joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a20
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404428
push 0x403c12
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT40.dll___set_app_type]
add esp, 4
mov dword [0x40547c], 0xffffffff
mov eax, dword [0x40547c]
mov dword [0x405480], eax
call dword [sym.imp.MSVCRT40.dll___p__fmode]
mov ecx, dword [0x40539c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT40.dll___p__commode]
mov ecx, dword [0x405398]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT40.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x405478], eax
call fcn.00403c10
cmp dword [0x405394], 0
jne 0x403ab0
push 0x403c00
call dword [sym.imp.MSVCRT40.dll___setusermatherr]
add esp, 4
call fcn.00403be0
push 0x405014
push 0x405010
call sub.MSVCRT40.dll__initterm
add esp, 8
mov eax, dword [0x405390]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x40538c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCRT40.dll___getmainargs]
add esp, 0x14
push 0x40500c
push section..data
call sub.MSVCRT40.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT40.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x403b24
mov al, byte [ebp - 0x40]
inc esi
mov al, byte [esi]
test al, al
je 0x403b1c
cmp al, 0x22
jne 0x403b11
cmp byte [esi], 0x22
jne 0x403b2e
inc esi
jmp 0x403b2e
cmp al, 0x20
jbe 0x403b2e
inc esi
cmp byte [esi], 0x20
ja 0x403b28
cmp byte [esi], 0
je 0x403b3e
cmp byte [esi], 0x20
ja 0x403b3e
inc esi
cmp byte [esi], 0
jne 0x403b33
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x5c], 1
mov eax, 0xa
je 0x403b65
mov eax, dword [ebp - 0x58]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT40.dll_exit]
jmp 0x403ba8
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401030
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push 0x423284
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.00408480
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401084
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push 0x423290
call fcn.004023e0
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.0040c4cf
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010b8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push 0x4232d8
push 0x42331c
call fcn.00402280
add esp, 0xc
jmp 0x4011e0
push 0x2000
call fcn.0040c4cf
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010ea
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push 0x423328
push 0x42331c
call fcn.00402280
add esp, 0xc
jmp 0x4011e0
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401119
ja 0x401112
cmp eax, 0x2000
jbe 0x401119
mov esi, 0x2000
jmp 0x40111b
mov esi, eax
mov eax, dword [esp + 0x5c]
push dword [eax]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040b82e
add esp, 0x10
cmp eax, esi
jne 0x4011db
mov eax, dword [esp + 0x5c]
push dword [eax]
call fcn.0040b61c
add esp, 4
test eax, eax
jne 0x4011db
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00406b10
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x401190.1
movzx ecx, byte [ecx + 0x401264]
jmp dword [ecx*4 + 0x401258]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401204
push ebp
push esi
push 1
push ebx
call fcn.0040c446
add esp, 0x10
cmp eax, esi
jne 0x4011c2
push ebp
call fcn.0040b61c
add esp, 4
test eax, eax
je 0x401215
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push 0x423370
call fcn.004023e0
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.004082c0
push dword [esp + 0x14]
call fcn.0040c4b4
push ebx
call fcn.0040c4b4
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401219
push esi
push ebx
push edi
call fcn.0040a280
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401162
cmp eax, 1
je 0x401253
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401237
cmp dword [esp + 0x10], ecx
jbe 0x4011c5
mov eax, dword [esp + 0x10]
jmp 0x401105
mov eax, 0xfffffffd
jmp 0x4011c5
cmp eax, 1
jne 0x4011c5
xor esi, esi
jmp 0x4011de
Function at 0x401290
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
mov edx, dword [ebp]
test edx, edx
jne 0x4012d1
lea eax, [ebp + 0x70]
push 0x423280
push eax
call fcn.00403600
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4012d1
mov eax, dword [esp + 0x10]
add eax, 0x12
push eax
push 0x423468
call fcn.004023e0
add esp, 8
xor eax, eax
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [ebp + 8]
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040bc25
add esp, 0x10
test eax, eax
jns 0x40130e
lea eax, [ebx + 0x12]
push eax
push 0x42349c
push 0x4234d8
call fcn.00402280
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
pop ecx
ret
push esi
push edi
push dword [ebx + 0xc]
call fcn.0040c4cf
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
jne 0x401340
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push 0x4234e0
push 0x42331c
call fcn.00402280
add esp, 0x10
jmp 0x4013bb
cmp byte [ebx + 0x10], 1
jne 0x401364
push esi
push 0
push ebx
push ebp
call fcn.00401030
add esp, 0x10
test eax, eax
je 0x4013bb
push esi
call fcn.0040c4b4
add esp, 4
xor esi, esi
jmp 0x4013bb
mov eax, esi
mov esi, dword [ebx + 0xc]
xor ebx, ebx
mov dword [esp + 0x10], eax
test esi, esi
je 0x4013b7
test ebx, ebx
jb 0x401388
ja 0x401381
cmp esi, 0x2000
jbe 0x401388
mov edi, 0x2000
jmp 0x40138a
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040b82e
add esp, 0x10
cmp eax, 1
jb 0x4013da
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
add eax, edi
mov dword [esp + 0x10], eax
test ebx, ebx
ja 0x401381
jb 0x4013b7
test esi, esi
jne 0x401373
mov esi, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
je 0x4013d2
push eax
call fcn.0040b56c
add esp, 4
mov dword [ebp], 0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x1c]
add eax, 0x12
push eax
push 0x4233f0
push 0x423424
call fcn.00402280
mov esi, dword [esp + 0x24]
add esp, 0xc
push esi
call fcn.0040c4b4
add esp, 4
xor esi, esi
jmp 0x4013bb
Function at 0x401410
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push ebp
call fcn.00405a20
add esp, 4
cmp eax, 0xffffffff
jne 0x40142d
or eax, eax
pop ebp
add esp, 0xc
ret
push ebx
push esi
mov esi, dword [esp + 0x20]
lea eax, [ebp + 0x2070]
push edi
lea ebx, [esi + 0x12]
push ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.00405cf0
mov edi, eax
add esp, 8
mov dword [esp + 0x18], edi
test edi, edi
jne 0x401473
push ebx
push 0x423524
push 0x423558
call fcn.00402280
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
mov edx, dword [ebp]
test edx, edx
jne 0x4014aa
lea eax, [ebp + 0x70]
push 0x423280
push eax
call fcn.00403600
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4014aa
push ebx
push 0x423468
call fcn.004023e0
add esp, 8
or edi, 0xffffffff
jmp 0x4015d0
mov ecx, dword [esi + 4]
xor eax, eax
add ecx, dword [ebp + 8]
push 0
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040bc25
add esp, 0x10
test eax, eax
jns 0x4014e1
push ebx
push 0x42349c
push 0x4234d8
call fcn.00402280
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015d0
cmp byte [esi + 0x10], 1
jne 0x4014fb
push 0
push edi
push esi
push ebp
call fcn.00401030
add esp, 0x10
mov edi, eax
jmp 0x4015d0
push 0x2000
xor edi, edi
call fcn.0040c4cf
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40152d
push ebx
push 0x4233b4
push 0x42331c
call fcn.00402280
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015d0
mov esi, dword [esi + 0xc]
xor ebx, ebx
test esi, esi
je 0x4015c7
nop word [eax + eax]
test ebx, ebx
jb 0x401555
ja 0x40154e
cmp esi, 0x2000
jbe 0x401555
mov edi, 0x2000
jmp 0x401557
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040b82e
add esp, 0x10
cmp eax, 1
jb 0x4015aa
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040c446
add esp, 0x10
cmp eax, 1
jb 0x40159a
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
test ebx, ebx
ja 0x40154e
jb 0x401596
test esi, esi
jne 0x401540
xor edi, edi
jmp 0x4015c3
push dword [esp + 0x14]
push 0x42342c
push 0x423460
jmp 0x4015b8
push dword [esp + 0x14]
push 0x4233f0
push 0x423424
call fcn.00402280
add esp, 0xc
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.0040c4b4
add esp, 4
mov eax, dword [ebp]
test eax, eax
je 0x4015e7
push eax
call fcn.0040b56c
add esp, 4
mov dword [ebp], 0
push dword [esp + 0x18]
call fcn.0040b56c
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
Function at 0x4058f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.00409620
mov eax, dword [0x430014]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1018]
push 0x423280
push eax
call fcn.00403600
push esi
push edi
mov ebx, eax
call fcn.00405cf0
add esp, 0x10
xor edi, edi
mov esi, eax
test ebx, ebx
je 0x4059ef
push ebx
test esi, esi
je 0x4059f4
call fcn.0040b5f0
add esp, 4
test eax, eax
jne 0x4059c6
nop dword [eax + eax]
push ebx
push 0x1000
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040b82e
add esp, 0x10
test eax, eax
jne 0x405989
push ebx
call fcn.0040b61c
add esp, 4
test eax, eax
je 0x4059ab
push ebx
jmp 0x4059bb
push esi
push eax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040c446
add esp, 0x10
test eax, eax
je 0x4059ba
push esi
call fcn.0040b61c
add esp, 4
test eax, eax
jne 0x4059ba
push ebx
call fcn.0040b5f0
add esp, 4
test eax, eax
je 0x405960
jmp 0x4059c6
push esi
call fcn.00411959
add esp, 4
or edi, 0xffffffff
push ebx
call fcn.0040b56c
push esi
call fcn.0040b56c
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00409609
add esp, 0x1004
ret
test esi, esi
je 0x4059fc
push esi
call fcn.0040b56c
add esp, 4
mov ecx, dword [esp + 0x100c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00409609
add esp, 0x1004
ret
Function at 0x409f42
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x42304c]
test eax, eax
je 0x409f81
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409f81
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409f81
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409f81
cmp dword [ecx + 0x74], 0xe
jbe 0x409f81
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x414932
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004147a8

Function at 0x41b625
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b652
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b652
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0xef5c3c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef5c46
pushal
call 0xef5c4c
pop ebp
sub ebp, 0x10
sub ebp, 0xaf5c3c
jmp 0xef5c62
mov eax, 0xaf5c3c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d0
add byte [eax], al
add byte [ecx + 0x5d0], bh
mov edx, 0x9abba1c8
xor byte [eax], dl
inc eax
dec ecx
jne 0xef5c79
jmp 0xef5c8c
inc ebx
add eax, 0xc8f44143
enter 0x49c8, 9
xor al, cl
enter 0xffffffffffffcbc8, 5
jo 0xef5c6c
enter 0xffffffffffffc8c8, 0x72
loopne 0xef5c6c
enter 0x3fc8, 0x2a
retf
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40596d
pop dword [ebp - 0x4c]
mov eax, 0xb6d57af1
add eax, 0x496ade7c
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x83b0e72b
add dword [ebp - 0x5c], 0xcaa15e20
mov dword [ebp - 0x58], 0x603b9469
add dword [ebp - 0x58], 0xd1f7b7dc
mov dword [ebp - 0x54], 0xd2c81408
add dword [ebp - 0x54], 0x79843026
mov dword [ebp - 0x50], 0x9cc59330
add dword [ebp - 0x50], 0x633a6cd0
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xa375e3d3
add eax, 0x5cca8c8d
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x7a86ada3
sub dword [ebp - 0x5c], 0x614444d
mov dword [ebp - 0x58], 0xc9acfa5b
add dword [ebp - 0x58], 0x77bf671a
mov dword [ebp - 0x54], 0x32c87585
sub dword [ebp - 0x54], 0xcf590919
mov dword [ebp - 0x50], 0x831f1fa6
sub dword [ebp - 0x50], 0x831f1fa6
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x2ffddb6b
add eax, 0xd0429595
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x37b8f
push 0
call eax
mov ecx, 0xb6de637c
sub ecx, 0xb6de1776
mov edx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x4c]
mov ebx, 0x678b49bf
add dword [ebp - 0x18], edx
mov edi, dword [esi]
add edi, ebx
mov dword [ebp - 0x30], 0x1768f162
mov dword [edx], edi
xor dword [ebp - 0x24], 0x89fe53eb
add edx, 4
add esi, 4
loop 0x405a83
add eax, 0xfb72800a
sub eax, 0xfb715d1f
xor ebx, ebx
add ebx, eax
add eax, 0xcdbcf151
add eax, 0x32430eb4
mov ecx, 0x5c7fd8fd
add ecx, 0xa3c02703
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x1007f669
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1007f6a8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1007f6a8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1007f6a8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1007f6a8
cmp dword [ecx + 0x74], 0xe
jbe 0x1007f6a8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10080480
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100804ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100804ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100807d0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008b608
push 0x1008b600
push str.FlsAlloc
push 0x1f
call fcn.10080ab3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10080804
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1008080a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1008084e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008b618
push 0x1008b610
push str.FlsGetValue
push 0x21
call fcn.10080ab3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10080885
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1008088d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1008b620
push 0x1008b618
push str.FlsSetValue
push 0x22
call fcn.10080ab3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100808c7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10083b70
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10083c0d
push ebx
push esi
call fcn.10083c10
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10083a74
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10083bba
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10083c0c
push edi
push eax
call fcn.10083c47
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10083bda
call fcn.10081d80
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10083c0b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10083a74
add esp, 0x20
test eax, eax
jne 0x10083bf9
push edi
call fcn.10081d80
jmp 0x10083c01
push ebx
call fcn.10081d80
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1000db80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057176
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x18], 0
je 0x1000dcaf
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::tempName_void_
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x14], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000dbf0
test cl, cl
je 0x1000dbf0
push dword [edi + 0x2c]
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::tempName_void_
mov eax, dword [esi + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::tempName_void_
mov edi, eax
test edi, edi
jne 0x1000dc30
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dc30
mov eax, dword [esi + 4]
push dword [eax + 0x18]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, dword [esi + 4]
add esp, 4
push dword [ecx + 0x18]
test eax, eax
je 0x1000dc74
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::tempName_void_
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x24]
jl 0x1000dc92
jg 0x1000dc8c
cmp eax, dword [ecx + 0x20]
jbe 0x1000dc92
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::tempName_void_
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000f0e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000f0ef
pop dword [ebp - 0x28]
mov eax, 0xe180f05c
add eax, 0x2e800093
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xdbd7d616
add dword [ebp - 0x38], 0x727a6f35
mov dword [ebp - 0x34], 0xeceff360
add dword [ebp - 0x34], 0x454358e5
mov dword [ebp - 0x30], 0x89beb3be
add dword [ebp - 0x30], 0xc28d9070
mov dword [ebp - 0x2c], 0x31c7d9aa
add dword [ebp - 0x2c], 0xce382656
lea eax, [ebp - 0x38]
push eax
mov eax, 0xb3e8e88e
sub eax, 0xa3e3286e
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x2de86716
add dword [ebp - 0x38], 0x468a0240
mov dword [ebp - 0x34], 0xa693dbf9
sub dword [ebp - 0x34], 0x65277a84
mov dword [ebp - 0x30], 0xed5b2db7
sub dword [ebp - 0x30], 0x89ebc14b
mov dword [ebp - 0x2c], 0x7d6d155d
sub dword [ebp - 0x2c], 0x7d6d155d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x55145
push 0
call eax
mov ecx, 0x4f49
xor edx, edx
add edx, eax
mov esi, 0xa04dae16
add esi, 0x6fbb6dea
add esi, dword [ebp - 0x28]
mov ebx, 0xb5ddff8e
xor dword [ebp - 0xc], esi
mov edi, dword [esi]
mov dword [ebp - 0x18], 0xd31edcb7
sub edi, ebx
mov dword [edx], edi
xor dword [ebp - 4], edi
add edx, 0x4febacb8
add edx, 0xb014534c
add esi, 0x53d57be7
sub esi, 0x53d57be3
loop 0x1000f202
add eax, 0xa7b08716
sub eax, 0xa7af571f
mov ebx, eax
add eax, 0x34588837
add eax, 0xcba777ce
mov ecx, 0x66b86b7a
add ecx, 0xa9479486
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x10010090
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::tempName_void_
cwde
test eax, eax
je 0x100100c2
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x100100b9
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033310
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033540
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x10035310
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call sym.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::tempName_void_
mov ebx, eax
test ebx, ebx
je 0x1003547c
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1003535c
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x10035358
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1003535c
mov edi, eax
jmp 0x10035340
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10035474
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x10035474
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x10035474
test edi, edi
je 0x10035474
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x10035474
cmp eax, edi
je 0x10035474
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035421
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100544a0
mov esp, ebp
pop ebp
ret