joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008fc10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cfc5b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10106404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
call fcn.100a3120
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1008fd51
cmp eax, 0x104
ja 0x1008fd51
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100a3120
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0x100e57a8
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1008fd02
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008fce0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.1002a6c2
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x438]
mov dword [esi + 0x14], 0
xor eax, eax
movups xmmword [esi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
call fcn.10028df2
jmp 0x1008fd76
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009cacf
mov esp, ebp
pop ebp
ret
Function at 0x10090bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cfd78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10106404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp byte [esi + 0x20], 0
jne 0x10090c17
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 1
jbe 0x10090c53
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x10091330
push 0
push 0
call fcn.100a6b54
xor ecx, ecx
mov dword [esi + 0x10], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x60]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x44]
call sub.gdiplus.dll_GdipCreateFromHDC
mov edi, dword [ebp - 0x10]
mov esi, eax
mov dword [ebp - 0x1c], edi
push 0xffffffffffffffff
push edi
mov dword [ebp - 4], 0
call sub.gdiplus.dll_GdipGraphicsClear
test eax, eax
cmovne esi, eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x2c]
push dword [eax + 0x28]
push 0
push 0
push dword [eax + 4]
push edi
call sub.gdiplus.dll_GdipDrawImageRectI
test eax, eax
push ebx
cmovne esi, eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
call fcn.10038520
mov ecx, esi
call fcn.10090ff0
push edi
call sub.gdiplus.dll_GdipDeleteGraphics
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10095030
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cff78
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10106404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
test esi, esi
je 0x100950d9
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100950d9
cmp dword [ebp + 0x1c], 0
je 0x100950d9
cmp dword [ebp + 0x34], 0
je 0x100950d9
cmp dword [ebp + 0x4c], 0
je 0x100950d9
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100950d0
cmp dword [ebp + 0x20], 0x10
lea ecx, [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmovae ecx, dword [ebp + 0xc]
push ecx
push esi
call ebx
test eax, eax
je 0x100950ac
call eax
mov dword [edi], eax
cmp dword [ebp + 0x38], 0x10
lea eax, [ebp + 0x24]
cmovae eax, dword [ebp + 0x24]
push eax
push esi
call ebx
cmp dword [ebp + 0x50], 0x10
mov dword [edi + 4], eax
lea eax, [ebp + 0x3c]
cmovae eax, dword [ebp + 0x3c]
push eax
push esi
call ebx
mov dword [edi + 8], eax
xor ebx, ebx
cmp dword [edi], ebx
setne bl
jmp 0x100950db
xor ebx, ebx
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x1009510f
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10095105
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100951a9
push edx
push ecx
call fcn.1009c669
add esp, 8
mov edx, dword [ebp + 0x38]
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0xf
mov byte [ebp + 0xc], 0
cmp edx, 0x10
jb 0x10095151
mov ecx, dword [ebp + 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10095147
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100951ae
push edx
push ecx
call fcn.1009c669
add esp, 8
mov edx, dword [ebp + 0x50]
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0xf
mov byte [ebp + 0x24], 0
cmp edx, 0x10
jb 0x10095193
mov ecx, dword [ebp + 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10095189
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100951b3
push edx
push ecx
call fcn.1009c669
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x4c
call fcn.100a6619
call fcn.100a6619
call fcn.100a6619
int3
Function at 0x10097d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x10097e07
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x10097d55
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10099660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0263
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x10106404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x101063f0]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10099550
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x10099841
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.100a3120
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x100e81cc
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10099841
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x10099735
cmp eax, 2
jne 0x10099841
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x10099756
test cl, 1
jne 0x10099841
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x1009975c
jmp 0x10099841
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x10099841
call fcn.10009590
mov ecx, eax
test ecx, ecx
je 0x1009986c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.100977b0
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x100e81d4
push eax
call fcn.10099d30
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.10097d40
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x10099825
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100997c6
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.100998c0
push dword [0x101063f8]
lea eax, [ebp - 0x74]
push dword [0x101063f4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10099802
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1009981e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x10099843
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10099841
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x1009984e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009cacf
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10006870
int3
Function at 0x10099a30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0298
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10106404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x101063f0]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10099550
test eax, eax
je 0x10099b58
mov esi, dword [ebp - 0x18]
mov edi, dword [str.SOFTWAREComMaster]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10099b03
cmp dword [esi], 0
je 0x10099af6
push 0x100e8080
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10099ac3
mov eax, 1
jmp 0x10099b24
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10099afc
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x10099b24
cmp dword [esi + 4], 0
jne 0x10099b03
mov eax, 1
jmp 0x10099b24
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10099b4e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10099b36
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x10099b5b
xor ebx, ebx
jmp 0x10099bff
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x10099bff
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x10099bb8
mov ecx, dword [ebx]
test ecx, ecx
je 0x10099c1e
push ecx
push eax
call fcn.100b0119
add esp, 8
test eax, eax
je 0x10099bb8
mov edx, dword [edi]
test edx, edx
je 0x10099bb8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10099b90
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x10099bc3
lea eax, [edx + 0xd]
jmp 0x10099bf8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10099bd0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x100e81cc
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x10099c0a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10006870
int3
Function at 0x1009b3b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1009b421
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1009b3ef
cmp eax, 2
jne 0x1009b40b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1009b41b
test ecx, ecx
je 0x1009b416
test cl, 1
jne 0x1009b40b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1009b41b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1009f6d0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d055f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10106404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.1009c639
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x1009f727
push 0x58
push 0
push esi
call fcn.100a3120
add esp, 0xc
mov ecx, esi
call fcn.1009eb00
mov esi, eax
jmp 0x1009f729
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x1009f73b
mov edi, dword [edi]
test edi, edi
je 0x1009f7d8
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009f7d8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1009f7d8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x1009f7d8
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x1009f7d8
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x1009f7d8
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.1009ef60
test eax, eax
je 0x1009f7d8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1009f7ee
mov ecx, esi
call fcn.1009ec20
push 0x58
push esi
call fcn.1009c669
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a0020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x100a011f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100a011f
or eax, 0xffffffff
cmp esi, 8
jb 0x100a00f7
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
sub edi, 1
jne 0x100a0050
pop edi
test esi, esi
je 0x100a011a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100ea4b0]
sub esi, 1
jne 0x100a0100
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x420bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x420bbf
pop dword [ebp - 0x14]
mov eax, 0x40ad8dd0
sub eax, 0x406b8211
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3af5a
push 0
mov eax, 0xfcf3908e
add eax, 0x34ec18a
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x60de3153
sub ecx, 0x60ddf5e6
xor edi, edi
add edi, eax
mov ebx, 0xb7b108ba
add ebx, 0x48924b46
add ebx, dword [ebp - 0x14]
mov esi, 0x9844fec4
sub esi, 0x97352361
xor dword [ebp - 0x10], 0xed130a17
mov edx, dword [ebx]
mov dword [ebp - 0x10], 0xc4fd1eea
sub edx, esi
xor dword [ebp - 0xc], 0xdb09e7eb
mov dword [edi], edx
xor dword [ebp - 8], edi
add edi, 4
add ebx, 4
loop 0x420c20
add eax, 0xe087
mov ebx, eax
add eax, 0x23538897
add eax, 0xdcac776e
mov ecx, 0x29ca6f5b
add ecx, 0xd67590a5
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40611c
pop dword [ebp - 0x44]
mov eax, 0xb9aacab1
sub eax, 0xb96a6995
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x2bf8c085
sub dword [ebp - 0x54], 0xdda67b3a
mov dword [ebp - 0x50], 0xbe58bdab
add dword [ebp - 0x50], 0x73da8e9a
mov dword [ebp - 0x4c], 0x58e00d7
sub dword [ebp - 0x4c], 0xb941bca9
mov dword [ebp - 0x48], 0xf203e739
sub dword [ebp - 0x48], 0xf203e739
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xce5b037a
add dword [ebp - 0x54], 0xa61765dc
mov dword [ebp - 0x50], 0x32258f9f
add dword [ebp - 0x50], 0xf46d1d6
mov dword [ebp - 0x4c], 0x95035380
add dword [ebp - 0x4c], 0xce6c18ec
mov dword [ebp - 0x48], 0x165853e5
sub dword [ebp - 0x48], 0x165853e5
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36ecb
push 0
call eax
mov ecx, 0x6cbc0967
sub ecx, 0x6cbbc023
mov edx, eax
mov ebx, 0x27296521
sub ebx, 0x26e86521
add ebx, dword [ebp - 0x44]
mov edi, 0x44b51e00
add edi, 0x1e112da0
add dword [ebp - 0x20], 0xcd79ec2f
mov esi, dword [ebx]
xor dword [ebp - 0x3c], 0x6bf48659
sub esi, edi
xor dword [ebp - 0x20], ecx
mov dword [edx], esi
add dword [ebp - 0x20], ebx
add edx, 4
add ebx, 0x9fd0723f
sub ebx, 0x9fd0723b
loop 0x406234
add eax, 0x3c387a00
add eax, 0xc3c89de3
xor ebx, ebx
add ebx, eax
add eax, 0x133f0202
add eax, 0xecc0fe03
mov ecx, 0x6bd27ae3
add ecx, 0x946d851d
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4013b5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0040fcd0
cmp dword [0x1a1faf8], 0x594
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x28], esi
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], ebx
jne 0x4013ef
push 0
lea eax, [ebp - 0x84c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x41a308]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
mov dword [ebp - 0x30], eax
mov eax, dword [0x41a30c]
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x24], eax
call fcn.004013ab
mov ecx, dword [0x41a310]
mov eax, dword [0x41a314]
add dword [ebp - 4], 0x23f
push 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
pop esi
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, ebx
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x1a1faf8], 0xfa9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1a1faf4]
cmove eax, edx
xor edx, edx
cmp dword [0x1a1faf8], 0x3eb
mov dword [0x1a1faf4], eax
mov eax, dword [0x1a1f4e4]
cmove eax, edx
add ecx, ebx
mov dword [0x1a1f4e4], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov eax, dword [ebp - 8]
xor edx, ecx
add eax, dword [ebp - 0x1c]
mov ecx, dword [0x1a1faf8]
xor eax, edx
mov dword [0x1a1faf0], 0xf4ea3dee
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp ecx, 0x213
jne 0x401524
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
lea eax, [ebp - 0x104c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
lea eax, [ebp - 0x44c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1a1faf8]
sub edi, eax
cmp ecx, 0xc
jne 0x401532
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov eax, edi
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, edi
mov edx, dword [ebp - 4]
shr eax, cl
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
xor eax, edx
mov edx, dword [ebp - 0xc]
xor edx, eax
mov dword [ebp - 0xc], edx
call fcn.004013b2
mov eax, dword [ebp - 0x18]
sub dword [ebp - 4], eax
dec esi
je 0x40157e
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
jmp 0x40142d
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret