joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f552
Capabilities:
Hash data using sha256

Disassembly:
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea edx, [eax + ecx]
cmp edx, ecx
push ebx
push edi
lea edi, [esi + 0x50]
mov dword [esi + 4], edx
jae 0x1003f569
inc dword [esi + 8]
mov ebx, 0x80
mov byte [eax + edi], bl
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x70
jbe 0x1003f5a3
mov ecx, ebx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
mov eax, ebx
mov edx, edi
mov dword [esi], ebx
call fcn.1003d334
pop ecx
push esi
call fcn.1003d418
and dword [esi], 0
pop ecx
mov eax, dword [esi]
push 0x70
pop ecx
sub ecx, eax
push ecx
xor ebx, ebx
add eax, edi
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
add esp, 0xc
mov ecx, eax
shl eax, 3
push edi
shr ecx, 0x1d
lea ecx, [ecx + edx*8]
mov dword [esi + 4], eax
push 0x70
pop eax
mov edx, edi
mov dword [esi + 8], ecx
call fcn.1003d334
mov eax, dword [esi + 8]
pop ecx
mov dword [esi + 0xc0], eax
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], ebx
call fcn.1003d418
pop ecx
lea edi, [esi + 0x10]
push edi
push 0x40
pop eax
mov edx, edi
call fcn.1003d334
pop ecx
push 0x40
push edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop ebx
jmp fcn.1003d39d

Function at 0x1003f628
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1003f64d
push 0xffffffffffffff99
pop edi
jmp 0x1003f68f
lea eax, [ebp - 0x20]
push eax
push 0x20
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1003f663
push 0xffffffffffffff98
jmp 0x1003f64a
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [ebp - 0x20]
push 0x20
push eax
lea eax, [esi + 4]
call fcn.1003a6bc
push 0x100
lea eax, [ebp - 0x120]
push eax
push esi
call fcn.1003f694
add esp, 0x14
mov eax, edi
pop edi
leave
ret
Function at 0x1003f6bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea edx, [eax + 0x20]
mov esi, edx
push 8
pop ebx
mov ecx, ebx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x40]
mov esi, 0x4d34d34d
add ecx, esi
add dword [edx], ecx
mov edx, dword [edx]
cmp edx, dword [ebp - 0x2c]
mov ecx, 0x2cb2cb2d
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x24], edx
mov edx, dword [eax + 0x24]
cmp edx, dword [ebp - 0x28]
mov edx, 0x34d34d34
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x28], edi
mov edi, dword [eax + 0x28]
cmp edi, dword [ebp - 0x24]
mov dword [ebp - 0xc], ebx
sbb edi, edi
neg edi
add edi, esi
add dword [eax + 0x2c], edi
mov edi, dword [eax + 0x2c]
cmp edi, dword [ebp - 0x20]
sbb edi, edi
neg edi
sub edi, ecx
add dword [eax + 0x30], edi
mov edi, dword [eax + 0x30]
cmp edi, dword [ebp - 0x1c]
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x34], edi
mov edx, dword [eax + 0x34]
cmp edx, dword [ebp - 0x18]
sbb edx, edx
neg edx
add edx, esi
add dword [eax + 0x38], edx
mov edx, dword [eax + 0x38]
cmp edx, dword [ebp - 0x14]
mov esi, eax
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x3c], edx
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [ebp - 0x10]
mov dword [ebp - 8], esi
sbb ecx, ecx
neg ecx
mov dword [eax + 0x40], ecx
lea ecx, [ebp - 0x2c]
sub ecx, eax
mov edx, dword [esi + 0x20]
add edx, dword [esi]
movzx edi, dx
mov esi, edx
shr esi, 0x10
mov dword [ebp - 4], esi
imul esi, edi
mov ebx, edi
imul ebx, edi
shr ebx, 0x11
add ebx, esi
mov esi, dword [ebp - 4]
imul esi, esi
shr ebx, 0xf
add ebx, esi
mov esi, edx
imul esi, edx
xor ebx, esi
mov esi, dword [ebp - 8]
mov dword [ecx + esi], ebx
add esi, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], esi
