joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f940
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov eax, dword [esp + 0x24]
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
mov esi, ecx
push 0x40000000
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x45fab7
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi + 0x20c]
push ecx
push ebx
mov ecx, esi
call fcn.0045f860
test eax, eax
jne 0x45f9a3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
mov eax, dword [edi + 0x20c]
xor ebp, ebp
test eax, eax
jbe 0x45fa52
lea esi, [edi + 0x224]
mov al, byte [esi - 0x10]
mov dl, byte [esi - 0x14]
mov byte [esp + 0x19], al
mov eax, dword [esi]
mov byte [esp + 0x18], dl
mov byte [esp + 0x1b], 0
mov cx, word [eax + 0xc]
mov word [esp + 0x1c], cx
mov dx, word [eax + 0xe]
mov word [esp + 0x1e], dx
mov ecx, dword [esp + 0x1e]
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and eax, 0xffff
imul ecx, eax
cmp ecx, 8
jl 0x45fa02
mov byte [esp + 0x1a], 0
jmp 0x45fa0a
mov dl, 1
shl dl, cl
mov byte [esp + 0x1a], dl
mov eax, dword [esi - 4]
mov ecx, dword [esp + 0x14]
push ebp
push edi
mov dword [esp + 0x28], eax
call fcn.0045f910
lea ecx, [esp + 0x30]
push 0
push ecx
lea edx, [esp + 0x20]
push 0x10
push edx
push ebx
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x45fab7
cmp dword [esp + 0x30], 0x10
jne 0x45fab7
mov eax, dword [edi + 0x20c]
inc ebp
add esi, 0x20
cmp ebp, eax
jb 0x45f9b9
mov eax, dword [edi + 0x20c]
xor ebx, ebx
test eax, eax
jbe 0x45faac
lea esi, [edi + 0x224]
mov eax, dword [esi]
push 0
mov ebp, dword [eax + 0x14]
mov dword [eax + 0x14], 0
mov ecx, dword [esi - 4]
mov edx, dword [esi - 8]
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x45fab7
mov ecx, dword [esp + 0x30]
mov eax, dword [esi - 4]
cmp ecx, eax
jne 0x45fab7
mov edx, dword [esi]
inc ebx
add esi, 0x20
mov dword [edx + 0x14], ebp
mov eax, dword [edi + 0x20c]
cmp ebx, eax
jb 0x45fa64
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
Function at 0x45fad0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45fb4f
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x45fb4f
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x45fb4f
push ebx
push ebp
push edi
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
mov ebp, eax
mov eax, ecx
mov edi, ebp
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x45fcd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45fdbd
mov esi, dword [esp + 0x28]
mov ecx, edi
push esi
mov word [esp + 0x14], 0x4d42
mov word [esp + 0x1a], bp
mov word [esp + 0x1c], bp
call fcn.0045fc90
and eax, 0xffff
push esi
add eax, 0x36
mov ecx, edi
mov dword [esp + 0x1e], eax
call fcn.0045fca0
imul eax, dword [esi + 8]
mov edx, dword [esp + 0x1a]
lea ecx, [esp + 0x24]
add eax, edx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
lea edx, [esp + 0x18]
push 0xe
shr eax, 2
push edx
push ebx
mov dword [esp + 0x26], eax
call ebp
test eax, eax
je 0x45fdb6
cmp dword [esp + 0x24], 0xe
jne 0x45fdb6
mov eax, dword [esi + 8]
push esi
cdq
sub eax, edx
mov ecx, edi
sar eax, 1
mov dword [esi + 8], eax
call fcn.0045fca0
mov edi, eax
mov ecx, dword [esp + 0x1a]
imul edi, dword [esi + 8]
lea eax, [esp + 0x24]
add edi, ecx
push 0
push eax
push edi
push esi
push ebx
call ebp
test eax, eax
je 0x45fdb6
cmp dword [esp + 0x24], edi
jne 0x45fdb6
mov ecx, dword [esi + 8]
push ebx
shl ecx, 1
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8

Function at 0x473772
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4737aa
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00471831
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00471809
jmp 0x4737b6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x474e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474ea2
call fcn.0047a7e5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474ea2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474e99
xor eax, eax
jmp 0x474eaa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474eb0
pop edi
pop esi
pop ebx
ret 4

Function at 0x47ad15
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47ad43
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47ad61
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047ac7b
jmp 0x47ad61
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47ad61
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047ac7b
test edi, edi
mov eax, edi
jne 0x47ad4b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001470
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xc
push 0x10049148
call fcn.10038e90
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 2]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x100014b1
call fcn.10038ed6
ret

Function at 0x100014b7
Capabilities:
Check for debugger via api
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
call fcn.10001470
test eax, eax
jne 0x10001587
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], ebx
jne 0x10001587
movaps xmm0, xmmword [0x10047ae0]
mov ecx, ebx
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x3e3f39
mov dword [ebp - 0x20], 0x35333f22
mov word [ebp - 0x1c], 0x2323
mov byte [ebp - 0x1a], bl
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x19
jb 0x1000151b
mov byte [ebp - 0x1a], bl
mov cl, 0x6d
mov dword [ebp - 0x18], 0x919036d
mov eax, ebx
mov dword [ebp - 0x14], 0x9430101
mov word [ebp - 0x10], 0x101
mov byte [ebp - 0xe], bl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 9
jae 0x10001555
mov cl, byte [ebp - 0x18]
jmp 0x10001546
lea eax, [ebp - 0x33]
mov byte [ebp - 0xe], bl
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000158f
push ebx
push 4
lea ecx, [ebp - 0xc]
push ecx
push 7
push 0xffffffffffffffff
call eax
test eax, eax
je 0x1000158f
cmp dword [ebp - 0xc], ebx
je 0x1000158f
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10038035
mov esp, ebp
pop ebp
ret

Function at 0x1000159e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [str.__ve_f_a.e_f]
xor edx, edx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0xb113d1b
mov ecx, edx
mov dword [ebp - 0x18], 0xc1b0a10
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x17
jb 0x100015c4
mov byte [ebp - 0x14], dl
mov cl, 0x1d
mov dword [ebp - 0x10], 0x6f78761d
mov eax, edx
mov dword [ebp - 0xc], 0x2e717873
mov dword [ebp - 8], 0x7179332f
mov word [ebp - 4], 0x71
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x10001602
mov cl, byte [ebp - 0x10]
jmp 0x100015f3
lea eax, [ebp - 0x2b]
mov byte [ebp - 3], dl
push eax
lea eax, [ebp - 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000b986
cmp al, 0xe9
jne 0x1000162d
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10001631
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
mov dword [ebp - 0x10], 0x5b5f4236
mov cl, 0x36
mov dword [ebp - 0xc], 0x42537153
mov dword [ebp - 8], 0x535b5f62
mov eax, edx
mov byte [ebp - 4], dl
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x10001664
mov cl, byte [ebp - 0x10]
jmp 0x10001655
mov byte [ebp - 4], dl
mov cl, 0x58
mov dword [ebp - 0x20], 0x2a3d3358
mov eax, edx
mov dword [ebp - 0x1c], 0x6b343d36
mov dword [ebp - 0x18], 0x343c766a
mov word [ebp - 0x14], 0x34
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001695
mov cl, byte [ebp - 0x20]
jmp 0x10001686
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], dl
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000b986
cmp al, 0xe9
jne 0x100016c0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x100016c4
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
mov dword [ebp - 0x10], 0x113374
mov cl, 0x74
mov dword [ebp - 0xc], 0x1f171d20
mov dword [ebp - 8], 0x1a011b37
mov eax, edx
mov word [ebp - 4], dx
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x100016f8
mov cl, byte [ebp - 0x10]
jmp 0x100016e9
mov byte [ebp - 3], dl
mov cl, 0x4a
mov dword [ebp - 0x20], 0x382f214a
mov eax, edx
mov dword [ebp - 0x1c], 0x79262f24
mov dword [ebp - 0x18], 0x262e6478
mov word [ebp - 0x14], 0x26
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001729
mov cl, byte [ebp - 0x20]
jmp 0x1000171a
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], dl
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000b986
cmp al, 0xe9
jne 0x10001754
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10001758
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.8J_YL_hJW__KKy]
push ebx
xor ebx, ebx
movups xmmword [ebp - 0x28], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0xe
jb 0x10001778
mov byte [ebp - 0x19], bl
mov cl, 0x62
mov dword [ebp - 0x18], 0x30272962
mov eax, ebx
mov dword [ebp - 0x14], 0x512e272c
mov dword [ebp - 0x10], 0xe064c50
mov word [ebp - 0xc], 0xe
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x100017b6
mov cl, byte [ebp - 0x18]
jmp 0x100017a7
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], bl
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop ebx
call fcn.10038035
mov esp, ebp
pop ebp
ret

Function at 0x10001885
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10049168
push 0x10038a6a
mov eax, dword fs:[0]
push eax
push ecx
push ecx
sub esp, 0x38
mov eax, dword [0x1004e014]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
and dword [ebp - 0x50], 0
and dword [ebp - 0x48], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
and dword [ebp - 0x20], 0
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
push dword [ebp - 0x44]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001903
xor al, al
jmp 0x10001983
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov byte [eax], 0xc3
lea eax, [ebp - 0x20]
push eax
push 0x140
push dword [ebp - 0x44]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000192c
xor al, al
jmp 0x10001983
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001971
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10038035
mov esp, ebp
pop ebp
ret
Function at 0x10001e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x10047b50]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x3f31
mov byte [ebp - 2], 0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x11
jb 0x10001e6d
lea eax, [ebp - 0x13]
mov byte [ebp - 2], 0
push eax
call fcn.100021b5
cmp eax, 0xba2d38a3
je 0x10001e92
xor al, al
jmp 0x10001ec1
movaps xmm0, xmmword [str._K]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10001e9f
lea eax, [ebp - 0x13]
mov byte [ebp - 5], 0
push eax
call fcn.100021b5
cmp eax, 0x27b35bb1
sete al
mov esp, ebp
pop ebp
ret
Function at 0x1000210b
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push esi
push edi
push 0x400
xor edi, edi
mov esi, 0x1004fca0
push edi
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 8
push edi
call fcn.10002180
shl eax, 0x18
push 8
mov dword [esi], eax
pop edx
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor eax, ecx
sub edx, 1
jne 0x10002133
push 0x20
push eax
call fcn.10002180
mov dword [esi], eax
inc edi
add esi, 4
cmp esi, 0x1005009c
jle 0x10002123
call fcn.100019ee
pop edi
pop esi
test al, al
je 0x1000217d
call fcn.10001e50
test al, al
je 0x1000217d
call fcn.10001ec5
test al, al
je 0x1000217d
mov al, 1
ret
xor al, al
ret

Function at 0x100021b5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x1004e014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x408], 0
push esi
push 0x1003d65c
push eax
lea eax, [ebp - 0x408]
or esi, 0xffffffff
push eax
mov dword [ebp - 0x40c], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x10002268
cmp dword [ebp - 0x408], eax
je 0x10002268
push ebx
push dword [ebp - 0x408]
mov ebx, 0x400
lea eax, [ebp - 0x404]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x10002258
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.1000227b
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10002221
mov esi, dword [ebp - 0x40c]
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
not esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10038035
mov esp, ebp
pop ebp
ret 4

Function at 0x1000227b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x100022ac
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1004fca0]
inc edi
mov dword [ebx], edx
sub esi, 1
jne 0x1000228e
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x100022b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movaps xmm0, xmmword [0x10048170]
xor edx, edx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 0x585d54
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
mov dword [esi], 0xff0000
mov ecx, edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x12
jb 0x100022e7
push ecx
mov byte [ebp - 1], dl
lea edx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x13]
call fcn.100315f2
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002fe3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x30
mov eax, 0x100399b6
call fcn.10039131
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor ebx, ebx
push 0x1003d65f
mov dword [ebp - 0x3c], ebx
call fcn.1000409e
mov dword [ebp - 4], ebx
mov al, byte [esi + 2]
cmp al, 0xff
je 0x1000316d
cmp al, 1
jne 0x10003050
mov cl, 0x16
mov dword [ebp - 0x34], 0x3b272616
mov dword [ebp - 0x30], 0x727a7971
mov eax, ebx
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 7
jae 0x1000303c
mov cl, byte [ebp - 0x34]
jmp 0x1000302d
lea ecx, [ebp - 0x33]
mov byte [ebp - 0x2c], bl
call fcn.10004086
push eax
lea eax, [ebp - 0x33]
jmp 0x10003164
jle 0x10003088
cmp al, 5
jge 0x1000308c
mov cl, 0x35
mov dword [ebp - 0x38], 0x18070535
mov dword [ebp - 0x34], 0x43595c46
mov eax, ebx
mov word [ebp - 0x30], 0x4750
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10003080
mov cl, byte [ebp - 0x38]
jmp 0x10003071
mov byte [ebp - 0x2e], bl
jmp 0x10003158
cmp al, 5
jl 0x100030ba
cmp al, 0xa
jge 0x100030be
mov cl, 0x4a
mov dword [ebp - 0x38], 0x67797a4a
mov dword [ebp - 0x34], 0x2b382327
mov eax, ebx
mov word [ebp - 0x30], 0x2f2d
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10003080
mov cl, byte [ebp - 0x38]
jmp 0x100030ab
cmp al, 0xa
jl 0x100030ec
cmp al, 0x1a
jge 0x100030f0
mov cl, 0x3f
mov dword [ebp - 0x38], 0x120b0f3f
mov dword [ebp - 0x34], 0x5b5e574c
mov eax, ebx
mov word [ebp - 0x30], 0x4850
mov byte [ebp - 0x2e], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 9
jae 0x10003080
mov cl, byte [ebp - 0x38]
jmp 0x100030dd
cmp al, 0x1a
jl 0x1000311c
cmp al, 0x65
jge 0x10003120
mov cl, 0x42
mov dword [ebp - 0x34], 0x6f777242
mov dword [ebp - 0x30], 0x36312b2f
mov eax, ebx
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 7
jae 0x1000303c
mov cl, byte [ebp - 0x34]
jmp 0x10003109
cmp al, 0x65
jl 0x1000316d
movsx eax, al
cmp eax, 0xc9
jge 0x1000316d
mov cl, 0x4f
mov dword [ebp - 0x38], 0x62797f4f
mov dword [ebp - 0x34], 0x262e3d3b
mov eax, ebx
mov dword [ebp - 0x30], 0x28212621
mov byte [ebp - 0x2c], bl
xor byte [ebp + eax - 0x37], cl
inc eax
cmp eax, 0xb
jae 0x10003155
mov cl, byte [ebp - 0x38]
jmp 0x10003146
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x37]
call fcn.10004086
push eax
lea eax, [ebp - 0x37]
push eax
lea ecx, [ebp - 0x28]
call fcn.10004017
lea eax, [ebp - 0x28]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov ecx, edi
push eax
mov byte [edi], bl
call fcn.10003b0e
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10003f4a
mov eax, edi
call fcn.100390db
ret 4
Function at 0x10003199
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10039a10
call fcn.10039131
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor ebx, ebx
push 0x1003d65f
mov dword [ebp - 0x44], ebx
call fcn.1000409e
mov dword [ebp - 4], ebx
mov al, byte [esi + 2]
cmp al, 0xff
je 0x10003313
cmp al, 1
jne 0x10003205
movaps xmm0, xmmword [0x10047b00]
mov ecx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x2e26
mov byte [ebp - 0x2a], bl
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x11
jb 0x100031e4
lea ecx, [ebp - 0x3b]
mov byte [ebp - 0x2a], bl
call fcn.10004086
push eax
lea eax, [ebp - 0x3b]
jmp 0x1000330a
jle 0x10003237
cmp al, 5
jge 0x1000323b
movaps xmm0, xmmword [0x10047a80]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x382f3c26
mov byte [ebp - 0x2c], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x13
jb 0x10003222
mov byte [ebp - 0x2c], bl
jmp 0x100032fe
cmp al, 5
jl 0x10003265
cmp al, 0xa
jge 0x10003269
movaps xmm0, xmmword [0x100476b0]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0xa080e1d
mov byte [ebp - 0x2c], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x13
jb 0x10003256
jmp 0x1000322f
cmp al, 0xa
jl 0x10003293
cmp al, 0x1a
jge 0x10003297
movaps xmm0, xmmword [0x100483a0]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x6a72797c
mov byte [ebp - 0x2c], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x13
jb 0x10003284
jmp 0x1000322f
cmp al, 0x1a
jl 0x100032c3
cmp al, 0x65
jge 0x100032c7
movaps xmm0, xmmword [0x10048270]
mov ecx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x7572
mov byte [ebp - 0x2a], bl
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x11
jb 0x100032b1
jmp 0x100031f1
cmp al, 0x65
jl 0x10003313
movsx eax, al
cmp eax, 0xc9
jge 0x10003313
movaps xmm0, xmmword [str.b__r_f]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0xb0c0b03
mov word [ebp - 0x2c], 0x50c
mov byte [ebp - 0x2a], bl
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x15
jb 0x100032ee
mov byte [ebp - 0x2a], bl
lea ecx, [ebp - 0x3f]
call fcn.10004086
push eax
lea eax, [ebp - 0x3f]
push eax
lea ecx, [ebp - 0x28]
call fcn.10004017
lea eax, [ebp - 0x28]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov ecx, edi
push eax
mov byte [edi], bl
call fcn.10003b0e
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10003f4a
mov eax, edi
call fcn.100390db
ret 4