joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9046dd
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4a973c57
mov eax, dword [ecx + 0x14]
shl eax, 8
test byte [ecx + 0x14], 0xc
je 0x4a973c66
xor eax, dword [ecx + 0x18]
push esi
push edi
mov edi, dword [ecx + 0x30]
xor esi, esi
xor eax, edi
test edi, edi
jle 0x4a973c88
push ebx
mov ebx, dword [ecx + 0x2c]
mov edx, dword [ebx]
mov ecx, esi
shl edx, cl
lea ebx, [ebx + 4]
xor eax, edx
inc esi
cmp esi, edi
jl 0x4a973c77
pop ebx
pop edi
pop esi
ret
Function at 0x4a905a33
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x4a9a1845
js 0x4a9a186b
or byte gs:[eax], al
add byte [eax], al
inc eax

Function at 0x4a905cb3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x4a9b583c
sub esp, 0x4c
mov eax, dword [0x4aa98440]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x58]
mov eax, ebx
push esi
push edi
mov ecx, ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x18], eax
mov edi, ebx
mov dword [esp + 0x1c], ebx
mov esi, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov word [esp + 0x54], bx
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
test eax, eax
jle 0x4a9b59a1
mov dword [esp + 0x14], 1
mov ecx, ebp
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp esi, eax
jae 0x4a9b58d1
mov ecx, ebp
call dword [sym.imp.icuuc58.dll_private:_wchar_t_const____thiscall_icu_58::UnicodeString::getArrayStart_void_const]
movzx ecx, word [eax + esi*2]
jmp 0x4a9b58d6
mov ecx, 0xffff
mov edx, dword [esp + 0x18]
cmp cx, dx
je 0x4a9b58f7
test edi, edi
jle 0x4a9b58f7
movzx eax, dx
cmp byte [esp + eax - 0x25], bl
jne 0x4a9b59b8
mov byte [esp + eax - 0x25], 1
mov edi, ebx
push 0x27
pop eax
cmp cx, ax
jne 0x4a9b594f
mov ecx, ebp
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp dword [esp + 0x14], eax
jge 0x4a9b5944
mov ecx, ebp
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jae 0x4a9b592f
mov ecx, ebp
call dword [sym.imp.icuuc58.dll_private:_wchar_t_const____thiscall_icu_58::UnicodeString::getArrayStart_void_const]
mov ecx, dword [esp + 0x14]
movzx eax, word [eax + ecx*2]
jmp 0x4a9b5934
mov eax, 0xffff
push 0x27
pop edx
cmp ax, dx
jne 0x4a9b5944
inc esi
inc ecx
mov dword [esp + 0x14], ecx
jmp 0x4a9b5972
cmp byte [esp + 0x13], bl
sete byte [esp + 0x13]
jmp 0x4a9b5972
cmp byte [esp + 0x13], bl
jne 0x4a9b5972
cmp cx, 0x61
jb 0x4a9b5961
cmp cx, 0x7a
jbe 0x4a9b596a
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x4a9b5972
movzx eax, cx
inc edi
mov dword [esp + 0x18], eax
inc esi
mov ecx, ebp
inc dword [esp + 0x14]
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp esi, eax
jl 0x4a9b58b7
mov edx, dword [esp + 0x18]
test edi, edi
jle 0x4a9b59a1
test bl, bl
jne 0x4a9b59a1
movzx ecx, dx
movsx ecx, byte [esp + ecx - 0x25]
neg ecx
sbb ecx, ecx
and edi, ecx
mov ecx, dword [esp + 0x58]
sub esi, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.4a9ebf20
add esp, 0x4c
ret
mov bl, 1
jmp 0x4a9b598b
Function at 0x4a9061b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x4a9bebc3
jmp sym.icuin58.dll_public:_static_void____cdecl_icu_58::InitialTimeZoneRule::getStaticClassID_void_

Function at 0x4a90638e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x4a9a19a3
push edi
mov byte [ebp - 0x34b], 0x4a
invalid
dec dword [edx - 0x3a]
test dword [esi + 0x46fffffc], esi
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.4a9a1162
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.4a9a1117
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
movsd dword es:[edi], dword [esi]
int3
cld
invalid
inc dword [eax]
Function at 0x4a906d61
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x4a9a1840
clc
add byte [eax], al
add byte [ebx + 0x448d2478], cl
or bh, bh
Function at 0x4a906e2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x4a9a136b
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.4a9a1152
mov ecx, 0x66c28781
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x4a9a13ac
lea ecx, [esi + 0xc]
movzx edx, ax
Function at 0x4a90709f
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x4a9bec85
mov ecx, dword [esp + 4]
jmp sym.icuin58.dll_public:_int___thiscall_icu_58::TimeZoneRule::getDSTSavings_void_const
Function at 0x4a9075a9
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x4a9bea89
mov ecx, dword [esp + 4]
jmp sym.icuin58.dll_public:_int___thiscall_icu_58::TimeZoneRule::getDSTSavings_void_const
Function at 0x4a9080a8
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
jmp 0x4a9d6e19
sub esp, 0x2c
mov eax, dword [0x4aa98440]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0x14], ecx
xor ebx, ebx
mov ecx, dword [ecx + 4]
xor ebp, ebp
and dword [esp + 0x2c], ebx
xor esi, esi
and dword [esp + 0x30], ebx
push edi
mov dword [esp + 0x14], ecx
or edi, 0xffffffff
mov dword [esp + 0x1c], ecx
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp dword [esp + 0x14], eax
jge 0x4a9d6f1a
mov ebx, dword [esp + 0x1c]
cmp esi, dword [esp + 0x50]
jg 0x4a9d6f16
mov ecx, dword [esp + 0x10]
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp ebx, eax
jae 0x4a9d6ea5
mov ecx, dword [esp + 0x10]
call dword [sym.imp.icuuc58.dll_private:_wchar_t_const____thiscall_icu_58::UnicodeString::getArrayStart_void_const]
movzx ecx, word [eax + ebx*2]
jmp 0x4a9d6eaa
mov ecx, 0xffff
cmp cx, word [esp + 0x48]
jne 0x4a9d6ec8
test esi, esi
jne 0x4a9d6ebb
test ebp, ebp
je 0x4a9d6f16
jmp 0x4a9d6f03
cmp dword [esp + esi*4 + 0x20], edi
jne 0x4a9d6f16
and dword [esp + esi*4 + 0x20], 0
jmp 0x4a9d6eff
mov edx, dword [esp + esi*4 + 0x20]
cmp edx, edi
je 0x4a9d6f16
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x4a9d6ee1
movzx ecx, cx
sub ecx, 0x30
jmp 0x4a9d6ee3
mov ecx, edi
test ecx, ecx
js 0x4a9d6f16
imul eax, dword [esp + esi*4 + 0x2c], 0xa
add eax, ecx
mov dword [esp + esi*4 + 0x2c], eax
lea eax, [edx + 1]
mov dword [esp + esi*4 + 0x20], eax
cmp eax, 2
jl 0x4a9d6eff
inc esi
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc ebx
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp ebx, eax
jl 0x4a9d6e7d
mov ebx, dword [esp + 0x2c]
xor edx, edx
xor ecx, ecx
test ebp, ebp
je 0x4a9d6f80
xor edi, edi
cmp ebx, 0x17
jle 0x4a9d6f3c
mov eax, ebx
push 0xa
pop ecx
cdq
idiv ecx
xor ecx, ecx
imul edx, eax, 0x36ee80
inc ecx
jmp 0x4a9d6f80
imul edx, ebx, 0x36ee80
mov ecx, ebp
cmp dword [esp + 0x24], 2
jne 0x4a9d6f80
mov eax, dword [esp + 0x30]
cmp eax, 0x3b
jg 0x4a9d6f80
imul eax, eax, 0xea60
lea ecx, [ebp + 3]
xor edi, edi
inc edi
add edx, eax
cmp dword [esp + 0x28], 2
jne 0x4a9d6f80
mov eax, dword [esp + 0x34]
cmp eax, 0x3b
jg 0x4a9d6f80
imul eax, eax, 0x3e8
push 2
pop edi
add edx, eax
add ecx, 3
mov esi, dword [esp + 0x18]
cmp edi, dword [esp + 0x4c]
jge 0x4a9d6f95
mov eax, dword [esp + 0x14]
mov dword [esi + 8], eax
xor eax, eax
jmp 0x4a9d6f9e
add ecx, dword [esp + 0x14]
mov eax, edx
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.4a9ebf20
add esp, 0x2c
ret
Function at 0x4a90887d
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x4a9a1666
js 0x4a9a1667
invalid
invalid
Function at 0x4a908bd4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4a9de39b
xor eax, eax
mov edx, eax
xor eax, dword [ecx + edx*4]
inc edx
cmp edx, 6
jl 0x4a9de39f
ret
Function at 0x4a981553
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x4a981553
push 0xffffffffffffffff
push 0x4a9fa01c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4aa98440]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
call sym.icuin58.dll_protected:_void___thiscall_icu_58::Collator::constructor_void_
xor ebx, ebx
mov dword [edi], vtable.icu_58::RuleBasedCollator.0
push ebx
push ebx
push ebx
push 0x4aa097f8
lea ecx, [edi + 0x14]
mov dword [esp + 0x30], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
call dword [sym.imp.icuuc58.dll_public:_void___thiscall_icu_58::Locale::constructor_char_const___char_const___char_const___char_const__]
mov dword [edi + 0xe0], ebx
mov byte [edi + 0xe4], bl
mov ebx, dword [esp + 0x34]
mov byte [esp + 0x20], 1
cmp dword [ebx], 0
jg 0x4a9816a4
cmp dword [esp + 0x28], 0
je 0x4a98169e
cmp dword [esp + 0x2c], 0
je 0x4a98169e
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x4a98169e
push ebx
call sym.icuin58.dll_public:_static_struct_icu_58::CollationTailoring_const____cdecl_icu_58::CollationRoot::getRoot_enum_UErrorCode__
cmp dword [ebx], 0
pop ecx
jg 0x4a9816a4
cmp dword [ebp + 0xc], eax
je 0x4a98160c
mov dword [ebx], 0x10
jmp 0x4a9816a4
push 0x150
call dword [sym.imp.icuuc58.dll_public:_static_void____cdecl_icu_58::UMemory::operator_new_unsigned_int_]
pop ecx
mov dword [esp + 0x34], eax
mov byte [esp + 0x20], 2
test eax, eax
je 0x4a981636
mov ecx, dword [ebp + 0xc]
push dword [ecx + 0x18]
mov ecx, eax
call sym.icuin58.dll_public:_void___thiscall_icu_58::CollationTailoring::constructor_struct_icu_58::CollationSettings_const__
mov esi, eax
jmp 0x4a981638
xor esi, esi
mov dword [esp + 0x34], esi
mov byte [esp + 0x20], 3
test esi, esi
je 0x4a981685
cmp dword [esi + 0x18], 0
je 0x4a981685
push ebx
push esi
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [ebp + 0xc]
call sym.icuin58.dll_public:_static_void___cdecl_icu_58::CollationDataReader::read_struct_icu_58::CollationTailoring_const___unsigned_char_const___int__struct_icu_58::CollationTailoring___enum_UErrorCode__
add esp, 0x14
cmp dword [ebx], 0
jle 0x4a98166c
mov byte [esp + 0x20], 1
jmp 0x4a981694
lea ecx, [esi + 0x5c]
call dword [sym.imp.icuuc58.dll_public:_void___thiscall_icu_58::Locale::setToBogus_void_]
and dword [esp + 0x34], 0
mov ecx, edi
push ebx
push esi
call sym.icuin58.dll_private:_void___thiscall_icu_58::RuleBasedCollator::adoptTailoring_struct_icu_58::CollationTailoring___enum_UErrorCode__
jmp 0x4a9816a4
mov dword [ebx], 7
mov byte [esp + 0x20], 1
test esi, esi
je 0x4a9816a4
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
jmp 0x4a9816a4
mov dword [ebx], 1
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4a99ccbd
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4aa98440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [ebp + 0xc]
push 4
push ebx
push 0x20000019
push edi
call esi
push 4
lea eax, [ebx + 4]
push eax
push 0x20000012
push edi
call esi
push 0xa
lea eax, [ebp - 0x10]
push eax
push 0x18
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x10]
push eax
call fcn.4a99cdab
push 0xc
mov dword [ebx + 8], eax
call sub.icuuc58.dll_uprv_malloc_58
pop ecx
pop ecx
push 6
push eax
push 0x16
push edi
mov dword [ebx + 0xc], eax
call esi
push 0xc
call sub.icuuc58.dll_uprv_malloc_58
pop ecx
push 6
push eax
push 0x17
push edi
mov dword [ebx + 0x10], eax
call esi
push 4
lea eax, [ebx + 0x14]
push eax
push 0x2000001c
push edi
call esi
push 4
lea eax, [ebx + 0x18]
push eax
push 0x2000001b
push edi
call esi
push 0x10
call sub.icuuc58.dll_uprv_malloc_58
pop ecx
push 8
push eax
push 0x14
push edi
mov dword [ebx + 0x1c], eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4a9ebf20
mov esp, ebp
pop ebp
ret

Function at 0x4a99cdea
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4aa98440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [ebp + 0xc]
push 4
push ebx
push 0x20000011
push edi
call esi
push 4
lea eax, [ebx + 4]
push eax
push 0x20000012
push edi
call esi
push 0xa
lea eax, [ebp - 0x10]
push eax
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x10]
push eax
call fcn.4a99cdab
push 0xc
mov dword [ebx + 8], eax
call sub.icuuc58.dll_uprv_malloc_58
pop ecx
pop ecx
push 6
push eax
push 0xe
push edi
mov dword [ebx + 0xc], eax
call esi
push 0xc
call sub.icuuc58.dll_uprv_malloc_58
pop ecx
push 6
push eax
push 0xf
push edi
mov dword [ebx + 0x10], eax
call esi
push 4
lea eax, [ebx + 0x14]
push eax
push 0x20001010
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4a9ebf20
mov esp, ebp
pop ebp
ret

Function at 0x4a9a1192
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4a9a11cd
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4a9a11b4
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4a9a11c5
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4a9a11cf
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4a9a11aa
xor eax, eax
pop edi
pop esi
ret
Function at 0x4a9d6e19
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
jmp 0x4a9d6e19
sub esp, 0x2c
mov eax, dword [0x4aa98440]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0x14], ecx
xor ebx, ebx
mov ecx, dword [ecx + 4]
xor ebp, ebp
and dword [esp + 0x2c], ebx
xor esi, esi
and dword [esp + 0x30], ebx
push edi
mov dword [esp + 0x14], ecx
or edi, 0xffffffff
mov dword [esp + 0x1c], ecx
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp dword [esp + 0x14], eax
jge 0x4a9d6f1a
mov ebx, dword [esp + 0x1c]
cmp esi, dword [esp + 0x50]
jg 0x4a9d6f16
mov ecx, dword [esp + 0x10]
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp ebx, eax
jae 0x4a9d6ea5
mov ecx, dword [esp + 0x10]
call dword [sym.imp.icuuc58.dll_private:_wchar_t_const____thiscall_icu_58::UnicodeString::getArrayStart_void_const]
movzx ecx, word [eax + ebx*2]
jmp 0x4a9d6eaa
mov ecx, 0xffff
cmp cx, word [esp + 0x48]
jne 0x4a9d6ec8
test esi, esi
jne 0x4a9d6ebb
test ebp, ebp
je 0x4a9d6f16
jmp 0x4a9d6f03
cmp dword [esp + esi*4 + 0x20], edi
jne 0x4a9d6f16
and dword [esp + esi*4 + 0x20], 0
jmp 0x4a9d6eff
mov edx, dword [esp + esi*4 + 0x20]
cmp edx, edi
je 0x4a9d6f16
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x4a9d6ee1
movzx ecx, cx
sub ecx, 0x30
jmp 0x4a9d6ee3
mov ecx, edi
test ecx, ecx
js 0x4a9d6f16
imul eax, dword [esp + esi*4 + 0x2c], 0xa
add eax, ecx
mov dword [esp + esi*4 + 0x2c], eax
lea eax, [edx + 1]
mov dword [esp + esi*4 + 0x20], eax
cmp eax, 2
jl 0x4a9d6eff
inc esi
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc ebx
call dword [sym.imp.icuuc58.dll_public:_int___thiscall_icu_58::UnicodeString::length_void_const]
cmp ebx, eax
jl 0x4a9d6e7d
mov ebx, dword [esp + 0x2c]
xor edx, edx
xor ecx, ecx
test ebp, ebp
je 0x4a9d6f80
xor edi, edi
cmp ebx, 0x17
jle 0x4a9d6f3c
mov eax, ebx
push 0xa
pop ecx
cdq
idiv ecx
xor ecx, ecx
imul edx, eax, 0x36ee80
inc ecx
jmp 0x4a9d6f80
imul edx, ebx, 0x36ee80
mov ecx, ebp
cmp dword [esp + 0x24], 2
jne 0x4a9d6f80
mov eax, dword [esp + 0x30]
cmp eax, 0x3b
jg 0x4a9d6f80
imul eax, eax, 0xea60
lea ecx, [ebp + 3]
xor edi, edi
inc edi
add edx, eax
cmp dword [esp + 0x28], 2
jne 0x4a9d6f80
mov eax, dword [esp + 0x34]
cmp eax, 0x3b
jg 0x4a9d6f80
imul eax, eax, 0x3e8
push 2
pop edi
add edx, eax
add ecx, 3
mov esi, dword [esp + 0x18]
cmp edi, dword [esp + 0x4c]
jge 0x4a9d6f95
mov eax, dword [esp + 0x14]
mov dword [esi + 8], eax
xor eax, eax
jmp 0x4a9d6f9e
add ecx, dword [esp + 0x14]
mov eax, edx
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.4a9ebf20
add esp, 0x2c
ret
Function at 0x10006690
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x811c9dc5
jmp 0x100066a9
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
add ecx, 2
cmp ecx, dword [esp + 8]
jne 0x1000669b
ret

Function at 0x100068c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x100068d1
pop dword [ebp - 0x2c]
mov eax, 0x3ce3f90a
add eax, 0xd31c6fc7
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3b574
push 0
mov eax, 0x255a1b8b
add eax, 0xeaa7e4b9
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x144d2a34
sub ecx, 0x144cd905
mov edx, eax
mov ebx, 0xd2c06351
sub ebx, 0xc2bcf951
add ebx, dword [ebp - 0x2c]
mov edi, 0x4aec5700
sub edi, 0x3d323ddc
add dword [ebp - 0x14], 0x8e6eb18a
mov esi, dword [ebx]
sub dword [ebp - 0xc], ecx
add esi, edi
xor dword [ebp - 0xc], edx
mov dword [edx], esi
sub dword [ebp - 0x28], 0x477157d7
add edx, 0x9ad80c74
add edx, 0x6527f390
add ebx, 0x4516505b
sub ebx, 0x45165057
loop 0x10006930
add eax, 0x6772d316
add eax, 0x988e6479
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1881caf6
add ecx, 0xf77e350a
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x1000b06c
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x1000b0ba
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x1000b0cb
push 0xd
pop eax
jmp 0x1000b0f5
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x1000b0ce
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x1000b5af
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.100068c2
mov ebx, eax
cmp ebx, esi
je 0x1000b622
lea ecx, [ebp - 0x74]
call fcn.10009ecc
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000b63a
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000b5af
cmp eax, esi
jne 0x1000b66c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000b62a
lea ecx, [ebp - 0x74]
call fcn.10009ecc
push dword [ebp - 0x78]
mov ecx, edi
call fcn.1000af95
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10009ecc
mov eax, esi
jmp 0x1000b608
Function at 0x1000bae0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
lea edx, [ebp + 8]
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1010e6a0]
sub esi, 1
jne 0x1000bb02
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc4], ebx
jne 0x1000bb37
push esi
push dword [ebp + 8]
push 4
push ebx
call fcn.10009720
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x1000bba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x10]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 8], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 4], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1010e6a0]
sub edi, 1
jne 0x1000bc10
pop edi
not edx
pop esi
mov eax, edx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c3b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1000c3c2
mov dword [edi], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000c4b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000c3da
pop edi
pop esi
pop ebp
ret
push ebx
push esi
call fcn.100dfe46
add esp, 4
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x1000c499
push 2
push 0
push esi
call fcn.100df722
add esp, 0xc
test eax, eax
jne 0x1000c499
push esi
call fcn.100dfe46
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1000c499
push 0
push dword [ebp + 0x10]
push esi
call fcn.100df722
add esp, 0xc
test eax, eax
jne 0x1000c499
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
call fcn.1000ee80
add esp, 4
mov dword [ebp + 0x10], eax
test eax, eax
je 0x1000c499
push esi
push ebx
push 1
push eax
call fcn.100df2c4
add esp, 0x10
cmp eax, ebx
je 0x1000c46a
push esi
call fcn.100ded58
mov eax, dword [ebp + 0x10]
push eax
call fcn.1000ef10
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x1000c482
push eax
mov eax, dword [ebp + 0x10]
add eax, ebx
push 0
push eax
call fcn.100db5a0
add esp, 0xc
push esi
call fcn.100ded58
add esp, 4
test edi, edi
je 0x1000c491
mov dword [edi], ebx
mov eax, dword [ebp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call fcn.100ded58
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret