joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcabd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcabd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xcabd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcabd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xcabd94
push eax
push esi
call fcn.00cae20b
add esp, 8
pop esi
ret 0x10

Function at 0xcabda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcabe22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xcabe15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xcc4320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00caddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xcabdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xcabe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcabec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xcabeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xcc4320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00caddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xcabeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xcabe6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xcac000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xcac131
push esi
call fcn.00caf145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00c9e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xcac131
push 0
push ebp
call fcn.00c9e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00c9e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xcac08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00c9e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xcac121
push 0xcc4918
push edi
call fcn.00cad3f0
push eax
push ebx
push esi
call fcn.00cabf60
push 0xcc48f8
push edi
call fcn.00cad3f0
push eax
push ebx
push esi
call fcn.00cabf60
push 0xcc48d8
push edi
call fcn.00cad3f0
push eax
push ebx
push esi
call fcn.00cabf60
push 0xcc48c0
push edi
call fcn.00cad3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00cabf60
push 0xcc48a0
push edi
call fcn.00cad3f0
push eax
push ebx
push esi
call fcn.00cabf60
push 0xcc4888
push edi
call fcn.00cad3f0
push eax
push ebx
push esi
call fcn.00cabf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xcad1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cad140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cad140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cad140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cad140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcadbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcadc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xcbf87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcadc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcadc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001670
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a861d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x100c90c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x100bf960]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x29331f39
mov dword [ebp - 0x2c], 0x2e392832
mov byte [ebp - 0x28], 0
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x17
jb 0x100016c8
mov byte [ebp - 0x28], 0
mov dl, 0xd
mov dword [ebp - 0x20], 0x7f68660d
xor ecx, ecx
mov dword [ebp - 0x1c], 0x3e616863
mov dword [ebp - 0x18], 0x6169233f
mov word [ebp - 0x14], 0x61
lea eax, [ebp - 0x1f]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10001709
mov dl, byte [ebp - 0x20]
jmp 0x100016f8
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x13], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x3f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1001cad0
cmp al, 0xe9
jne 0x100017c5
movaps xmm0, xmmword [0x100bf870]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x3e
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x10001744
xorps xmm0, xmm0
mov byte [ebp - 0x13], 0
lea ecx, [ebp - 0x23]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001770
sub ecx, edx
lea eax, [ebp - 0x23]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.10002620
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.10021e10
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x100017c5
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100017bb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100017d7
push ecx
push edx
call fcn.100859f6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1008ac0f
int3
Function at 0x100017e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a864d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x100c90c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dl, 6
mov dword [ebp - 0x20], 0x6b6f7206
mov dword [ebp - 0x1c], 0x72634163
xor ecx, ecx
mov dword [ebp - 0x18], 0x636b6f52
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1f]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x10001847
mov dl, byte [ebp - 0x20]
jmp 0x10001836
mov byte [ebp - 0x14], 0
mov dl, 0x48
mov dword [ebp - 0x38], 0x3a2d2348
xor ecx, ecx
mov dword [ebp - 0x34], 0x7b242d26
mov dword [ebp - 0x30], 0x242c667a
mov word [ebp - 0x2c], 0x24
nop word [eax + eax]
lea eax, [ebp - 0x37]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10001881
mov dl, byte [ebp - 0x38]
jmp 0x10001870
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1001cad0
cmp al, 0xe9
jne 0x10001945
movaps xmm0, xmmword [0x100bfb90]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x5a
nop dword [eax]
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x10
jb 0x100018c0
xorps xmm0, xmm0
mov byte [ebp - 0x2b], 0
lea ecx, [ebp - 0x3b]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100018f0
sub ecx, edx
lea eax, [ebp - 0x3b]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10002620
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.10021e10
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x10001945
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000193b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001957
push ecx
push edx
call fcn.100859f6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1008ac0f
int3
Function at 0x10001960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a867d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x100c90c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dl, 0x77
mov dword [ebp - 0x34], 0x3123077
mov dword [ebp - 0x30], 0x1c141e23
xor ecx, ecx
mov dword [ebp - 0x2c], 0x19021834
mov word [ebp - 0x28], 3
lea eax, [ebp - 0x33]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x100019c9
mov dl, byte [ebp - 0x34]
jmp 0x100019b8
mov byte [ebp - 0x27], 0
mov dl, 0x4a
mov dword [ebp - 0x24], 0x382f214a
xor ecx, ecx
mov dword [ebp - 0x20], 0x79262f24
mov dword [ebp - 0x1c], 0x262e6478
mov word [ebp - 0x18], 0x26
nop dword [eax]
lea eax, [ebp - 0x23]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10001a01
mov dl, byte [ebp - 0x24]
jmp 0x100019f0
lea eax, [ebp - 0x23]
mov byte [ebp - 0x17], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x33]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1001cad0
cmp al, 0xe9
jne 0x10001af8
mov byte [ebp - 0x24], 0x7c
mov cl, 0x15
xor cl, byte [ebp - 0x24]
mov al, 0x28
xor al, byte [ebp - 0x24]
mov ch, 0x3f
mov byte [ebp - 0x23], al
mov dl, 0x1f
mov byte [ebp - 0x22], cl
mov dh, 0x13
mov cl, byte [ebp - 0x24]
mov ah, 0x17
mov byte [ebp - 0x11], 9
xor dl, cl
mov al, byte [ebp - 0x11]
xor ch, cl
xor al, cl
mov byte [ebp - 0x12], 0x12
mov byte [ebp - 0x1d], al
xor dh, cl
mov al, byte [ebp - 0x12]
xor ah, cl
xor al, cl
mov byte [ebp - 0x13], 8
mov byte [ebp - 0x1c], al
xorps xmm0, xmm0
mov al, byte [ebp - 0x13]
xor al, cl
mov byte [ebp - 0x1f], ch
lea ecx, [ebp - 0x23]
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x21], dl
mov byte [ebp - 0x1e], dh
lea edx, [ecx + 1]
mov byte [ebp - 0x20], ah
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001aa3
sub ecx, edx
lea eax, [ebp - 0x23]
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.10002620
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.10021e10
mov ecx, dword [ebp - 0x28]
cmp ecx, 0xf
jbe 0x10001af8
mov edx, dword [ebp - 0x3c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001aee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001b0a
push ecx
push edx
call fcn.100859f6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1008ac0f
int3

Function at 0x10001e00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
ret
Function at 0x10001e10
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100c26a0
push 0x10086ff0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x100c90c0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001ea5
xor al, al
jmp 0x10001f2e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001ed0
xor al, al
jmp 0x10001f2e
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001f1b
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10085995
mov esp, ebp
pop ebp
ret
Function at 0x10003120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [str._nNkk_CogUExmU]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x687e2479
mov word [ebp - 4], 0x66
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x14
jb 0x10003140
lea eax, [ebp - 0x17]
mov byte [ebp - 3], 0
push eax
call fcn.10003630
cmp eax, 0xd73df878
jne 0x10003266
movaps xmm0, xmmword [0x100c01e0]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x6c7a2065
mov word [ebp - 4], 0x62
nop
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x14
jb 0x10003180
lea eax, [ebp - 0x17]
mov byte [ebp - 3], 0
push eax
call fcn.10003630
cmp eax, 0xd73df878
jne 0x10003266
movaps xmm0, xmmword [0x100bf730]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x27316b20
mov word [ebp - 4], 0x29
nop
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x14
jb 0x100031c0
lea eax, [ebp - 0x17]
mov byte [ebp - 3], 0
push eax
call fcn.10003630
cmp eax, 0xb212610
jne 0x10003266
movaps xmm0, xmmword [0x100bf110]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x13133008
mov dword [ebp - 8], 0x8520f17
mov word [ebp - 4], 0x101e
mov byte [ebp - 2], 0
nop word [eax + eax]
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x19
jb 0x10003210
lea eax, [ebp - 0x1b]
mov byte [ebp - 2], 0
push eax
call fcn.10003630
cmp eax, 0x6694b71f
jne 0x10003266
movaps xmm0, xmmword [0x100becd0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
nop
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10003240
lea eax, [ebp - 0x13]
mov byte [ebp - 5], 0
push eax
call fcn.10003630
cmp eax, 0xef7c0020
sete al
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x100034f0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x100ce0f0
call fcn.10087b80
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x1000351b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10003526
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10003531
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000353c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10003547
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10003552
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000355d
bts eax, 1
test cl, 2
je 0x10003566
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x100035ff
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x100035f0
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x100ce0f0], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10003510
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003630
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x100c90c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x100b68a0
push eax
or ebx, 0xffffffff
call fcn.1008b052
add esp, 8
mov dword [ebp - 0x408], eax
test eax, eax
jne 0x10003676
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10085995
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax + eax]
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.1008b242
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x100036cd
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100ce0f0]
sub edx, 1
jne 0x100036a5
mov eax, dword [ebp - 0x408]
cmp edi, 0x400
je 0x10003680
push dword [ebp - 0x408]
call fcn.1008b4a2
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.10085995
mov esp, ebp
pop ebp
ret 4

Function at 0x10003700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
xorps xmm0, xmm0
mov dword [esp + 0x18], 0x353d3934
movaps xmmword [esp + 0x20], xmm0
xor eax, eax
movq qword [esp + 0x30], xmm0
movaps xmm0, xmmword [0x100bf8e0]
movups xmmword [esp + 8], xmm0
mov byte [esp + 0x1c], 0
mov cl, byte [esp + 8]
xor byte [esp + eax + 9], cl
inc eax
cmp eax, 0x13
jb 0x10003732
sub esp, 8
mov byte [esp + 0x24], 0
lea edx, [esp + 0x28]
lea ecx, [esp + 0x11]
call fcn.10028e30
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x100060d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10006207
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
mov bh, 0x5c
mov al, 0x13
mov byte [ebp - 8], 0
mov ah, 0x18
mov byte [ebp - 0x10], bh
xor al, bh
mov byte [ebp - 8], 0
xor ah, bh
mov byte [ebp - 0xf], al
push 0
mov byte [ebp - 0xb], ah
mov cl, 0x10
lea eax, [ebp - 0xf]
mov dl, cl
push eax
mov ch, 0x1e
mov dh, 0x1b
mov bl, 5
xor cl, bh
push 0
xor dl, bh
mov byte [ebp - 0xe], cl
xor ch, bh
mov byte [ebp - 0xd], dl
xor dh, bh
mov byte [ebp - 0xa], ch
xor bl, bh
mov byte [ebp - 9], dh
push 0
mov byte [ebp - 0xc], bl
call esi
test eax, eax
je 0x10006191
mov bh, 0x5b
mov byte [ebp - 8], 0
push 0
push 0
mov al, 0x14
mov byte [ebp - 0x10], bh
mov ah, 0x1f
mov byte [ebp - 8], 0
push 0x10
xor al, bh
xor ah, bh
push 0
mov byte [ebp - 0xf], al
mov cl, 0x17
mov byte [ebp - 0xb], ah
mov dl, cl
lea eax, [ebp - 0xf]
mov ch, 0x19
push eax
mov dh, 0x1c
mov bl, 2
push 0
xor cl, bh
xor dl, bh
xor ch, bh
mov byte [ebp - 0xe], cl
xor dh, bh
mov byte [ebp - 0xd], dl
xor bl, bh
mov byte [ebp - 0xa], ch
push 0
mov byte [ebp - 0xc], bl
mov byte [ebp - 9], dh
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dl, 0x48
mov byte [ebp - 1], 0
mov al, 1
mov byte [ebp - 4], dl
xor al, dl
mov byte [ebp - 1], 0
push 0
mov byte [ebp - 3], al
mov cl, 0xc
lea eax, [ebp - 3]
xor cl, dl
push eax
push 0
push 0
mov byte [ebp - 2], cl
call esi
test eax, eax
je 0x100061f0
push 0
push 0
mov dl, 6
mov byte [ebp - 1], 0
mov al, 0x4f
mov byte [ebp - 4], dl
push 0x10
xor al, dl
mov byte [ebp - 1], 0
push 0
mov byte [ebp - 3], al
mov cl, 0x42
lea eax, [ebp - 3]
xor cl, dl
push eax
push 0
push 0
mov byte [ebp - 2], cl
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret