joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010c3b7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.101008ca
xor ebx, ebx
cmp dword [0x102bfec4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1010c48d
push 0x1017129c
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1010c56d
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x10171290
push edi
call esi
cmp eax, ebx
je 0x1010c56d
push eax
call fcn.1010085c
mov dword [esp], 0x10171280
push edi
mov dword [0x102bfec4], eax
call esi
push eax
call fcn.1010085c
mov dword [esp], 0x1017126c
push edi
mov dword [0x102bfec8], eax
call esi
push eax
call fcn.1010085c
mov dword [0x102bfecc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.100fb60c
test eax, eax
pop ecx
pop ecx
je 0x1010c45b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100ffa46
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1010c48d
push 0x10171250
push edi
call esi
push eax
call fcn.1010085c
cmp eax, ebx
pop ecx
mov dword [0x102bfed4], eax
je 0x1010c48d
push 0x10171238
push edi
call esi
push eax
call fcn.1010085c
pop ecx
mov dword [0x102bfed0], eax
mov eax, dword [0x102bfed0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1010c512
cmp dword [0x102bfed4], ecx
je 0x1010c512
push eax
call fcn.101008d3
push dword [0x102bfed4]
mov esi, eax
call fcn.101008d3
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1010c512
cmp edi, ebx
je 0x1010c512
call esi
cmp eax, ebx
je 0x1010c4df
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1010c4df
test byte [ebp - 0x18], 1
jne 0x1010c512
lea eax, [ebp - 0x10]
push eax
call fcn.100fb643
test eax, eax
pop ecx
je 0x1010c4fa
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100ffa46
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1010c509
or dword [ebp + 0x10], 0x200000
jmp 0x1010c54d
or dword [ebp + 0x10], 0x40000
jmp 0x1010c54d
mov eax, dword [0x102bfec8]
cmp eax, dword [ebp - 8]
je 0x1010c54d
push eax
call fcn.101008d3
cmp eax, ebx
pop ecx
je 0x1010c54d
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1010c54d
mov eax, dword [0x102bfecc]
cmp eax, dword [ebp - 8]
je 0x1010c54d
push eax
call fcn.101008d3
cmp eax, ebx
pop ecx
je 0x1010c54d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102bfec4]
call fcn.101008d3
cmp eax, ebx
pop ecx
je 0x1010c56d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1010c56f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10112273
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x101a53c4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.10112208
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.100f5b10
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x101122c2
cmp dword [ebp - 0x1c], 5
jb 0x101122da
jmp 0x101122d6
cmp dword [ebp - 0x10], 1
jne 0x101122da
cmp dword [ebp - 0x1c], 4
ja 0x101122d6
jne 0x101122da
cmp dword [ebp - 0x18], 0
jbe 0x101122da
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x101713a0
call fcn.10001ac0
test eax, eax
jge 0x101122fb
mov byte [0x101a6d20], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100f5016
add ebp, 0x78
leave
ret

Function at 0x10113dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101579e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
mov eax, dword [0x101a53c4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], 0x10171478
mov byte [esp + 0x10], al
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x2c], 0
call fcn.10113500
mov bl, al
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esp + 8], 0x10171478
je 0x10113e40
cmp byte [esp + 0x10], 0
je 0x10113e40
push eax
call fcn.100f61d4
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x18
ret 0x10
Function at 0x1011a050
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push esi
push edi
call edx
mov esi, dword [ebp + 0xc]
mov ecx, 0xc1
lea edi, [esp + 0x28]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0xe], 1
lea ebx, [ebx]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [eax + 8]
push 1
push 1
lea ecx, [esp + 0x17]
push ecx
mov ecx, esi
call edx
cmp eax, 1
jne 0x1011a257
cmp byte [esp + 0xe], 0
mov al, byte [esp + 0xf]
jne 0x1011a0bd
test al, al
jne 0x1011a090
cmp al, 0x21
je 0x1011a24a
cmp al, 0x2c
je 0x1011a0da
cmp al, 0x3b
je 0x1011a257
test al, al
sete byte [esp + 0xe]
jmp 0x1011a090
mov eax, dword [esi]
mov edx, dword [eax + 8]
push 1
push 9
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call edx
mov eax, dword [esp + 0x10]
push eax
mov ecx, ebx
call fcn.101143e0
mov ecx, dword [esp + 0x12]
push ecx
mov ecx, ebx
mov word [esp + 0x14], ax
call fcn.101143e0
mov edx, dword [esp + 0x14]
push edx
mov ecx, ebx
mov word [esp + 0x16], ax
call fcn.101143e0
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x16]
push eax
mov ecx, ebx
call fcn.101143e0
mov ecx, dword [ebp + 0x10]
cmp word [ecx + 6], 0
mov dx, word [esp + 0x14]
mov word [esp + 0x16], ax
jne 0x1011a14e
cmp word [ecx + 8], 0
jne 0x1011a14e
mov word [ecx + 6], dx
mov word [ecx + 8], ax
movzx edi, word [esp + 0x10]
movzx ecx, word [ecx + 6]
movzx edx, dx
add edx, edi
cmp edx, ecx
jg 0x1011a090
movzx ecx, word [esp + 0x12]
movzx edx, ax
add edx, ecx
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + 8]
cmp edx, ecx
jg 0x1011a090
movzx ecx, byte [esp + 0x18]
add dword [esp + 0x1c], 1
test cl, cl
jns 0x1011a1be
mov edx, dword [esi]
mov edx, dword [edx + 8]
and ecx, 7
add ecx, 1
mov eax, 1
shl eax, cl
push 1
lea ecx, [esp + 0x30]
mov word [esp + 0x2e], ax
movsx eax, ax
lea eax, [eax + eax*2]
push eax
push ecx
mov ecx, esi
call edx
movzx ecx, byte [esp + 0x18]
mov ax, word [esp + 0x16]
xor edx, edx
movzx eax, ax
and ecx, 0x40
mov dword [ebx + 0x1dc], ecx
mov dword [ebx + 0x1e8], eax
mov dword [esp + 0x20], edx
mov dword [ebx + 0x1f0], 0x4000
mov dword [ebx + 0x1e4], 8
mov dword [ebx + 0x1e0], edx
mov dword [ebx + 0x1ec], edx
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
push esi
mov ecx, ebx
mov edi, eax
call fcn.10119870
cmp dword [esp + 0x20], 0
je 0x1011a22a
push edi
push esi
mov ecx, ebx
call fcn.10119bb0
jmp 0x1011a090
mov ecx, dword [ebx + 0x1f0]
sub ecx, dword [ebx + 0x1f4]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
add ecx, 1
push 1
push ecx
mov ecx, esi
call edx
jmp 0x1011a090
push esi
mov ecx, ebx
call fcn.10118f10
jmp 0x1011a090
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push 0
push ecx
mov ecx, esi
call edx
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1011b210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xf864], eax
mov dword [esi + 0xf860], ecx
mov dword [esi + 0xf854], ecx
mov edx, 1
shl edx, cl
add ecx, 0xffffffff
mov eax, 1
shl eax, cl
push edi
xor edi, edi
sub edx, 1
mov dword [esi + 0xf868], eax
add eax, 1
mov dword [esi + 0xf86c], eax
mov ax, word [esi + 0xf868]
add ax, 2
mov ecx, esi
mov dword [esi + 0xf85c], edi
mov dword [esi + 0x1d8], edi
mov dword [esi + 0x1d4], edi
mov word [esi + 0xf858], dx
mov word [esi + 0xf85a], ax
mov dword [esi + 0xf870], edi
call fcn.101194e0
mov dword [esp + 0x10], eax
xor ecx, ecx
mov eax, 0x138b
jmp 0x1011b2a0
add eax, eax
add ecx, 1
cmp eax, 0x10000
jl 0x1011b2a0
mov eax, 8
sub eax, ecx
push 0x138b
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.10119570
movzx ecx, word [esi + 0xf868]
push ecx
mov ecx, esi
call fcn.1011ad40
mov ecx, esi
call fcn.101194e0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1011b3e4
push ebx
mov ecx, dword [esp + 0x18]
movsx edi, bp
shl edi, cl
mov ebx, ebp
shl ebx, 0xc
add ebx, dword [esp + 0x14]
xor edi, dword [esp + 0x14]
mov ecx, dword [esi + edi*4 + 0x8310]
cmp ecx, ebx
lea eax, [esi + edi*4 + 0x8310]
jne 0x1011b31e
movzx edx, word [esi + edi*2 + 0xd13c]
mov dword [esp + 0x14], edx
jmp 0x1011b3d1
test ecx, ecx
jl 0x1011b356
mov ecx, 0x138b
sub ecx, edi
test edi, edi
jne 0x1011b332
mov ecx, 1
lea edx, [ecx*4]
sub edi, ecx
sub eax, edx
test edi, edi
jge 0x1011b34c
add edi, 0x138b
add eax, 0x4e2c
mov edx, dword [eax]
cmp edx, ebx
je 0x1011b38c
test edx, edx
jg 0x1011b332
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.1011ad40
movzx eax, word [esi + 0xf85a]
cmp ax, 0x1000
mov dword [esp + 0x14], ebp
jge 0x1011b39a
mov word [esi + edi*2 + 0xd13c], ax
add word [esi + 0xf85a], 1
mov dword [esi + edi*4 + 0x8310], ebx
jmp 0x1011b3d1
movzx eax, word [esi + edi*2 + 0xd13c]
mov dword [esp + 0x14], eax
jmp 0x1011b3d1
push 0x138b
mov ecx, esi
call fcn.10119570
movzx eax, word [esi + 0xf868]
mov dx, word [esi + 0xf868]
add dx, 2
push eax
mov ecx, esi
mov word [esi + 0xf85a], dx
mov dword [esi + 0xf85c], 1
call fcn.1011ad40
mov ecx, esi
call fcn.101194e0
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1011b2e5
pop ebx
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.1011ad40
movzx edx, word [esi + 0xf86c]
push edx
mov ecx, esi
call fcn.1011ad40
pop edi
pop esi
pop ebp
ret 8
Function at 0x10133c50
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10133c7f
push esi
call fcn.101343e0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x10133c78
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x10133cfa
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x10133cea
mov eax, dword [esi + 8]
test eax, eax
je 0x10133ca4
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x190]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x10133ce6
cmp eax, 2
je 0x10133cea
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10133c95
cmp eax, 3
je 0x10133ccc
cmp eax, 1
jne 0x10133c95
add dword [ecx + 4], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x10133c95
mov edx, dword [esi + 0x11c]
add dword [eax + 8], edx
jmp 0x10133c95
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.10133ae0
pop esi
ret
cmp eax, 0xcc
je 0x10133d1c
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.10133ae0
pop esi
ret
Function at 0x1013c6b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [esp + 0x18], esi
jne 0x1013c6d7
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x1013c6e3
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0xc], ecx
jle 0x1013c7ef
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x18], edx
jmp 0x1013c72c
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebp, dword [edx]
cdq
idiv ebp
cmp dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
je 0x1013c74d
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov edi, dword [edx + ecx*4]
add ebp, 0xffffffff
mov ecx, ebp
xor eax, eax
xor ebx, ebx
call fcn.1013c520
mov ecx, eax
xor esi, esi
cmp esi, ecx
jle 0x1013c782
lea esp, [esp]
add ebx, 1
mov ecx, ebp
mov eax, ebx
call fcn.1013c520
mov ecx, eax
cmp esi, ecx
jg 0x1013c770
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + edi], al
add esi, 1
cmp esi, 0xff
jle 0x1013c765
cmp dword [esp + 0x10], 0
je 0x1013c7d0
mov eax, 1
lea ecx, [edi - 1]
jmp 0x1013c7b0
movzx edx, byte [edi]
mov byte [ecx], dl
movzx edx, byte [edi + 0xff]
mov byte [edi + eax + 0xff], dl
add eax, 1
sub ecx, 1
cmp eax, 0xff
jle 0x1013c7b0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add dword [esp + 0x18], 4
add eax, 1
cmp eax, dword [ecx + 0x64]
mov dword [esp + 0x14], eax
jl 0x1013c720
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10303473
Capabilities:
Get number of processors

Disassembly:
jmp 0x102f7794
call fcn.102f777f
salc
arpl word [ebp - 0x79], cx
loop 0x102f778a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x1031d3b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x103161dd
jmp 0x10302476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x10311856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x10319e32
jmp 0x1031186d
call fcn.10311858
adc byte [eax - 0x77], dl
loopne 0x1031187c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x102f777d
jmp 0x103161f4
call fcn.103161df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x102f7bce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x102f8698
jmp 0x102f9265

Function at 0x103226f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x10311a70

Function at 0x105744e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x1057453e
jmp 0x105744fd
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x105744fd
jmp 0x1057453e
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x1029e2c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 4]
mov word [ebp + 4], ax
lea esp, [esp + 0x40]
jg 0x1029e72d
pushfd
pushfd
push edx
push dword [esp + 8]
pop dword [ebp]
pushfd
pushfd
mov dword [esp], 0xd89e4d77
lea esp, [esp + 0x14]
jmp fcn.1029e8aa
push 0xa8a6fdb7
push dword [esp]
and al, dl
jmp 0x1029e0b7
push ebx
pushfd
pop dword [esp]
pushfd
pushal
mov byte [esp + 4], ch
push dword [esp + 0x24]
pop dword [ebp]
mov byte [esp + 4], 0xd8
mov word [esp], ax
pushfd
lea esp, [esp + 0x2c]
jmp fcn.1029e8aa

Function at 0x403371
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x40339c
mov ecx, dword [0x4702b8]
push esi
add eax, ecx
push esi
push eax
mov dword [0x4326f4], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403479
cmp eax, esi
jl 0x403473
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.004061db
test eax, eax
je 0x403463
push dword [ebp + 8]
add dword [0x4326f4], 4
call fcn.00403479
mov ebx, eax
cmp ebx, esi
jl 0x403471
cmp dword [ebp + 0x10], esi
jne 0x40343f
cmp dword [ebp + 8], esi
jle 0x403471
mov esi, 0x4266f0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x403401
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.004061db
test eax, eax
je 0x403463
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.0040620a
test eax, eax
je 0x40343b
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x4326f4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4033f0
jmp 0x403471
push 0xfffffffffffffffe
jmp 0x403465
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40344a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403468
push 0xfffffffffffffffd
pop eax
jmp 0x403473
mov ebx, dword [ebp - 4]
add dword [0x4326f4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x10005161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10005170
pop dword [ebp - 0xc]
mov eax, 0x10005170
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x10ffd9da
add dword [ebp - 0x1c], 0x3d526b71
mov dword [ebp - 0x18], 0x3c374674
sub dword [ebp - 0x18], 0xa03fa2f
mov dword [ebp - 0x14], 0x5d6b810f
sub dword [ebp - 0x14], 0x111f3ce1
mov dword [ebp - 0x10], 0x791bb807
add dword [ebp - 0x10], 0x86e447f9
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x28f95986
add eax, 0xe7074732
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x92a8b04d
sub dword [ebp - 0x1c], 0x1e3646f7
mov dword [ebp - 0x18], 0xb5b832ef
sub dword [ebp - 0x18], 0x744bd17a
mov dword [ebp - 0x14], 0xb0f15b41
sub dword [ebp - 0x14], 0x4d81eed5
mov dword [ebp - 0x10], 0x6add3423
add dword [ebp - 0x10], 0x9522cbdd
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x38d9c
push 0
call eax
mov ecx, 0xfdc32018
sub ecx, 0xfdc2d4c3
xor edi, edi
add edi, eax
mov ebx, 0x10013200
add ebx, dword [ebp - 0xc]
mov esi, 0xc808e8e0
add esi, 0x1eb4c268
xor dword [ebp - 4], 0x71f5308
mov edx, dword [ebx]
xor dword [ebp - 8], edi
sub edx, esi
mov dword [edi], edx
add dword [ebp - 4], 0x9fad56e7
add edi, 0x8f03b60
add edi, 0xf70fc4a4
add ebx, 0xc4e77a13
sub ebx, 0xc4e77a0f
loop 0x10005284
add eax, 0x52b6b1dd
add eax, 0xad4a6e4a
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10009da0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
sub esp, 0x18
test byte [0x100173c0], 8
jne 0x10009e10
mov eax, dword [ebx + 8]
test eax, eax
jne 0x10009e43
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebx + 0x2c]
jb 0x10009e05
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
cmp eax, 0xffffffff
je 0x10009e70
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
sub eax, edx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__read]
mov edx, eax
test eax, eax
jle 0x10009e70
mov eax, dword [ebx + 0x10]
add edx, eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x2c], edx
movzx eax, byte [eax]
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.filebuf_underflow
mov dword [esp + 4], 0x100173c0
mov dword [esp], 3
call fcn.10007230
mov eax, dword [ebx + 8]
test eax, eax
je 0x10009dbd
lea eax, [ebp - 5]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x10009e70
movzx eax, byte [ebp - 5]
mov ebx, dword [ebp - 4]
leave
ret
mov eax, 0xffffffff
jmp 0x10009e08
Function at 0x1000af60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
and esp, 0xfffffff8
sub esp, 0x24
mov esi, dword [ebp + 8]
test byte [0x100173c0], 8
jne 0x1000b008
mov edx, dword [ebx + 8]
test edx, edx
je 0x1000afc0
cmp esi, 0xffffffff
jne 0x1000afa0
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [ebx + 0x4c]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_fputc]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov ecx, ebx
call sym.msvcirt.dll_protected:_int___thiscall_streambuf::allocate_void_
cmp eax, 0xffffffff
je 0x1000b0f4
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x1000b078
mov edx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x18]
cmp edx, eax
ja 0x1000b040
cmp esi, 0xffffffff
je 0x1000af8a
mov eax, dword [ebx + 0x20]
cmp dword [ebx + 0x18], eax
jae 0x1000afa0
mov eax, dword [ebx + 0x1c]
lea edx, [eax + 1]
mov dword [ebx + 0x1c], edx
mov edx, esi
mov byte [eax], dl
jmp 0x1000af8a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.__p__d__n
mov dword [esp + 8], str.stdiobuf_overflow
mov dword [esp + 4], 0x100173c0
mov dword [esp], 3
call fcn.10007230
jmp 0x1000af7e
mov edi, edx
mov edx, dword [ebx + 0x4c]
mov dword [esp + 4], 1
sub edi, eax
mov dword [esp], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
call dword [sym.imp.msvcrt.dll_fwrite]
cmp edi, eax
jne 0x1000b0f4
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
jmp 0x1000afe5
mov edx, dword [ebx + 0x14]
mov eax, edx
sub eax, dword [ebx + 0x10]
mov edi, eax
shr edi, 0x1f
add edi, eax
sar edi, 1
add edi, dword [ebx + 0x10]
movd xmm0, edi
test byte [0x100173c0], 8
jne 0x1000b0b0
punpckldq xmm0, xmm0
mov dword [ebx + 0x20], edx
movq qword [ebx + 0x18], xmm0
jmp 0x1000afe5
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__p__n
mov dword [esp + 8], str.streambuf_setp
mov dword [esp + 4], 0x100173c0
mov dword [esp], 3
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edi
call fcn.10007230
mov edx, dword [esp + 0x1c]
movd xmm0, dword [esp + 0x20]
jmp 0x1000b099
mov eax, 0xffffffff
jmp 0x1000af8f