joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x3cac049b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x3ab732c8
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4056ee
Capabilities:
Delete file
Enumerate gui resources
Manipulate console buffer
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.00406ad0
push esi
shr edx, 3
xor esi, esi
cmp edx, esi
jbe 0x4057eb
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
cmp dword [0x42e644], 0x5d
jne 0x4057d3
push esi
lea eax, [ebp - 0x424]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x824]
push eax
push 0x401258
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push esi
push 0x401264
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push esi
push esi
push esi
push 0x4012a0
push 0x4012c0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4012f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
push esi
lea eax, [ebp - 0x1024]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.00405549
add ebx, 8
dec dword [ebp - 8]
jne 0x405710
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x4063cd
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00406ad0
mov eax, dword [0x41c7ac]
push esi
push edi
mov dword [0x42e644], eax
mov eax, 0xb2d3b
add dword [0x42e644], eax
push 0x6e
pop eax
push 0x33
mov word [0x42dcde], ax
pop eax
push 0x2e
mov word [0x42dce4], ax
xor eax, eax
mov word [0x42dcf0], ax
pop eax
push 0x6b
mov word [0x42dce8], ax
pop eax
push 0x6c
mov word [0x42dcd8], ax
pop eax
push 0x64
mov word [0x42dcec], ax
pop eax
push 0x6c
mov word [0x42dcea], ax
pop eax
push 0x32
mov word [0x42dcee], ax
mov word [0x42dce2], ax
pop eax
push 0x65
mov word [0x42dce6], ax
pop eax
push 0x72
mov word [0x42dcda], ax
mov word [0x42dce0], ax
pop eax
mov word [0x42dcdc], ax
call fcn.00405a1d
mov edi, reloc.KERNEL32.dll_RtlUnwind
xor esi, esi
cmp dword [0x42e644], 0x1833b
jne 0x4064d7
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x4013e0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
push esi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x401410
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 0x804]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
dec edi
jne 0x40646b
mov eax, dword [0x42dc24]
mov dword [0x42dccc], eax
call eax
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x40779b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c770]
jne 0x4077a5
repz ret
jmp fcn.0040d88b
Function at 0x412ad3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409cd7
and dword [ebp - 4], 0
cmp dword [0x42f03c], 0
mov ebx, eax
jne 0x412b84
push 0x4048b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412c35
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4048a4
push edi
call esi
test eax, eax
je 0x412c35
push eax
call fcn.00409c65
mov dword [esp], 0x404894
push edi
mov dword [0x42f03c], eax
call esi
push eax
call fcn.00409c65
mov dword [esp], 0x404880
push edi
mov dword [0x42f040], eax
call esi
push eax
call fcn.00409c65
mov dword [esp], 0x404864
push edi
mov dword [0x42f044], eax
call esi
push eax
call fcn.00409c65
pop ecx
mov dword [0x42f04c], eax
test eax, eax
je 0x412b84
push 0x40484c
push edi
call esi
push eax
call fcn.00409c65
pop ecx
mov dword [0x42f048], eax
mov eax, dword [0x42f048]
cmp eax, ebx
je 0x412bdc
cmp dword [0x42f04c], ebx
je 0x412bdc
push eax
call fcn.00409ce0
push dword [0x42f04c]
mov esi, eax
call fcn.00409ce0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x412bdc
test edi, edi
je 0x412bdc
call esi
test eax, eax
je 0x412bd3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x412bd3
test byte [ebp - 0xc], 1
jne 0x412bdc
or dword [ebp + 0x10], 0x200000
jmp 0x412c15
mov eax, dword [0x42f040]
cmp eax, ebx
je 0x412c15
push eax
call fcn.00409ce0
pop ecx
test eax, eax
je 0x412c15
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x412c15
mov eax, dword [0x42f044]
cmp eax, ebx
je 0x412c15
push eax
call fcn.00409ce0
pop ecx
test eax, eax
je 0x412c15
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42f03c]
call fcn.00409ce0
pop ecx
test eax, eax
je 0x412c35
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412c37
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x49b6d4
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffec
cmp esi, 1
jne 0x49b6f2
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx]
call fcn.0049b4c4
pop ecx
cmp esi, 1
je 0x49b6fc
cmp esi, 2
jne 0x49b76a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
mov dword [ebx], eax
cmp dword [ebx], 0x27
je 0x49b70e
cmp dword [ebx], 0x22
jne 0x49b76a
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx]
call fcn.0049b4c4
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0049b5ac
pop ecx
mov dword [ebx], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x18]
je 0x49b76a
cmp dword [ebx], 0x5c
jne 0x49b74d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx]
call fcn.0049b4c4
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0049b5ac
pop ecx
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x49b70e
mov ecx, 0x49b8d0
mov dl, 1
mov eax, dword [0x4590c4]
call fcn.004629d8
call fcn.0040494c
jmp 0x49b70e
cmp esi, 1
je 0x49b77d
cmp esi, 2
je 0x49b77d
cmp esi, 3
jne 0x49b8c1
mov eax, dword [ebp + 8]
push eax
call fcn.0049b60c
pop ecx
mov edx, dword [ebp + 8]
mov dword [edx - 0x18], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x18], 0x2f
jne 0x49b8c1
cmp dword [ebx], 0x28
je 0x49b7df
cmp dword [ebx], 0x2c
je 0x49b7df
cmp dword [ebx], 0x3d
je 0x49b7df
cmp dword [ebx], 0x3a
je 0x49b7df
cmp dword [ebx], 0x5b
je 0x49b7df
cmp dword [ebx], 0x21
je 0x49b7df
cmp dword [ebx], 0x26
je 0x49b7df
cmp dword [ebx], 0x7c
je 0x49b7df
cmp dword [ebx], 0x3f
je 0x49b7df
cmp dword [ebx], 0x7b
je 0x49b7df
cmp dword [ebx], 0x7d
je 0x49b7df
cmp dword [ebx], 0x3b
je 0x49b7df
cmp dword [ebx], 0xa
jne 0x49b8c1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx]
call fcn.0049b4c4
pop ecx
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
call fcn.0049b4c4
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0049b5ac
pop ecx
mov dword [ebx], eax
cmp dword [ebx], 0x5b
jne 0x49b863
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx]
call fcn.0049b4c4
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0049b5ac
pop ecx
mov dword [ebx], eax
cmp dword [ebx], 0x5d
je 0x49b885
cmp dword [ebx], 0x5c
jne 0x49b846
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx]
call fcn.0049b4c4
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0049b5ac
pop ecx
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x49b80c
mov ecx, 0x49b8fc
mov dl, 1
mov eax, dword [0x4590c4]
call fcn.004629d8
call fcn.0040494c
jmp 0x49b80c
cmp dword [ebx], 0x2f
je 0x49b8b1
cmp dword [ebx], 0x5c
jne 0x49b885
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx]
call fcn.0049b4c4
pop ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0049b5ac
pop ecx
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x49b8a0
mov ecx, 0x49b93c
mov dl, 1
mov eax, dword [0x4590c4]
call fcn.004629d8
call fcn.0040494c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebx]
call fcn.0049b4c4
pop ecx
jmp 0x49b7fb
mov eax, dword [ebp + 8]
push eax
call fcn.0049b60c
pop ecx
mov edx, dword [ebp + 8]
mov dword [edx - 0x18], eax
pop esi
pop ebx
pop ebp
ret
Function at 0x4049f2
Capabilities:
Encode data using xor

Disassembly:
mov dword [0xe37b8930], eax
mov ebp, 0x2e8580e6
rol byte [eax - 0x686e91f3], cl
push ss
inc edi
add dword [eax], eax
adc byte [ecx + 0x1039f263], dl
xor ah, cl
out dx, eax
cdq
adc dh, byte [esi + 0x60]
push es
in eax, 0x41
dec ebx
sub eax, 0x9d081005
invalid
mov eax, dword [0xe410858]
lds esi, [esp + eax + 0x7b]
mov byte [0xe73e9069], al
in al, 0x1a
push eax
cmp eax, 0xbd712caf
mov dh, 0xd6
aad 0x1f
stosb byte es:[edi], al
xor cl, byte [ebp + 0x76]
sbb dword [eax], ebp
xor ch, ch
rcr byte [eax], 1
sub al, 0xc4
pop ecx
jecxz 0x4049db
mov ah, 0x54
jp 0x404997
or ch, byte [esi]
xchg edi, eax
retf 0xfb6b

Function at 0x45472f
Capabilities:
Encode data using xor

Disassembly:
pushfd
les ebx, [esi]
stosb byte es:[edi], al
rcl dword [ebx - 0x33], 0x5b
mov gs, word [eax]
shr byte [esi], 1
test al, 0xd
and dh, byte [edi - 0x7e9884cd]
scasb al, byte es:[edi]
push edx
inc eax
sal byte [edi], 0x49
rcl byte [edi + 0x2d], cl
arpl ax, di
loopne 0x454700
invalid
pushal
mov byte [esi], bl
mov esp, 0xf1abf59b
sub eax, 0x5ff79686
push ebx
mov ebp, 0xc5a70911
xchg edx, eax
mov dword [ecx + 0x48], esi
stosb byte es:[edi], al
pop eax
inc edx
add eax, dword [eax - 0x10acaceb]
jae 0x454763
jne 0x4546e8
pop ss
pop esi
jmp 0x454704
adc al, 0xd
sbb eax, 0x77e81bbe
sub cl, byte ds:[ecx]
or ebx, 0xffffffac
or eax, 0x1a02c394
neg bh
jl 0x4547e6
inc eax
outsd dx, dword [esi]
mov eax, 0x46e8a7a6
int1
cmp dword [esi], ebp
mov al, 7
cmp al, 0x72
or dword [ebx - 0x13d4724f], edx
xchg edi, eax
inc esi
neg byte [edi]
or ecx, dword [ebp - 0x152e05c1]
invalid
ljmp 0x3576:0xacffe2c6
or dword [edx + edi - 0x3e449336], 0x6c
loop 0x45486c
imul esi, dword [ebx + 0x6e33f040], 0x2e
sub al, 0x84
xchg esp, eax
insd dword es:[edi], dx
fisttp dword [eax - 0x54]
mov cl, 0xaf
scasd eax, dword es:[edi]
jge 0x454797
cwde
or eax, 0x735417f1
int1
fld st(1)
enter 0xffffffffffff832d, 0x63
lea ecx, [edi + 0x33]
sub byte [eax], dl
idiv dword [ecx - 0x42d1a96d]
cmp eax, dword [ecx]
fiadd dword [edi + 0x2338525d]
pop ebp
adc eax, 0x862b92f4
sar dh, 0x3a
push ebx
xor cl, cl
cmp edx, dword [0x5b5de97e]
add dword [eax], esi
add eax, 0xd0ef7e16
xchg dword [ebp - 0x7b140720], ebx
sal byte [ebx - 0x39da44d2], 1
xchg ebx, eax
jae 0x45481a
sub dword [esi], 0xefc5f54b
in eax, dx
ret
aaa
aas
scasb al, byte es:[edi]
push ebx
jl 0x4547ff
invalid
Function at 0x405850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebx - 0x15], eax
or al, byte [0x36f4d2ce]
pop esp
add al, 0xe7
cdq
Function at 0x1000dce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
je 0x1000dd1f
push edi
mov edi, dword [esp + 0xc]
mov ecx, eax
lea edi, [edi + 1]
shr ecx, 8
shl eax, 8
movzx edx, byte [ecx + 0x100013a0]
movzx ecx, byte [edi - 1]
add ecx, eax
mov eax, edx
shl eax, 0xd
xor ecx, edx
xor eax, edx
shl eax, 2
xor eax, ecx
and eax, 0xffff
dec esi
jne 0x1000dcf0
pop edi
pop esi
ret 8

Function at 0x10017470
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x60
mov eax, dword [0x100504f0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
push ebx
mov ebx, dword [esp + 0x70]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, dword [esp + 0x74]
mov esi, ecx
mov dword [esp + 0x14], eax
call ebp
mov dword [esp + 0x10], eax
mov dword [esi + 0x6c], 1
jmp 0x100174b0
push dword [esi + 0x6c]
mov ecx, edi
mov dword [esp + 0x1c], 1
call fcn.1001b630
cmp eax, 0x100
jb 0x100175c6
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x6c]
push 1
add eax, 0x10000000
push eax
call fcn.10021ab0
mov eax, dword [esp + 0x18]
test al, 1
jne 0x100174fb
cmp dword [esp + 0x1c], 0xfffffbff
je 0x100175ca
test eax, 0xfffffffe
je 0x1001750b
lea ecx, [esp + 0x18]
call fcn.1001c060
cmp dword [esi + 0x6c], 0x100
jb 0x10017545
call ebp
mov ecx, dword [esp + 0x10]
sub ecx, eax
add ecx, 0x1388
cmp ecx, 0x80000000
jb 0x100174a0
cmp dword [esi + 0x6c], 0x100
jb 0x10017545
push 1
push 0xfffffbdd
mov ecx, ebx
call fcn.1001c1e0
test byte [ebx], 8
jne 0x100175fd
push 0x40
lea eax, [esp + 0x30]
push 0x20
push eax
call fcn.100444c0
add esp, 0xc
lea eax, [esp + 0x2c]
mov ecx, 0x10051c08
push ebx
push 0x20
push eax
call fcn.10038db0
test byte [ebx], 8
jne 0x100175fd
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x20
push eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1c]
call fcn.10043160
test eax, eax
js 0x100175ef
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x2c]
push ebx
push 0x40
push eax
mov eax, dword [esi + 0x6c]
dec eax
shl eax, 6
push eax
call fcn.100221b0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10044550
add esp, 0x60
ret 0xc
mov eax, dword [esp + 0x18]
test eax, 0xfffffffe
je 0x100175da
lea ecx, [esp + 0x18]
call fcn.1001c060
inc dword [esi + 0x6c]
cmp dword [esi + 0x6c], 0x100
jb 0x100174b0
jmp 0x1001750b
push 1
push 0xfffffc15
mov ecx, ebx
call fcn.1001c1e0
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10044550
add esp, 0x60
ret 0xc
Function at 0x100188c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
je 0x100189e9
mov eax, dword [esi + 0x3c]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], 1
push edi
mov edi, dword [eax + 0x38]
mov eax, dword [eax + 0x5c]
mov dword [esp + 0x10], eax
call ebp
mov ebx, eax
mov ecx, esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.100186c0
mov ecx, dword [esp + 0x14]
test cl, 8
je 0x10018959
nop
mov eax, edi
dec edi
test eax, eax
je 0x10018959
lea ecx, [esp + 0x14]
call fcn.1001c120
call ebp
sub ebx, eax
mov eax, dword [esp + 0x10]
add eax, ebx
cmp eax, 0x80000000
jae 0x10018938
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov ebx, eax
mov ecx, esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.100186c0
mov ecx, dword [esp + 0x14]
test cl, 8
jne 0x10018910
pop edi
pop ebp
pop ebx
test cl, 1
jne 0x100189c8
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffbae
jl 0x100189c8
cmp eax, 0xfffffbaf
jle 0x1001897a
cmp eax, 0xfffffbb2
jne 0x100189c8
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.100191b0
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x100189a2
test byte [esp + 8], 1
mov edx, 0
mov ecx, dword [esp + 0xc]
cmovne ecx, edx
test eax, eax
je 0x100189ba
cmp eax, dword [esi + 0x6c]
je 0x100189ba
push dword [esp + 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.10019990
jmp 0x100189d6
push 1
push ecx
mov ecx, dword [esp + 0x34]
call fcn.1001c1e0
jmp 0x100189d6
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 8]
push eax
call fcn.1001bf90
test dword [esp + 8], 0xfffffffe
je 0x100189e9
lea ecx, [esp + 8]
call fcn.1001c060
pop esi
add esp, 0x18
ret 0x10
Function at 0x1001ab20
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [ecx + 4]
movzx eax, word [edi + 8]
movzx ecx, word [edi + eax*2 + 8]
and ecx, 0x3fff
cmp dword [esp + 0x14], 0
jne 0x1001ab50
movzx eax, word [edi + esi*2 + 0xa]
and eax, 0x3fff
jmp 0x1001ab82
test ebx, ebx
jle 0x1001ab6b
test esi, esi
jne 0x1001ab5f
mov eax, 0x800
jmp 0x1001ab82
movzx eax, word [edi + esi*2 + 8]
and eax, 0x3fff
jmp 0x1001ab82
test esi, esi
jne 0x1001ab76
mov eax, 0x800
jmp 0x1001ab80
movzx eax, word [edi + esi*2 + 8]
and eax, 0x3fff
add eax, ebx
sub eax, ecx
push eax
lea eax, [ecx + edi]
sub ecx, ebx
push eax
add ecx, edi
push ecx
call fcn.10044d40
movzx eax, word [edi + 8]
add esp, 0xc
cmp esi, eax
jae 0x1001abc5
lea edx, [edi + 0xa]
lea edx, [edx + esi*2]
movzx eax, word [edx]
lea edx, [edx + 2]
mov ecx, eax
inc esi
sub ecx, ebx
xor ecx, eax
and ecx, 0x3fff
xor ecx, eax
mov word [edx - 2], cx
movzx eax, word [edi + 8]
cmp esi, eax
jb 0x1001aba4
movzx ecx, word [edi + 8]
mov eax, 0x3fff
mov dx, word [edi + ecx*2 + 8]
and dx, ax
lea eax, [ecx + ecx]
sub dx, ax
sub dx, 0xa
mov word [edi + 2], dx
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x1001beb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x1001bf03
lea esi, [ecx + 6]
mov edi, dword [ebp + 8]
xor ebx, ebx
xor edx, edx
mov bl, byte [ecx + 4]
mov dl, byte [ecx + 5]
inc bl
push ebp
xor eax, eax
mov ebp, dword [ebp + 0xc]
mov cl, byte [esi + ebx]
add dl, cl
mov ch, byte [edi]
inc edi
mov al, byte [esi + edx]
mov byte [esi + edx], cl
mov byte [esi + ebx], al
add al, cl
inc bl
xor ch, byte [esi + eax]
dec ebp
mov byte [edi - 1], ch
mov cl, byte [esi + ebx]
jne 0x1001bedb
pop ebp
mov ecx, dword [ebp - 4]
mov byte [ecx + 4], dh
mov byte [ecx + 5], dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10021dc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, ecx
test byte [edi + 0x10], 0x80
jne 0x10021e7f
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x30], 0
push eax
push ebx
push dword [esp + 0x48]
mov dword [esp + 0x40], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10021e65
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
mov ecx, 0x10051c08
call fcn.10038990
mov eax, dword [esp + 0xc]
test al, 1
jne 0x10021e3f
cmp dword [esp + 0x10], 0xfffffc15
jne 0x10021e3f
or dword [edi + 0x10], 0x80
jmp 0x10021e53
test al, 8
je 0x10021e53
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.1001bf90
mov eax, dword [esp + 0xc]
test eax, 0xfffffffe
je 0x10021e79
lea ecx, [esp + 0xc]
call fcn.1001c060
jmp 0x10021e79
cmp dword [esp + 0x44], ebx
je 0x10021e79
push 1
push 0xfffffc06
mov ecx, esi
call fcn.1001c1e0
test byte [edi + 0x10], 0x80
je 0x10021eed
push ebp
lea ebp, [edi + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push dword [esp + 0x44]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10021eac
push esi
mov ecx, 0x10051c08
call fcn.10038990
jmp 0x10021ee5
push 0
lea eax, [esp + 0x4c]
push eax
push ebx
push dword [esp + 0x4c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10021ed1
push esi
mov ecx, 0x10051c08
call fcn.10038990
jmp 0x10021ee5
cmp dword [esp + 0x48], ebx
je 0x10021ee5
push 1
push 0xfffffc06
mov ecx, esi
call fcn.1001c1e0
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
test byte [esi], 8
je 0x10021efc
push 0
push esi
mov ecx, edi
call fcn.100220a0
pop edi
pop esi
pop ebx
add esp, 0x28
ret 0x10