jne 0x1003f76d
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x10]
mov esi, ecx
rol esi, 0x10
add esi, edx
rol edi, 0x10
add edi, esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x28]
mov dword [eax], edi
add esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x28]
rol edi, 0x10
mov dword [eax + 4], esi
mov esi, dword [ebp - 0x24]
add edi, esi
rol edx, 0x10
add edx, edi
mov edi, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov edx, esi
rol edx, 8
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x28]
rol edi, 0x10
rol esi, 0x10
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x1c]
add edi, edx
add esi, edi
mov dword [eax + 0x10], esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x18]
pop edi
add esi, dword [ebp - 0x20]
mov dword [eax + 0x14], esi
mov esi, dword [ebp - 0x18]
rol esi, 0x10
add esi, ecx
rol edx, 0x10
add edx, esi
rol ecx, 8
add ecx, dword [ebp - 0x18]
pop esi
add ecx, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
pop ebx
leave
ret
Function at 0x1003f8bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
shl eax, 0x10
mov ebx, edi
shr ebx, 0x10
or eax, ebx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
mov ebx, ecx
shl ebx, 0x10
or eax, ebx
mov dword [esi + 0xc], eax
mov eax, edx
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
or eax, ebx
mov dword [esi + 0x14], eax
mov ebx, edx
shr ebx, 0x10
mov eax, edi
shl eax, 0x10
or eax, ebx
mov dword [esi + 0x1c], eax
mov eax, edi
rol eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
rol eax, 0x10
mov dword [esi + 0x28], eax
mov eax, ecx
rol eax, 0x10
mov ebx, edx
mov dword [esi + 0x30], eax
mov eax, edx
xor ebx, ecx
rol eax, 0x10
mov dword [esi + 0x38], eax
mov eax, 0xffff
and ebx, eax
xor ebx, ecx
mov dword [esi + 0x24], ebx
mov dword [esi + 8], edx
mov ebx, edi
xor ebx, edx
and ebx, eax
xor ebx, edx
mov edx, dword [ebp - 4]
xor edx, edi
and edx, eax
xor edx, edi
mov dword [esi + 0x34], edx
mov edx, dword [ebp - 4]
xor edx, ecx
and edx, eax
xor edx, dword [ebp - 4]
and dword [esi + 0x40], 0
push 4
mov dword [esi + 0x10], edi
mov dword [esi], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], edx
pop edi
mov eax, esi
call fcn.1003f6bd
dec edi
jne 0x1003f973
pop edi
xor ecx, ecx
lea eax, [esi + 0x20]
pop ebx
lea edx, [ecx - 4]
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jb 0x1003f984
push 8
lea eax, [esi + 0x20]
pop ecx
mov edx, dword [eax - 0x20]
mov dword [eax + 0x24], edx
mov edx, dword [eax]
mov dword [eax + 0x44], edx
add eax, 4
dec ecx
jne 0x1003f99e
mov eax, dword [esi + 0x40]
mov dword [esi + 0x84], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1003f9c6
mov edx, esi
call fcn.1003f835
leave
ret
Function at 0x1003f9c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x10
push ebx
push esi
push edi
mov ebx, eax
mov esi, ecx
jb 0x1003fa52
mov ecx, dword [ebp + 0xc]
shr ecx, 4
lea eax, [esi + 0x44]
mov dword [ebp - 4], ecx
call fcn.1003f6bd
movzx edx, word [esi + 0x5a]
mov ecx, dword [esi + 0x50]
shl ecx, 0x10
xor edx, ecx
xor edx, dword [eax]
mov ecx, dword [ebp + 8]
xor edx, dword [ebx]
sub dword [ebp + 0xc], 0x10
mov dword [ecx], edx
movzx edx, word [esi + 0x62]
mov edi, dword [esi + 0x58]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx + 4]
add ecx, 0x10
xor edx, dword [esi + 0x4c]
add ebx, 0x10
mov dword [ecx - 0xc], edx
movzx edx, word [esi + 0x4a]
mov edi, dword [esi + 0x60]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 8]
mov dword [ebp + 8], ecx
