joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053270
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
lea ecx, [ebp - 0x68]
push 0
push ecx
mov dword [ebp - 0x6c], eax
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x1009ca80
push str.D5CHECK1
push str.config
call edi
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D5CHECK2
push str.config
mov dword [0x10194ba8], eax
call edi
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x10194878], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b88
push str.D5CHECK3
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b88
push str.D5CHECK4
push str.config
mov dword [0x1019487c], eax
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D5RADI01
push str.config
mov dword [0x10194ba4], eax
call edi
lea edx, [ebp - 0x68]
push edx
call ebx
mov ebx, dword [ebp - 0x6c]
push 0xbb8
mov dword [0x10194874], eax
push 0
push ebx
call sub.MSVCR100.dll_memset
add esp, 0x10
push esi
push 0xbb8
push ebx
push 0x10092e4c
push str.D5LIST1
push str.config
call edi
mov eax, dword [0x1019494c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x184
push eax
call esi
mov edi, dword [sym.imp.MSVCR100.dll_strtok]
push 0x1009e9c8
push ebx
call edi
add esp, 8
test eax, eax
je 0x100533e1
lea ebx, [ebx]
mov ecx, dword [0x1019494c]
push eax
push 0
push 0x180
push ecx
call esi
push 0x1009e9c8
push 0
call edi
add esp, 8
test eax, eax
jne 0x100533c0
mov edx, dword [0x10194800]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
pop edi
pop esi
pop ebx
cmp eax, 1
jne 0x10053402
push 0
mov ecx, 0x101947e0
call sub.mfc100.dll_Ordinal_13219
mov ecx, 0x10199d00
call fcn.10015aa0
mov ecx, 0x10199d00
call fcn.10015670
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10086786
mov esp, ebp
pop ebp
ret
Function at 0x10055f00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push str..ini
push esi
call dword [sym.imp.MSVCR100.dll_strstr]
push 0x64
test eax, eax
lea ecx, [ebp - 0x68]
setne al
push 0
push ecx
mov byte [0x1012d417], al
call sub.MSVCR100.dll_memset
push 0x14c08
call sub.mfc100.dll_Ordinal_265
mov edi, eax
push edi
push esi
call fcn.10050930
push edi
push esi
call fcn.10051430
push edi
push esi
call fcn.10052270
push edi
push esi
call fcn.100528d0
push edi
push esi
call fcn.10053270
add esp, 0x40
push edi
push esi
call fcn.10053830
push edi
push esi
call fcn.1003fc50
push edi
push esi
call fcn.100542c0
push edi
push esi
call fcn.10054780
push edi
push esi
call fcn.10054cb0
push edi
push esi
call fcn.1003f980
push edi
push esi
call fcn.10053430
push edi
push esi
call fcn.1003f830
add esp, 0x40
push edi
push esi
call fcn.1003f640
push edi
push esi
call fcn.10053b50
push edi
push esi
call fcn.10054f30
push edi
push esi
call fcn.1003fe70
push edi
push esi
call fcn.100553f0
add esp, 0x28
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b88
push str.D12CHECK1
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
push edi
mov dword [0x10199274], eax
call sub.mfc100.dll_Ordinal_1296
add esp, 8
push 0
mov ecx, 0x10195948
call sub.mfc100.dll_Ordinal_13219
push 0
mov ecx, 0x101990f8
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10086786
mov esp, ebp
pop ebp
ret
Function at 0x10058d00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x2feacec]
fld dword [esi + 0x1f6c]
call fcn.100867f0
fld dword [esi + 0x1f74]
mov dword [ebp - 8], eax
call fcn.100867f0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 0x101b876c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10058d51
test dl, dl
je 0x10058d4d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10058d51
add eax, 2
add ecx, 2
test dl, dl
jne 0x10058d31
xor eax, eax
jmp 0x10058d56
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10058d7a
mov eax, dword [0x101a46e8]
mov ecx, dword [0x100eaf2c]
add eax, 0x44
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.10060d20
pop esi
mov esp, ebp
pop ebp
ret
push 0x100945cc
call fcn.10007370
add esp, 4
cmp eax, 1
jne 0x10058d9e
push str.ClickBox1
call fcn.10038c30
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
fild dword [ebp + 0xc]
sub esp, 8
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fild dword [ebp - 8]
fstp dword [esp]
call fcn.10056030
fcomp qword [0x100a0038]
add esp, 8
fnstsw ax
test ah, 5
jp 0x10058e1d
fild dword [ebp + 0x14]
sub esp, 8
fstp dword [esp + 4]
fild dword [ebp - 0xc]
fstp dword [esp]
call fcn.10056030
fcomp qword [0x100a0038]
add esp, 8
fnstsw ax
test ah, 5
jp 0x10058e1d
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101b8cfc]
cmp eax, 0xbb8
jbe 0x10058e1d
mov edx, dword [ebp + 0x18]
push edx
push 1
call fcn.10039970
add esp, 8
call esi
mov dword [0x101b8cfc], eax
pop esi
mov esp, ebp
pop ebp
ret
fild dword [ebp + 0x14]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.10038180
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10058e50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x2feacec]
fld dword [esi + 0x1f6c]
call fcn.100867f0
fld dword [esi + 0x1f74]
mov dword [ebp - 8], eax
call fcn.100867f0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 0x101b876c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10058ea1
test dl, dl
je 0x10058e9d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10058ea1
add eax, 2
add ecx, 2
test dl, dl
jne 0x10058e81
xor eax, eax
jmp 0x10058ea6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10058ecc
mov eax, dword [0x101a46e8]
mov ecx, dword [0x100eaf2c]
add eax, 0x93
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.10070350
pop esi
mov esp, ebp
pop ebp
ret
push 0x100945cc
call fcn.10007370
add esp, 4
cmp eax, 1
jne 0x10058ef0
push str.ClickBox1
call fcn.10038c30
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
fild dword [ebp + 0xc]
sub esp, 8
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fild dword [ebp - 8]
fstp dword [esp]
call fcn.10056030
fcomp qword [0x100a0038]
add esp, 8
fnstsw ax
test ah, 5
jp 0x10058f6f
fild dword [ebp + 0x14]
sub esp, 8
fstp dword [esp + 4]
fild dword [ebp - 0xc]
fstp dword [esp]
call fcn.10056030
fcomp qword [0x100a0038]
add esp, 8
fnstsw ax
test ah, 5
jp 0x10058f6f
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101b8d00]
cmp eax, 0xbb8
jbe 0x10058f6f
mov edx, dword [ebp + 0x18]
push edx
push 1
call fcn.10039970
add esp, 8
call esi
mov dword [0x101b8d00], eax
pop esi
mov esp, ebp
pop ebp
ret
fild dword [ebp + 0x14]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.10038180
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10080c20
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x1019efc0], 1
jne 0x10080c2e
jmp fcn.100809e0
push ebx
push esi
mov esi, dword [0x2feacec]
mov eax, dword [esi + 0x1d20]
push edi
push 0xda2b90
push eax
call fcn.10006f80
mov ebx, eax
add esp, 8
test ebx, ebx
jle 0x10080cb5
cmp ebx, esi
je 0x10080cb5
xor esi, esi
cmp dword [0x101435f0], esi
jle 0x10080cb5
mov edi, 0x10142df8
cmp byte [esi + 0x101433d4], 1
jne 0x10080ca9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi*4 + 0x10143410]
cmp eax, dword [esi*4 + 0x10143500]
jb 0x10080ca9
mov ecx, dword [esi*4 + 0x101432a8]
shl ecx, 5
cmp dword [ecx + ebx + 0x45c4], 0
jne 0x10080ca9
movzx edx, word [ebx + 0x14]
push edx
push edi
call fcn.10006c90
add esp, 8
cmp al, 1
je 0x10080cc3
inc esi
add edi, 0x14
cmp esi, dword [0x101435f0]
jl 0x10080c64
pop edi
pop esi
mov dword [0x100ae398], 0x64
pop ebx
ret
lea eax, [esi + esi*4]
lea ecx, [eax*4 + 0x10142df8]
push 8
push ecx
call fcn.1003ae80
add esp, 8
pop edi
pop esi
mov dword [0x100ae398], 0xbd6
pop ebx
ret
Function at 0x10086786
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100ae8c8]
jne 0x10086790
repz ret
jmp fcn.10086ef9
Function at 0x101c3917
Capabilities:
Encode data using base64

Disassembly:
xor al, 0x3d
shl dword [esp + 4], cl
neg al
call fcn.1027ec21
mov eax, 0x17b68e08
movzx dx, byte [eax + ebp - 0x17b68e08]
xchg ah, al
movsx ecx, ax
mov cl, byte [eax + ebp - 0x17b6088c]
lea ebp, [ebp + eax*2 - 0x2f6c111a]
not eax
and ax, ax
or ax, ax
not dl
and eax, 0x6ba58b0
not cl
dec al
push eax
and dl, cl
sar dword [esp + eax*8 - 0x428178], 0x88
lea ecx, [eax + eax*2 - 0x504458e5]
mov word [ebp + eax*2 - 0x10a05e], dx
or word [esp + eax*2 - 0x10a05d], cx
bt ecx, 0x89
mov edx, dword [eax + edi - 0x8502f]
lea edi, [edi + eax*2 - 0x10a05a]
sar ax, 0x2a
xor edx, ebx
ror edx, 3
inc ax
xor dword [esp + eax - 0x80015], 0x5610833a
xor edx, 0x62322e2f
inc edx
not byte [esp + eax - 0x80013]
not edx
ror eax, 0xe7
cwde
ror edx, 1
sar dword [esp + eax*4 - 0x4000], 0xca
xor edx, 0x862c4d85
xadd dword [esp + eax*2 - 0x2000], ecx
lea edx, [edx + eax*4 + 0x65950711]
xor ebx, edx
and dword [esp + ecx*8 - 0xacf050], eax
cbw
call fcn.102160f0
dec dword [esp + edx*2]
lea ebp, [ebp + edx*8 - 4]
shr dx, 0xa7
jns 0x101dd0d1
mov dword [eax + ebp - 0x2e600005], ecx
movsx ecx, dl
jp 0x102302bb
jmp esi
mul dword [esp + edx]
mov edx, dword [ebp + edx*2 - 0xf6]
sar dword [esp + eax - 0x71400000], 3
shl eax, 0x21
jl 0x101d8daf
xor edx, ebx
cbw
bswap edx
shr al, 0x66
dec edx
ror byte [esp + 3], 4
push eax
push eax
ror edx, 2
movzx ecx, word [esp + 1]
lea edx, [edx + ecx*8 - 0x348b083c]
xor ebx, edx
sub ecx, eax
add esi, edx
mov edx, eax
pop ecx
pop edx
pop edx
jmp fcn.102a453e

Function at 0x101d89c4
Capabilities:
Manually build aes constants

Disassembly:
add eax, ecx
ror edx, 1
call fcn.10264fbd
mov ecx, 0x4329aaa
lea esi, [esi + ecx*2 - 0x8653558]
lea ecx, [ecx*8 + 0x5081d6ac]
movsx eax, cl
mov edx, ecx
mov edx, dword [esi + edx - 0x7216abfc]
call fcn.102b6d7c
mov edx, 0x4da60ab1
mov eax, edx
mov ecx, ebp
xor eax, edx
shr ax, 0x44
lea ebp, [ebp + eax - 2]
neg dl
mov word [edx + ebp - 0x4da60a4f], cx
mov edx, dword [edi + eax*2]
adc al, 0x1b
lea edi, [edi + eax - 0x18]
adc eax, eax
xor edx, ebx
movzx ecx, al
shr cx, 0x2f
neg eax
bswap edx
not eax
lea edx, [edx + eax*4 + 0x7b96d7d2]
rol ecx, 0xb2
rol ax, 0x65
neg edx
dec cx
inc edx
neg edx
lea ecx, [ecx*8 - 0x6efdc262]
ror edx, 3
push eax
add dword [esp + eax*2 - 0xdc0], 0x47a0afab
sbb edx, 0xaebbbfb5
xor ebx, edx
cwde
bts ecx, ecx
adc esi, edx
call fcn.10240a96
ror eax, cl
xor edx, ebx
dec edx
cwde
neg edx
neg cx
jb 0x101c7e68
mul eax
mov ax, word [ebp + eax*2 - 0x1abc6]
lea ebp, [edx + ebp + 2]
dec word [esp + edx*4 + 2]
adc cx, ax
inc dl
jg 0x102a5130
Function at 0x101d9523
Capabilities:
Manually build aes constants

Disassembly:
rol cl, cl
movzx edx, byte [esp + ecx - 0x2fb7857d]
lea eax, [eax + ecx*4 + 0x2938b77f]
sar dx, 0xec
ror eax, 3
dec eax
mov dword [esp + ecx - 0x2fb78581], edx
not cx
rol eax, 3
bts ecx, edx
xor ebx, eax
ror dx, 0x6a
adc esi, eax
call fcn.1020aa59
mov ecx, 0xc13ca204
sub edi, 2
movzx eax, word [edi]
xor ax, bx
rol cl, 0x85
adc ax, 0x822b
lea edx, [ecx + ecx*2 - 0x455bb8e9]
rol ax, 1
push ecx
and ecx, 0xc5bf6939
js 0x1022416b
sbb ax, 0x8a17
shr ecx, 0xa6
setne dl
xor ax, 0x4fba
rol byte [esp + ecx*2 - 0x609e0fd], 0xc4
jb 0x102aef0c
xor bx, ax
lea ebp, [ecx + ebp - 0x304f082]
dec edx
sar dword [esp + ecx*2 - 0x609e100], 0x36
mov word [ebp + ecx*8 - 0x18278400], ax
movzx eax, dx
sal dl, 0xc5
inc dword [esp + ecx - 0x304f080]
lea edi, [edi + ecx*8 - 0x18278404]
mov eax, dword [edi + ecx*8 - 0x18278400]
imul dx, dx
xor eax, ebx
lea eax, [eax + ecx - 0x7fa64e26]
not eax
sub eax, 0xc58f1f15
bswap ecx
rol dword [esp], 0xc1
neg eax
sub dword [esp], ecx
dec eax
sar ecx, 0x51
bswap eax
not word [esp + 1]
sub word [esp], 0x9c2b
sal dword [esp], 0x4a
xor ebx, eax
push ecx
bswap ecx
neg dword [esp + ecx - 0x78c0fffc]
add esi, eax
mov dword [esp + ecx - 0x78c0fffd], ecx
pop ecx
pop edx
jmp fcn.10257737
Function at 0x10208c64
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x49f7d692], ecx
add edi, edx
call fcn.101f95ec
cmp al, 1
sbb dword [esi], ecx
and bh, dl
aaa
adc byte [edx], 0x67
mov bh, 0xb7
and dl, byte [0xfbe46b0a]
out 0x50, al
loopne 0x10208cca
invalid
sti
push ebx
daa
pop eax
add ah, cl
sbb byte [ecx - 0x1b], ah
lahf
in eax, 0x9f
jmp 0xe793e742
pop edx
jae 0x10208c70
xor dword [edi + esi], esp
cmp byte [esi - 0x80], ah
mov dh, 0x1a
imul esi, dword [edi], 0xffffffbf
and dword [ebx + 5], edi
call 0x272459df
cmp esi, ebx
mov ebp, 0xf5f004eb
loopne 0x10208c92
frstor dword [esi - 0x7b]
loope 0x10208d04
push ebx
or cl, dl
xchg esi, eax
je 0x10208d15
xchg byte [eax - 0x18110ed], al
ja 0x10208ccf
fstp xword [eax]
ja 0x10208c96
mov byte [ecx], ah
fldcw word [edi + 0x4b3de38a]
mov word [esi + 0x3d6afe5c], ds
mov esp, ss
pop eax
scasd eax, dword es:[edi]
mov ah, bl
cmp eax, 0x5c9e8c4b
invalid
aam 0x58
sbb edi, eax
inc esp
inc edi
and edx, dword [eax + 0x62dc0668]
pushal
xor byte [ebx - 5], 0xa0
test dword [esi], edi
sub eax, 0x5758a852
lds edx, [esi]
sbb dword ss:[edx + 0x39], ebp
jg 0x10208cdb
push es
and edi, ebx
mov ah, 0x35
push ecx
mov ecx, 0xd6286381
arpl word [eax], bp
salc
add dword [edx - 0x4b], esi
mov ah, 0xbe
xchg esi, eax
syscall
xchg byte [edx + 0x7bd8355d], ah
sub ebx, ecx
xor dword cs:[edx + 0x5c9cd9d3], edi
jecxz 0x10208d2c
mov eax, dword [0x627e4551]
dec esi
test al, 0x26
inc ebp
in al, dx
pop ebx
in al, 0xa9
xchg esp, eax
cwde
test eax, 0x52c5e487
mov ebp, 0x76159086
dec ecx
mov ecx, dword [ecx]
dec eax
mov esp, 0x116c76fd
inc edx
in eax, 6
test eax, 0xa998c487
xchg esp, esp
lds edx, [edx - 0x43]
xchg byte [eax - 0x74b689eb], dl
or dword [eax - 0x44], ecx
std
jbe 0x10208dae
adc dword [edx - 0x1b], eax
push es
mov dword [edi - 0x777b5aae], esp
adc edx, ecx
ljmp 0x607
xchg dword [ecx], eax
or eax, 0x4908ed38
ficomp dword [ecx - 1]
add esp, edx
ret

Function at 0x1020d2c4
Capabilities:
Manually build aes constants

Disassembly:
not edx
neg edx
movzx eax, cx
mov dword [esp + eax - 0x541], eax
or ax, ax
sbb edx, 0xe097fc95
and eax, 0x63383308
sal word [esp + eax*4 - 0x3ff], cl
ror edx, 2
btr eax, ecx
sub eax, dword [esp + eax*2 - 0x200]
xor ebx, edx
sar ax, cl
inc cl
or eax, eax
adc ebp, edx
mov eax, dword [edi]
mov dl, byte [edi + 4]
neg cl
adc edi, 5
or ecx, ecx
call fcn.1029b7a5
Function at 0x10235c2d
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp + edx*2 - 0x74000000]
or dword [esp + ecx - 0x51c00003], 0xe2ac693d
lea ebp, [ebp + ecx - 0x51c00003]
mov dword [esp + ecx - 0x51c00007], ecx
dec ecx
mov dword [esp + ecx - 0x51c00002], edx
pop eax
popfd
call fcn.101d21f6
adc eax, esi
xor ebx, dword [eax]
mov ecx, 0x679bbca5
push eax
jle 0x10235c56
out 0x42, eax
std
mov byte [esi - 0x68], bl
mov ebp, dword [edi - 0x1f98589e]
dec ecx
push ecx
pop ecx
inc eax
cwde
outsd dx, dword [esi]
leave
mov byte [0x15c39167], al
pop esp
cwde
pop esp
push 0x61834be
rcl dword [ebp + 0x4f], 0x18
stc
dec edi
stosd dword es:[edi], eax
stc
pop es
in al, 0xb2
clc
lahf
pop edx
xchg cl, al
out 0xf5, eax
wait
mov bl, 0x43
push ss
pop esi
ja 0x10235d17
ret
add eax, 0x16462b35
popfd
test dh, 0x67
push ss
jle 0x10235c7f
sbb byte [ebx + 0x45c924e9], bh
inc eax
push ss
invalid
shr dword [eax + 0x66c355f], 1
invalid

Function at 0x102894f1
Capabilities:
Authenticate hmac

Disassembly:
btr edx, edx
xor ecx, 0x8bb45c86
sar eax, 0xc5
or dl, 0x16
lea edx, [edx*4 + 0x350f7e0a]
adc ecx, eax
inc edx
dec eax
xor ebx, ecx
shl ax, 0xea
dec edx
add ebp, ecx
lea ecx, [eax*4 + 0x1f9f6c95]
movzx ax, byte [edi + ecx*2 - 0x3f3e992a]
bts ecx, ecx
push edx
mov cl, byte [edi + ecx*2 - 0x3f7e9928]
xor edx, dword [esp]
sar word [esp + edx + 2], 0x66
lea edi, [edi + edx*2 + 2]
shr al, cl
jmp fcn.102c48d7
mov dword [esp + ecx - 0x1f9f10fa], eax
xchg dword [esp + ecx*2 - 0x3f3e21f4], ecx
ror dl, 1
shr word [esp], 0xab
dec ax
inc dl
call fcn.101f6d20
call fcn.10230cba
mov edx, 0xd35f806
lea esi, [edx + esi - 0xd35f80a]
movzx eax, dl
sal eax, 0x5c
bts edx, edx
mov ecx, dword [esi + edx*2 - 0x1a6bf08c]
shl dx, 2
mul ax
shl edx, 0x4b
xor ecx, ebx
xadd dl, dh
adc al, 0x3e
xor ecx, 0x7899741c
lea edx, [edx + eax*8 + 0x25123307]
xchg edx, eax
dec ecx
sar eax, 0x1f
jp 0x101f6bef

Function at 0x102a6db4
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + eax*4 - 0x31440af4]
xor edx, 0xa53faabd
sub ecx, 0x6235b732
div cl
mov dword [esp + ecx*2 - 0x658ce12], ecx
lea edx, [edx + eax - 0x65e46512]
pop ecx
sar ecx, 0xcc
sal ecx, cl
xor edx, 0x6c224206
call fcn.102550b1
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40611c
pop dword [ebp - 0x38]
mov eax, 0xf3e458b2
add eax, 0xc5c086a
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x859b7756
sub dword [ebp - 0x48], 0x3749320b
mov dword [ebp - 0x44], 0x59b139
add dword [ebp - 0x44], 0x31d99b0c
mov dword [ebp - 0x40], 0x42063bef
sub dword [ebp - 0x40], 0xf5b9f7c1
mov dword [ebp - 0x3c], 0x458c13cd
sub dword [ebp - 0x3c], 0x458c13cd
lea eax, [ebp - 0x48]
push eax
mov eax, 0xf6e58dfb
add eax, 0x95ae265
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x1a71dc17
sub dword [ebp - 0x48], 0xa5ff72c1
mov dword [ebp - 0x44], 0xb02c18af
add dword [ebp - 0x44], 0x914048c6
mov dword [ebp - 0x40], 0x583e0602
sub dword [ebp - 0x40], 0xf4ce9996
mov dword [ebp - 0x3c], 0x7a9045a5
sub dword [ebp - 0x3c], 0x7a9045a5
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x73d3923e
add eax, 0x8c6cdec2
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x326bf
push 0
call eax
mov ecx, 0x248d432a
add ecx, 0xdb72f417
mov ebx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x38]
mov edx, 0x18d443c3
add dword [ebp - 0x18], 0x6378b044
mov esi, dword [edi]
sub dword [ebp - 0x14], 0x126b5ce6
xor esi, edx
add dword [ebp - 0x1c], edi
mov dword [ebx], esi
add dword [ebp - 0x28], 0x512a5601
add ebx, 0x3aebd7d2
sub ebx, 0x3aebd7ce
add edi, 0x4cf58b0b
add edi, 0xb30a74f9
loop 0x406232
add eax, 0xfda63f5
add eax, 0xf0266be2
mov ebx, eax
add eax, 0x5eaed3f9
sub eax, 0x5eaed3f4
mov ecx, 0xf4092967
sub ecx, 0xf3c92967
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x7c34100e
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x7c38b2ac]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x7c3410c5
call edi
mov esi, eax
cmp esi, ebx
je 0x7c34800f
mov dword [0x7c38b2ac], 1
cmp esi, ebx
je 0x7c348030
cmp word [esi], bx
mov eax, esi
je 0x7c34106e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, ebp
cmp word [eax], bx
jne 0x7c341060
add eax, ebp
cmp word [eax], bx
jne 0x7c341060
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x7c3410b5
push ebp
call sym.MSVCR71.dll_malloc
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x7c3410b5
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x7c34803d
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
jne 0x7c348050
jmp 0x7c341044
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x7c348026
mov eax, ebp
mov dword [0x7c38b2ac], eax
jmp 0x7c3410c5
mov eax, dword [0x7c38b2ac]
jmp 0x7c3410c5
call edi
mov esi, eax
cmp esi, ebx
je 0x7c348058
jmp 0x7c34104c
push dword [esp + 0x10]
call sym.MSVCR71.dll_free
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x7c3410b1
cmp eax, ebp
je 0x7c34805f
cmp eax, ebx
je 0x7c34805f
xor eax, eax
jmp 0x7c3410be
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x7c348058
cmp byte [esi], bl
je 0x7c348079
inc eax
cmp byte [eax], bl
jne 0x7c34806f
inc eax
cmp byte [eax], bl
jne 0x7c34806f
sub eax, esi
inc eax
mov ebp, eax
push ebp
call sym.MSVCR71.dll_malloc
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x7c34808f
xor edi, edi
jmp 0x7c34809a
push ebp
push esi
push edi
call fcn.7c34a598
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
mov eax, edi
jmp 0x7c3410be
Function at 0x7c347632
Capabilities:
Terminate process

Disassembly:
push 8
call fcn.7c34a598
jmp 0x7c347643
pop ecx
pop ecx
push 0x7c38cc90
push 0x7c38cc88
call sym.MSVCR71.dll__initterm
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x7c3476ce
jmp 0x7c3476b6
pop ecx
ret
ret
push 8
push 0x7c37f0d0
call fcn.7c34230b
jmp 0x7c3423d9
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x7c390f88], esi
jne 0x7c347664
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x7c390f84], esi
mov al, byte [ebp + 0x10]
mov byte [0x7c390f80], al
cmp dword [ebp + 0xc], edi
jne 0x7c3423e7
cmp dword [0x7c38b2cc], edi
je 0x7c3476a2
mov eax, dword [0x7c38b2c8]
sub eax, 4
mov dword [0x7c38b2c8], eax
cmp eax, dword [0x7c38b2cc]
jb 0x7c3476a2
mov eax, dword [eax]
cmp eax, edi
je 0x7c347683
call eax
jmp 0x7c347683
push 0x7c38cca4
push 0x7c38cc94
call sym.MSVCR71.dll__initterm
jmp 0x7c3423e5
cmp dword [ebp + 0x10], edi
jne 0x7c3476e3
mov dword [0x7c390f88], esi
push dword [ebp + 8]
call fcn.7c348cd5
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x7c342407
push 8
call fcn.7c34a598
jmp 0x7c342406
call fcn.7c342346
jmp 0x7c342408

Function at 0x7c348cd5
Capabilities:
Terminate process

Disassembly:
push str.mscoree.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x7c348cfa
push str.CorExitProcess
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x7c348cfa
push dword [esp + 4]
call eax
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_ExitProcess]