joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5cd2577c
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7eb53cd3
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x402453
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x402462
pop dword [ebp - 0x20]
mov eax, 0xf718cc63
sub eax, 0xf6d8a801
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x4c925a47
add dword [ebp - 0x30], 0x1bfeb04
mov dword [ebp - 0x2c], 0x8b42e75e
sub dword [ebp - 0x2c], 0x590f9b19
mov dword [ebp - 0x28], 0x7088ffcc
sub dword [ebp - 0x28], 0x243cbb9e
mov dword [ebp - 0x24], 0xc1e3c9cc
add dword [ebp - 0x24], 0x3e1c3634
lea eax, [ebp - 0x30]
push eax
mov eax, 0x95897b50
sub eax, 0x9543caec
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x17eeb51b
add dword [ebp - 0x30], 0x5c83b43b
mov dword [ebp - 0x2c], 0x336b6c63
add dword [ebp - 0x2c], 0xe00f512
mov dword [ebp - 0x28], 0x53817902
add dword [ebp - 0x28], 0xfedf36a
mov dword [ebp - 0x24], 0xfeda9f0a
add dword [ebp - 0x24], 0x12560f6
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x1158ef9f
sub eax, 0x11133f1f
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x4d530
push 0
call eax
mov ecx, 0xe754de70
sub ecx, 0xe7549653
xor edi, edi
add edi, eax
mov esi, 0x476000
add esi, dword [ebp - 0x20]
mov ebx, 0x3072b025
add ebx, 0xeccd2b4
add dword [ebp - 0x18], esi
mov edx, dword [esi]
add dword [ebp - 8], ebx
xor edx, ebx
sub dword [ebp - 0x18], 0x8d02e19a
mov dword [edi], edx
add edi, 0x8aa6dae0
add edi, 0x75592524
add esi, 0x2bc694bf
sub esi, 0x2bc694bb
loop 0x402580
add eax, 0x6e918f43
add eax, 0x916f8404
mov ebx, eax
add eax, 0xca79266e
add eax, 0x3586d997
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x3bc01e32
nop
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x6e6c2a28
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401025
Capabilities:
Set file attributes

Disassembly:
push 8
push 0x417f88
call fcn.0040ee4c
and dword [ebp - 4], 0
mov dword [ebp - 4], 1
push 0xa0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x401053
and dword [ebp - 4], 0
jmp 0x401060
mov dword [ebp - 4], 0xfffffffe
call fcn.0040ee91
ret 4

Function at 0x401a79
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0xc], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0x80
mov dword [ebp - 0x10], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
mov eax, dword [esi + 0x10]
xor ecx, ecx
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 4]
push edx
push ecx
push 0xf013f
push 4
push ecx
push ecx
push eax
push dword [esi + 4]
mov dword [esi], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401b89
cmp dword [ebp - 4], eax
je 0x401b6a
push 0x80
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x200
call edi
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x200
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x200
call edi
push dword [esi + 0x18]
push dword [ebp - 4]
call fcn.00403946
push dword [ebp - 4]
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401b6d
and dword [esi], 0
push dword [ebp - 0xc]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop ebx
leave
ret
Function at 0x401b8d
Capabilities:
Query environment variable

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x41c028]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 8
mov eax, 0x4100b6
call fcn.0040f448
mov esi, 0x208
push esi
lea eax, [ebp]
push 0
push eax
call sub.MSVCR90.dll_memset
push esi
lea eax, [ebp + 0x208]
push 0
push eax
call sub.MSVCR90.dll_memset
push 0
call dword [sym.imp.SolvusoftWMhelper.dll_int___cdecl_DisableFsRedirection_void___]
add esp, 0x1c
push 0x104
lea eax, [ebp + 0x208]
push eax
push str._SystemRoot_System32Config_regback
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ecx
lea eax, [ebp + 0x208]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
call dword [sym.imp.SolvusoftWMhelper.dll_enum_PCO_ERROR_CODES___cdecl_RecrusivelyCreateDirectory_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
pop ecx
lea eax, [ebp + 0x208]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SolvusoftWMhelper.dll_enum_PCO_ERROR_CODES___cdecl_DoesPathExists_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__]
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
test esi, esi
je 0x401c98
lea eax, [ebp + 0x208]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea esi, [edi + 0x254]
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [esi]
push 0x103
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ecx, esi
test eax, eax
je 0x401c90
lea eax, [ebp]
push eax
jmp 0x401ca3
lea eax, [ebp + 0x208]
jmp 0x401c8d
push 0x412adc
lea ecx, [edi + 0x254]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0040e9fc
add ebp, 0x414
leave
ret
Function at 0x401ccc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x41c028]
xor eax, ebp
mov dword [ebp + 0x190], eax
test byte [0x41cc00], 1
mov eax, dword [ebp + 0x19c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1a0]
push esi
push edi
mov dword [ebp - 0x7c], eax
jne 0x401d20
or dword [0x41cc00], 1
call dword [sym.imp.MSVCR90.dll_rand]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
movzx esi, si
jmp 0x401d26
mov esi, dword [0x41cbfc]
mov eax, esi
not eax
test al, 2
je 0x401d33
add esi, 3
jmp 0x401d36
add esi, 5
mov edi, 0x208
push edi
lea eax, [ebp - 0x78]
push 0
push eax
mov dword [0x41cbfc], esi
call sub.MSVCR90.dll_memset
mov eax, dword [ebx + 0x254]
add esp, 0xc
lea ecx, [ebp - 0x78]
push ecx
push esi
push 0x412ae0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0x7c]
test eax, eax
je 0x401d7a
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
jmp 0x401d83
push dword [ebp - 0x80]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
push edi
lea eax, [ebp - 0x78]
push 0
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [ebp - 0x7c]
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0x190]
pop edi
xor ecx, ebp
pop esi
call fcn.0040e9fc
add ebp, 0x194
leave
ret 8
Function at 0x40e9fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c028]
jne 0x40ea06
repz ret
jmp fcn.0040ef8e
Function at 0x10004ac0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10004b21
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10004b04
cmp edi, 2
jb 0x10004b04
cmp byte [esi], cl
jne 0x10004b04
cmp byte [esi + 1], cl
jne 0x10004b04
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10195ca0]
jmp 0x10004ad5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10195ca0]
test edi, edi
jne 0x10004ad5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10004b50
cmp cl, 0x23
jne 0x10004b37
cmp byte [esi], cl
jne 0x10004b37
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10195ca0]
test cl, cl
jne 0x10004b28
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10004c60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10004c74
mov dword [ebx], 0
mov edx, 0x1039063c
call fcn.10004b60
mov esi, eax
test esi, esi
je 0x10004d62
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10004d58
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004d58
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x10004d58
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004d58
mov eax, dword [0x103ca828]
test eax, eax
je 0x10004cec
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x10004d58
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x10004d3d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x103ca828]
add esp, 4
test eax, eax
je 0x10004d2a
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x10004d4f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007ea0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x103b0024]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0xe4]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0xe8]
subss xmm0, xmm1
mov ecx, dword [edx + 0xc8]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xd0]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10195ca0]
sub edi, 1
jne 0x10007f20
mov ecx, dword [ebp - 8]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.101238be
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f480
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000f4bf
cmp bl, 0x23
jne 0x1000f4a1
cmp byte [esi], bl
jne 0x1000f4a1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10195ca0]
test bl, bl
jne 0x1000f492
mov ecx, dword [0x103ca828]
not eax
mov esi, dword [ecx + 0x3e20]
mov edi, dword [ecx + 0x3e28]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000f4fe
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000f4f8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000f4fa
mov esi, edx
test esi, esi
jne 0x1000f4e0
cmp edi, ebx
je 0x1000f50d
cmp dword [edi], eax
jne 0x1000f50d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10014270
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x103b0024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x103ca828]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x3e38]
mov esi, 4
mov eax, dword [edi + 0xc8]
add edi, 0xc8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10195ca0]
sub esi, 1
jne 0x100142b1
mov eax, dword [0x103ca828]
not ebx
cmp dword [eax + 0x3e58], ebx
jne 0x100142eb
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1001c700
add esp, 8
mov ecx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ecx
jne 0x10014316
inc esi
test ecx, ecx
je 0x10014304
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10014309
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.1001cf80
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101238be
mov esp, ebp
pop ebp
ret

Function at 0x1001b150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5a34], 0
lea esi, [edi + 0x5a38]
je 0x1001b1d2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001b18c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1001d300
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10005730
mov edx, dword [esi]
mov ecx, 0x103ca824
push dword [edi + 0x5a34]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5a40]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10005730
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001b690
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x103ca828]
test bl, bl
je 0x1001b6d6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001b6b7
cmp byte [esi], bl
jne 0x1001b6b7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x10195ca0]
test bl, bl
jne 0x1001b6a8
mov edi, dword [0x103ca828]
mov esi, dword [edi + 0x59f8]
xor ecx, ecx
not eax
test esi, esi
jle 0x1001b6fc
mov edi, dword [edi + 0x5a00]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x1001b702
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x1001b6f0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x1001b930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x103ca828]
sub esp, 8
push esi
mov esi, ecx
mov dword [eax + 0x59e8], 0
push edi
test esi, esi
je 0x1001b98d
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.1001b9a0
mov edx, 0x10390640
mov ecx, esi
mov edi, eax
call fcn.10004b60
mov esi, eax
test esi, esi
je 0x1001b98d
push esi
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001efb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1001efea
mov eax, dword [0x103ca828]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1001efdd
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1001f01b
mov eax, dword [0x103ca828]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1001f00e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1001f04c
mov eax, dword [0x103ca828]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1001f03f
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1001f099
mov eax, dword [0x103ca828]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1001f08c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1001f0ca
mov eax, dword [0x103ca828]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1001f0bd
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1001f0fb
mov eax, dword [0x103ca828]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1001f0ee
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10022310