xor edx, dword [esi + 0x54]
mov dword [ecx - 8], edx
movzx edx, word [esi + 0x52]
mov edi, dword [esi + 0x48]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 4]
xor edx, dword [esi + 0x5c]
dec dword [ebp - 4]
mov dword [ecx - 4], edx
jne 0x1003f9e7
cmp dword [ebp + 0xc], 0
je 0x1003fad1
lea eax, [esi + 0x44]
call fcn.1003f6bd
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
mov edi, ecx
mov eax, edx
shl eax, 0x10
shr edi, 0x10
xor eax, edi
xor eax, dword [esi + 0x44]
mov edi, dword [esi + 0x60]
mov dword [ebp - 0x14], eax
shl ecx, 0x10
mov eax, edi
shr eax, 0x10
xor eax, ecx
xor eax, dword [esi + 0x4c]
shl edi, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x48]
mov ecx, eax
shr ecx, 0x10
xor ecx, edi
xor ecx, dword [esi + 0x54]
shl eax, 0x10
shr edx, 0x10
xor eax, edx
xor eax, dword [esi + 0x5c]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
jbe 0x1003fad1
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov esi, ebx
sub esi, eax
sub edi, eax
lea eax, [ebp + ecx - 0x14]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov byte [edi + eax], dl
jb 0x1003fabf
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10043036
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005aae0]
jne 0x10043040
repz ret
jmp fcn.1004327e
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x63e414ac
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x451d7671
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001520
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov eax, dword [0x1006b0dc]
xor eax, esp
mov dword [esp + 4], eax
cmp dword [0x1006bb00], 0
je 0x1000157f
cmp dword [0x1006bb0c], 0
jne 0x1000157f
push 0
push 0x10064ea1
push 0x10065177
push 0x3f5000
push dword [0x1006bda8]
call fcn.100383c0
add esp, 0x14
mov dword [0x1006bb0c], eax
push 6
push 0x10001500
push eax
call fcn.10038430
add esp, 0xc
test al, al
je 0x1000157f
add dword [0x1006bb0c], 6
mov dword [esp], 0
cmp dword [0x1006bb00], 0
je 0x100015e1
cmp dword [0x1006bb10], 0
jne 0x100015e1
push 0
push 0x10064e8f
push 0x100664e5
push 0x3f5000
push dword [0x1006bda8]
call fcn.100383c0
add esp, 0x14
mov dword [0x1006bb10], eax
call fcn.10001470
mov eax, esp
push eax
push 0x40
push 2
push dword [0x1006bb10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.100014b0
mov eax, dword [0x1006bb10]
mov byte [eax], 0x74
cmp byte [0x1006bb14], 0
mov eax, dword [0x1006bb18]
je 0x10001609
test eax, eax
je 0x10001698
cmp byte [0x1006bb1c], 0
jne 0x1000176f
jmp 0x100016ff
test eax, eax
je 0x1000176f
cmp byte [0x1006bb1c], 0
je 0x1000176f
mov byte [0x1006bb1c], 0
call fcn.10001470
mov eax, esp
push eax
push 0x40
push 6
push dword [0x1006bb18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [0x1006bb1d]
mov ecx, dword [0x1006bb18]
mov byte [ecx], al
movzx eax, byte [0x1006bb1e]
mov ecx, dword [0x1006bb18]
mov byte [ecx + 1], al
movzx eax, byte [0x1006bb1f]
mov ecx, dword [0x1006bb18]
mov byte [ecx + 2], al
movzx eax, byte [0x1006bb20]
mov ecx, dword [0x1006bb18]
mov byte [ecx + 3], al
movzx eax, byte [0x1006bb21]
mov ecx, dword [0x1006bb18]
mov byte [ecx + 4], al
movzx eax, byte [0x1006bb22]
jmp 0x1000174c
push 0
push 0x10065223
push 0x100665a0
push 0x3f5000
push dword [0x1006bda8]
call fcn.100383c0
add esp, 0x14
mov dword [0x1006bb18], eax
movzx ecx, byte [eax]
mov byte [0x1006bb1d], cl
movzx ecx, byte [eax + 1]
mov byte [0x1006bb1e], cl
movzx ecx, byte [eax + 2]
mov byte [0x1006bb1f], cl
movzx ecx, byte [eax + 3]
mov byte [0x1006bb20], cl
movzx ecx, byte [eax + 4]
mov byte [0x1006bb21], cl
movzx eax, byte [eax + 5]
mov byte [0x1006bb22], al
cmp byte [0x1006bb1c], 0
jne 0x1000176f
mov byte [0x1006bb1c], 1
call fcn.10001470
mov eax, esp
push eax
push 0x40
push 6
push dword [0x1006bb18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x1006bb18]
mov byte [eax], 0x90
mov eax, dword [0x1006bb18]
mov byte [eax + 1], 0x90
mov eax, dword [0x1006bb18]
mov byte [eax + 2], 0x90
mov eax, dword [0x1006bb18]
mov byte [eax + 3], 0x90
mov eax, dword [0x1006bb18]
mov byte [eax + 4], 0x90
mov al, 0x90
mov ecx, dword [0x1006bb18]
mov byte [ecx + 5], al
mov eax, esp
push eax
push dword [esp + 4]
push 6
push dword [0x1006bb18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.100014b0
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10038f79
add esp, 8
ret
Function at 0x10001ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov eax, dword [0x1006b0dc]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [0x1006bb4c]
test eax, eax
jne 0x10001b29
cmp byte [0x1006bb50], 0
je 0x10001b29
push 0
push 0x10064ea1
push 0x10066542
push 0x3f5000
push dword [0x1006bda8]
call fcn.100383c0
add esp, 0x14
mov eax, dword [eax + 2]
mov dword [0x1006bb4c], eax
call fcn.10001470
mov eax, esp
push eax
push 0x40
push 1
push dword [0x1006bb4c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.100014b0
mov eax, dword [0x1006bb4c]
test eax, eax
je 0x10001b46
xor ecx, ecx
cmp byte [0x1006bb50], 0
sete cl
movsd xmm0, qword [ecx*8 + 0x10058180]
movsd qword [eax], xmm0
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10038f79
add esp, 8
ret
Function at 0x1000a030
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp dword [0x1006bddc], 0
jne 0x1000a15c
movdqa xmm6, xmmword [0x10058490]
mov eax, 0xfffffc00
movdqa xmm1, xmmword [0x100584a0]
movdqa xmm7, xmmword [0x10058500]
nop word cs:[eax + eax]
movdqa xmm2, xmm6
psrld xmm2, 1
movdqa xmm0, xmm6
pslld xmm0, 0x1f
psrad xmm0, 0x1f
pand xmm0, xmm1
pxor xmm0, xmm2
movdqa xmm3, xmm0
psrld xmm3, 1
movdqa xmm2, xmm6
pslld xmm2, 0x1e
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm3
movdqa xmm3, xmm6
pslld xmm3, 0x1d
psrad xmm3, 0x1f
pand xmm3, xmmword [0x100584b0]
movdqa xmm4, xmm6
pslld xmm4, 0x1c
psrad xmm4, 0x1f
pand xmm4, xmmword [0x100584c0]
pxor xmm4, xmm3
movdqa xmm5, xmm6
pslld xmm5, 0x1b
psrad xmm5, 0x1f
pand xmm5, xmmword [0x100584d0]
pxor xmm5, xmm4
movdqa xmm3, xmm6
pslld xmm3, 0x1a
psrad xmm3, 0x1f
pand xmm3, xmmword [0x100584e0]
pxor xmm3, xmm5
movdqa xmm4, xmm2
psrld xmm4, 6
pxor xmm3, xmm4
pslld xmm2, 0x1a
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm3
pslld xmm0, 0x1a
psrad xmm0, 0x1f
pand xmm0, xmmword [0x100584f0]
pxor xmm2, xmm0
movdqu xmmword [eax + 0x1006c1d8], xmm2
paddd xmm6, xmm7
add eax, 0x10
jne 0x1000a070
mov esi, dword [esp + 0x10]
not ecx
test edx, edx
jle 0x1000a177
test dl, 1
jne 0x1000a1c4
mov edi, edx
cmp edx, 1
jne 0x1000a1e3
jmp 0x1000a222
movzx edx, byte [esi]
test dl, dl
je 0x1000a220
add esi, 2
mov ebx, ecx
jmp 0x1000a1ad
movzx edi, dl
mov eax, ebx
shr eax, 8
movzx ebx, bl
xor ebx, edi
xor eax, dword [ebx*4 + 0x1006bdd8]
inc esi
mov dl, dh
mov ebx, eax
test dh, dh
je 0x1000a222
mov dh, byte [esi - 1]
cmp dl, 0x23
jne 0x1000a190
cmp dh, 0x23
jne 0x1000a190
cmp byte [esi], 0x23
cmove ebx, ecx
mov dh, 0x23
jmp 0x1000a190
lea edi, [edx - 1]
mov eax, ecx
shr eax, 8
movzx ecx, cl
movzx ebx, byte [esi]
inc esi
xor ebx, ecx
xor eax, dword [ebx*4 + 0x1006bdd8]
mov ecx, eax
cmp edx, 1
je 0x1000a222
xor edx, edx
mov eax, ecx
nop word [eax + eax]
movzx ecx, al
shr eax, 8
movzx ebx, byte [esi + edx]
xor ebx, ecx
xor eax, dword [ebx*4 + 0x1006bdd8]
movzx ecx, al
shr eax, 8
movzx ebx, byte [esi + edx + 1]
xor ebx, ecx
xor eax, dword [ebx*4 + 0x1006bdd8]
add edx, 2
cmp edi, edx
jne 0x1000a1f0
jmp 0x1000a222
mov eax, ecx
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x1000aa60
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test ebp, ebp
je 0x1000aa7c
mov dword [ebp], 0
push ecx
push eax
call fcn.1000a700
add esp, 8
xor esi, esi
test eax, eax
je 0x1000aaa8
mov edi, eax
push 2
push 0
push eax
call fcn.10045b48
add esp, 0xc
test eax, eax
je 0x1000aab2
push edi
call fcn.100452d3
add esp, 4
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.10045e6b
add esp, 4
cmp eax, 0xffffffff
je 0x1000aa9f
mov ebx, eax
push 0
push 0
push edi
call fcn.10045b48
add esp, 0xc
test eax, eax
jne 0x1000aa9f
mov eax, dword [esp + 0x24]
add eax, ebx
inc dword [0x1006c1d8]
push dword [0x1006c1dc]
push eax
call dword [0x1006b0bc]
add esp, 8
test eax, eax
je 0x1000aa9f
push edi
push ebx
push 1
push eax
mov dword [esp + 0x10], eax
call fcn.10045937
add esp, 0x10
cmp eax, ebx
jne 0x1000ab3c
mov esi, dword [esp]
mov ecx, dword [esp + 0x24]
test ecx, ecx
jle 0x1000ab23
mov eax, esi
add eax, ebx
push ecx
push 0
push eax
call fcn.1003c390
add esp, 0xc
push edi
call fcn.100452d3
add esp, 4
test ebp, ebp
je 0x1000aaa8
mov dword [ebp], ebx
jmp 0x1000aaa8
push edi
call fcn.100452d3
add esp, 4
dec dword [0x1006c1d8]
push dword [0x1006c1dc]
push dword [esp + 4]
call dword [0x1006b0c0]
add esp, 8
jmp 0x1000aaa8

Function at 0x1000b6f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 8]
mov eax, dword [ecx + 0x1d8]
mov ecx, dword [ecx + 0x1e0]
mov eax, dword [ecx + eax*4 - 4]
cmp dword [0x1006bddc], 0
jne 0x1000b81c
movdqa xmm6, xmmword [0x10058490]
mov ecx, 0xfffffc00
movdqa xmm1, xmmword [0x100584a0]
movdqa xmm7, xmmword [0x10058500]
nop
movdqa xmm2, xmm6
psrld xmm2, 1
movdqa xmm0, xmm6
pslld xmm0, 0x1f
psrad xmm0, 0x1f
pand xmm0, xmm1
pxor xmm0, xmm2
movdqa xmm3, xmm0
psrld xmm3, 1
movdqa xmm2, xmm6
pslld xmm2, 0x1e
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm3
movdqa xmm3, xmm6
pslld xmm3, 0x1d
psrad xmm3, 0x1f
pand xmm3, xmmword [0x100584b0]
movdqa xmm4, xmm6
pslld xmm4, 0x1c
psrad xmm4, 0x1f
pand xmm4, xmmword [0x100584c0]
pxor xmm4, xmm3
movdqa xmm5, xmm6
pslld xmm5, 0x1b
psrad xmm5, 0x1f
pand xmm5, xmmword [0x100584d0]
movdqa xmm3, xmm6
pslld xmm3, 0x1a
psrad xmm3, 0x1f
pand xmm3, xmmword [0x100584e0]
pxor xmm3, xmm5
pxor xmm3, xmm4
movdqa xmm4, xmm2
psrld xmm4, 6
pxor xmm3, xmm4
pslld xmm2, 0x1a
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm3
pslld xmm0, 0x1a
psrad xmm0, 0x1f
pand xmm0, xmmword [0x100584f0]
pxor xmm2, xmm0
movdqu xmmword [ecx + 0x1006c1d8], xmm2
paddd xmm6, xmm7
add ecx, 0x10
jne 0x1000b730
not eax
mov ecx, eax
shr ecx, 8
xor eax, edx
movzx eax, al
xor ecx, dword [eax*4 + 0x1006bdd8]
mov eax, edx
shr eax, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1006bdd8]
mov eax, edx
shr eax, 0x10
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1006bdd8]
movzx esi, cl
mov eax, ecx
shr eax, 8
shr edx, 0x18
xor edx, esi
xor eax, dword [edx*4 + 0x1006bdd8]
not eax
mov ecx, dword [0x1006bdd4]
cmp dword [ecx + 0x1974], eax
jne 0x1000b882
mov byte [ecx + 0x1980], 1
pop esi
ret 4
Function at 0x10037c20
Capabilities:
Get common file path

Disassembly:
push edi
push esi
sub esp, 0x108
mov esi, dword [esp + 0x114]
mov edi, dword [esp + 0x118]
mov eax, dword [0x1006b0dc]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x10037bc0
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [0x1006e104], eax
mov dword [0x1006e088], edi
mov dword [0x1006e0a0], esi
push 0
call fcn.1000c560
add esp, 4
call fcn.1000ce10
mov esi, eax
mov dword [eax + 0xcc], 0x10033af0
mov eax, dword [0x1006e088]
mov dword [esi + 0xc8], eax
mov edi, esp
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.10046c60
add esp, 4
movups xmm0, xmmword [str.FontsArialbd.ttf]
movups xmmword [esp + eax], xmm0
mov dword [esp + eax + 0xf], 0x667474
mov esi, dword [esi + 0x8c]
mov ecx, esi
call fcn.1002fa20
mov ecx, esi
push eax
push 0
push 0x41800000
push edi
call fcn.100294a0
call fcn.100342e0
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10038f79
add esp, 0x108
pop esi
pop edi
ret
Function at 0x10038130
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1003817c
mov ebp, 0xfffffffd
nop word cs:[eax + eax]
cmp byte [edi + ebp + 3], 0
lea ebp, [ebp + 1]
jne 0x10038150
push 0x400
call fcn.10038f70
add esp, 4
mov dword [esp + 8], eax
test ebp, ebp
je 0x1003822c
lea eax, [ebp + 2]
mov dword [esp + 4], eax
jmp 0x1003819a
mov dword [esp + 4], 0
mov ebp, 0xfffffffe
push 0x400
call fcn.10038f70
add esp, 4
mov dword [esp + 8], eax
xor ebx, ebx
xor edx, edx
mov dword [esp], ebp
nop word cs:[eax + eax]
movzx esi, byte [edi + edx]
mov ebp, esi
shr ebp, 2
movzx ecx, byte [ebp + str.ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210._]
mov edi, dword [esp + 8]
mov byte [edi + ebx], cl
shl esi, 4
and esi, 0x30
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + edx + 1]
mov ebp, ecx
shr ebp, 4
movzx eax, byte [ebp + esi + str.ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210._]
mov esi, dword [esp + 0x20]
mov ebp, dword [esp]
mov byte [edi + ebx + 1], al
and ecx, 0xf
movzx eax, byte [esi + edx + 2]
mov esi, eax
shr esi, 6
movzx ecx, byte [esi + ecx*4 + str.ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210._]
mov byte [edi + ebx + 2], cl
and eax, 0x3f
movzx eax, byte [eax + str.ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210._]
mov byte [edi + ebx + 3], al
mov edi, dword [esp + 0x20]
add ebx, 4
add edx, 3
cmp edx, ebp
jb 0x100381b0
mov dword [esp], ebx
mov eax, dword [esp + 4]
jmp 0x1003823a
xor edx, edx
mov eax, 2
mov dword [esp], 0
cmp edx, eax
mov esi, dword [esp + 8]
jae 0x100382bc
mov ecx, eax
movzx ebx, byte [edi + edx]
mov eax, ebx
shr eax, 2
movzx eax, byte [eax + str.ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210._]
mov edi, dword [esp]
mov ebp, edi
or ebp, 1
mov byte [esi + edi], al
mov dword [esp + 4], ecx
lea eax, [ecx - 1]
shl ebx, 4
and ebx, 0x30
cmp edx, eax
jne 0x1003827e
movzx eax, byte [ebx + str.ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210._]
mov byte [esi + ebp], al
mov dl, 0x3d
jmp 0x100382a6
mov eax, dword [esp + 0x20]
movzx eax, byte [edx + eax + 1]
mov ecx, eax
shr ecx, 4
movzx edx, bl
or edx, ecx
movzx ecx, byte [edx + str.ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210._]
mov byte [esi + ebp], cl
and eax, 0xf
movzx edx, byte [eax*4 + str.ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210._]
mov eax, dword [esp + 4]
mov edi, dword [esp]
mov ecx, edi
or ecx, 2
mov byte [esi + ecx], dl
or edi, 3
mov byte [esi + edi], 0x3d
add eax, 2
mov ecx, 0xaaaaaaab
mul ecx
and edx, 0xfffffffe
mov byte [esi + edx*2], 0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret