joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1028df90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.fatal_flex_scanner_internal_error__no_action_found
push 0x103558ba
push eax
call fcn.10003f70
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x102937c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ecx]
mov ebx, dword [eax + 4]
cmp byte [ebx + 0xd], 0
mov dword [ebp - 0x1c], edx
jne 0x10293862
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
mov dword [ebp - 0x20], eax
mov edx, dword [esi + 4]
mov esi, ebx
mov ecx, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
xor ebx, ebx
cmp edx, edi
setb bl
xor eax, eax
cmp dword [ebp - 0x20], ecx
setb al
cmove eax, ebx
mov ebx, eax
xor bl, 1
movzx ebx, bl
mov ebx, dword [esi + ebx*8]
cmp byte [ebx + 0xd], 0
je 0x102937f2
mov dword [ebp - 0x14], esi
test al, al
jne 0x1029386b
mov dword [ebp - 0x18], 0
mov eax, esi
xor ebx, ebx
cmp edi, edx
setb bl
xor edx, edx
cmp ecx, dword [ebp - 0x20]
setb dl
cmove edx, ebx
cmp dl, 1
je 0x10293882
mov edi, dword [ebp - 0x1c]
mov dword [edi], eax
xor eax, eax
mov byte [edi + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, edx
mov dword [ebp - 0x14], eax
mov esi, eax
jmp 0x10293871
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp esi, dword [eax]
jne 0x1029389f
mov ecx, dword [ebp - 0x24]
mov edx, edi
push dword [ebp + 8]
push esi
push 1
jmp 0x10293893
movzx eax, byte [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x1c]
mov edx, edi
push dword [ebp + 8]
push esi
push eax
call fcn.10294ce0
add esp, 0xc
mov al, 1
jmp 0x1029384b
lea edi, [ebp - 0x14]
mov ecx, edi
call fcn.1022b2d0
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
mov edx, dword [ebp + 8]
mov ebx, dword [edx]
mov dword [ebp - 0x20], ebx
mov edx, dword [edx + 4]
mov bl, 1
mov dword [ebp - 0x18], ebx
jmp 0x1029382d
Function at 0x10297ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], edx
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx]
mov edx, dword [esi + 4]
cmp byte [edx + 0xd], 0
mov ebx, dword [ebp + 8]
jne 0x10298040
mov dword [ebp - 0x18], ecx
mov edi, edx
add edx, 0x10
mov ecx, ebx
call fcn.10297c80
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov edx, dword [edi + ecx*8]
cmp byte [edx + 0xd], 0
je 0x10298017
mov dword [ebp - 0x14], edi
test al, al
je 0x102980ae
mov ecx, dword [ebp - 0x18]
jmp 0x10298045
mov dword [ebp - 0x14], esi
mov edi, esi
cmp edi, dword [esi]
jne 0x10298060
mov esi, dword [ebp - 0x1c]
mov edx, esi
push dword [ebp + 0xc]
push edi
push 1
call fcn.10297ea0
add esp, 0xc
mov al, 1
jmp 0x10298097
mov dword [ebp - 0x18], ecx
lea esi, [ebp - 0x14]
mov ecx, esi
call fcn.1022b2d0
mov al, 1
mov dword [ebp - 0x20], eax
mov esi, dword [esi]
lea ecx, [esi + 0x10]
mov edx, ebx
call fcn.10297c80
test al, al
jne 0x102980b9
push dword [ebp + 0xc]
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov esi, eax
xor eax, eax
mov byte [esi + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x20], 0
mov esi, edi
jmp 0x10298074
movzx eax, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edx, esi
push dword [ebp + 0xc]
push edi
push eax
jmp 0x10298054
Function at 0x102986c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [ebp - 0x14], edx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx edx, byte [edi + 1]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [edi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [edi + 3]
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [ecx + 0x18]
mov ebx, dword [ecx + 0xc]
mov edx, dword [ebx + eax*8]
add eax, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + 4]
mov esi, ecx
cmp edx, ecx
je 0x10298727
lea esi, [eax*4]
or esi, 4
mov esi, dword [ebx + esi]
mov esi, dword [esi]
mov dword [ebp - 0x18], ebx
mov edi, dword [edi]
cmp esi, edx
je 0x10298770
mov esi, dword [esi + 4]
cmp edi, dword [esi + 8]
jne 0x1029872c
mov eax, dword [ebp + 0xc]
mov edi, eax
mov eax, dword [eax]
mov edx, dword [edi + 4]
mov dword [edx], eax
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
dec dword [eax + 8]
push edi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov edi, dword [ebp - 0x14]
mov dword [edi], esi
xor eax, eax
mov byte [edi + 4], al
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov esi, dword [esi]
cmp edx, esi
mov edi, dword [ebp - 0x18]
je 0x102987ab
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov edi, dword [edi + 4]
mov dword [edi], esi
mov edi, dword [esi + 4]
mov dword [edi], edx
mov edi, dword [edx + 4]
mov dword [edi], ecx
mov edi, dword [edx + 4]
mov ebx, dword [esi + 4]
mov dword [edx + 4], ebx
mov ebx, dword [ecx + 4]
mov dword [esi + 4], ebx
mov dword [ecx + 4], edi
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
mov edi, dword [esi + 0xc]
mov esi, dword [edi + eax*4]
cmp esi, ecx
jne 0x102987d5
mov ebx, dword [ebp + 0xc]
mov dword [edi + eax*4], ebx
shl eax, 2
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
or eax, 4
mov dword [edx + eax], ebx
mov edi, dword [ebp - 0x14]
call fcn.10298810
mov dword [edi], ebx
mov al, 1
jmp 0x10298763
cmp esi, edx
jne 0x102987e7
mov ebx, dword [ebp + 0xc]
mov dword [edi + eax*4], ebx
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
jmp 0x102987ca
or eax, 1
mov edx, dword [edi + eax*4]
mov edx, dword [edx]
mov dword [edi + eax*4], edx
mov ebx, dword [ebp + 0xc]
cmp edx, ebx
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
je 0x102987ca
mov edx, dword [ecx + 0xc]
mov esi, dword [edx + eax*4]
mov esi, dword [esi + 4]
mov dword [edx + eax*4], esi
jmp 0x102987e2
Function at 0x102a1670
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
movzx esi, byte [eax + 1]
xor esi, edx
imul edx, esi, 0x1000193
movzx esi, byte [eax + 2]
xor esi, edx
imul edx, esi, 0x1000193
movzx esi, byte [eax + 3]
xor esi, edx
imul edi, esi, 0x1000193
and edi, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + edi*8]
add edi, edi
inc edi
mov dword [ebp - 0x18], edi
mov edi, edx
mov edx, ecx
mov ebx, dword [eax]
mov ecx, esi
cmp edi, esi
je 0x102a16e5
mov eax, dword [ebp - 0x18]
mov eax, dword [edx + eax*4]
mov eax, dword [eax]
cmp ecx, eax
je 0x102a1729
cmp dword [ecx + 8], ebx
je 0x102a16e9
mov ecx, dword [ecx]
jmp 0x102a16cc
mov eax, esi
jmp 0x102a16d8
mov dword [ebp - 0x1c], edx
mov edx, ecx
mov dword [ebp - 0x14], edi
cmp edi, esi
je 0x102a1714
mov edi, dword [ebp - 0x1c]
mov eax, ebx
mov ebx, dword [ebp - 0x18]
mov edi, dword [edi + ebx*4]
mov ebx, eax
mov edi, dword [edi]
cmp edx, edi
je 0x102a1718
cmp ebx, dword [edx + 8]
jne 0x102a1718
mov edx, dword [edx]
mov edi, dword [ebp - 0x14]
jmp 0x102a16f1
mov edi, esi
jmp 0x102a1704
cmp ecx, edx
mov edi, dword [ebp - 0x14]
je 0x102a1729
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x102a1731
mov eax, dword [ebp - 0x10]
mov dword [eax], edi
mov dword [eax + 4], edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x102a1740
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov dword [ebp - 0x10], edx
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx edx, byte [esi + 1]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 3]
xor edx, eax
imul edi, edx, 0x1000193
and edi, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + edi*8]
add edi, edi
inc edi
mov dword [ebp - 0x14], edi
mov edi, dword [esi]
mov ebx, eax
cmp edx, eax
je 0x102a17b0
mov esi, dword [ebp - 0x14]
mov esi, dword [ecx + esi*4]
mov esi, dword [esi]
cmp ebx, esi
je 0x102a17b4
cmp dword [ebx + 8], edi
je 0x102a17bb
mov ebx, dword [ebx]
jmp 0x102a1797
mov esi, eax
jmp 0x102a17a3
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
jmp 0x102a17c0
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102a7230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x10]
cmp dword [edi + 0x14], 0xf
jbe 0x102a7247
mov edi, dword [edi]
test esi, esi
mov dword [ebp - 0x18], edx
mov ebx, 0x811c9dc5
je 0x102a7266
xor eax, eax
movzx edx, byte [edi + eax]
xor edx, ebx
imul ebx, edx, 0x1000193
inc eax
cmp esi, eax
jne 0x102a7255
mov dword [ebp - 0x24], edi
and ebx, dword [ecx + 0x18]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + ebx*8]
add ebx, ebx
mov edi, eax
mov dword [ebp - 0x1c], eax
cmp ecx, eax
je 0x102a7292
lea eax, [ebx*4]
or eax, 4
mov eax, dword [edx + eax]
mov edi, dword [eax]
mov dword [ebp - 0x20], edx
cmp edi, ecx
mov dword [ebp - 0x14], ecx
je 0x102a72ca
mov edi, dword [edi + 4]
cmp esi, dword [edi + 0x18]
jne 0x102a72c6
cmp dword [edi + 0x1c], 0xf
jbe 0x102a72af
mov eax, dword [edi + 8]
jmp 0x102a72b2
lea eax, [edi + 8]
push esi
push eax
push dword [ebp - 0x24]
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
mov ecx, dword [ebp - 0x14]
je 0x102a732b
cmp edi, ecx
jne 0x102a729c
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
je 0x102a7306
mov edx, dword [edi + 4]
mov dword [edx], eax
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 0x14]
mov dword [edx], ecx
mov edx, dword [ecx + 4]
mov dword [edx], edi
mov esi, dword [ecx + 4]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov dword [edi + 4], esi
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + ebx*4]
cmp eax, edx
mov esi, dword [ebp - 0x18]
jne 0x102a736b
mov dword [ecx + ebx*4], edi
shl ebx, 2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0xc]
or ebx, 4
mov dword [eax + ebx], edi
call fcn.10224b40
mov al, 1
jmp 0x102a735c
mov eax, dword [ebp + 0xc]
mov esi, eax
mov eax, dword [eax]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x10]
dec dword [eax + 8]
lea ecx, [esi + 8]
call fcn.1021dbb0
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
xor eax, eax
mov esi, dword [ebp - 0x18]
mov dword [esi], edi
mov byte [esi + 4], al
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, dword [ebp - 0x14]
jne 0x102a7378
mov dword [ecx + ebx*4], edi
mov ecx, dword [ebp - 0x10]
jmp 0x102a7322
or ebx, 1
mov eax, dword [ecx + ebx*4]
mov eax, dword [eax]
mov dword [ecx + ebx*4], eax
cmp eax, edi
mov ecx, dword [ebp - 0x10]
je 0x102a7322
mov eax, dword [ecx + 0xc]
mov edx, dword [eax + ebx*4]
mov edx, dword [edx + 4]
mov dword [eax + ebx*4], edx
jmp 0x102a7322
Function at 0x102a7660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 0x10]
cmp dword [edi + 0x14], 0xf
jbe 0x102a7677
mov edi, dword [edi]
mov eax, 0x811c9dc5
test ebx, ebx
je 0x102a7693
xor edx, edx
movzx esi, byte [edi + edx]
xor esi, eax
imul eax, esi, 0x1000193
inc edx
cmp ebx, edx
jne 0x102a7682
mov dword [ebp - 0x18], edi
and eax, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x20], ecx
mov edi, dword [ecx + eax*8]
add eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov esi, edi
mov dword [ebp - 0x14], edx
cmp edx, edi
je 0x102a76d7
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax]
cmp esi, eax
je 0x102a7750
cmp dword [esi + 0x18], ebx
jne 0x102a76f2
cmp dword [esi + 0x1c], 0xf
jbe 0x102a76db
mov eax, dword [esi + 8]
jmp 0x102a76de
mov eax, edi
jmp 0x102a76bf
lea eax, [esi + 8]
push ebx
push dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
mov edx, dword [ebp - 0x14]
je 0x102a76f6
mov esi, dword [esi]
jmp 0x102a76b0
mov ecx, esi
cmp edx, edi
mov dword [ebp - 0x10], ecx
je 0x102a773f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
cmp ecx, eax
je 0x102a7743
cmp ebx, dword [ecx + 0x18]
jne 0x102a7743
cmp dword [ecx + 0x1c], 0xf
jbe 0x102a7721
mov eax, dword [ecx + 8]
jmp 0x102a7724
lea eax, [ecx + 8]
push ebx
push eax
push dword [ebp - 0x18]
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
jne 0x102a7743
mov ecx, dword [ecx]
jmp 0x102a76f8
mov eax, edi
jmp 0x102a770d
cmp esi, ecx
je 0x102a7750
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, ecx
jmp 0x102a7755
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], edx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x102a7dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x6c
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1d], 0x656e69
mov dword [ebp - 0x20], 0x69666564
mov ax, 0x66
mov word [ebp - 0x24], ax
mov dword [ebp - 0x28], 0x65646e75
xor ebx, ebx
mov byte [ebp - 0x2a], bl
mov word [ebp - 0x2c], 0x6669
mov word [ebp - 0x30], ax
mov dword [ebp - 0x34], 0x65646669
mov dword [ebp - 0x39], 0x666564
mov dword [ebp - 0x3c], 0x646e6669
mov byte [ebp - 0x40], bl
mov dword [ebp - 0x44], 0x65736c65
mov byte [ebp - 0x48], bl
mov dword [ebp - 0x4c], 0x66696c65
mov word [ebp - 0x50], ax
mov dword [ebp - 0x54], 0x69646e65
mov word [ebp - 0x58], 0x72
mov dword [ebp - 0x5c], 0x6f727265
mov dword [ebp - 0x61], 0x616d67
mov dword [ebp - 0x64], 0x67617270
mov word [ebp - 0x10], 0x6e
mov dword [ebp - 0x14], 0x6f69736e
mov dword [ebp - 0x18], 0x65747865
mov dword [ebp - 0x70], 0x6e6f69
mov dword [ebp - 0x74], 0x73726576
mov byte [ebp - 0x68], bl
mov dword [ebp - 0x6c], 0x656e696c
cmp dword [ecx], 0x102
je 0x102a7e94
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1021e470
mov eax, ebx
add esp, 0x6c
pop esi
pop ebx
pop ebp
ret
mov esi, ecx
add esi, 0x10
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.10239a50
test al, al
je 0x102a7ead
xor ebx, ebx
inc ebx
jmp 0x102a7e81
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 2
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 3
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 4
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 5
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 6
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 7
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 8
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x5c]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 9
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 0xa
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 0xb
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x74]
mov ecx, esi
push eax
call fcn.10239a50
mov ebx, 0xc
test al, al
jne 0x102a7e81
lea eax, [ebp - 0x6c]
mov ecx, esi
push eax
call fcn.10239a50
xor ecx, ecx
test al, al
mov ebx, 0xd
cmove ebx, ecx
jmp 0x102a7e81
Function at 0x102afe00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
cmp dword [edi + 0x14], 0xf
jbe 0x102afe17
mov edi, dword [edi]
test ebx, ebx
mov dword [ebp - 0x10], edx
mov eax, 0x811c9dc5
je 0x102afe36
xor edx, edx
movzx esi, byte [edi + edx]
xor esi, eax
imul eax, esi, 0x1000193
inc edx
cmp ebx, edx
jne 0x102afe25
mov dword [ebp - 0x14], edi
and eax, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ecx + eax*8]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x20], eax
mov esi, ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x102afe7a
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov eax, dword [eax + edi*4]
mov eax, dword [eax]
cmp esi, eax
je 0x102afe9d
cmp dword [esi + 0x18], ebx
jne 0x102afe99
cmp dword [esi + 0x1c], 0xf
jbe 0x102afe7e
mov edi, dword [esi + 8]
jmp 0x102afe81
mov eax, ecx
jmp 0x102afe66
lea edi, [esi + 8]
mov eax, dword [ebp - 0x14]
push ebx
push eax
push edi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
je 0x102afeaa
mov esi, dword [esi]
jmp 0x102afe57
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
push edi
push dword [ebp - 0x14]
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x102afec5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x102afea2
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
jmp 0x102afea2
Function at 0x4051cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e2a8]
jne 0x4051d5
repz ret
jmp fcn.0040b4d7

Function at 0x40bf4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407cac
and dword [ebp - 4], 0
cmp dword [0x438a04], 0
mov ebx, eax
jne 0x40bffb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c0ac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40c0ac
push eax
call fcn.00407c3a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x438a04], eax
call esi
push eax
call fcn.00407c3a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x438a08], eax
call esi
push eax
call fcn.00407c3a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x438a0c], eax
call esi
push eax
call fcn.00407c3a
pop ecx
mov dword [0x438a14], eax
test eax, eax
je 0x40bffb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407c3a
pop ecx
mov dword [0x438a10], eax
mov eax, dword [0x438a10]
cmp eax, ebx
je 0x40c053
cmp dword [0x438a14], ebx
je 0x40c053
push eax
call fcn.00407cb5
push dword [0x438a14]
mov esi, eax
call fcn.00407cb5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c053
test edi, edi
je 0x40c053
call esi
test eax, eax
je 0x40c04a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c04a
test byte [ebp - 0xc], 1
jne 0x40c053
or dword [ebp + 0x10], 0x200000
jmp 0x40c08c
mov eax, dword [0x438a08]
cmp eax, ebx
je 0x40c08c
push eax
call fcn.00407cb5
pop ecx
test eax, eax
je 0x40c08c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c08c
mov eax, dword [0x438a0c]
cmp eax, ebx
je 0x40c08c
push eax
call fcn.00407cb5
pop ecx
test eax, eax
je 0x40c08c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x438a04]
call fcn.00407cb5
pop ecx
test eax, eax
je 0x40c0ac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c0ae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100144ea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100144f9
pop dword [ebp - 0x20]
mov eax, 0x947d8ea7
add eax, 0x7b83b652
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3de77
push 0
mov eax, 0x598310e4
add eax, 0xb67ee0f8
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x4e98
mov edx, eax
mov ebx, 0xad28942e
add ebx, 0x62df4dd2
add ebx, dword [ebp - 0x20]
mov esi, 0xb99f90c4
sub esi, 0x58c5f1b5
xor dword [ebp - 0x1c], eax
mov edi, dword [ebx]
xor dword [ebp - 0x10], ecx
xor edi, esi
add dword [ebp - 0x1c], ecx
mov dword [edx], edi
mov dword [ebp - 4], 0xa8d592f7
add edx, 4
add ebx, 0x473d4688
add ebx, 0xb8c2b97c
loop 0x10014552
add eax, 0xd36a74b7
sub eax, 0xd3694784
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb6ad17bd
add ecx, 0x5952e843
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x407b70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47b8bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004707cb
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x407bf2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046e71a
mov eax, dword [eax]
push 0x4931f0
push eax
call fcn.004611c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00470a56
test bl, bl
je 0x407bf2
push 0x4931f0
lea ecx, [esp + 0xc]
call fcn.00470de6
push 0x496d3c
lea ecx, [esp + 0xc]
call fcn.00470de6
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x407c2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00470a56
jmp 0x407cf9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x407cb2
lea edx, [esp + 0x7c]
push 0x496d38
push edx
call fcn.004611c4
add esp, 8
test eax, eax
je 0x407cb2
lea eax, [esp + 0x7c]
push 0x496d34
push eax
call fcn.004611c4
add esp, 8
test eax, eax
je 0x407cb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x407c42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00470a56
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4084f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x408552
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc