joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8c858
Capabilities:
Hash data using murmur3

Disassembly:
ror edx, 0x13
add dword [0xf2796], 0xd67a623e
rol edx, 4
xor eax, ecx
rol eax, 1
and dword [0xf24f9], edi
add eax, 0x95241db3
xor edi, ebx
not ecx
mov ecx, 0x3b6b9480
dec ecx
neg edx
xor esi, ebp
xor dword [0xf23d7], ebx
xor edi, eax
dec ecx
add edi, 0x31fda440
std
xor dword [ebx], esi
cmp eax, 0xf2cae
sub edi, 0x3cabc8bd
add eax, dword [0xf29fb]
add edi, 0x3cabc8bd
sub edi, 0x31fda440
inc ecx
xor edi, eax
xor esi, ebp
neg edx
inc ecx
xor ecx, 0x6a08f28
neg esi
xor ebx, 0x69791499
neg edx
sub edi, 0xa6eea74a
sub dword [0xf23a7], ecx
add edi, 0xcda50bb9
xor dword [0xf2651], edx
xor edx, dword [0xf2e6a]
dec esi
call fcn.000c9366
xor edi, 0xf3477635
rol edx, 0xd
xor ebx, 0xfe71822d
and dword [0xf2408], eax
call fcn.000bd31c
call fcn.000b7b28
or dword [0xf27df], edx
xor ebx, 0xfe71822d
ror edx, 0xd
xor edi, 0xf3477635
inc esi
or dword [0xf22fc], edx
sub edi, 0xcda50bb9
sub dword [0xf279f], edi
add edi, 0xa6eea74a
neg edx
xor ebx, 0x69791499
imul esi, edi, 0x3ce981de
scasd eax, dword es:[edi]
pop ebx
fimul dword [ecx]
cmp eax, 0xf2511
xor ebx, 0xc4170864
mov dword [0xf242d], eax
xor esi, dword [0xf2d92]
xor ecx, edi
xor ebx, dword [0xf2a92]
call fcn.000b4114
not edi
add edi, dword [0xf2d0a]
sub ecx, dword [0xf2a3a]
sub esi, dword [0xf2d07]
not edi
call fcn.00040ccf
xor ecx, edi
add dword [0xf237e], esi
xor ebx, 0xc4170864
sub dword [0xf241e], eax
push ecx
dec ecx
add dword [0xf22ab], edi
xor eax, ecx
neg ebx
sub edx, edi
or dword [0xf23ff], eax
xor edx, ebp
mov dword [0xf2495], 0xf55651e1
sub edx, dword [0xf2ba1]
call fcn.00061d24
call fcn.00067d93
or dword [0xf266d], 0x17fa686e
xor edx, ebp
xor dword [0xf2820], ecx
add edx, edi
neg ebx
xor eax, ecx
inc ecx
mov ecx, 0x5cccdd32
not ebx
xor ecx, dword [0xf2b0e]
dec esi
invalid
int1
aas
invalid
Function at 0x8c908
Capabilities:
Hash data using murmur3

Disassembly:
ror edx, 0x13
add dword [0xf2796], 0xd67a623e
rol edx, 4
xor eax, ecx
rol eax, 1
and dword [0xf24f9], edi
add eax, 0x95241db3
xor edi, ebx
not ecx
mov ecx, 0x3b6b9480
dec ecx
neg edx
xor esi, ebp
xor dword [0xf23d7], ebx
xor edi, eax
dec ecx
add edi, 0x31fda440
std
xor dword [ebx], esi
cmp eax, 0xf2cae
sub edi, 0x3cabc8bd
add eax, dword [0xf29fb]
add edi, 0x3cabc8bd
sub edi, 0x31fda440
inc ecx
xor edi, eax
xor esi, ebp
neg edx
inc ecx
xor ecx, 0x6a08f28
neg esi
xor ebx, 0x69791499
neg edx
sub edi, 0xa6eea74a
sub dword [0xf23a7], ecx
add edi, 0xcda50bb9
xor dword [0xf2651], edx
xor edx, dword [0xf2e6a]
dec esi
call fcn.000c9366
xor edi, 0xf3477635
rol edx, 0xd
xor ebx, 0xfe71822d
and dword [0xf2408], eax
call fcn.000bd31c
call fcn.000b7b28
or dword [0xf27df], edx
xor ebx, 0xfe71822d
ror edx, 0xd
xor edi, 0xf3477635
inc esi
or dword [0xf22fc], edx
sub edi, 0xcda50bb9
sub dword [0xf279f], edi
add edi, 0xa6eea74a
neg edx
xor ebx, 0x69791499
imul esi, edi, 0x3ce981de
scasd eax, dword es:[edi]
pop ebx
fimul dword [ecx]
cmp eax, 0xf2511
xor ebx, 0xc4170864
mov dword [0xf242d], eax
xor esi, dword [0xf2d92]
xor ecx, edi
xor ebx, dword [0xf2a92]
call fcn.000b4114
not edi
add edi, dword [0xf2d0a]
sub ecx, dword [0xf2a3a]
sub esi, dword [0xf2d07]
not edi
call fcn.00040ccf
xor ecx, edi
add dword [0xf237e], esi
xor ebx, 0xc4170864
sub dword [0xf241e], eax
push ecx
dec ecx
add dword [0xf22ab], edi
xor eax, ecx
neg ebx
sub edx, edi
or dword [0xf23ff], eax
xor edx, ebp
mov dword [0xf2495], 0xf55651e1
sub edx, dword [0xf2ba1]
call fcn.00061d24
call fcn.00067d93
or dword [0xf266d], 0x17fa686e
xor edx, ebp
xor dword [0xf2820], ecx
add edx, edi
neg ebx
xor eax, ecx
inc ecx
mov ecx, 0x5cccdd32
not ebx
xor ecx, dword [0xf2b0e]
dec esi
invalid
int1
aas
invalid

Function at 0x8cab0
Capabilities:
Hash data using murmur3

Disassembly:
sbb cl, al
rcl byte [edx], 3
shr eax, cl
clc
mov dl, 0
add al, ch
push edi
cld
jmp [ebx]
Function at 0x8d314
Capabilities:
Hash data using murmur3

Disassembly:
neg eax
inc ecx
rol edx, 0x19
xor ecx, 0xd1c7587c
call fcn.000258bc
add ebx, edi
xchg edi, esi
inc esi
push 0x72108
or ebx, dword [0xf2ce9]
sub dword [0xf278e], ecx
sub eax, ebx
neg ebx
dec ecx
xor ecx, edi
call fcn.0003f7a8
sub dword [0xf24fc], edx
or esi, dword [0xf2f00]
or dword [0xf2717], eax
dec ecx
add eax, dword [0xf2ce6]
add ecx, dword [0xf2d6f]
neg esi
xor edx, dword [0xf2bb9]
call fcn.0003a385
neg esi
inc ecx
and dword [0xf28aa], eax
xor dword [0xf23be], ebx
xor ecx, edi
inc ecx
neg ebx
add eax, ebx
xor dword [0xf2763], eax
mov edi, 0xbf5f5281
ror edi, 1
xor edi, ebp
rol edi, 0x1b
add edi, dword [0xf28f9]
add dword [0xf230e], eax
mov dword [0xf27af], ebx
neg edx
dec eax
neg eax
xor ebx, edx
neg esi
dec edi
ror edx, 0xf
neg esi
sub edx, dword [0xf2e49]
call fcn.000a7c10
add ebx, 0x55979040
ror esi, 0x19
rol esi, 0x19
sub ebx, 0x55979040
call fcn.00014ff7
neg esi
rol edx, 0xf
inc edi
neg esi
xor ebx, edx
neg eax
inc eax
neg edx
and dword [0xf23a7], ebx
mov dword [0xf2599], edi
ror edi, 0x1b
xor edi, ebp
rol edi, 1
xor edi, 0x29ea8390
add esi, dword [0xf2dbd]
sub edx, dword [0xf2cd0]
xchg ebx, edx
rol ebx, 0x10
and dword [0xf2346], edx
rol esi, 0x1c
add dword [0xf2657], ecx
call fcn.0008f9d1
xor ecx, 0xe86793
add eax, esp
add dword [0xf23cc], ecx
xchg ecx, eax
rol edi, 0xd
xor ecx, esp
add dword [0xf2219], ecx
neg edi
inc ecx
call fcn.000aa233
and dword [0xf23f0], ecx
sub ecx, dword [0xf2c3e]
call fcn.0009783f
invalid
or al, 0x51

Function at 0x8d5fc
Capabilities:
Hash data using murmur3

Disassembly:
add byte [ebp - 0x296c67cb], cl
mov byte [0x810dcec1], al
sar byte [ebx], 0xc3
jnp 0x8d63a
add eax, dword [eax]

Function at 0x8e190
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0xf1b34]
cmp byte [eax], 0
jne 0x8e1be
mov ecx, 0xb7
mov edx, 0x8e20c
mov eax, 0x8e24c
call fcn.00013d5c
mov eax, ebx
call fcn.000143b8
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x8e1fd
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0001453c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8e260
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0xf1b34]
cmp byte [eax], 0
jne 0x8e281
mov ecx, 0xc3
mov edx, 0x8e298
mov eax, 0x8e2d8
call fcn.00013d5c
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
pop ebx
ret
Function at 0x8fd5c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x8fdc0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00013fb8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0001901c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8fdc7
lea eax, [ebp - 0xc]
call fcn.00013d78
ret

Function at 0x9366c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x937dd
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x937b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00013f20
lea eax, [ebp - 0x118]
mov edx, 0x937f4
call fcn.00014010
mov eax, dword [ebp - 0x118]
call fcn.000141cc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x9372a
lea eax, [ebp - 0x111]
call fcn.000195b0
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00013e60
jmp 0x93731
mov eax, esi
call fcn.00013d78
cmp bl, 0x61
jae 0x93752
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0001b608
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00013dcc
jmp 0x9376c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0001b57c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00013dcc
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x93800
call fcn.00019d08
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00013dcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x937bf
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x96acc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.000141cc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x96ae5
test al, 0x10
jne 0x96ae9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x1000313f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x1000f00c]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, ecx
mov dword [esp + 4], 0
mov ecx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 4]
or eax, 0x2001f
mov dword [esp + 0x1c], ecx
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.10003630
mov esi, eax
test esi, esi
je 0x100031c0
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x100031a7
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.10008939
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x10003228
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.10003630
mov esi, eax
test esi, esi
jne 0x1000327a
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x100031ef
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
je 0x10003241
push eax
call esi
mov dword [esp + 0xc], 0
push dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x14], 0
call fcn.10003630
mov ecx, dword [esp + 0xc]
mov edi, eax
test ecx, ecx
je 0x10003261
push ecx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.10008939
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100031a7
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10008939
mov esp, ebp
pop ebp
ret 4
Function at 0x10003630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000363f
pop dword [ebp - 0x24]
mov eax, 0x9177d9fe
add eax, 0x7e885c41
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x785f78fd
sub dword [ebp - 0x34], 0x2a0d33b2
mov dword [ebp - 0x30], 0xc6c02e33
sub dword [ebp - 0x30], 0x948ce1ee
mov dword [ebp - 0x2c], 0x90084da8
add dword [ebp - 0x2c], 0xbc43f686
mov dword [ebp - 0x28], 0x22778095
sub dword [ebp - 0x28], 0x22778095
lea eax, [ebp - 0x34]
push eax
mov eax, 0x8c50e3d8
sub eax, 0x7c503344
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x1a756dd7
add dword [ebp - 0x34], 0x59fcfb7f
mov dword [ebp - 0x30], 0x3528c07
add dword [ebp - 0x30], 0x3e19d56e
mov dword [ebp - 0x2c], 0x4fb10a7d
sub dword [ebp - 0x2c], 0xec419e11
mov dword [ebp - 0x28], 0x9956ae63
add dword [ebp - 0x28], 0x66a9519d
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x32a79
push 0
call eax
mov ecx, 0xe070ea67
add ecx, 0x1f8f48d0
xor ebx, ebx
add ebx, eax
mov esi, 0x10015000
add esi, dword [ebp - 0x24]
mov edx, 0xdb41f0d2
sub edx, 0xc84b818f
mov edi, dword [esi]
xor dword [ebp - 0x10], ecx
sub edi, edx
add dword [ebp - 0x1c], 0x48cc7e10
mov dword [ebx], edi
add dword [ebp - 0x10], 0x2962cfcc
add ebx, 0xd5739b6f
add ebx, 0x2a8c6495
add esi, 0xd38b94e8
add esi, 0x2c746b1c
loop 0x10003758
add eax, 0xbfaf
mov ebx, eax
add eax, 0xc02af953
sub eax, 0xc02af94e
mov ecx, 0x80d28a3f
add ecx, 0x8f2d75c1
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1000920a
Capabilities:
Hide graphical window

Disassembly:
push edi
mov dword [0x10020764], 3
call fcn.10008e30
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x10021430]
call edi
push 5
push dword [0x1002121c]
call edi
push 0x100069e4
push dword [0x10021434]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push dword [0x1002142c]
call edi
push 0x100069f4
push dword [0x1002142c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0x1f4
push 0x1f9
push dword [0x10021438]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
ret

Function at 0x1000927a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.1000fbe0
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x10]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x10021220
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100092d0
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a32e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1000a34a
xor al, al
leave
ret
push ebx
push dword [ebp + 0x14]
xor ebx, ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1000a369
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x1000a377
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x10020014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.1000a253
test al, al
je 0x1000a42a
push esi
push 0x10006d7c
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1000a0b3
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x270]
push ebx
push eax
call fcn.1000fbe0
xor eax, eax
mov dword [ebp - 0x270], esi
lea edi, [ebp - 0x228]
add esp, 0x1c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x270]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000a42a
push ebx
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x228]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push dword [ebp - 0x228]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x224]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e71a
leave
ret
Function at 0x1000a57a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov dword [ebp - 0x10], edx
test edx, edx
je 0x1000a60b
mov eax, dword [ebx + 0x10]
xor ecx, ecx
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], ecx
cmp dword [ebx + 8], ecx
jle 0x1000a60b
movzx eax, byte [esi + 2]
cmp eax, edx
jne 0x1000a5ec
mov al, byte [esi]
mov edx, ecx
mov ecx, dword [ebp - 8]
mov byte [ebp - 1], al
mov eax, dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp - 0x18], ecx
cmp edx, dword [ebp - 0x10]
jge 0x1000a614
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x18]
mov al, byte [eax + ecx]
xor al, dl
xor al, byte [ebp - 1]
cmp byte [ecx], al
jne 0x1000a5e7
mov eax, dword [ebp + 0xc]
inc edx
jmp 0x1000a5ca
mov edx, dword [ebp - 0x10]
xor ecx, ecx
movzx eax, byte [esi + 3]
add dword [ebp - 8], eax
mov eax, dword [esi + 8]
add esi, 0xc
mov dword [ebp - 0x14], esi
lea edi, [edi + eax*4]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 8]
jl 0x1000a5b0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [esi + 8]
push 4
push 0x1000
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul ecx, dword [ebp - 0xc], 0xc
movzx edx, word [esi]
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], ecx
mov eax, ecx
mov ecx, dword [ebx + 0xc]
cmp dword [ecx + eax + 8], 0
mov eax, dword [ebp - 8]
jbe 0x1000a681
sub eax, edi
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov esi, eax
mov eax, edx
shl eax, 5
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 5
xor eax, edx
shl eax, 7
xor eax, dword [edi]
xor eax, edx
inc ecx
mov dword [esi + edi], eax
inc edx
mov esi, dword [ebp + 0xc]
lea edi, [edi + 4]
mov eax, dword [ebx + 0xc]
cmp ecx, dword [eax + esi + 8]
mov esi, dword [ebp - 0x10]
jb 0x1000a64f
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
jmp 0x1000a60d

Function at 0x1000a752
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push edi
push 0x10006728
mov esi, ecx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push dword [ebp - 4]
add esi, 0x418
mov edx, 0x105
mov ecx, esi
call fcn.1000a1d1
push 0x10006940
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
leave
ret 4
Function at 0x1000c45f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1000c46a
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1000c526
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
sub edi, 1
jne 0x1000c47f
pop edi
test esi, esi
je 0x1000c542
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
inc edx
sub esi, 1
jne 0x1000c52a
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1000c549
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x10007070]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10007070]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x1000cc66
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov ecx, ebx
imul ecx, dword [ebp + 8]
cmp byte [edi], 0
je 0x1000cc9f
push 0
lea edx, [ebp + 8]
push edx
push ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000cc9a
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x1000ccc9
mov edx, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ecx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.100118e0
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop esi
xor edx, edx
pop edi
div ebx
pop ebx
leave
ret
Function at 0x1000d8de
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0x1000d97d
cmp dword [esi + 4], 0xffffffff
jne 0x1000d97d
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000d912
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x1000d949
cmp eax, 0x2f
je 0x1000d949
sub edi, 2
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bx
jne 0x1000d936
mov eax, dword [0x10006fe4]
mov dword [edi], eax
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000cb60
pop ecx
pop ecx
test eax, eax
jne 0x1000d964
mov eax, dword [ebp - 4]
jmp 0x1000d982
mov ecx, eax
call fcn.1000cec0
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x1000d982
mov eax, 0x1000000
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1000de3e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10020014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov ebx, edx
test esi, esi
je 0x1000de72
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000de72
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x1000df55
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x1000de90
cmp dx, 0x5c
jne 0x1000de92
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x1000de84
cmp edi, ebx
je 0x1000dedc
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.100118e0
add esp, 0xc
cmp edi, 0x208
jae 0x1000df64
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.1000de3e
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x1000df00
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x1000def1
mov esi, ebx
xor ecx, ecx
mov ax, word [ebx]
add ebx, 2
cmp ax, cx
jne 0x1000df04
lea edi, [ebp - 0x20c]
sub ebx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x1000df1a
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000df55
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e71a
leave
ret
call fcn.1000e8bb
int3