joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416ae7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
push 5
pop ecx
mov esi, 0x4040a4
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x40408c
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x404078
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 8]
movsw word es:[edi], word [esi]
mov esi, 0x404064
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
push 0x404044
movsb byte es:[edi], byte [esi]
xor esi, esi
lea eax, [ebp - 0xc4]
push 0x64
push eax
mov dword [0x4298ec], esi
mov dword [0x4298f0], esi
mov dword [0x4298f4], esi
call fcn.00416a8f
add esp, 0x10
test eax, eax
jl 0x416c8b
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xc4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416c94
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0x4298ec
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 4
call edi
test eax, eax
je 0x416bb5
mov dword [0x4298ec], esi
lea eax, [ebp - 4]
push eax
push 0x4298f0
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x416bd6
mov dword [0x4298f0], esi
lea eax, [ebp - 4]
push eax
push 0x4298f4
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x416bf7
mov dword [0x4298f4], esi
lea eax, [ebp - 4]
push eax
push 0x4298f8
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x416c1c
mov dword [0x4298f8], 0xffff0000
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4298ec], esi
jne 0x416c45
cmp dword [0x4298f0], esi
jne 0x416c55
cmp dword [0x4298f4], esi
jne 0x416c55
xor eax, eax
inc eax
jmp 0x416cc9
cmp dword [0x4298f0], esi
jne 0x416c55
cmp dword [0x4298f4], esi
je 0x416c7a
push ebx
push 0x404040
push 0x64
push 0x429888
call fcn.00416a8f
add esp, 0x10
test eax, eax
jl 0x416c8b
push esi
push ebx
call sub.rtutils.dll_TraceRegisterExW
mov dword [0x4276f0], eax
cmp dword [0x4298ec], esi
jne 0x416c8f
cmp dword [0x4276f0], 0xffffffff
jne 0x416c8f
xor eax, eax
jmp 0x416cc9
xor eax, eax
inc eax
jmp 0x416cc4
push ebx
push 0x404040
push 0x64
push 0x429888
call fcn.00416a8f
add esp, 0x10
test eax, eax
jl 0x416c8b
push esi
push ebx
call sub.rtutils.dll_TraceRegisterExW
mov ecx, eax
xor eax, eax
inc eax
cmp ecx, 0xffffffff
mov dword [0x4276f0], ecx
je 0x416cc9
mov dword [0x4298fc], eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x416cd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
xor esi, esi
cmp dword [0x4298ec], esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x201
jbe 0x416df7
test dword [0x4298f8], edi
je 0x416df7
cmp edi, 0x10002
je 0x416d3c
cmp edi, 0x20002
je 0x416d39
cmp edi, 0x40002
je 0x416d35
cmp edi, 0x80002
je 0x416d30
xor eax, eax
cmp edi, 0x100002
setne al
add eax, 4
mov esi, eax
jmp 0x416d3c
push 3
pop esi
jmp 0x416d3c
push 2
jmp 0x416d32
xor esi, esi
inc esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [esi*4 + 0x4276f4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push 0x429888
push 0x404104
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00416a8f
add esp, 0x28
test eax, eax
jl 0x416e8f
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00416a0f
test eax, eax
jl 0x416e8f
mov eax, dword [ebp - 4]
cmp eax, ebx
jae 0x416e8f
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x218]
push eax
call fcn.00416a74
test eax, eax
jge 0x416dd8
cmp eax, 0x7a
jne 0x416e8f
push 0x404100
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00416ab6
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x4276f0], 0xffffffff
je 0x416e8f
xor eax, eax
cmp dword [0x4298f0], eax
ja 0x416e16
cmp dword [0x4298f4], eax
jbe 0x416e8f
cmp edi, 0x10002
je 0x416e52
cmp edi, 0x20002
je 0x416e4f
cmp edi, 0x40002
je 0x416e4b
cmp edi, 0x80002
je 0x416e46
xor eax, eax
cmp edi, 0x100002
setne al
add eax, 4
jmp 0x416e52
push 3
pop eax
jmp 0x416e52
push 2
jmp 0x416e48
xor eax, eax
inc eax
push dword [ebp + 0xc]
push dword [eax*4 + 0x4276f4]
lea eax, [ebp - 0x218]
push 0x4040f8
push ebx
push eax
call fcn.00416a8f
add esp, 0x14
test eax, eax
jl 0x416e8f
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
or edi, 4
push edi
push dword [0x4276f0]
call sub.rtutils.dll_TraceVprintfExA
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42375a
Capabilities:
Create thread

Disassembly:
mov eax, 0x425361
call fcn.00416838
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x4298fc], edi
mov esi, ecx
mov ebx, 0x80002
je 0x423787
push 0x40f2a8
push ebx
call fcn.00416cd0
pop ecx
pop ecx
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x30], edi
mov dword [ebp - 4], edi
jne 0x423807
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 0x3c], eax
jne 0x4237ca
cmp dword [0x4298fc], edi
je 0x4237c3
push 0x40f288
push 0x10002
call fcn.00416cd0
pop ecx
pop ecx
mov edi, 0x80004005
jmp 0x42381f
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x42374e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x40], eax
jne 0x423807
cmp dword [0x4298fc], edi
je 0x4237c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40f26c
push 0x10002
call fcn.00416cd0
add esp, 0xc
jmp 0x4237c3
inc dword [esi + 0x30]
cmp dword [0x4298fc], edi
je 0x42381f
push 0x40f24c
push ebx
call fcn.00416cd0
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10001321
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], 0x52c1934a
test edx, edx
je 0x10001344
mov eax, esi
and eax, 3
mov al, byte [ebp + eax - 4]
xor byte [ecx + esi], al
inc esi
cmp esi, edx
jb 0x10001333
pop esi
leave
ret

Function at 0x1000146d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x60]
sub esp, 0x384
push esi
call fcn.10001347
test eax, eax
je 0x100015b6
lea edx, [ebp - 0x60]
mov ecx, edx
call fcn.100013fd
test eax, eax
je 0x100015b6
lea edx, [ebp - 0x60]
movzx ecx, byte [edx]
inc edx
cmp byte [ecx + str.______________________________________b____________6789:__4__5__], 0x3f
jbe 0x1000149f
lea eax, [ebp - 0x60]
sub edx, eax
lea eax, [edx + 2]
cdq
and edx, 3
add eax, edx
sar eax, 2
imul esi, eax, 3
cmp esi, 0x12
jb 0x100015b6
push ebx
push edi
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x20]
call fcn.100010d4
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.10001321
mov ax, word [ebp + 0x18]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10001d4e
mov edi, 0x100
lea eax, [ebp - 0x184]
push edi
push 0
push eax
mov dword [ebp + 0x14], edi
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x84]
mov edx, esi
push eax
push ecx
push ecx
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x20]
call fcn.10001295
lea eax, [ebp - 0x84]
push eax
call fcn.10001f57
add esp, 0x18
mov dword [ebp + 0x18], 0x52c1934a
xor ecx, ecx
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax + 0x18]
xor byte [ebp + ecx - 0x184], al
inc ecx
cmp ecx, edi
jb 0x1000154a
push ecx
lea edx, [ebp - 0x184]
lea ecx, [ebp - 0x384]
call fcn.100011e9
mov bl, byte [ebp - 0x384]
mov edi, dword [ebp + 8]
pop ecx
xor ecx, ecx
xor esi, esi
jmp 0x100015a8
test esi, esi
je 0x1000159c
xor edx, edx
mov dword [ebp + 0x18], 0xc
mov eax, esi
div dword [ebp + 0x18]
test edx, edx
jne 0x1000159c
mov byte [ecx + edi], 0x20
inc ecx
mov byte [ecx + edi], bl
inc ecx
mov bl, byte [ebp + esi - 0x383]
inc esi
test bl, bl
jne 0x10001581
mov byte [ecx + edi], bl
xor eax, eax
pop edi
inc eax
pop ebx
jmp 0x100015b8
xor eax, eax
pop esi
leave
ret 0x14
Function at 0x100033e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10003441
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10003424
cmp edi, 2
jb 0x10003424
cmp byte [esi], cl
jne 0x10003424
cmp byte [esi + 1], cl
jne 0x10003424
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1009af18]
jmp 0x100033f5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1009af18]
test edi, edi
jne 0x100033f5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10003470
cmp cl, 0x23
jne 0x10003457
cmp byte [esi], cl
jne 0x10003457
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1009af18]
test cl, cl
jne 0x10003448
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10003580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10003594
mov dword [ebx], 0
mov edx, 0x1009ad00
call fcn.10003480
mov esi, eax
test esi, esi
je 0x10003682
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10003678
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003678
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x10003678
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003678
mov eax, dword [0x100a38c8]
test eax, eax
je 0x1000360c
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x10003678
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000365d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x100a38c8]
add esp, 4
test eax, eax
je 0x1000364a
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1000366f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010ca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100a33c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x100a38c8]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1009af18]
sub esi, 1
jne 0x10010ce0
mov eax, dword [0x100a38c8]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x10010d1a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10021e20
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.10022020
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008b0e2
mov esp, ebp
pop ebp
ret
Function at 0x10016870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x100168f2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x100168ac
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.10022d00
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.100039c0
mov edx, dword [esi]
mov ecx, 0x100a38c4
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100039c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016cd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x10016d18
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x10016cff
cmp byte [esi], bl
jne 0x10016cff
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x1009af18]
test bl, bl
jne 0x10016cf0
mov ebx, dword [0x100a38c8]
not eax
mov edi, dword [ebx + 0x5390]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x10016d52
cmp dword [esi], eax
je 0x10016d61
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x10016d33
mov ecx, dword [ebp - 4]
call fcn.10016bf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10016d52
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016d70
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x100a38c8]
test bl, bl
je 0x10016db6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x10016d97
cmp byte [esi], bl
jne 0x10016d97
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x1009af18]
test bl, bl
jne 0x10016d88
mov edi, dword [0x100a38c8]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x10016ddc
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x10016de2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x10016dd0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x1002b030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002b06a
mov eax, dword [0x100a38c8]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1002b05d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1002b09b
mov eax, dword [0x100a38c8]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002b08e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1002b0cc
mov eax, dword [0x100a38c8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1002b0bf
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1002b119
mov eax, dword [0x100a38c8]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002b10c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1002b14a
mov eax, dword [0x100a38c8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1002b13d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002b17b
mov eax, dword [0x100a38c8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1002b16e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1002d970
Function at 0x1003e440
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1003e480
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x1003e6b0
push 0
push 0
mov dword [0x100a38d4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100a38d0], eax
mov eax, 1
pop esi
pop ebp
ret 0xc
test eax, eax
jne 0x1003e491
push eax
push dword [0x100a38d0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10046310
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100463bf
push esi
call fcn.10054af0
add esp, 4
test al, al
jne 0x100463bf
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10046337
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1005dd10
add esp, 0xc
test eax, eax
je 0x1004636b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1005dd10
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1004636d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x1004639e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.100533c0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x10046380
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1004def0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x6c3], 0
je 0x1004df8d
cmp dword [esi + 0x19c], 0
je 0x1004df47
push esi
call fcn.100434e0
push 1
push esi
mov byte [esp + 0x14], al
call fcn.100435f0
push dword [esi + 0x14c]
mov eax, dword [esi + 0x19c]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call eax
push dword [esp + 0x28]
push esi
call fcn.100435f0
add esp, 0x28
pop esi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x1004df5c
sub eax, 1
je 0x1004df5c
sub eax, 1
jne 0x1004df8d
push dword [esi + 0x148]
lea eax, [ecx*2 + 0x10090ca4]
push 1
add eax, ecx
push 2
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
push dword [esi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x20
pop esi
ret

Function at 0x100505e0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100505fa
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x100910c0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
add esp, 8
test eax, eax
je 0x10050642
test ebp, ebp
je 0x10050633
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x10050668
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10050668
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x1005071f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10050685
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10050715
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10050715
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100506b7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100506d0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x100506e0
test ebp, ebp
je 0x1005070c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x100a3004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x100a3004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x10054c80
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10054cbe
mov eax, dword [esi + 0x7c]
cmp byte [eax + 0x104], 0
jne 0x10054caf
push 0
call fcn.10054c80
add esp, 4
test al, al
mov eax, dword [esi + 0x7c]
setne cl
inc cl
mov byte [eax + 0x104], cl
mov eax, dword [esi + 0x7c]
pop esi
cmp byte [eax + 0x104], 2
sete al
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x10054cd3
xor al, al
pop esi
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, 1
pop esi
ret