joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f5680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x101a6468
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push ebp
push esi
mov eax, dword [0x10206370]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x84]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
cmp esi, eax
ja 0x100f56d8
cmp dword [edi + 0x18], eax
je 0x100f56d8
push 1
push eax
mov ecx, edi
call fcn.10005ea0
test al, al
je 0x100f56d8
push esi
mov ecx, edi
call fcn.10005e60
mov esi, dword [ebp + 4]
mov ebx, dword [ebp + 8]
inc esi
dec ebx
cmp esi, ebx
je 0x100f57bb
mov al, byte [esi]
inc esi
mov byte [esp + 0x18], al
cmp al, 0x22
je 0x100f57bb
cmp al, 0x5c
jne 0x100f57a7
cmp esi, ebx
je 0x100f57d2
mov al, byte [esi]
movsx eax, al
inc esi
add eax, 0xffffffde
mov dword [esp + 0x84], esi
cmp eax, 0x53
ja case.0x100f5727.35
movzx eax, byte [eax + 0x100f58a8]
jmp dword [eax*4 + 0x100f5880]
push 0x22
jmp 0x100f57ac
push 0x2f
jmp 0x100f57ac
push 0x5c
jmp 0x100f57ac
push 8
jmp 0x100f57ac
push 0xc
jmp 0x100f57ac
push 0xa
jmp 0x100f57ac
push 0xd
jmp 0x100f57ac
push 9
jmp 0x100f57ac
mov edx, dword [esp + 0x80]
lea ecx, [esp + 0x14]
push ecx
push ebx
push edx
lea ecx, [esp + 0x90]
mov edx, ebp
call fcn.100f5900
test al, al
je 0x100f581d
mov ecx, dword [esp + 0x14]
lea esi, [esp + 0x54]
call fcn.100f4040
push eax
mov ecx, edi
mov dword [esp + 0x7c], 1
call fcn.10082f70
mov ecx, esi
mov dword [esp + 0x78], 0xffffffff
call fcn.10005740
mov esi, dword [esp + 0x84]
jmp 0x100f57b3
mov eax, dword [esp + 0x18]
push eax
mov ecx, edi
call fcn.10082f90
cmp esi, ebx
jne 0x100f56e8
mov al, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 8
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x20]
call fcn.10005a50
mov ecx, dword [esp + 0x80]
push esi
mov esi, ebp
lea ebx, [esp + 0x20]
mov dword [esp + 0x7c], 0
call fcn.100f5b80
lea ecx, [esp + 0x1c]
mov bl, al
call fcn.10005740
mov al, bl
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 8
xor al, al
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 8
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x3c]
call fcn.10005a50
mov ecx, dword [esp + 0x80]
push esi
mov esi, ebp
lea ebx, [esp + 0x3c]
mov dword [esp + 0x7c], 2
call fcn.100f5b80
lea ecx, [esp + 0x38]
mov bl, al
call fcn.10005740
mov al, bl
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 8

Function at 0x100f87b5
Capabilities:
Hash data with md5

Disassembly:
push esi
xor ecx, ecx
push 0x40
lea esi, [eax + 0x5c]
push ecx
push esi
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
call fcn.101845c0
add esp, 0xc
mov byte [esi], 0x80
pop esi
ret
Function at 0x100ff2c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x100ff2ed
push esi
push edi
jmp 0x100ff2d0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x101bc0e0]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x100ff2d0
pop edi
pop esi
ret

Function at 0x100ff350
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, eax
lea eax, [esi*8]
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 0x400
jbe 0x100ff370
mov esi, 0x80
cmp esi, dword [edi]
jne 0x100ff37e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [0x10210598]
test eax, eax
je 0x100ff389
call eax
lea ecx, [esi*8]
push ecx
call fcn.100fbd00
mov ebp, eax
mov eax, dword [0x1021059c]
add esp, 4
mov dword [esp + 0x14], ebp
test eax, eax
je 0x100ff3aa
call eax
test ebp, ebp
je 0x100ff374
mov edx, dword [edi + 0xc]
push edx
call fcn.100fc010
add esp, 4
push ebp
mov dword [edi + 0xc], ebp
call dword [0x10208e34]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [edi], ebx
call fcn.101845c0
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x100ff43a
nop
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x100ff423
lea esp, [esp]
movzx edi, byte [esi]
movzx edi, byte [edi + 0x101bc0e0]
lea ebp, [eax*8]
xor edi, ebp
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x100ff400
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
xor edx, edx
div ebx
mov esi, dword [ecx]
mov eax, ecx
lea edx, [ebp + edx*8]
call fcn.100ff2f0
mov ecx, esi
test esi, esi
jne 0x100ff3f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x101108e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x34]
push edi
mov edi, eax
push esi
lea eax, [esp + 0x24]
mov ecx, edi
mov dword [esp + 0x14], ebx
call fcn.1010ba30
mov ax, word [esp + 0x3c]
add esp, 4
test ax, ax
je 0x10110985
movzx ecx, word [esi + 0x12]
add ecx, dword [esi + 0x38]
movzx eax, ax
add eax, edi
lea edx, [eax + 3]
cmp edx, ecx
jbe 0x10110948
push 0x101e32a4
push 0xd891
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100fd7d0
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, byte [eax]
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl esi, 8
or esi, ecx
mov ecx, dword [ebx + 0x24]
shl esi, 8
or esi, edx
movzx edx, word [esp + 0x36]
shl esi, 8
or esi, eax
mov eax, dword [esp + 0x30]
sub ecx, 4
sub eax, edx
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
xor ecx, ecx
cmp eax, ecx
jne 0x1011099a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
xor ecx, ecx
dec eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
cmp esi, 2
jb 0x10110a86
cmp esi, dword [ebx + 0x2c]
ja 0x10110a86
cmp eax, ecx
je 0x101109de
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
mov edi, ebx
call fcn.1010ed30
add esp, 0xc
test eax, eax
jne 0x10110987
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x101109ed
call fcn.1010c660
mov ebx, dword [esp + 0x10]
mov edi, eax
test edi, edi
je 0x10110a17
mov eax, dword [edi + 0x44]
cmp word [eax + 0x1a], 1
je 0x10110a17
push 0x101e32a4
push 0xd8b3
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100fd7d0
add esp, 0x10
mov ebx, 0xb
jmp 0x10110a25
push esi
push ebx
mov eax, edi
call fcn.10110590
add esp, 8
mov ebx, eax
test edi, edi
je 0x10110a62
mov eax, dword [edi + 0x44]
test eax, eax
je 0x10110a62
test byte [eax + 0x18], 0x40
mov esi, dword [eax + 0x10]
je 0x10110a42
mov ecx, eax
call fcn.10106810
jmp 0x10110a47
call fcn.10102e00
cmp dword [esi + 0x78], 0
jne 0x10110a62
mov ecx, dword [esi + 0xcc]
cmp dword [ecx + 0xc], 0
jne 0x10110a62
push esi
call fcn.101051a0
add esp, 4
test ebx, ebx
jne 0x10110a7d
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], ebx
jne 0x10110990
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x101e32a4
push 0xd89f
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100fd7d0
add esp, 0x10
pop edi
pop esi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10122be0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push esi
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0x48]
mov esi, dword [eax + 0x34]
test ecx, ecx
je 0x10122c00
push esi
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push edi
call fcn.10119ab0
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x10122c35
movzx ecx, word [edi + 6]
xor edx, edx
xor eax, eax
mov word [esi + 4], cx
cmp dx, cx
jae 0x10122c31
mov ecx, dword [esi + 0x10]
add ecx, 0x1c
mov edi, edi
test byte [ecx], 1
jne 0x10122c4e
movzx edx, word [esi + 4]
inc eax
add ecx, 0x28
cmp eax, edx
jl 0x10122c20
or byte [esi + 6], 2
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push esi
push eax
push ecx
call fcn.10119ba0
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ecx
ret
pop edi
mov dword [ebx], 0xffffffff
pop esi
pop ecx
ret
Function at 0x1012ee50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x1012ee67
xor ebx, ebx
jmp 0x1012ee7f
cmp byte [ebp], 0
je 0x1012ee76
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x1012ee70
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x14]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x1012ef40
jmp 0x1012eea4
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x1012eeac
xor esi, 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1012eed1
mov edx, dword [esp + 0x1c]
mov edx, dword [edx + 0x10]
mov ecx, esi
shl ecx, 4
mov ecx, dword [ecx + edx]
push ecx
push eax
call fcn.100fe1a0
add esp, 8
test eax, eax
jne 0x1012ef2d
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x10]
shl esi, 4
mov ecx, dword [esi + eax + 0xc]
add ecx, 8
cmp dword [ecx + 0xc], 0
je 0x1012ef17
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x1012ef11
movzx esi, byte [edx]
movzx esi, byte [esi + 0x101bc0e0]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x1012eef2
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x1012ef19
xor edx, edx
push ebp
call fcn.100ff450
add esp, 4
test eax, eax
je 0x1012ef4a
mov edi, dword [eax + 8]
test edi, edi
jne 0x1012ef40
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x1012eea0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x1012ef2d

Function at 0x1012f040
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x1012f056
xor ebx, ebx
jmp 0x1012f06f
cmp byte [edi], 0
je 0x1012f066
jmp 0x1012f060
inc eax
cmp byte [eax], 0
jne 0x1012f060
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 0x14]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x1012f130
mov ecx, dword [ecx + 0x10]
push esi
mov dword [esp + 0x14], ecx
jmp 0x1012f094
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x1012f09c
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x1012f0c1
mov eax, dword [eax]
push eax
push ecx
call fcn.100fe1a0
add esp, 8
test eax, eax
jne 0x1012f10f
cmp dword [esi + 0x24], 0
lea ecx, [esi + 0x18]
je 0x1012f0f9
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x1012f0f3
movzx edi, byte [edx]
movzx edi, byte [edi + 0x101bc0e0]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x1012f0d4
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x1012f0fb
xor edx, edx
push edi
call fcn.100ff450
add esp, 4
test eax, eax
je 0x1012f12c
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x1012f122
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x1012f090
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x1012f10f
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10134870
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x10134890
mov al, byte [ebp + 0x101bc9a8]
mov byte [esp + 0x10], al
test edi, edi
je 0x10134915
cmp byte [edi], 0
mov eax, edi
je 0x101348ab
inc eax
cmp byte [eax], 0
jne 0x101348a5
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x1a4
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x101348fd
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x101348f3
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x101bc0e0]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x101348d0
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x101348ff
xor edx, edx
push edi
call fcn.100ff450
add esp, 4
test eax, eax
je 0x10134911
mov eax, dword [eax + 8]
jmp 0x1013491c
xor eax, eax
jmp 0x1013491c
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 8]
test eax, eax
je 0x1013492c
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x1013494d
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x10134890
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x101625c0
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push 0x1c
push 0x101f35f8
call fcn.10184a48
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp + 0xc], ebx
cmp eax, ebx
je 0x101625e0
mov dword [eax], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp edi, ebx
je 0x1016271f
cmp dword [sym.imp.KERNEL32.dll_CloseHandle], ebx
je 0x1016271f
push 1
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call esi
mov dword [ebp - 0x1c], eax
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call edi
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x10162651
push ebx
push ebx
push ebx
push 0x1000002
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x10162651
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x10162651
mov dword [ebp - 0x28], eax
push dword [ebp - 0x1c]
call esi
mov edi, dword [ebp - 0x28]
cmp edi, ebx
je 0x101626d5
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x101626c9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x101626c9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x101626c9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x101626c9
movzx ecx, word [eax]
cmp ecx, dword [ebp - 0x1c]
ja 0x101626c2
mov dword [ebp - 0x1c], ecx
add ecx, 3
and ecx, 0xfffffffc
mov dword [ebp - 0x1c], ecx
cmp dword [eax + 0x28], 0xfeef04bd
je 0x101626cc
jmp 0x101626c2
mov dword [ebp - 0x20], 0xd
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x101626dc
mov dword [ebp - 0x20], 0xd
cmp dword [ebp + 0xc], ebx
je 0x101626ea
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x24], ebx
je 0x101626f8
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c], 0xffffffff
je 0x10162707
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + eax + 4]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x10162721
xor eax, eax
call fcn.10184a8d
ret
Function at 0x10162727
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push 0x20
push 0x101f35d8
call fcn.10184a48
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, ebx
je 0x10162761
cmp dword [sym.imp.KERNEL32.dll_CloseHandle], ebx
je 0x10162761
cmp dword [ebp + 0xc], 2
jae 0x10162769
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
call fcn.10184a8d
ret
push 1
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call edi
mov dword [ebp - 0x24], eax
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call esi
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x101627c0
push ebx
push ebx
push ebx
push 0x1000002
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x101627c0
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x101627c0
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x1c], ebx
je 0x10162853
push 0x10
xor edi, edi
inc edi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x10162850
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x10162850
mov dword [ebp - 4], ebx
movzx esi, word [eax]
mov dword [ebp - 0x24], esi
lea edx, [esi + esi + 4]
mov ecx, dword [ebp + 0xc]
cmp edx, ecx
jbe 0x10162812
shr ecx, 1
sub ecx, 4
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], edi
jmp 0x10162815
mov dword [ebp - 0x24], ebx
push esi
push eax
mov edi, dword [ebp + 0x10]
push edi
call fcn.10184640
add esp, 0xc
mov dword [esi + edi], 0x58324546
cmp dword [ebp - 0x24], ebx
je 0x10162832
mov word [edi], si
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x10162853
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x28], ebx
je 0x10162861
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x2c], ebx
je 0x1016286f
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], 0xffffffff
je 0x1016287e
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
jmp 0x10162763
Function at 0x10163003
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
push edi
mov edi, eax
cmp dword [esi], ecx
je 0x1016310e
cmp dword [esi + 4], ecx
je 0x1016310e
mov dword [esi + 8], ecx
xor eax, eax
push ebx
mov ebx, dword [eax + 0x10207db8]
mov edx, dword [esi]
mov dword [eax + edx], ebx
add eax, 4
cmp eax, 0x48
jl 0x10163023
xor eax, eax
mov edx, 0x100
mov ebx, dword [eax + 0x10207e00]
mov ecx, dword [esi + 4]
mov dword [eax + ecx], ebx
add eax, 4
dec edx
jne 0x1016303d
cmp eax, 0x1000
jl 0x10163038
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov al, byte [ecx + edi]
mov byte [ebp + 0xb], al
lea eax, [ecx + 1]
cdq
idiv ebx
mov al, byte [edx + edi]
mov byte [ebp + 0xa], al
lea eax, [ecx + 2]
cdq
idiv ebx
mov al, byte [edx + edi]
mov byte [ebp + 9], al
lea eax, [ecx + 3]
cdq
idiv ebx
mov al, byte [edx + edi]
mov edx, dword [ebp - 4]
mov byte [ebp + 8], al
mov eax, dword [esi]
add eax, edx
mov edx, dword [ebp + 8]
xor dword [eax], edx
lea eax, [ecx + 4]
cdq
idiv ebx
add dword [ebp - 4], 4
cmp dword [ebp - 4], 0x48
mov ecx, edx
jl 0x1016305e
and dword [ebp - 4], 0
and dword [ebp + 8], 0
xor edi, edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.101628a6
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [edi + eax], ecx
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
mov dword [edi + eax + 4], ecx
add edi, 8
cmp edi, 0x48
jl 0x101630b0
xor edi, edi
mov ebx, 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.101628a6
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [edi + eax], ecx
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 4]
mov dword [eax + edi + 4], ecx
add edi, 8
dec ebx
jne 0x101630de
cmp edi, 0x1000
jl 0x101630d9
pop ebx
pop edi
leave
ret 4
Function at 0x10168f00
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x10168f07
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.10168f30
Function at 0x1016f050
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x10206370]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
mov dword [esp + 8], 0
push ecx
mov word [esp + 0x14], ax
call fcn.101845c0
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, esi
test eax, eax
jne 0x1016f0c7
lea edx, [esp + 8]
push edx
jmp 0x1016f0cc
push 0x101da6a0
call fcn.1000b560
mov ecx, dword [esp + 0x210]
xor ecx, esp
mov eax, esi
call fcn.1017e01c
add esp, 0x214
ret

Function at 0x1016f720
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x101ae328
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10206370]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
test edi, edi
jne 0x1016f759
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1016f746
lea eax, [esp + 8]
push str.360Base.dll
push eax
call fcn.100ea5b0
add esp, 8
mov ecx, eax
mov dword [esp + 0x14], 0
call fcn.1004f530
push eax
call fcn.100500a0
add esp, 4
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call fcn.100056e0
test esi, esi
je 0x1016f7c1
push 0
push edi
call fcn.100500d0
add esp, 8
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
mov eax, edi
call fcn.101763a0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10175490
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x10206370]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10178e60
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.10178f00
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.1017e01c
add esp, 0x68
ret