mov dword [edi + edx*2 - 0x30d900e4], eax
call fcn.104554d0

Function at 0x104dc2fa
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ecx + esi - 0x2b368404]
sar ax, 0x41
movzx edx, word [esp + ecx - 0x2b368400]
setp al
mov ecx, dword [esi + ecx*2 - 0x566d0800]
sar ax, 0xcc
sbb byte [esp + edx - 0x7fb6], 0x1f
call fcn.1047e9e2
mov dword [esp], eax
lea ecx, [eax*2 + 0x2e03ce35]
mov word [edi], dx
sal ecx, 0xea
jns 0x10439d40
Function at 0x104eb11a
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax*8 - 0x4a4f04c7]
or eax, edx
dec ecx
xor ebx, ecx
ror word [esp], 0x81
sar dword [esp], 0x3c
add ebp, ecx
xadd dword [esp], eax
call fcn.104c8382
mov edx, 0xefb35e89
sub esi, 4
mov edx, dword [esi]
xor edx, ebx
mov ecx, 0xc1891daf
movzx eax, cx
bswap edx
xor ecx, ecx
lea edx, [edx + ecx*2 + 0x1d3913b9]
jl 0x10408f55
not edx
adc edx, 0xec8f3a80
push eax
not dword [esp + ecx]
pop eax
xor edx, 0xb097fe21
neg ecx
not edx
and eax, 0xcd10b329
inc edx
neg al
sar eax, 0x7e
xor ebx, edx
shl eax, 0x92
add edi, edx
xor ax, cx
adc ecx, ebp
sub ebp, 4
mov dword [ebp], ecx
jmp fcn.10511f38
and ax, cx
mov edx, dword [esi]
adc esi, 4
add al, cl
ror ecx, 0xd6
xor edx, ebx
inc edx
xchg ecx, eax
jmp 0x104e5cda
not edx
inc cl
rol cl, 0x83
rol ecx, 5
dec edx
sar ecx, cl
lea ecx, [ecx + 0x679c2bb1]
sub ecx, eax
xor edx, 0x9e08399f
not eax
rol al, 0x62
xor ebx, edx
neg ecx
call fcn.10508758
mov dword [esi + edx*2 - 0x5913be00], ecx
mov dword [esp + edx - 0x2c89df00], edi
ret 4
neg cl
mov word [eax + edi - 0x23], dx
pop ecx
pop eax
jno fcn.1045b2b6
mov eax, 0x2c28b5be
mov ecx, dword [esi + eax*2 - 0x58516b7c]
lea edx, [eax - 0x7ec83c6]
push edx
xor eax, eax
lea esi, [esi + eax + 4]
jbe 0x104f088e
movzx dx, byte [edi]
mov eax, 0x5b27008c
lea ecx, [eax + eax*2 - 0x77c4b55]
mov cl, byte [ecx + edi - 0x9f8b64d]
lea edi, [edi + eax - 0x5b27008a]
lea eax, [eax + eax*8 + 0x7f3204bf]
shl eax, 0x9b
dec eax
and dl, cl
lea ecx, [eax*8 + 0x1f031a21]
xchg ecx, eax
xor dl, cl
ror cl, 0xa2
shl ecx, cl
mov word [edi + ecx - 0x80000000], dx
sar ecx, 0x1d
ja 0x104734c9
xor ecx, ebx
sal edx, 0x8b
setp dl
neg dword [esp + eax]
rol ecx, 2
inc ecx
lea eax, [edx + eax*4 - 0x1b6b70f6]
dec al
or edx, eax
ror ecx, 3
jmp 0x104538e6

Function at 0x104f0e2e
Capabilities:
Encode data using base64

Disassembly:
add edi, ecx
xor dx, word [ebp + edx]
mov cx, word [ebp + 2]
push eax
add ebp, 2
xchg word [esp], ax
call fcn.104cef34
add edi, ecx
mov ebp, dword [ebp]
inc ax
lea ecx, [eax*2 - 0x3259fd73]
pop edx
jno fcn.10511f38
mov ecx, 0xf2aa86b5
mov edx, dword [edi]
mov eax, ecx
rol ecx, cl
adc edi, 4
sub ecx, ecx
and ecx, eax
xadd al, ah
xor edx, ebx
shl ax, 0x86
neg edx
sar eax, 0xf4
lea edx, [edx + ecx*8 - 0x25286d04]
ror eax, 0xf6
rol cl, 0x65
shl ax, 0xea
ror edx, 1
neg al
shr al, 7
not edx
ror eax, 0x6d
je 0x105005ca
mov edx, 0x6facb399
mov edx, dword [ebp + edx - 0x6facb399]
mov ecx, 0x3b1afa82
push ecx
mov eax, dword [ebp + ecx*2 - 0x7635f500]
and byte [esp + ecx*2 - 0x7635f502], ch
mov ecx, dword [ebp + ecx*2 - 0x7635f4fc]
call fcn.103ded40
xor edx, ebx
dec edx
neg edx
pop ecx
inc edx
jmp 0x104f4e28
not edx
pop ecx
xor ebx, edx
sal ecx, 0x52
add ebp, edx
movsx eax, cx
mov edx, ecx
jmp fcn.1048f00f
xor edx, 0x61a58e16
neg ax
call fcn.104f305d
dec eax
inc ecx
not eax
inc eax
neg eax
xor ebx, eax
shr edx, 0xec
adc edi, eax
neg cx
sbb cl, ch
lea eax, [edx*8 - 0x95051c9]
mov edx, dword [ebp + edx*2 - 0x27024]
sbb cl, ch

Function at 0x104f4b4e
Capabilities:
Encode data using base64

Disassembly:
adc edi, edx
bswap eax
shl ecx, 0xf6
pop ecx
pop ecx
pop edx
pop ecx
pop ecx
ja fcn.10511f38
Function at 0x104fa841
Capabilities:
Encode data using base64

Disassembly:
xadd byte [esp + eax + 1], ah
rol al, cl
pop eax
jbe fcn.1045b2b6
xor ecx, eax
xor dx, 0xb499
mov dword [esp + eax], eax
sar ecx, 0xc1
xor bx, dx
lea edi, [edi + eax*4 - 2]
inc ecx
mov word [edi + eax], dx
js 0x1049ae15

Function at 0x104fd938
Capabilities:
Encode data using base64

Disassembly:
rol dl, 1
sar ax, 0xa9
sar eax, 0x70
dec eax
xor dl, al
add dl, 0x93
call fcn.10421fcb
lea ecx, [ecx + edx - 0x2a08ae22]
lea eax, [edx*2 + 0x77183e31]
or dword [esp + edx*4 - 0x30ffe], 0x4004788b
call fcn.1049a0c5
xchg dword [esp + edx*2 - 0x14eee], edx
neg ecx
ror dword [esp + edx - 0xc3fc], 3
add byte [esp + edx*2 - 0x18800], 0x12
bswap ecx
rol eax, 0xbb
js 0x1040c45e
rol eax, 1
mov dword [esp], 0x63296dac
xor ebx, eax
xchg word [esp + 6], cx
shl edx, cl
add edi, eax
inc ecx
pop eax
pop eax
jle fcn.10511f38
jnp 0x104f51a7
movzx edx, byte [edx + esi - 0xc500000]
ror ax, 0x64
dec eax
xor dl, bl
sub eax, eax
jp 0x103e77dc

Function at 0x10511cdf
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ebp]
call fcn.1051bd92

Function at 0x10511f8c
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + ecx*4 - 0x5eba9efb]
inc cx
shl edx, cl
bswap eax
xadd ecx, edx
not eax
jge 0x105091d6
add ebp, 2
not ecx
sal ecx, 0x62
or al, dl
not al
xor cx, 0xd720
or cl, cl
js 0x105150bd
bswap eax
neg dl
setge dl
ror eax, 1
sar byte [esp + edx - 0x6fe], 0xa3
lea eax, [eax + edx - 0x38a93111]
xor ebx, eax
dec edx
push edx
call fcn.10400b94
mov eax, 0xd024cd1c
mov ecx, 0x6d038b80
shr ecx, 0xa1
mov eax, dword [esi + ecx - 0x3681c5c0]
neg ecx
lea edx, [ecx + ecx*2 + 0xd94a236]
call fcn.104181ee
or cl, dh
inc ecx
rol eax, 1
push edx
jmp 0x1046f8d5
inc dl
xor dl, 0x8f
xadd dword [esp + ecx*4 - 0x4c28cf8c], ecx
rol dword [esp + ecx - 0x3f17ceb1], 0xb7
adc dword [esp + ecx*2 - 0x7e2f9d66], 0xb08ebf90
neg dl
mov byte [esp + ecx - 0x3f17ceaf], 0xb5
mov dword [esp + ecx - 0x3f17ceb5], ecx
sub dl, 0xb2
sub cx, word [esp + ecx - 0x3f17ceb4]
jne 0x10424969
mov edx, 0x3fb30cab
mov ecx, edx
mov eax, dword [edx + edi - 0x3fb30cab]
lea edi, [edi + ecx - 0x3fb30ca7]
xadd edx, ecx
shr ecx, 0x93
and dx, dx
xor eax, ebx
inc cx
lea edx, [edx*4 - 0x2b550f48]
jnp 0x104057e8
movzx ax, byte [ebp]
mov edx, 0xcb062292
mov ecx, edx
mov dl, byte [ebp + 2]
jmp 0x10405838
mov word [ebp], ax
call fcn.104e6df7
call fcn.1045ac56

Function at 0x10518d33
Capabilities:
Encode data using base64

Disassembly:
cmp edi, ecx
mov dword [esp], 0x5204ee2a
call fcn.1051d8ff
mov edx, dword [edi]
add edi, 4
mov eax, 0xd9911db4
xor edx, ebx
call fcn.10497680
bswap eax
call fcn.104ce4dd
rol ecx, 1
push edx
bswap ecx
and al, dh
not ecx
xor eax, eax
xor ebx, ecx
pop edx
add ebp, ecx
movzx dx, byte [edx + edi - 0x298820bc]
mov cl, byte [edi + 2]
call fcn.103dd2a9

Function at 0x105218d7
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
call fcn.104a9f31
xor dx, dx
mov eax, edx
ror ecx, 2
dec ecx
bswap ecx
or edx, edx
lea edx, [edx*4 - 0x4efe6970]
shl dl, 0x23
rol ecx, 1
bswap ecx
xor ecx, 0xb18a5f93
xor ax, ax
jae 0x104a0d58
call fcn.10470939
Function at 0x10525e06
Capabilities:
Encode data using xor

Disassembly:
xchg dh, dl
mov edx, dword [edi]
mov ecx, 0x130a499e
movsx eax, cl
lea edi, [edi + ecx - 0x130a499a]
ror cx, 0xcb
call fcn.1043cdba
cmp esi, ecx
lea esp, [esp + 4]
ja 0x104b999e
mov ecx, 0x6137c90c
dec ecx
mov edx, esp
movzx eax, cl
xadd ecx, eax
lea ecx, [ecx - 0x6137c8c6]
not al
call fcn.1053356d
mov edx, 0xe42e2838
jmp 0x104c834a

Function at 0x10527432
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + ecx*2 + 0x26ef8753]
neg eax
inc cl
call fcn.1049654e
call fcn.104616e6
mov ecx, 0x631ab180
and ecx, ecx
sar cl, 0xe2
mov edx, dword [esi + ecx - 0x631ab1e0]
and ecx, ecx
lea esi, [esi + ecx - 0x631ab1dc]
movzx eax, cx
xor edx, ebx
lea edx, [ecx + edx - 0xe07d154]
not al
rol al, 0xc1
bswap edx
jno 0x10418f70

Function at 0x105276dc
Capabilities:
Encode data using base64

Disassembly:
pushfd
add dword [esp + 4], 0xeffcbbb7
mov dword [esp + 4], 0x829294b
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1047e703

Function at 0x1052d2cf
Capabilities:
Encode data using base64

Disassembly:
xchg dword [esp + ecx - 0xf28d5f3], eax
lea ebp, [ebp + ecx*2 - 0x1e51abec]
movzx ecx, byte [esi + ecx - 0xf28d5f7]
lea esi, [esi + eax - 0x70f28d5e]
inc byte [esp + eax - 0x70f28d5b]
and ax, ax
rol ax, 9
xor cl, bl
inc cl
shr al, 0xe4
not eax
rol ax, 0x47
rol cl, 1
or eax, eax
inc dword [esp + 4]
neg cl
dec cl
xor bl, cl
sub dword [esp], eax
lea ecx, [esp + ecx + 8]
mov byte [ecx], dl
pop ecx
pop ecx
jmp edi
add al, 0x66
mov edx, dword [ebp + eax - 0x638112bf]
jb 0x104cb332
mov dword [esp + edi - 0x131666a3], esi
movsx esi, di
call fcn.1051501f
outsd dx, dword [esi]
sar dword [esp + esi*4], cl
pop es
fiadd word [ebx]
loopne 0x1052d2a7
mov ch, 0x89
sbb byte [edi], bh
js 0x1052d298
inc eax
ljmp 0xc0f4

Function at 0x1052e6f5
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [edi + eax*8]
or cl, 0x3a
lea edi, [eax + edi + 2]
bswap ecx
lea esi, [esi + eax*2 - 1]
push eax
mov dword [esp + ecx - 0x7a9602ad], ecx
sar eax, 0xb9
movzx ecx, byte [esi + eax*8]
call fcn.10424d19
Function at 0x10003170
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x1003b010]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x10003212
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10003260
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x10003221
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.10003260
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
pop esi
xor ecx, esp
call fcn.10033b17
mov esp, ebp
pop ebp
ret
Function at 0x10015080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [0x1003b028], 0
push esi
mov esi, ecx
je 0x100150f5
mov cl, 0x5d
mov dword [esp + 8], 0x3272735d
mov dword [esp + 0xc], 0x3c293833
xor eax, eax
mov dword [esp + 0x10], 0x3b3e732d
mov word [esp + 0x14], 0x3a
mov byte [esp + 0x16], 0
nop dword [eax]
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0xc
jae 0x100150d0
mov cl, byte [esp + 8]
jmp 0x100150c0
lea eax, [esp + 9]
mov word [esp + 0x15], 0x100
push eax
mov eax, dword [0x100449a4]
mov ecx, 0x100449a4
push 0x100364c8
call dword [eax + 8]
mov byte [0x1003b028], 0
mov al, byte [0x1003b068]
mov ecx, 0x1003b030
mov byte [0x10044dac], al
mov al, byte [0x10044d7c]
mov byte [esp + 4], al
mov al, byte [0x10044d7d]
mov byte [esp + 5], al
mov al, byte [0x10044d7e]
mov byte [esp + 6], al
mov byte [esp + 7], 0xff
push dword [esp + 4]
push esi
call fcn.1000a3e0
test al, al
je 0x100151d3
mov eax, dword [0x1003b064]
cmp eax, 3
ja case.default.0x10015140
jmp dword [eax*4 + 0x100151d8]
mov ecx, esi
call fcn.1000e430
jmp case.default.0x10015140
mov ecx, esi
call fcn.1000ff20
jmp case.default.0x10015140
mov ecx, esi
call fcn.100122c0
jmp case.default.0x10015140
mov ecx, esi
call fcn.10014800
movss xmm1, dword [0x10044828]
lea ecx, [esp + 4]
addss xmm1, dword [0x100375ec]
mov eax, dword [0x100448d8]
xorps xmm0, xmm0
mov dword [0x10044820], eax
mov eax, dword [0x100448dc]
mov dword [0x10044824], eax
lea eax, [esp + 0x18]
comiss xmm0, xmm1
mov dword [esp + 0x1c], 0x3f800000
mov dword [esp + 4], 0
movss dword [esp + 0x18], xmm1
cmovbe ecx, eax
lea eax, [esp + 0x1c]
comiss xmm1, dword [0x10037608]
cmovbe eax, ecx
movss xmm0, dword [eax]
movss dword [0x10044828], xmm0
call fcn.100095a0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10015ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
push 0x40
sub esi, ebx
mov dword [ebp - 8], 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
test esi, esi
je 0x10016046
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x90
idiv ecx
movzx eax, dl
shl dx, 8
or dx, ax
mov byte [ebx + edi], dl
inc edi
cmp edi, esi
jb 0x10016026
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033b17
mov esp, ebp
pop ebp
ret 8
Function at 0x1002b110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1002b138
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x1002b0a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1002dd50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, esi
push edi
mov edi, ecx
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x1002dd60
sub edx, ecx
mov ecx, 0x811c9dc5
add edx, 1
je 0x1002dd86
movsx eax, byte [esi]
lea esi, [esi + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub edx, 1
jne 0x1002dd73
mov eax, edi
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x10030dd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10030e01
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100307b0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10030f0c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10030e91
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10030f02
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10030ecb
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10030ec3
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x10030eff
cmp edi, edx
je 0x10030edc
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10030f15
cmp edi, edx
jne 0x10030ed0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x10030e40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10030eff
Function at 0x100336e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003b010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0xc], eax
push edi
mov edi, dword [ebp + 0x10]
lea esi, [esi*2 + 1]
mov dword [ebp - 8], edx
mov eax, esi
call fcn.10034dd0
mov dword [ebp - 0x10], esp
push edi
mov edi, dword [ebp - 0x10]
push esi
push edi
push 0x100364c8
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [edi], 0
jne 0x10033758
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10033784
push eax
push 0
push dword [ebp - 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10033b17
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
je 0x10033784
lea eax, [ebp - 8]
push eax
push str._02X
push edi
call fcn.10033630
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov al, byte [ebp - 8]
add edi, 2
mov byte [ecx + esi], al
inc esi
cmp esi, ebx
jb 0x10033761
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10033b17
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret