joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4280b2
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov word [esp + 2], 0
mov eax, 0xfffffff0
mov ecx, dword [esp + 8]
mov cl, byte [ecx + eax + 0x10]
mov edx, dword [esp + 4]
xor cl, byte [edx + eax + 0x10]
movzx ecx, cl
or word [esp + 2], cx
inc eax
jne 0x4280d1
movzx ecx, word [esp + 2]
dec ecx
xor eax, eax
bt ecx, 8
adc eax, 0xffffffff
add esp, 0xc
ret

Function at 0x4280ff
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov word [esp + 2], 0
mov eax, 0xffffffe0
mov ecx, dword [esp + 8]
mov cl, byte [ecx + eax + 0x20]
mov edx, dword [esp + 4]
xor cl, byte [edx + eax + 0x20]
movzx ecx, cl
or word [esp + 2], cx
inc eax
jne 0x42811e
movzx ecx, word [esp + 2]
dec ecx
xor eax, eax
bt ecx, 8
adc eax, 0xffffffff
add esp, 0xc
ret

Function at 0x42814c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov word [esp + 2], 0
mov eax, 0xffffffc0
mov ecx, dword [esp + 8]
mov cl, byte [ecx + eax + 0x40]
mov edx, dword [esp + 4]
xor cl, byte [edx + eax + 0x40]
movzx ecx, cl
or word [esp + 2], cx
inc eax
jne 0x42816b
movzx ecx, word [esp + 2]
dec ecx
xor eax, eax
bt ecx, 8
adc eax, 0xffffffff
add esp, 0xc
ret

Function at 0x428247
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, esp
push esi
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__ftime64]
add esp, 4
mov eax, 0xf4240
mul dword [esi]
mov ecx, eax
imul edi, dword [esi + 4], 0xf4240
add edi, edx
movzx eax, word [esi + 8]
mov edx, 0x3e8
mul edx
add eax, ecx
adc edx, edi
mov ecx, dword [0x43c590]
mov esi, dword fs:[0x2c]
mov ecx, dword [esi + ecx*4]
lea esi, [ecx + 8]
mov dword [esi + 0x228], eax
mov dword [esi + 0x22c], edx
lea edi, [ecx + 0x30]
xor ebx, ebx
push 0x200
push ebx
push edi
call fcn.0042bc6d
add esp, 0xc
mov dword [edi - 0x24], ebx
cmp byte [0x43c518], 0
jne 0x4282d1
call fcn.00428f39
mov byte [0x43c518], 1
lea eax, [esi + 8]
push 0x20
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x4282ee
mov dword [esi], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00428ea1
push ebp
push ebx
push edi
push esi
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [0x43c590]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
lea ebx, [eax + 8]
cmp dword [ebx], 0
jne 0x428326
mov edi, esi
mov esi, edx
call fcn.00428247
mov edx, esi
mov esi, edi
lea ebp, [ebx + 0x228]
lea edi, [ebx + 8]
xor eax, eax
push edi
push ebp
push eax
push edx
push esi
mov esi, edx
call fcn.004275b8
add esp, 0x14
xor dword [ebx + 8], esi
add dword [ebx + 0x228], 1
adc dword [ebx + 0x22c], 0
push edi
push ebp
xor eax, eax
push eax
push 0x20
push edi
push edi
call fcn.004275df
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x428f5d
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov byte [esp + 3], 0
test eax, eax
je 0x428f97
xor ecx, ecx
mov edx, dword [esp + 8]
mov dl, byte [edx + ecx]
mov esi, dword [esp + 4]
xor dl, byte [esi + ecx]
or byte [esp + 3], dl
inc ecx
cmp eax, ecx
jne 0x428f80
movzx ecx, byte [esp + 3]
dec ecx
xor eax, eax
bt ecx, 8
adc eax, 0xffffffff
add esp, 0xc
pop esi
ret

Function at 0x4290c7
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x24
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x43c474], eax
cmp eax, 0xf
jbe 0x4290f7
push 0x10
push 0x43c54c
call fcn.0042844e
add esp, 8
xor eax, eax
add esp, 0x24
pop esi
ret
call fcn.00428ea1
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualLock]
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
mov eax, ecx
ret

Function at 0x42928e
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4292f2
add ebx, 0xfffffff0
mov eax, dword [0x43c474]
mov edi, eax
neg edi
and edi, ebx
lea ecx, [eax + eax]
mov esi, edi
sub esi, ecx
jbe 0x4292fa
mov ebp, dword [esi]
lea eax, [eax + eax*2]
add eax, ebp
mov ecx, esp
push ecx
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10
push 0x43c54c
push ebx
call fcn.00428f5d
add esp, 0xc
test eax, eax
jne 0x4292ff
push ebp
push edi
call fcn.00429114
add esp, 8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00428ea1
call fcn.00429304
Function at 0x42966a
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 2]
mov ecx, 0xaaaaaaab
mul ecx
and edx, 0xfffffffe
lea ecx, [edx + edx + 1]
xor eax, eax
cmp ecx, dword [esp + 0x20]
ja 0x42975a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp ebx, 3
jb 0x429704
mov dword [esp], ebx
movzx esi, byte [edx]
movzx ebx, byte [edx + 1]
movzx edi, byte [edx + 2]
add edx, 3
mov ebp, esi
shr ebp, 2
mov cl, byte [ebp + 0x438ca7]
mov byte [eax], cl
shl esi, 4
and esi, 0x30
mov ecx, ebx
shr ecx, 4
mov cl, byte [esi + ecx + 0x438ca7]
mov byte [eax + 1], cl
and ebx, 0xf
mov ecx, edi
shr ecx, 6
mov cl, byte [ecx + ebx*4 + 0x438ca7]
mov ebx, dword [esp]
mov byte [eax + 2], cl
and edi, 0x3f
mov cl, byte [edi + 0x438ca7]
mov byte [eax + 3], cl
add eax, 4
add ebx, 0xfffffffd
cmp ebx, 2
ja 0x42969d
mov esi, eax
mov eax, dword [esp + 0x18]
jmp 0x429706
mov esi, eax
test ebx, ebx
je 0x429757
movzx edi, byte [edx]
mov ecx, edi
shr ecx, 2
mov cl, byte [ecx + 0x438ca7]
mov byte [esi], cl
cmp ebx, 1
jne 0x429729
shl edi, 4
and edi, 0x30
mov dl, 0x3d
jmp 0x429744
movzx ecx, byte [edx + 1]
shl edi, 4
and edi, 0x30
mov edx, ecx
shr edx, 4
or edi, edx
and ecx, 0xf
mov dl, byte [ecx*4 + 0x438ca7]
mov cl, byte [edi + 0x438ca7]
mov byte [esi + 1], cl
mov byte [esi + 2], dl
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x429764
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x1c]
call fcn.0042bc6d
add esp, 0xc
xor esi, esi
dec esi
cmp edi, 2
jl 0x429837
mov ebx, 2
mov ebp, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push ebx
call ebp
add esp, 4
push dword [esp + 0x1c]
push 0x438ce7
push eax
call fcn.00429a21
add esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
call ebp
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
push 0
call ebp
add esp, 4
push eax
push edi
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fgets
add esp, 0xc
test eax, eax
je 0x429837
push ebx
call fcn.00429b3a
add esp, 4
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, edi
jae 0x429807
mov bl, byte [ebx]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
test bl, bl
je 0x429823
push eax
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
jmp 0x429835
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push edi
push str._truncated_to__u_characters__n
push eax
call fcn.0042983e
add esp, 0xc
jmp 0x429835
push eax
push 1
push 8
push str._empty__n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x429948
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
mov ecx, 0x438d11
cmovne ecx, eax
push ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_perror
add esp, 4
push 2
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
Function at 0x429966
Capabilities:
Terminate process

Disassembly:
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x18]
mov edi, 2
mov dword [esp], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp], eax
call 0x429991
mov dword [esp], edi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
mov dword [esp], ecx
push ecx
push 0x438d12
push eax
call fcn.0042b834
add esp, 0xc
pop eax
ret

Function at 0x4299ff
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00429149
add esp, 4
test eax, eax
je 0x4299f5
ret
push str.sodium_malloc__
call fcn.00429948
push ebx
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x429a1e
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
xor esi, esi
mov bl, byte [ecx + esi]
xor byte [edx + esi], bl
inc esi
cmp eax, esi
jne 0x429a13
pop esi
pop ebx
ret

Function at 0x429a21
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
lea eax, [esp + 0x18]
mov dword [esp], eax
push 0x1000
call fcn.00429149
add esp, 4
test eax, eax
je 0x429a80
mov esi, eax
mov edi, 0x1000
push dword [esp]
push dword [esp + 0x18]
push edi
push eax
call fcn.0042b870
add esp, 0x10
cmp eax, edi
jae 0x429a8a
push dword [esp + 0x10]
push 1
push eax
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
mov edi, eax
push esi
call fcn.0042928e
add esp, 4
cmp edi, 1
jne 0x429a94
xor eax, eax
add esp, 4
pop esi
pop edi
ret
push str.sodium_malloc__
call fcn.00429948
push str.xfprintf___overflow
call fcn.00429966
push str.fwrite__
call fcn.00429948
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
lea eax, [ebx*4 + 8]
mov ecx, 0xaaaaaaab
mul ecx
mov edi, edx
shr edi, 1
inc edi
push edi
call fcn.00429149
add esp, 4
test eax, eax
je 0x429afb
mov esi, eax
push ebx
push edi
push dword [esp + 0x1c]
push eax
call fcn.0042966a
add esp, 0x10
test eax, eax
je 0x429b05
push esi
push 0x438d12
push dword [esp + 0x18]
call fcn.00429a21
add esp, 0xc
push esi
call fcn.0042928e
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
push str.sodium_malloc__
call fcn.00429948
push esi
call fcn.0042928e
add esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
Function at 0x42a4cb
Capabilities:
Terminate process

Disassembly:
push str._n_e_38_5_48mINFOe_0m___________________________________________n_e_38_5_48mINFOe_0m__e_38_5_51mApplicatione_0m:_e_38_5_231me_3mFXSignVerifiere_23me_0m_n_e_38_5_48mINFOe_0m____e_38_5_228mBuild_Datee_0m:_2024_June_16_n_e_38_5_48mINFOe_0m____A_Signature_Verifier_For_FMXInno_n_e_38_5_48mINFOe_0m____Compiler:_Zig_v0.12.1_n_e_38_5_48mINFOe_0m___________________________________________n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
add esp, 4
push str.e_38_5_123mUSAGEe_0m:_n__e_38_5_231me_4me_3mFXSignVerifier.exee_23me_24me_0m__e_38_5_209m_s_sig_filee_0m___e_38_5_209m_k_pubkeye_0m___e_38_5_209m_i_filee_0m__n_n_i__file__________:_Specify_the_file_to_verify._n_k__pubkey________:_Specify_the_public_key._n_s__sigfile_______:_Specify_the_signature_file.__e_38_5_39mdefaulte_0m:__e_38_5_210mfilee_0m_.sig__n_ne_38_5_123mEXAMPLEe_0m:_n__e_38_5_231me_4me_3mFXSignVerifier.exee_23me_24me_0m__s__e_38_5_209m.FMXInno_final.sige_0m____k_e_38_5_209mrwxdret...qqkkyuue_0m__i__e_38_5_209m.FMXInno_final.rare_0m__n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
add esp, 4
push 2
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit

Function at 0x42a568
Capabilities:
Parse pe header

Disassembly:
push ebx
push edi
push esi
push eax
mov edi, ecx
mov ebx, 0x2a
push ebx
call fcn.004299e4
add esp, 4
mov esi, eax
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, esp
push ecx
push eax
push ebx
push edi
push esi
call fcn.004294e4
add esp, 0x14
test eax, eax
je 0x42a554
cmp dword [esp], 0x2a
jne 0x42a554
movzx eax, word [esi]
cmp eax, 0x6445
jne 0x42a55e
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
ret
push str._e_38_5_226mErrore_0m___e_38_5_214mbase64_conversion_failed___pbks_.e_0m_n
call fcn.00429966
push str._e_38_5_226mErrore_0m___e_38_5_214mUnsupported_signature_algorithm.e_0m_n
call fcn.00429966
mov eax, dword [0x439940]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [0x439944]
mov dword [eax], ecx
mov eax, dword [0x439948]
mov dword [eax], ecx
mov ecx, dword [0x439934]
movzx edx, word [ecx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x42a5da
mov edx, dword [ecx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x42a5da
add ecx, edx
movzx edx, word [ecx + 0x18]
cmp edx, 0x20b
je 0x42a5c3
cmp edx, 0x10b
jne 0x42a5da
cmp dword [ecx + 0x74], 0xf
jb 0x42a5da
add ecx, 0xe8
jmp 0x42a5d2
cmp dword [ecx + 0x84], 0xf
jb 0x42a5da
add ecx, 0xf8
xor eax, eax
cmp dword [ecx], 0
setne al
push esi
mov ecx, dword [0x43993c]
cmp dword [ecx], 1
mov dword [0x43c560], eax
mov eax, 2
sbb eax, 0
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_app_type
add esp, 4
mov eax, dword [0x439970]
mov esi, dword [eax]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___p__fmode
mov dword [eax], esi
mov eax, dword [0x439968]
mov esi, dword [eax]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___p__commode
mov dword [eax], esi
call fcn.0042a8dc
mov eax, dword [0x439930]
cmp dword [eax], 1
jne 0x42a632
push 0x42a968
call fcn.0042aa22
add esp, 4
xor eax, eax
pop esi
ret

Function at 0x42a845
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x43993c]
mov dword [eax], 0
jmp fcn.0042a676
Function at 0x42be58
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x43c5d0], 0
je 0x42beb5
push ebp
push ebx
push edi
push esi
push 0x43c5d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x43c5ec]
test edi, edi
je 0x42bea6
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x42be9f
test esi, esi
je 0x42be9f
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
mov edi, dword [edi + 8]
test edi, edi
jne 0x42be86
push 0x43c5d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42bfba
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x439934]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x42c01b
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x42c01b
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x42c01b
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x42c01b
mov edx, dword [esp + 0xc]
sub edx, dword [0x439934]
movzx edi, word [esi + 0x14]
lea esi, [esi + edi + 0x18]
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x42c011
add edi, dword [esi + 8]
cmp edi, edx
ja 0x42c019
add esi, 0x28
dec ecx
jne 0x42c003
jmp 0x42c01b
mov eax, esi
pop esi
pop edi
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403e59
pop dword [ebp - 0x10]
mov eax, 0x403e59
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x7ea89e5b
add dword [ebp - 0x20], 0xcfa9a6f0
mov dword [ebp - 0x1c], 0x1cc3091a
sub dword [ebp - 0x1c], 0xea8fbcd5
mov dword [ebp - 0x18], 0xe4b1c32e
add dword [ebp - 0x18], 0x679a8100
mov dword [ebp - 0x14], 0x3772cb86
sub dword [ebp - 0x14], 0x3772cb86
lea eax, [ebp - 0x20]
push eax
mov eax, 0x469897cb
add eax, 0xb9a7d899
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xe6f2f0fc
add dword [ebp - 0x20], 0x8d7f785a
mov dword [ebp - 0x1c], 0xa1c3dc25
sub dword [ebp - 0x1c], 0x60577ab0
mov dword [ebp - 0x18], 0x8a12ddbe
add dword [ebp - 0x18], 0xd95c8eae
mov dword [ebp - 0x14], 0x7e1ee4c0
add dword [ebp - 0x14], 0x81e11b40
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x14074b8b
add eax, 0xec39251d
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3d271
push 0
call eax
mov ecx, 0x66233c7e
sub ecx, 0x6622dadf
xor edi, edi
add edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x10]
mov esi, 0x49d8abc2
sub esi, 0x4c3f2d8a
sub dword [ebp - 4], 0xebd8bbdd
mov edx, dword [ebx]
xor dword [ebp - 0xc], 0x18e3c976
xor edx, esi
xor dword [ebp - 0xc], ecx
mov dword [edi], edx
xor dword [ebp - 8], ecx
add edi, 0x68de5818
add edi, 0x9721a7ec
add ebx, 0x55d0045e
add ebx, 0xaa2ffba6
loop 0x403f72
add eax, 0xcc4bac2c
sub eax, 0xcc4a32dd
mov ebx, eax
add eax, 0xdea1b148
sub eax, 0xdea1b143
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x20452058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.204521a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x2045207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2045206a
add dl, dl
jne 0x20452089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x204520dc
xor eax, eax
add dl, dl
jne 0x20452096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2045217d
add dl, dl
jne 0x204520a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x204520b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x204520bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x204520c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x204520d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x20452075
mov eax, 1
add dl, dl
jne 0x204520ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x204520f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x204520e1
sub eax, ebx
mov ebx, 1
jne 0x20452128
mov ecx, 1
add dl, dl
jne 0x2045210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x20452119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20452105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20452075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2045213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2045214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x20452136
cmp eax, 0x7d00
jae 0x2045216d
cmp eax, 0x500
jb 0x20452168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20452075
cmp eax, 0x7f
ja 0x20452170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20452075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x2045219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x20452075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10009d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [0x10168d24], 0
lea eax, [ebp - 4]
mov dword [0x10168d1c], 0
mov dword [0x10168d20], 0
push eax
push 1
push 0
push str.SoftwareValveSteam
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009de2
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x103
push eax
push 0x10168c18
push 0
push 0
push str.InstallPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10009dd9
mov eax, dword [ebp - 8]
mov byte [eax + 0x10168c18], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10009e00
mov eax, 0x10168c18
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x2e
mov word [0x10168c18], ax
call fcn.10009e00
mov eax, 0x10168c18
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bab0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
mov dword [ebp - 4], edx
lea eax, [edx - 2]
xor ecx, ecx
test eax, eax
jle 0x1000bb56
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
push ebx
mov ebx, edx
shr ebx, 1
inc ebx
push esi
lea esi, [edi + 2]
lea eax, [ebx + ebx*2]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
movzx ecx, byte [esi - 2]
lea esi, [esi + 3]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movsx edx, byte [esi - 5]
movzx ecx, byte [esi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movsx ecx, byte [esi - 4]
movzx edx, byte [esi - 3]
and ecx, 0xf
shl ecx, 2
shr edx, 6
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movsx ecx, byte [esi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
add eax, 4
sub ebx, 1
jne 0x1000bae6
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
pop esi
pop ebx
jmp 0x1000bb59
mov eax, dword [ebp + 8]
sub edx, ecx
add edi, ecx
test dl, 2
je 0x1000bbaa
movzx ecx, byte [edi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movsx edx, byte [edi]
movzx ecx, byte [edi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
movsx ecx, byte [edi + 1]
and ecx, 0xf
pop edi
movzx ecx, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov word [eax + 3], 0x3d
mov esp, ebp
pop ebp
ret
test dl, 1
je 0x1000bbe0
movzx ecx, byte [edi]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
movsx ecx, byte [edi]
and ecx, 3
shl ecx, 4
pop edi
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov word [eax + 2], 0x3d3d
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret
mov byte [eax], 0
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000bbf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
or eax, 0xffffffff
xor esi, esi
test edi, edi
je 0x1000bc19
movzx ecx, byte [esi + edx]
inc esi
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1008d838]
cmp esi, edi
jb 0x1000bc01
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x1000e5a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [sym.imp.CORE.DLL_Ordinal_1092]
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [eax]
push 0x100901c4
push 0x20
mov eax, dword [ecx]
call dword [eax]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x1000e653
mov eax, dword [ebp + 8]
mov dword [ebx], edi
lea edi, [ebx + 0x1c]
mov dword [ebx + 4], esi
push 0
mov eax, dword [eax]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x14]
push 0
push ebx
push 0x1000d650
mov eax, dword [eax]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x18]
push 0
push 0
mov dword [ebp - 4], edi
mov al, byte [eax]
mov byte [ebx + 0x18], al
mov dword [edi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [edi]
xor esi, esi
cmp edi, 0xffffffff
jne 0x1000e63b
nop dword [eax]
inc esi
cmp esi, 0x320
ja 0x1000e653
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
cmp edi, 0xffffffff
je 0x1000e620
push 0x20
push ebx
call fcn.10051409
add esp, 8
cmp edi, 1
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f8e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
call fcn.1002ed50
cmp byte [0x100fc774], 0
jne 0x1000f910
push 0
push 0
push 0
push 0x1000f8b0
push 0
push 0
mov byte [0x100fc774], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret