joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475520
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x475547
cmp ecx, 0xffffffff
cmovne eax, ecx
ret

Function at 0x476fb0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, 0x2b
test edi, edi
je 0x47705b
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ebx, 4
lea eax, [esp + 0x1c]
push 4
push eax
cmp edi, ebx
push ebp
cmovb ebx, edi
call fcn.00458460
add esp, 0xc
cmp eax, 4
jne 0x477016
cmp byte [0x4c4278], 0
jne 0x477022
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x47705d
mov eax, dword [esp + 0x1c]
jmp 0x47703f
imul eax, dword [0x4c4274], 0x41c64e6d
add eax, 0x3039
mov dword [0x4c4274], eax
rol eax, 0x10
xor ecx, ecx
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x477053
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x477043
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x476fd0
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x477070
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
sub ebx, 1
je 0x4770e8
mov esi, dword [esp + 0x14]
mov ebp, 0x3e
nop word [eax + eax]
push 4
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00458460
add esp, 0xc
cmp eax, 4
jne 0x4770c9
cmp byte [0x4c4278], 0
jne 0x4770f2
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x47710f
test eax, eax
jne 0x4770ed
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffffc
jae 0x477090
xor edx, edx
div ebp
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x477090
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
imul eax, dword [0x4c4274], 0x41c64e6d
add eax, 0x3039
mov dword [0x4c4274], eax
rol eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x4770d1
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret

Function at 0x477120
Capabilities:
Generate random numbers via winapi

Disassembly:
push dword [esp + 8]
push 0
push dword [esp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
ret
Function at 0x47ab20
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
push edi
lea esi, [ebp + 1]
push esi
push ebp
call dword [0x4c2028]
mov edi, eax
add esp, 8
test edi, edi
je 0x47ab77
nop word [eax + eax]
push esi
push edi
push dword [esp + 0x1c]
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x47ab8f
cmp esi, ebx
je 0x47ab8f
cmp esi, 0x8000
ja 0x47ab8f
cmp esi, ebx
jb 0x47ab88
push esi
push edi
call dword [0x4c2028]
mov edi, eax
add esp, 8
test edi, edi
jne 0x47ab40
push ebp
call dword [0x4c2024]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x4c2024]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x47c370
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0
mov byte [esp + 0x12], cl
lea ecx, [esp + 0x10]
push 3
mov eax, dword [esi + 0x18]
push ecx
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], bl
push dword [eax + 0x1a0]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x47c3bc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0045f010
add esp, 0xc
push dword [esp + 0x14]
push ebx
push str.SENT
push esi
call fcn.0047bf90
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x47c520
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [ebx + 0x18]
mov ebp, dword [ebx + 0x120]
mov dword [esp + 8], eax
jne 0x47c673
push esi
lea ecx, [ebp + 0x1cc4]
push edi
lea edi, [ebp + 0x1ec4]
mov eax, ecx
mov dword [edi], ecx
cmp ecx, edi
jae 0x47c55d
lea eax, [ecx + 1]
mov byte [ecx], 0xff
mov dword [edi], eax
cmp eax, edi
jae 0x47c571
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c571
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x18], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x18]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x47c5db
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c5db
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c5db
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c5db
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c5db
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x47c5db
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebp + 0x1ec8], eax
lea esi, [ebp + 0x1cc4]
sub eax, esi
mov dword [edi], esi
sub eax, 2
push eax
lea eax, [ebp + 0x1cc6]
push eax
push 0x3e
push ebx
call fcn.0047c090
mov eax, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push esi
push dword [eax + 0x1a0]
call edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x47c633
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0045f010
add esp, 0xc
push 4
lea eax, [ebp + 0x1cc7]
push eax
push ebx
call fcn.0047c3e0
add esp, 0xc
lea eax, [ebp + 0x1ccb]
push 0
push 2
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x1a0]
call edi
test eax, eax
jns 0x47c671
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0045f010
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x47da70
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4c2014]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
xor ebx, ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [eax + 0x430]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], ebx
jne 0x47daf6
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [edi + 0xb0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov esi, dword [edi + 0x134]
cmp esi, 4
jge 0x47db31
push str.Received_too_short_packet
push ebp
call fcn.0045f010
add esp, 8
mov dword [edi + 0xc], 7
mov eax, ebx
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044612d
add esp, 0x8c
ret
mov edx, dword [edi + 0x148]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x47db50.1
jmp dword [ecx*4 + 0x47dc3c]
cmp esi, 4
jle case.0x47db50.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x47db50.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebp
call fcn.004602a0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x47db50.4
push 5
push edi
call fcn.0047e550
add esp, 8
jmp 0x47db16
movzx ecx, byte [edx + 2]
lea eax, [edx + 4]
mov dword [esp + 0x14], eax
add esi, 0xfffffffc
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [edx + 4]
push esi
push eax
mov dword [edi + 8], ecx
call fcn.0047e5c0
add esp, 8
cmp eax, esi
jae case.0x47db50.4
push dword [esp + 0x14]
push str.TFTP_error:__s
push ebp
call fcn.0045f0e0
jmp 0x47dc11
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.0047d820
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x47db50.4
jmp 0x47db16
push str.Internal_error:_Unexpected_packet
push 0x4a81b0
push ebp
call fcn.0045f010
add esp, 0xc
push ebp
call fcn.004727e0
add esp, 4
test eax, eax
je 0x47db16
push 5
push edi
call fcn.0047e550
add esp, 8
mov eax, 0x2a
jmp 0x47db18
Function at 0x49a3b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x4c2014]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x49a430
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044ae90
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.0045f010
push esi
call dword [0x4c2024]
add esp, 0x20
lea eax, [ebx + 0x4d]
jmp 0x49a590
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x49a48a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044ae90
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.0045f010
push 0
mov esi, 0x4d
call dword [0x4c2024]
add esp, 0x20
jmp 0x49a581
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x49a4ca
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044ae90
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.0045f010
add esp, 0x1c
mov esi, 0x4d
jmp 0x49a56d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x49a4f8
jg 0x49a4de
cmp edi, 0x100000
jbe 0x49a4f8
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.0045f010
add esp, 0xc
mov esi, 0x4d
jmp 0x49a56d
lea eax, [edi + 1]
push eax
call dword [0x4c2020]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x49a510
lea esi, [eax + 0x1b]
jmp 0x49a56d
test edi, edi
je 0x49a554
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49a5ad
mov eax, dword [esp + 0x10]
test eax, eax
je 0x49a5a9
add esi, eax
cmp esi, edi
jb 0x49a520
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.0049a1b0
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x4c2024]
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044612d
add esp, 0x120
ret
mov edi, esi
jmp 0x49a554
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044ae90
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.0045f010
add esp, 0x1c
mov esi, 0x4d
jmp 0x49a56d
Function at 0x4a0860
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.004625a0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x4c2020]
mov esi, eax
add esp, 8
test esi, esi
je 0x4a09e2
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x4a08e2
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4a0953
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4a0910
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x4a0985
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x4b590d
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x4b590e
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x4a0960
push dword [esp + 0x30]
call fcn.004625a0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x4a09b0
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x4c2024]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x4a0ab0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4a0ad6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4a0b0e
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.004625a0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x4a0b65
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x4a0b74
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4a0b85
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret

Function at 0x4a17c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x4a180c
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x4a17d1
pop ebx
pop edi
pop esi
ret
Function at 0x10003f2a
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov eax, 0x1005cd59
call fcn.1005c6c0
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10004057
mov dword [ebp - 0x20], 0x5fe5
cmp dword [ebp - 0x20], 0x60f3
jle 0x10003f9d
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov esi, dword [ebp - 0x24]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x10077cb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000651b
inc esi
cmp esi, 0x34be
jl 0x10003f6b
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x8052
jl 0x10003f5e
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x524e
jl 0x10003f5c
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5e46
jge 0x10003fb9
mov edx, str.joo_rkvhym_ywmfwrr_rwzlh_zghwqhm_vvawxyogw
mov ecx, 0x10077cb8
call fcn.10009581
mov eax, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x10004065
mov dword [ebp - 0x20], 0x70c0
cmp dword [ebp - 0x20], 0x7478
jle 0x1000401d
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003ff8
mov eax, dword [eax]
push eax
call fcn.10045f6d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10007132
inc edi
cmp edi, 0x5a22
jl 0x10003fdd
inc esi
cmp esi, 0x15ad
jl 0x10003fdb
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x20], 0x6cee
jge 0x10004065
push str.dykp_cvnr_szrau
call fcn.10045f6d
pop ecx
jmp 0x10004065
lea edx, [ebp - 0x15]
mov byte [ebp - 0x15], 0
xor cl, cl
call fcn.10001e1f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004fc5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005cdef
call fcn.1005c6c0
sub esp, 0x38
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x1c], cl
je 0x10005139
test cl, cl
je 0x100050b5
mov dword [ebp - 0x24], 0x63b5
cmp dword [ebp - 0x24], 0x6670
jle 0x10005069
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp + 0x18], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
mov dword [ebp - 0x28], edi
mov eax, edi
xor esi, esi
cdq
idiv ebx
mov edi, edx
mov eax, edi
mov ecx, 0x10077cb8
and eax, esi
cdq
push edx
push eax
call fcn.1000651b
inc esi
cmp esi, 0x7c1b
jl 0x10005025
mov edi, dword [ebp - 0x28]
inc ebx
cmp ebx, 0x764a
jl 0x1000501c
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp + 0x18], edi
cmp edi, 0x3d8e
jl 0x10005010
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x79f3
jl 0x1000500b
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6142
jge 0x10005085
mov edx, str.fkazbjz_oyajfjcr_ohw_xctx_wqzvxxnr
mov ecx, 0x10077cb8
call fcn.10009581
or dword [ebp - 4], 0xffffffff
push ecx
push ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
call fcn.10008422
jmp 0x1000520a
mov dword [ebp + 0x18], 0x5b47
cmp dword [ebp + 0x18], 0x5e38
jle 0x10005107
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x40]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100050e2
mov eax, dword [eax]
push eax
call fcn.10045f6d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10007132
inc edi
cmp edi, 0x354f
jl 0x100050c9
inc esi
cmp esi, 0x802c
jl 0x100050c7
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x1000511c
push 0x1d0a
xor dl, dl
call fcn.10001ddd
pop ecx
cmp dword [ebp + 0x18], 0x5a87
jge 0x1000520a
push str.ujbdiiruz_elugol_osmsmegci_kbcjjv_megidl_qugenp_ucxfcyqcc_ohfzufwxc_uucbsk_znmil
call fcn.10045f6d
pop ecx
jmp 0x1000520a
test dl, dl
je 0x100051f9
mov dword [ebp - 0x24], 0x3f77
cmp dword [ebp - 0x24], 0x4264
jle 0x100051a4
xor esi, esi
mov dword [ebp + 0x18], esi
xor edi, edi
mov ebx, 0x171f
xor esi, esi
mov eax, edi
mov ecx, 0x10077cb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000651b
inc esi
cmp esi, 0x4184
jl 0x1000515f
mov esi, dword [ebp + 0x18]
add edi, esi
dec ebx
jne 0x1000515d
inc esi
mov dword [ebp + 0x18], esi
cmp esi, 0x5073
jl 0x10005156
push 0x26e5
push 0xbea
push ebx
push 0x16e0
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100051be
push 0x17ba
mov edx, 0x7930
xor cl, cl
call fcn.1000526b
pop ecx
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0x3db7
jge 0x100051dd
mov edx, str.fiong_yumhxsf_geetzlb_xyssmsbn_ujvwxzki_uhihor_fkgie_xsj_ibxfib_kwluahl_cwc_awe
mov ecx, 0x10077cb8
call fcn.10009581
jmp 0x1000520a
push ecx
push dword [ebp + 0x20]
mov ecx, dword [ebp + 8]
call fcn.100066e8
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000aef4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d105
call fcn.1005c6c0
sub esp, 0x44
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1000af3a
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1000b0be
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x6b80f4b4
inc dword [edx]
cmp dword [edx], 1
jl 0x1000af23
jmp 0x1000b0be
mov dword [ebp - 0x2c], 0x51dc
xor esi, esi
cmp dword [ebp - 0x2c], 0x55a0
jle 0x1000afa2
mov edi, esi
mov ebx, esi
mov ecx, esi
mov dword [ebp - 0x18], esi
lea eax, [ebx + edi]
and eax, ecx
lea ecx, [ebp - 0x50]
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000af6f
mov eax, dword [eax]
push eax
call fcn.10045f6d
pop ecx
push esi
push 1
lea ecx, [ebp - 0x50]
call fcn.10007132
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x78f0
jl 0x1000af55
inc ebx
cmp ebx, 0x3f23
jl 0x1000af50
inc edi
cmp edi, 0xae1
jl 0x1000af4e
mov dword [ebp - 0x18], esi
jmp 0x1000afb5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x38], 0x1b3c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000afa7
mov dword [ebp - 0x28], 0x64be
cmp dword [ebp - 0x28], 0x6675
jle 0x1000b034
mov dword [ebp - 0x18], esi
mov edi, esi
mov dword [ebp - 0x24], esi
mov ebx, esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
lea eax, [ebx + edi]
mov ebx, 0x4421
mov dword [ebp - 0x30], eax
mov edi, eax
mov eax, edi
mov ecx, 0x10077cb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000651b
dec edi
dec ebx
jne 0x1000afe8
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x7325
jl 0x1000afdb
inc edi
mov dword [ebp - 0x24], edi
push 0
pop esi
cmp edi, 0x5edc
jl 0x1000afd3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x7379
jl 0x1000afce
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x18], esi
jmp 0x1000b047
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1c], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1000b039
mov dword [ebp - 4], esi
cmp dword [ebp - 0x28], 0x62fa
jge 0x1000b086
mov edx, str.qyk_xzgrq_bmpwqrjvr_xza_rbdaqchz_yyj_ikfjjylr
mov ecx, 0x10077cb8
call fcn.10009581
jmp 0x1000b086
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], esi
jl 0x1000b0aa
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0xfffffffd
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x1c]
jns 0x1000b092
cmp dword [ebp - 0x2c], 0x5086
jge 0x1000b0be
push str.vffojf_epur_rllywkjow_lhidb_mhhyhx_cvrkj_monvhgbis_avyh_bxr_ween_aegusa_dlnjy_rau_uxoqql
call fcn.10045f6d
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret