joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003340
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x10014020]
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp eax, 1
mov dword [esp + 0x14], edi
je 0x1000340a
cmp eax, 3
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jne 0x10003390
mov ecx, dword [0x10014044]
push esi
push edi
push ecx
call fcn.10004170
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x10003493
mov dword [ebx], esi
mov eax, dword [0x10014020]
cmp eax, 2
jne 0x100034c2
mov eax, dword [0x1001402c]
cmp eax, 4
je 0x100033a8
cmp eax, 5
jne 0x100033b2
push 1
call fcn.10003030
add esp, 4
mov eax, dword [0x10011ff0]
push 0
lea edx, [esp + 0x18]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov ecx, dword [esp + 0x14]
mov dword [ebx], ecx
je 0x100033d9
cmp ecx, esi
je 0x100034c4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str._Device_Monitor__Write_Error______GetLasetError__x
push 0x10012008
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10012008
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add dword [0x1001403c], ebx
cmp ebx, edi
mov dword [esp + 0x10], eax
je 0x10003489
mov esi, ebx
sub esi, edi
cmp esi, 0x1000
jbe 0x10003431
mov esi, 0x1000
push str.____1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x10]
mov edx, dword [0x10011ffc]
push esi
push ecx
push edx
call fcn.10004170
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x10003463
add dword [esp + 0x10], esi
add edi, esi
cmp ebx, edi
jne 0x10003420
jmp 0x10003489
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.WriteFile_Fail_nBufferSize_d__LastError_d__n
push 0x10012008
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10012008
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp ebx, edi
mov eax, dword [esp + 0x24]
mov dword [eax], edi
je 0x100034c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Device_Monitor__Write_Error______GetLasetError__x
push 0x10012008
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10012008
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10003fc0
Capabilities:
Print debug messages

Disassembly:
push ecx
mov eax, dword [0x10012000]
movzx ecx, word [0x10012110]
movzx edx, word [0x10012114]
push esi
push eax
push ecx
push edx
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push str.Control
call fcn.10003e80
mov esi, eax
add esp, 0x28
cmp esi, 0xffffffff
jne 0x10004000
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
push 0
push edi
push eax
push ecx
push 3
lea edx, [esp + 0x1c]
push edx
push 0x22003c
push esi
mov byte [esp + 0x28], 0xc
mov byte [esp + 0x29], 0
mov byte [esp + 0x2a], 0x87
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
push str.Control
push esi
jne 0x1000404c
call fcn.10003fa0
add esp, 8
pop edi
xor eax, eax
pop esi
pop ecx
ret
cmp dword [edi], 0
ja 0x1000406a
call fcn.10003fa0
add esp, 8
push str.Noting_______________n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
pop ecx
ret
call fcn.10003fa0
add esp, 8
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x10004090
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
xor eax, eax
push esi
push edi
push eax
push eax
push 1
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov dword [esp + 0x28], eax
mov ebp, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
jne 0x10004151
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10004151
mov eax, dword [0x10011008]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
jne 0x1000412d
push 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
xor edx, edx
cmp ebx, eax
sete dl
mov dword [ecx], eax
mov esi, edx
jmp 0x10004146
cmp eax, 0x102
jne 0x10004146
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10004170
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
xor eax, eax
push esi
push edi
push eax
push eax
push 1
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov dword [esp + 0x28], eax
mov ebp, eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x10004229
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10004229
mov eax, dword [0x10011008]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
jne 0x10004205
push 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor eax, eax
cmp dword [esp + 0x10], ebx
sete al
mov esi, eax
jmp 0x1000421e
cmp eax, 0x102
jne 0x1000421e
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x100044f0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x1001100c]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.10004b40
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x1000455e
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
jne 0x1000455e
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10004b28
add esp, 0xa0
ret
mov eax, dword [esp + 0x14]
sub eax, 1
je 0x100045f6
sub eax, 1
jne 0x100045db
mov eax, dword [esp + 8]
cmp eax, 4
ja 0x10004594
mov eax, 4
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10004b28
add esp, 0xa0
ret
cmp eax, 5
jne 0x100045bb
xor eax, eax
cmp dword [esp + 0xc], eax
pop esi
setne al
add eax, 5
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10004b28
add esp, 0xa0
ret
cmp eax, 6
jb 0x100045db
mov eax, 7
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10004b28
add esp, 0xa0
ret
mov eax, 1
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10004b28
add esp, 0xa0
ret
mov eax, dword [esp + 8]
cmp eax, 4
ja 0x10004623
jne 0x10004608
cmp dword [esp + 0xc], 0
ja 0x10004623
mov eax, 2
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10004b28
add esp, 0xa0
ret
mov ecx, dword [esp + 0xa0]
pop esi
xor ecx, esp
mov eax, 3
call fcn.10004b28
add esp, 0xa0
ret
Function at 0x10004640
Capabilities:
Check os version
Print debug messages

Disassembly:
sub esp, 0xa0
mov eax, dword [0x1001100c]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push edi
push 0x9c
xor edi, edi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.10004b40
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x9c
call esi
test eax, eax
jne 0x100046ae
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x94
call esi
test eax, eax
jne 0x100046ae
pop edi
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10004b28
add esp, 0xa0
ret
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x100046c7
mov eax, dword [esp + 0xc]
cmp eax, 6
jne 0x100046eb
cmp dword [esp + 0x10], 2
jae 0x100046f0
push str._Device_Monitor__IsWindows8orHigher:_FLASE
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0xa4]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10004b28
add esp, 0xa0
ret
cmp eax, 7
jbe 0x100046c7
mov edi, 1
push str._Device_Monitor__IsWindows8orHigher:_TRUE
jmp 0x100046cc
Function at 0x10004b28
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001100c]
jne 0x10004b32
repz ret
jmp fcn.10005cab

Function at 0x10008b72
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10011950]
je 0x10008b8d
inc edi
cmp edi, 0x17
jb 0x10008b7e
cmp edi, 0x17
jae 0x10008d0d
push ebp
push 3
call fcn.1000bb90
cmp eax, 1
pop ecx
je 0x10008cd9
push 3
call fcn.1000bb90
test eax, eax
pop ecx
jne 0x10008bc1
cmp dword [0x10012148], 1
je 0x10008cd9
cmp ebx, 0xfc
je 0x10008d0c
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10012670
push ebp
call fcn.1000541c
add esp, 0xc
test eax, eax
je 0x10008bf7
push esi
push esi
push esi
push esi
push esi
call fcn.10005b0c
add esp, 0x14
push 0x104
mov esi, 0x10012689
push esi
push 0
mov byte [0x1001278d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10008c3b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000541c
add esp, 0xc
test eax, eax
je 0x10008c3b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10005b0c
add esp, 0x14
push esi
call fcn.100072c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10008c80
push esi
call fcn.100072c0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10012984
push 0x1000e73c
sub ecx, eax
push ecx
push eax
call fcn.1000add6
add esp, 0x14
test eax, eax
je 0x10008c80
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10005b0c
add esp, 0x14
jmp 0x10008c82
xor esi, esi
push 0x1000e738
push ebx
push ebp
call fcn.1000ad1c
add esp, 0xc
test eax, eax
je 0x10008ca2
push esi
push esi
push esi
push esi
push esi
call fcn.10005b0c
add esp, 0x14
push dword [edi*8 + 0x10011954]
push ebx
push ebp
call fcn.1000ad1c
add esp, 0xc
test eax, eax
je 0x10008cc4
push esi
push esi
push esi
push esi
push esi
call fcn.10005b0c
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1000b9d3
add esp, 0xc
jmp 0x10008d0c
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10008d0c
cmp ebp, 0xffffffff
je 0x10008d0c
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10011954]
push dword [esi]
call fcn.100072c0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1000b9d3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10006d35
xor ebx, ebx
cmp dword [0x10012ae0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1000baa9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1000bb89
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1000bb89
push eax
call fcn.10006cc7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10012ae0], eax
call esi
push eax
call fcn.10006cc7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10012ae4], eax
call esi
push eax
call fcn.10006cc7
mov dword [0x10012ae8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000891f
test eax, eax
pop ecx
pop ecx
je 0x1000ba77
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10005b0c
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1000baa9
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10006cc7
cmp eax, ebx
pop ecx
mov dword [0x10012af0], eax
je 0x1000baa9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10006cc7
pop ecx
mov dword [0x10012aec], eax
mov eax, dword [0x10012aec]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1000bb2e
cmp dword [0x10012af0], ecx
je 0x1000bb2e
push eax
call fcn.10006d3e
push dword [0x10012af0]
mov esi, eax
call fcn.10006d3e
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1000bb2e
cmp edi, ebx
je 0x1000bb2e
call esi
cmp eax, ebx
je 0x1000bafb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000bafb
test byte [ebp - 0x18], 1
jne 0x1000bb2e
lea eax, [ebp - 0x10]
push eax
call fcn.10008956
test eax, eax
pop ecx
je 0x1000bb16
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10005b0c
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1000bb25
or dword [ebp + 0x10], 0x200000
jmp 0x1000bb69
or dword [ebp + 0x10], 0x40000
jmp 0x1000bb69
mov eax, dword [0x10012ae4]
cmp eax, dword [ebp - 8]
je 0x1000bb69
push eax
call fcn.10006d3e
cmp eax, ebx
pop ecx
je 0x1000bb69
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1000bb69
mov eax, dword [0x10012ae8]
cmp eax, dword [ebp - 8]
je 0x1000bb69
push eax
call fcn.10006d3e
cmp eax, ebx
pop ecx
je 0x1000bb69
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10012ae0]
call fcn.10006d3e
cmp eax, ebx
pop ecx
je 0x1000bb89
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000bb8b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100404d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x10083980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [0x10149cc8]
or eax, dword [0x10149ccc]
xor eax, 0x863e44f9
sub eax, 0xaca961be
add eax, 0x7d1fa54e
mov ecx, 0x15b49abc
xor edx, edx
div ecx
mov ecx, 0x24d2464f
xor edx, edx
div ecx
xor eax, 0x981c7bee
and eax, 0x55fa2a08
xor eax, 0xb22180ae
sub eax, 0x6fdf2e98
or eax, 0x77e79bbb
imul eax, eax, 0x70dc1075
add eax, 0x3de1142c
xor eax, 0xd0c45bb1
or eax, 0x2dda359
imul eax, eax, 0xf9f317f6
mov ecx, 0x507e4579
xor edx, edx
div ecx
and eax, 0xf91b34d9
sub eax, 0x5e8d016c
or eax, 0xff772213
and eax, 0x83ea47f1
mov ecx, 0x7fa17e63
xor edx, edx
div ecx
add eax, 0x54207fd9
imul eax, eax, 0x420ee441
and eax, 0x5d140a5a
xor eax, 0x4ba551d5
and eax, 0x2463cc10
xor eax, 0xd6dc2d5d
sub eax, 0x26f7f695
imul eax, eax, 0xb411db5a
imul eax, eax, 0x251dacb6
xor eax, 0xe293e34e
mov ecx, 0x81850d67
xor edx, edx
div ecx
add eax, 0x492a248f
cmp eax, 0xf9f8b8a8
je 0x10083c23
mov edx, dword [ebp - 4]
mov eax, 0x246e18b0
push eax
mov ecx, esp
mov dword [ecx], edx
mov ecx, dword [ecx]
movzx ecx, byte [ecx]
mov dword [ebp - 8], ecx
cmp eax, 0x12b19c6d
je 0x10083c23
mov eax, dword [str.__K]
add eax, dword [0x10149cdc]
and eax, 0x4c8801c
or eax, 0xf6279469
and eax, 0xa4d00eec
add eax, 0x60b470bf
and eax, 0xf0270ce8
mov ecx, 0x1bcba773
xor edx, edx
div ecx
sub eax, 0x668ee14f
mov ecx, 0x30ae037b
xor edx, edx
div ecx
imul eax, eax, 0x978cb041
imul eax, eax, 0xaac26dd
or eax, 0xc55e80fa
sub eax, 0xe908a8b2
imul eax, eax, 0x73286819
sub eax, 0x184c083a
sub eax, 0x52ffe180
add eax, 0xe84396f7
mov ecx, 0xccc59094
xor edx, edx
div ecx
and eax, 0xcbb5198e
imul eax, eax, 0x59850797
sub eax, 0x80ac84ea
or eax, 0xd27fdb58
add eax, 0x9986e2ba
or eax, 0x1e93683
xor eax, 0x38016658
add eax, 0x1ab6090a
and eax, 0x30bbe34d
or eax, 0xa9ace83b
sub eax, 0x7fe39c8b
or eax, 0x5014e983
add eax, 0xe1743fa5
and eax, 0x748999d5
add eax, 0x46070b30
sub eax, 0x76b609de
cmp eax, 0xf4390b0
jb 0x10083c30
mov eax, dword [0x10149ce0]
add eax, dword [0x10149ce4]
sub eax, 0x171ec9aa
imul eax, eax, 0xd26e263a
xor eax, 0x45ca259a
imul eax, eax, 0x143abfbe
sub eax, 0xafa03238
mov ecx, 0x85d7c7c2
xor edx, edx
div ecx
and eax, 0x461a8ba4
xor eax, 0x4dc3679d
imul eax, eax, 0x4d42a4e
mov ecx, 0x7dfbbe69
xor edx, edx
div ecx
imul eax, eax, 0xf79fc4a6
xor eax, 0x9f149983
add eax, 0x151260bf
add eax, 0x44495d81
add eax, 0xe6457107
imul eax, eax, 0xaac606f3
xor eax, 0xdf13328e
imul eax, eax, 0xe785d55f
imul eax, eax, 0xe663bd11
imul eax, eax, 0xc6f4d6b5
imul eax, eax, 0x52baf7e6
and eax, 0x6c58bd08
sub eax, 0x9e3d795e
or eax, 0xedd0a488
mov ecx, 0xe9df3d93
xor edx, edx
div ecx
and eax, 0xfa765c15
xor eax, 0x9cd32fab
and eax, 0x2ef03938
or eax, 0xed441aca
imul eax, eax, 0x47c4ce54
and eax, 0x22871042
xor eax, 0xc9fc0388
add eax, 0x1d725a6
cmp eax, 0x78e75f88
jb 0x10083b4b
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push eax
mov eax, esp
mov dword [eax], ecx
jmp 0x10083a60
jmp 0x10083b4b
Function at 0x100fa4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x1014e4a8]
and eax, dword [0x1014e4ac]
sub eax, 0x45e2e848
or eax, 0xadc78d5b
imul eax, eax, 0x72aa6b4
sub eax, 0x471dc0cb
or eax, 0xdba0837a
sub eax, 0x65b326f0
mov ecx, 0xa755db9c
xor edx, edx
div ecx
add eax, 0x2b1e728a
and eax, 0xd26b7583
or eax, 0x6177293f
sub eax, 0x82a72c3
imul eax, eax, 0x583bbd42
sub eax, 0xa0c1ee55
imul eax, eax, 0x59d141fa
mov ecx, 0xbaae40ce
xor edx, edx
div ecx
mov ecx, 0x9f83633c
xor edx, edx
div ecx
mov ecx, 0xd892b63a
xor edx, edx
div ecx
and eax, 0x21a23d08
add eax, 0xd9995a9c
and eax, 0x26f53d7f
mov ecx, 0x8fa14601
xor edx, edx
div ecx
xor eax, 0xfa9d9a82
or eax, 0x6504c1c7
sub eax, 0x915c6629
sub eax, 0x37e5af59
mov ecx, 0x92a30bac
xor edx, edx
div ecx
sub eax, 0xfb133d24
add eax, 0x774bcbf1
sub eax, 0x384d6054
and eax, 0x5b253bf0
xor eax, 0x7685adba
sub eax, 0x1c85994e
xor eax, 0x620b56ed
cmp eax, 0x4cf07cce
jb 0x100fa6a6
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [0x1014e4b0]
mov esi, dword [0x1014e4b4]
and eax, esi
xor eax, 0x2825b111
and eax, 0x6bb5fb1b
add eax, 0xff3e3039
or eax, 0x28730
xor eax, 0x2bf48
add eax, 0xdf9b8093
xor eax, 0x9ab2
imul eax, eax, 0x47b659d1
and eax, 0x3b233
imul eax, eax, 0xfd79990
or eax, 0x60
and eax, 0x40060
or eax, 0x1fbff8e
imul eax, eax, 0x71b91271
and eax, 0x150140e
add eax, 0x2c60e705
xor eax, 0x1c30400
and eax, 0x1c3a400
imul eax, eax, 0xe2be390c
add eax, 0xe389cb1c
and eax, 0x37f16204
add eax, 0xc7458653
or eax, 0xc180024
xor eax, 0x88010200
or eax, 0x73e6fd52
add eax, 0x642ce407
mov dword [ebp - 0x14], eax
push eax
mov esi, esp
push eax
mov eax, esp
mov dword [esi], ecx
mov dword [eax], edx
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
sub esp, 4
mov dword [esp], eax
call fcn.10107ba0
mov eax, dword [ebp - 0x14]
cmp eax, 0xede4fdc
je 0x100fa5d9
mov eax, dword [ebp - 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push eax
mov esi, esp
push eax
mov eax, esp
mov dword [esi], ecx
mov dword [eax], edx
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
sub esp, 4
mov dword [esp], eax
call fcn.10107ba0
jmp 0x100fa5d9
Function at 0x10123d81
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10123dc0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10123dc0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10123dc0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10123dc0
cmp dword [ecx + 0x74], 0xe
jbe 0x10123dc0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10128230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1012825d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1012825d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1012a7a4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013df58
push 0x1013df50
push str.FlsAlloc
push 0x1f
call fcn.1012abbb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1012a7d8
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1012a7de
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1012a822
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013df68
push 0x1013df60
push str.FlsGetValue
push 0x21
call fcn.1012abbb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1012a859
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1012a861
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013df70
push 0x1013df68
push str.FlsSetValue
push 0x22
call fcn.1012abbb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1012a89b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1012deb1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1011e770
mov eax, dword [0x1014fe14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1012d2c1
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1012def3
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1012e04f
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10136520
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10151978]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.1012dc59
mov ecx, dword [esi*4 + 0x10151978]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x1012e048
cmp eax, dword [ecx + edi + 0x24]
jne 0x1012e048
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1012e048
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1012dc59
add esp, 0x14
test edx, edx
jl 0x1012e048
jg 0x1012dfbe
test eax, eax
jb 0x1012e048
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1012e048
jl 0x1012dfd8
cmp dword [ebp - 0x1008], eax
ja 0x1012e048
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1012dff6
test ebx, ebx
je 0x1012e02f
cmp ecx, edi
jae 0x1012e02f
mov al, byte [ecx]
cmp al, 0xd
jne 0x1012e010
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1012e01c
cmp byte [ecx + 1], 0xa
jne 0x1012e01c
inc ecx
jmp 0x1012e01c
movzx eax, al
movsx eax, byte [eax + 0x10150710]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1012dff6
cmp edx, ebx
jne 0x1012dff6
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1012e04d
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1011e164
leave
ret