joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c898
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov eax, 0x4cdc78
call fcn.004aad94
call fcn.00409aec
test al, al
je 0x49c945
push 8
call fcn.004a8e84
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x49c8df
mov word [ebp - 0x34], 0x14
mov eax, dword [ebp - 4]
call fcn.0047e7b4
mov word [ebp - 0x34], 8
mov ebx, dword [ebp - 4]
jmp 0x49c8e2
mov ebx, dword [ebp - 4]
mov word [ebp - 0x34], 0x20
mov edx, 0x4c6ffb
lea eax, [ebp - 8]
call fcn.004b4dd8
inc dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, ebx
call fcn.0047e7d8
dec dword [ebp - 0x28]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004b4f38
mov word [ebp - 0x34], 0x2c
mov edx, 0x4c6ffc
lea eax, [ebp - 0xc]
call fcn.004b4dd8
inc dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, ebx
call fcn.0047ec04
dec dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004b4f38
jmp 0x49ca28
mov dl, 1
mov eax, dword [0x423588]
call fcn.00423688
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.004b4d44
mov word [ebp - 0x34], 0x38
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea eax, [ebp - 0x10]
call fcn.004b4dd8
inc dword [ebp - 0x28]
mov edx, dword [eax]
mov cl, 1
mov eax, ebx
call fcn.0042378c
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004b4f38
pop ecx
test cl, cl
je 0x49c9fa
mov word [ebp - 0x34], 0x44
mov edx, 0x4c7036
lea eax, [ebp - 0x14]
call fcn.004b4dd8
inc dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, ebx
call fcn.00423d6c
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004b4f38
pop ecx
test cl, cl
je 0x49c9fa
mov word [ebp - 0x34], 0x50
mov edx, 0x4c703e
lea eax, [ebp - 0x18]
call fcn.004b4dd8
inc dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, ebx
call fcn.00423998
dec dword [ebp - 0x28]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004b4f38
mov eax, ebx
call fcn.004236f8
mov esi, ebx
mov dword [ebp - 0x20], esi
test esi, esi
je 0x49ca28
mov eax, dword [esi]
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x34], 0x68
mov edx, 3
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x34], 0x5c
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49de4c
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
push 0x94
push 0
lea eax, [esp + 8]
push eax
call fcn.004aa980
add esp, 0xc
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
jne 0x49de7f
mov byte [ebx], 3
jmp 0x49dea6
cmp dword [esp + 4], 6
jne 0x49de8b
mov byte [ebx], 1
jmp 0x49dea6
cmp dword [esp + 4], 5
jne 0x49de97
mov byte [ebx], 0
jmp 0x49dea6
cmp dword [esp + 4], 6
jbe 0x49dea3
mov byte [ebx], 2
jmp 0x49dea6
mov byte [ebx], 3
mov al, byte [ebx]
add esp, 0x94
pop ebx
ret
Function at 0x49e1fa
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
mov ebx, 0x4ce6a8
push 0
push 0x49e338
call sub.USER32.DLL_EnumWindows
cmp dword [ebx], 0
je 0x49e256
jmp 0x49e22f
push 0
mov eax, dword [ebx]
push eax
call sub.USER32.DLL_ShowWindow
push 0
push 2
push 0x111
mov edx, dword [ebx]
push edx
call sub.USER32.DLL_SendMessageA
push 1
call sub.KERNEL32.DLL_Sleep
mov ecx, dword [ebx]
push ecx
call sub.USER32.DLL_IsWindow
test eax, eax
jne 0x49e20d
xor eax, eax
mov dword [ebx], eax
xor edx, edx
mov dword [0x4ce6b4], edx
xor ecx, ecx
mov dword [0x4ce6b8], ecx
xor eax, eax
mov dword [0x4ce6bc], eax
mov eax, 1
pop ebx
ret

Function at 0x49e260
Capabilities:
Enumerate gui resources

Disassembly:
push 0
push 0x49e2d4
call sub.USER32.DLL_EnumWindows
cmp dword [0x4ce6a8], 0
je 0x49e2ce
jmp 0x49e2a7
push 0
push 0
push 0x201
mov eax, dword [0x4ce6ac]
push eax
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x202
mov edx, dword [0x4ce6ac]
push edx
call sub.USER32.DLL_SendMessageA
push 1
call sub.KERNEL32.DLL_Sleep
mov ecx, dword [0x4ce6a8]
push ecx
call sub.USER32.DLL_IsWindow
test eax, eax
jne 0x49e277
xor eax, eax
mov dword [0x4ce6a8], eax
xor edx, edx
mov dword [0x4ce6ac], edx
xor ecx, ecx
mov dword [0x4ce6b0], ecx
mov eax, 1
ret

Function at 0x49e8d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov eax, 0x4ce874
call fcn.004aad94
mov word [ebp - 0x18], 8
mov edx, dword [esi]
mov dword [edx], ebx
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
xor ecx, ecx
mov dword [edx + 0xc], ecx
mov eax, dword [esi]
mov dword [eax + 0x2c], 0xffffffff
mov edx, dword [0x4d72e4]
mov ecx, dword [edx]
mov dl, 1
mov eax, dword [0x441100]
call fcn.00442688
mov ebx, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
mov dword [eax + 0x30], ebx
mov dword [ebp - 0x30], fcn.0049ebac
mov edx, dword [esi]
mov eax, ebx
mov dword [ebp - 0x2c], edx
push dword [ecx + 4]
push dword [ecx]
call fcn.00442830
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
xor edx, edx
call fcn.00442810
mov ecx, dword [esi]
mov edx, 0x1388
mov eax, dword [ecx + 0x30]
call fcn.00442820
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x1c], eax
mov edx, dword [esi]
mov dword [edx + 4], edi
mov dl, 1
mov ecx, dword [0x4d72e4]
mov eax, dword [0x441100]
mov ecx, dword [ecx]
call fcn.00442688
mov ebx, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x38]
mov dword [eax + 0x34], ebx
mov dword [ebp - 0x38], fcn.0049eec4
mov edx, dword [esi]
mov eax, ebx
mov dword [ebp - 0x34], edx
push dword [ecx + 4]
push dword [ecx]
call fcn.00442830
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
xor edx, edx
call fcn.00442810
mov ecx, dword [esi]
mov edx, 0x3e8
mov eax, dword [ecx + 0x34]
call fcn.00442820
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afb5c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4afbbe
call fcn.004afb0c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004aaa60
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004aaa60
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4afc3c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4d5714], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4afd16
cmp dword [0x4d5710], 0
jne 0x4afd16
cmp dword [0x4d5914], 0
je 0x4afcd0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004afa0c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4afcb6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004afa0c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4afcb6
lea ebx, [ebp - 0x84]
jmp 0x4afcb7
inc ebx
call fcn.004afbf8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4afd51
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4d5718
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004aaa60
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4d571b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4afd51
cmp dword [0x4d5710], 0
je 0x4afd30
cmp dword [0x4d5710], 0xffffffff
je 0x4afd51
push esi
call dword [0x4d5710]
pop ecx
mov eax, dword [0x4d5714]
test eax, eax
je 0x4afd51
cmp dword [0x4d5714], 0xffffffff
je 0x4afd51
cmp byte [eax], 0
je 0x4afd51
push esi
push eax
call fcn.004afb5c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100037e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x10007140]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x10003843
push 0x74
push 1
call fcn.10004c50
add esp, 8
mov edi, eax
test edi, edi
je 0x10003839
push edi
mov eax, dword [0x10007140]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10003839
push edi
call fcn.100037c0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
jmp 0x10003843
push 0x10
call fcn.10002bc0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x10003960
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.100039f0
mov dword [0x10007180], 1
cmp dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
mov byte [0x1000717c], bl
jne 0x100039c1
cmp dword [0x10009268], 0
je 0x100039af
mov esi, dword [0x10009260]
sub esi, 4
cmp esi, dword [0x10009268]
jb 0x100039af
mov eax, dword [esi]
test eax, eax
je 0x100039a4
call eax
sub esi, 4
cmp esi, dword [0x10009268]
jae 0x1000399c
push 0x10007024
push 0x1000701c
call fcn.10003a10
add esp, 8
push 0x1000702c
push 0x10007028
call fcn.10003a10
add esp, 8
test ebx, ebx
je 0x100039df
call fcn.10003a00
pop esi
pop ebx
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10004500
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor eax, eax
mov ecx, 0x10007638
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [ecx], edx
je 0x10004528
add ecx, 8
inc eax
cmp ecx, 0x100076c0
jb 0x10004518
cmp dword [eax*8 + 0x10007638], edx
lea ebx, [eax*8]
jne 0x100046e3
cmp dword [0x10007124], 1
je 0x100046a8
cmp dword [0x10007124], 0
jne 0x1000455f
cmp dword [0x10007128], 1
je 0x100046a8
cmp edx, 0xfc
je 0x100046e3
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x1000459c
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x100045e0
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x1000770c
push ebp
call fcn.10004d50
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100076ec
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x1000763c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.10004cb0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x10009160]
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0x100046bf
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x1000763c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x10005440
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], edi
cmp ebp, edi
jne 0x10005468
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov edx, dword [esp + 0x42c]
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x10009160
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ebx, dword [esp + 0x18]
shl eax, 2
lea ecx, [eax + eax*8]
mov eax, dword [ebx]
mov dword [esp + 0x1c], ecx
test byte [eax + ecx + 4], 0x20
je 0x100054a9
push 2
push 0
push edx
call fcn.10005950
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x10005545
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x1000557e
lea esi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x1000550c
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x100054fa
mov byte [esi], 0xd
inc edi
inc esi
mov byte [esi], al
inc esi
mov eax, esi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x100054e1
lea eax, [esp + 0x24]
push 0
sub esi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push esi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10005574
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, esi
jge 0x100054cc
jmp 0x1000557e
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10005574
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x1000557e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x1000562a
cmp dword [esp + 0x10], 0
je 0x100055da
cmp dword [esp + 0x10], 5
jne 0x100055bd
call fcn.10005700
mov dword [eax], 9
call fcn.10005710
mov ecx, dword [esp + 0x10]
pop ebp
pop edi
mov dword [eax], ecx
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10005680
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x10005604
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x10005604
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
call fcn.10005700
mov dword [eax], 0x1c
call fcn.10005710
pop ebp
mov dword [eax], 0
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, edi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0xee9988
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax + 0x50], 0x98
add byte [eax], al
add bl, ch
jmp 0xee9992
add byte [esi], bl
or al, 0
add byte [eax], al
add byte [eax], al
jmp 0xee9992
pushal
call 0xee9998
pop ebp
sub ebp, 0x10
sub ebp, 0xae9988
jmp 0xee99ae
in eax, dx
mov byte [ecx + 0x4e900ae], bl
add byte [eax], al
add byte [edi - 0x18], ah
bound esp, qword [ecx]
mov eax, 0xae9988
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0x9009762d
xor byte [eax], dl
inc eax
dec ecx
jne 0xee99c5
jmp 0xee99d8
cmpsb byte [esi], byte es:[edi]
loopne 0xee9981
movsb byte es:[edi], byte [esi]
adc dword [0xecac2d2d], ebp
aad 0x2d
sub eax, 0x95e02e2d
sub ebp, dword [0x5972d2d]
sub eax, 0xcfda2d2d
in eax, 0xa6
lodsb al, byte [esi]
and dword [0xe82e2d2d], ebp
jge 0xee99a0
dec ecx
or ecx, edx
movsb byte es:[edi], byte [esi]
sub dword [ecx], ecx
inc ebp
loope 0xee99a7
or eax, 0xc894452d
mov al, byte [0x9012c2d]
inc ebp
lock xor dword [ebp - 0x4b], edi
lds ebp, [eax]
sub eax, 0x1dc42d2d
sub eax, 0x49a02d2d
or ecx, edx
movsb byte es:[edi], byte [esi]
add dword [ecx], ecx
mov al, byte [0xa62d0941]
test al, 0x25
sub eax, 0xb8a62d2d
and dword [0xa0a62d2d], ebp
cmp eax, 0xec2d2d2d
les ebp, [edi]
sbb al, 0x2f
scasb al, byte es:[edi]
out dx, eax
sub dword [edx - 0x58], esp
invalid
Function at 0x100036f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10003751
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10003734
cmp edi, 2
jb 0x10003734
cmp byte [esi], cl
jne 0x10003734
cmp byte [esi + 1], cl
jne 0x10003734
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10044448]
jmp 0x10003705
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10044448]
test edi, edi
jne 0x10003705
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10003780
cmp cl, 0x23
jne 0x10003767
cmp byte [esi], cl
jne 0x10003767
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10044448]
test cl, cl
jne 0x10003758
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10003890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100038a4
mov dword [ebx], 0
mov edx, 0x1004405c
call fcn.10003790
mov esi, eax
test esi, esi
je 0x10003992
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10003988
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003988
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x10003988
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003988
mov eax, dword [0x1005b8d8]
test eax, eax
je 0x1000391c
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x10003988
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000396d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1005b8d8]
add esp, 4
test eax, eax
je 0x1000395a
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1000397f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100063e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1004d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [edi + 0xec]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10044448]
sub esi, 1
jne 0x10006420
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10006457
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10018c00
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040c7b
mov esp, ebp
pop ebp
ret 4
Function at 0x10008510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x1005b8d8]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
mov eax, dword [esi + 0x47ec]
mov edx, dword [eax]
inc dword [esi + 0xa8]
mov ecx, dword [edi + 0x264]
mov dword [ebp - 4], edx
cmp dword [ecx + 0x7c], 1
jle 0x1000854f
push ecx
add ecx, 0x78
call fcn.10024b70
mov edx, dword [ebp - 4]
mov edi, dword [edi + 0x264]
mov esi, dword [edx + ebx*4 + 0x70]
mov eax, dword [edi]
test eax, eax
je 0x100085c2
cmp eax, 1
jne 0x10008573
mov eax, dword [edi + 8]
cmp dword [eax + 0x1c], 0
jne 0x10008573
cmp dword [eax + 0x20], 0
je 0x100085c2
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x100085a9
lea edx, [eax + 1]
mov dword [ebp - 8], edx
test ecx, ecx
je 0x10008594
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp - 8]
sar eax, 1
add eax, ecx
jmp 0x10008599
mov eax, 8
cmp eax, edx
mov ecx, esi
cmovg edx, eax
push edx
call fcn.10019380
mov edx, dword [ebp - 4]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov dword [eax + ecx*4], edi
inc dword [esi]
inc dword [edx + 0x3c]
mov eax, dword [edi + 0x18]
add dword [edx + 0x44], eax
mov eax, dword [edi + 0xc]
add dword [edx + 0x40], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x188]
mov eax, dword [eax + 0x180]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x10008602
nop dword [eax + eax]
mov ecx, dword [esi]
cmp byte [ecx + 0xaa], 0
je 0x100085fb
cmp byte [ecx + 0xb1], 0
jne 0x100085fb
mov edx, ebx
call fcn.10008510
add esi, 4
cmp esi, edi
jne 0x100085e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret