joyce8/EMBER2024-capa huggingface dataset:
Function at 0xedfd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xedfd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xedfd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xedfd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xedfd94
push eax
push esi
call fcn.00ee220b
add esp, 8
pop esi
ret 0x10

Function at 0xedfda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xedfe22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xedfe15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xef8320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ee1dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xedfdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xedfe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xedfec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xedfeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xef8320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ee1dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xedfeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xedfe6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xee0000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xee0131
push esi
call fcn.00ee3145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00ed2080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xee0131
push 0
push ebp
call fcn.00ed23a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00ed2260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xee008b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00ed22f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xee0121
push 0xef8918
push edi
call fcn.00ee13f0
push eax
push ebx
push esi
call fcn.00edff60
push 0xef88f8
push edi
call fcn.00ee13f0
push eax
push ebx
push esi
call fcn.00edff60
push 0xef88d8
push edi
call fcn.00ee13f0
push eax
push ebx
push esi
call fcn.00edff60
push 0xef88c0
push edi
call fcn.00ee13f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00edff60
push 0xef88a0
push edi
call fcn.00ee13f0
push eax
push ebx
push esi
call fcn.00edff60
push 0xef8888
push edi
call fcn.00ee13f0
push eax
push ebx
push esi
call fcn.00edff60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xee11b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00ee1140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00ee1140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00ee1140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00ee1140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xee1bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xee1c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xef387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xee1c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xee1c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x43fe7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x43fe8e
pop dword [ebp - 0x28]
mov eax, 0x99a570b5
sub eax, 0x99617227
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x501cd
push 0
mov eax, 0x98729e9e
add eax, 0x67d21412
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x72ecdfc9
sub ecx, 0x72ec97bf
mov edx, eax
mov edi, 0x226ee285
sub edi, 0x22265485
add edi, dword [ebp - 0x28]
mov esi, 0xf86ac120
add esi, 0xe1b1b1c7
add dword [ebp - 0x20], 0x237aefee
mov ebx, dword [edi]
mov dword [ebp - 0x10], 0xfacda50
add ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x24], 0x4e88ed53
add edx, 4
add edi, 4
loop 0x43feed
add eax, 0xb9d084ec
add eax, 0x46308e0f
mov ebx, eax
add eax, 5
mov ecx, 0x1764862f
sub ecx, 0x1724862f
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x10001a1a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
faddp st(6)
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1000169b
push eax
push esi
push dword [ebp + 8]
call fcn.10001650
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax

Function at 0x10001d07
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10001d3f
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10001d3a
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
add byte [eax], al
add byte [eax], al
cmp edx, 0x3000
jne 0x10001d24
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10001d2c
cmp edx, ebx
jne 0x10001e7a
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10001cfb
add eax, dword [eax + 4]
jmp 0x10001ce8
mov dword [ebp + 0xc], ebx
jmp 0x10001d4a

Function at 0x10001ef3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
invalid
invalid
invalid
cld
Function at 0x1000ef90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi + 0x78]
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov ecx, dword [eax]
add edx, 0x400
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.1000ed30
mov eax, dword [esi + 0x24]
mov ebp, dword [esi + 0x20]
mov edi, 0x100000
add ebp, eax
sub edi, eax
mov al, byte [esi + 0x43]
cmp al, bl
je 0x1000f009
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
sub eax, ecx
mov ecx, dword [esi + 0x4c]
sbb ecx, edx
xor edx, edx
cmp edx, ecx
jb 0x1000f009
ja 0x1000f003
cmp edi, eax
jb 0x1000f009
cmp eax, ebx
mov edi, eax
je 0x1000f04b
push edi
push ebp
lea ecx, [esp + 0x18]
call fcn.1000ed80
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x24]
sub eax, ebp
add ecx, eax
mov dword [esi + 0x50], ecx
mov ebp, dword [esi + 0x54]
adc ebp, ebx
add edx, eax
cmp eax, edi
mov dword [esi + 0x54], ebp
mov dword [esi + 0x24], edx
jb 0x1000f03d
mov ecx, esi
call fcn.1000ef50
cmp eax, ebx
jne 0x1000f06e
cmp dword [esp + 0x18], ebx
jg 0x1000efd1
cmp dword [esp + 0x20], ebx
je 0x1000f05f
jmp 0x1000efd1
mov cl, byte [esi + 0x42]
xor eax, eax
pop edi
cmp cl, bl
pop esi
pop ebp
setne al
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esp + 0x1c]
mov byte [esi + 0x40], 1
not eax
mov dword [esi + 0x3c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x1000ef99
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi + 0x78]
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov ecx, dword [eax]
add edx, 0x400
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.1000ed30
mov eax, dword [esi + 0x24]
mov ebp, dword [esi + 0x20]
mov edi, 0x100000
add ebp, eax
sub edi, eax
mov al, byte [esi + 0x43]
cmp al, bl
je 0x1000f009
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
sub eax, ecx
mov ecx, dword [esi + 0x4c]
sbb ecx, edx
xor edx, edx
cmp edx, ecx
jb 0x1000f009
ja 0x1000f003
cmp edi, eax
jb 0x1000f009
cmp eax, ebx
mov edi, eax
je 0x1000f04b
push edi
push ebp
lea ecx, [esp + 0x18]
call fcn.1000ed80
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x24]
sub eax, ebp
add ecx, eax
mov dword [esi + 0x50], ecx
mov ebp, dword [esi + 0x54]
adc ebp, ebx
add edx, eax
cmp eax, edi
mov dword [esi + 0x54], ebp
mov dword [esi + 0x24], edx
jb 0x1000f03d
mov ecx, esi
call fcn.1000ef50
cmp eax, ebx
jne 0x1000f06e
cmp dword [esp + 0x18], ebx
jg 0x1000efd1
cmp dword [esp + 0x20], ebx
je 0x1000f05f
jmp 0x1000efd1
mov cl, byte [esi + 0x42]
xor eax, eax
pop edi
cmp cl, bl
pop esi
pop ebp
setne al
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esp + 0x1c]
mov byte [esi + 0x40], 1
not eax
mov dword [esi + 0x3c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x1001ab32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x1001ab9b
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x1001abdc
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x1001abc1
mov ecx, ebx
call fcn.1001a820
add ebx, 0x28
dec ebp
jne 0x1001abb5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x1001abd7
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.1001a750
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.1001ac80
mov ebx, eax
cmp ebx, edi
jne 0x1001ac3f
lea ecx, [ebp + 0x20]
call fcn.1001d9c0
mov ebx, eax
cmp ebx, edi
jne 0x1001ac3f
lea ecx, [ebp + 0x1c]
call fcn.1001d9c0
mov ebx, eax
cmp ebx, edi
jne 0x1001ac3f
push ebp
call fcn.1001acd0
mov ebx, eax
cmp ebx, edi
je 0x1001ac54
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.1001acb0
cmp ebx, edi
jle 0x1001ac4f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x1001ac54
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x1001ac66
cmp dword [esi + 0x40], edi
jne 0x1001ac66
cmp dword [esi + 0x3c], edi
jne 0x1001ac66
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x1001ccb0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret

Function at 0x1001d880
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
xor ebx, ebx
mov ebp, edx
cmp edi, 0x38
je 0x1001d8b5
jmp 0x1001d8a0
and edi, 0x3f
jne 0x1001d8ab
push esi
call fcn.1001ccf0
mov byte [esi + edi + 0x28], bl
inc edi
cmp edi, 0x38
jne 0x1001d8a0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.1001ccf0
xor eax, eax
mov ecx, dword [esi + eax*4 + 4]
mov edx, dword [esi + eax*4]
bswap edx
bswap ecx
mov dword [ebp], edx
mov dword [ebp + 4], ecx
add eax, 2
add ebp, 8
cmp eax, 8
jb 0x1001d8d7
pop edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0x1001d980
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x1001d9a9
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001d9b8
mov eax, 1
ret 4
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.1003cb4f
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.1003cb4f
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.1003cb4f
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x1003cb4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1003cb5e
pop dword [ebp - 0x10]
mov eax, 0x48c14e1f
add eax, 0xc7427d3f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x692c8e5c
sub dword [ebp - 0x20], 0x1ada4911
mov dword [ebp - 0x1c], 0x1e9297b1
add dword [ebp - 0x1c], 0x13a0b494
mov dword [ebp - 0x18], 0xebb920ac
sub dword [ebp - 0x18], 0x9f6cdc7e
mov dword [ebp - 0x14], 0x1a506fe1
sub dword [ebp - 0x14], 0x1a506fe1
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xd33eb250
add dword [ebp - 0x20], 0xa133b706
mov dword [ebp - 0x1c], 0x5f80b297
sub dword [ebp - 0x1c], 0x1e145122
mov dword [ebp - 0x18], 0x6ffbb7a6
sub dword [ebp - 0x18], 0xc8c4b3a
mov dword [ebp - 0x14], 0xed4f5c26
add dword [ebp - 0x14], 0x12b0a3da
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xab00859e
add eax, 0x650448e6
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3eb87
push 0
call eax
mov ecx, 0x43b4
mov edi, eax
mov esi, 0xb3218c28
sub esi, 0xa31bd828
add esi, dword [ebp - 0x10]
mov ebx, 0x7969e0af
sub dword [ebp - 8], ebx
mov edx, dword [esi]
xor dword [ebp - 0xc], edi
xor edx, ebx
xor dword [ebp - 0xc], 0xe7a81cdc
mov dword [edi], edx
sub dword [ebp - 4], ecx
add edi, 0xf96fe9c3
add edi, 0x6901641
add esi, 0x31f84aeb
add esi, 0xce07b519
loop 0x1003cc6f
add eax, 0x101a3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9d30ee48
add ecx, 0x72cf11b8
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4046f4
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x404736
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x404756
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00409754
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4049ac
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00408a5c
test esi, esi
jne 0x4049e2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00408be4
jmp 0x404a00
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404890
mov edi, eax
test esi, esi
je 0x404a00
cmp dword [ebx], 0
je 0x404a00
dec esi
jmp 0x4049e9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4053f4
Capabilities:
Read file on windows

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x40540a
sub ecx, 2
jne 0x40542c
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x405433
cmp edx, dword [ebx + 8]
je 0x40543d
mov eax, 0x64
jmp 0x405438
mov eax, 0x67
jmp 0x405438
call sub.kernel32.dll_GetLastError
call fcn.004046d8
pop ebx
ret