joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ca34
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x3c]
mov ecx, 0x5a4d
push edi
cmp word [esi], cx
je 0x43ca5c
cmp dword [eax + esi], 0x4550
je 0x43ca5c
mov eax, 0x800700c1
jmp 0x43cac7
mov eax, dword [eax + esi + 0x78]
test eax, eax
jne 0x43ca69
or eax, 0xffffffff
jmp 0x43cac7
and dword [ebp - 8], 0
add eax, esi
mov edi, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add edi, esi
add ecx, esi
add ebx, esi
mov dword [ebp - 0x10], eax
test eax, eax
je 0x43cac2
mov dword [ebp - 0xc], ecx
sub dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx]
mov eax, dword [ebp + 8]
push 1
add edx, esi
call fcn.004246ae
pop ecx
test eax, eax
jne 0x43cab3
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x43cacc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 4], 4
cmp eax, dword [ebp - 0x10]
jb 0x43ca91
mov eax, 0x8007007f
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 8]
movzx eax, word [ebx + eax*2]
mov ecx, dword [ebp + 0xc]
sub ecx, esi
lea edi, [edi + eax*4]
mov eax, dword [edi]
xor edx, edx
cmp eax, ecx
sete dl
lea ebx, [eax + esi]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jne 0x43cb2a
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.0042917a
lea eax, [ebp - 0x18]
push eax
push 0x40
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.004291d1
add esp, 0x18
test eax, eax
jne 0x43cb27
call fcn.00427398
test eax, eax
jle 0x43cac7
and eax, 0xffff
or eax, 0x80070000
jmp 0x43cac7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
test esi, esi
jne 0x43cb4a
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
mov dword [edi], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.004291d1
add esp, 0x10
xor eax, eax
jmp 0x43cac7
Function at 0x43cb51
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, eax
push edi
push esi
call fcn.00429667
pop ecx
cmp eax, 1
jne 0x43cb70
or eax, 0xffffffff
jmp 0x43cccc
mov eax, dword [esi + 0x3c]
mov ecx, 0x5a4d
cmp word [esi], cx
jne 0x43ccc7
cmp dword [eax + esi], 0x4550
jne 0x43ccc7
mov eax, dword [eax + esi + 0x80]
xor ebx, ebx
cmp eax, ebx
je 0x43cb68
lea edi, [eax + esi]
cmp dword [edi], ebx
je 0x43cbd7
mov eax, edi
mov eax, dword [eax + 0xc]
add eax, esi
push eax
mov dword [ebp - 4], eax
call fcn.00429667
pop ecx
cmp eax, 1
je 0x43cbd7
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
push 1
call fcn.004246ae
pop ecx
test eax, eax
je 0x43cbe1
inc ebx
mov eax, ebx
imul eax, eax, 0x14
add eax, edi
cmp dword [eax], 0
jne 0x43cba4
mov eax, 0x8007007e
jmp 0x43cccc
imul ebx, ebx, 0x14
add edi, ebx
mov ebx, dword [edi + 0x10]
test ebx, ebx
je 0x43ccc0
mov edi, dword [edi]
test edi, edi
je 0x43ccc0
add ebx, esi
add edi, esi
jmp 0x43cc2f
js 0x43cc29
add eax, esi
add eax, 2
push eax
mov dword [ebp - 4], eax
call fcn.00429667
pop ecx
cmp eax, 1
je 0x43cc29
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push 0
call fcn.004246ae
pop ecx
test eax, eax
je 0x43cc3f
add edi, 4
add ebx, 4
mov eax, dword [edi]
test eax, eax
jne 0x43cc01
mov eax, 0x8007007f
jmp 0x43cccc
mov esi, dword [ebp + 0x10]
xor eax, eax
cmp dword [ebx], esi
sete al
mov edi, eax
test edi, edi
jne 0x43cc86
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.0042917a
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call fcn.004291d1
add esp, 0x18
test eax, eax
jne 0x43cc86
call fcn.00427398
test eax, eax
jle 0x43cccc
and eax, 0xffff
or eax, 0x80070000
jmp 0x43cccc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x43cc91
mov ecx, dword [ebx]
mov dword [eax], ecx
test edi, edi
jne 0x43ccbc
push ebx
call fcn.00429667
pop ecx
cmp eax, 1
je 0x43cb68
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
mov dword [ebx], esi
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call fcn.004291d1
add esp, 0x10
xor eax, eax
jmp 0x43cccc
mov eax, 0x80070057
jmp 0x43cccc
mov eax, 0x800700c1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43ccd1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
mov dword [esp + 0x14], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.00429111
pop ecx
call fcn.0043cb51
add esp, 0x10
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 0xc]
jmp 0x43cdb0
push 0x104
lea eax, [esp + 0x1c]
push eax
push dword [esi + 0x30]
call fcn.00428ae8
add esp, 0xc
test eax, eax
je 0x43cdb9
mov edx, dword [ebp + 8]
push 1
lea eax, [esp + 0x1c]
call fcn.004246ae
test eax, eax
pop ecx
lea eax, [esp + 0x18]
push eax
jne 0x43cd72
call fcn.00429111
pop ecx
cmp eax, ebx
je 0x43cda2
lea ecx, [esp + 0xc]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043ca34
add esp, 0xc
cmp dword [esp + 0xc], ebx
je 0x43cdb9
jmp 0x43cda2
call fcn.00429111
mov edi, eax
pop ecx
cmp edi, ebx
je 0x43cda2
push edi
call fcn.00429667
pop ecx
cmp eax, 1
je 0x43cdb9
lea eax, [esp + 0x14]
push eax
push dword [ebp + 0x10]
mov eax, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043cb51
add esp, 0x10
mov esi, dword [esi]
push esi
call fcn.00429667
pop ecx
cmp eax, 1
je 0x43cdb9
cmp dword [esi + 0x18], ebx
jne 0x43cd18
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43d422
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
mov edi, eax
test edi, edi
je 0x43d4da
mov dword [ebp - 0x44], 0x33332231
mov dword [ebp - 0x40], 0x3037312c
mov dword [ebp - 0x3c], 0x33363726
mov byte [ebp - 0x38], 0x63
mov byte [ebp - 0x44], 0x52
lea eax, [ebp - 0x44]
inc eax
xor byte [eax], 0x63
jne 0x43d453
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
lea esi, [ebp - 4]
call fcn.00424f68
xor esi, esi
call 0x424de0
mov ebx, eax
neg ebx
lea esi, [ebp - 4]
sbb bl, bl
call fcn.00424fe3
inc bl
je 0x43d488
push 2
pop eax
jmp 0x43d4d8
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi + 0x19c], esi
jbe 0x43d4d5
mov eax, dword [edi + 0x198]
test eax, eax
jne 0x43d4a3
xor ebx, ebx
jmp 0x43d4a6
lea ebx, [eax + esi*8]
push dword [ebp + 8]
call fcn.0042db24
pop ecx
cmp eax, dword [ebx]
je 0x43d4be
inc esi
cmp esi, dword [edi + 0x19c]
jb 0x43d495
jmp 0x43d4d5
mov edi, dword [edi + 0x198]
test edi, edi
jne 0x43d4cc
xor eax, eax
jmp 0x43d4cf
lea eax, [edi + esi*8]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x43f3f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], 0x65e1445
mov dword [ebp - 0x38], 0x63635e17
mov dword [ebp - 0x40], 0xf0a020e
mov dword [ebp - 0x3c], 0x1b061745
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x44], 0x26
lea eax, [ebp - 0x44]
inc eax
xor byte [eax], 0x63
jne 0x43f424
push esi
push edi
lea eax, [ebp - 0x44]
push eax
lea esi, [ebp - 4]
call fcn.00424f68
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.00441fcc
pop ecx
push dword [eax]
mov edi, esi
call fcn.0042521f
lea esi, [ebp + 0xc]
call fcn.00424fe3
cmp dword [0x44842c], 0
je 0x43f46a
push ebx
mov ebx, edi
call fcn.0043f1e2
pop ebx
jmp 0x43f46c
xor eax, eax
test eax, eax
jne 0x43f47c
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0043f34f
lea esi, [ebp - 4]
call fcn.00424fe3
pop edi
pop esi
leave
ret 8
Function at 0x43f967
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
mov dword [ebp - 0x40], 0x6363635e
push edi
lea esi, [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x50], 0x65e1445
mov dword [ebp - 0x4c], 0x17451111
mov dword [ebp - 0x48], 0x5e060e0a
mov dword [ebp - 0x44], 0x17451046
mov byte [ebp - 0x3f], 0x63
call fcn.00424fc8
lea eax, [ebp - 0xc]
push eax
call 0x42494f
lea ecx, [ebp - 8]
push ecx
mov edi, eax
call fcn.00441fcc
mov eax, dword [eax]
xor byte [ebp - 0x50], 0x63
pop ecx
pop ecx
je 0x43f9c8
lea ecx, [ebp - 0x50]
inc ecx
xor byte [ecx], 0x63
jne 0x43f9c2
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 4]
call fcn.0042549a
pop ecx
pop ecx
lea esi, [ebp - 8]
call fcn.00424fe3
lea esi, [ebp - 0xc]
call fcn.00424fe3
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00441fcc
pop ecx
push dword [eax]
lea edi, [ebp - 4]
call fcn.0042521f
lea esi, [ebp + 8]
call fcn.00424fe3
cmp dword [0x44842c], 0
je 0x43fa1a
push ebx
mov ebx, edi
call fcn.0043f1e2
pop ebx
jmp 0x43fa1c
xor eax, eax
test eax, eax
jne 0x43fa2c
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
call fcn.0043f34f
lea esi, [ebp - 4]
call fcn.00424fe3
pop edi
pop esi
leave
ret 4
Function at 0x441fcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
call fcn.00424fc8
mov ecx, dword [edi]
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x62613938
mov dword [ebp - 8], 0x66656463
test ecx, ecx
jne 0x442001
xor eax, eax
jmp 0x442006
call fcn.00424786
imul eax, eax, 3
inc eax
push eax
call fcn.0040a1d5
push eax
call fcn.0042734d
mov edx, eax
pop ecx
pop ecx
mov dword [ebp - 4], edx
test edx, edx
je 0x4420b6
mov ecx, dword [edi]
test ecx, ecx
jne 0x44202f
xor eax, eax
jmp 0x442034
call fcn.00424786
xor esi, esi
test eax, eax
je 0x4420ab
push ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x442043
add ecx, esi
mov cl, byte [ecx]
cmp cl, 0x20
jne 0x44204f
mov byte [edx], 0x2b
jmp 0x4420a4
cmp cl, 0x2a
je 0x4420a2
cmp cl, 0x5f
je 0x4420a2
cmp cl, 0x2d
je 0x4420a2
cmp cl, 0x2e
je 0x4420a2
cmp cl, 0x61
jb 0x44206d
cmp cl, 0x7a
jbe 0x4420a2
cmp cl, 0x41
jb 0x442077
cmp cl, 0x5a
jbe 0x4420a2
cmp cl, 0x30
jb 0x442081
cmp cl, 0x39
jbe 0x4420a2
movzx ecx, cl
mov ebx, ecx
shr ebx, 4
mov bl, byte [ebp + ebx - 0x14]
and ecx, 0xf
mov cl, byte [ebp + ecx - 0x14]
mov byte [edx], 0x25
mov byte [edx + 1], bl
mov byte [edx + 2], cl
add edx, 3
jmp 0x4420a5
mov byte [edx], cl
inc edx
inc esi
cmp esi, eax
jb 0x44203b
pop ebx
push dword [ebp - 4]
mov esi, dword [ebp + 8]
call fcn.00425330
mov eax, dword [ebp + 8]
pop esi
leave
ret
Function at 0x446758
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
cmp dword [ebp + 8], 0x44240d7a
jne 0x44677d
lea eax, [0x44432c]
mov dword [ebp - 4], eax
jmp 0x446827
cmp dword [ebp + 8], 0x44240d79
jne 0x4467a1
lea eax, [0x4443e4]
lea edx, [0x44432c]
sub eax, edx
mov dword [ebp - 4], eax
jmp 0x446827
mov ecx, 0x98
mov esi, 0x448428
lea edi, [ebp - 0x268]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x44846c]
mov dword [ebp - 8], eax
mov eax, dword [0x448470]
mov dword [ebp - 0x278], eax
mov eax, dword [0x448474]
mov dword [ebp - 0x274], eax
mov eax, dword [0x448478]
mov dword [ebp - 0x26c], eax
mov eax, dword [0x44847c]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x26c]
xor byte [esi], al
rol al, cl
inc esi
loop 0x4467f6
mov esi, dword [ebp - 0x274]
mov ecx, dword [ebp - 0x270]
xor byte [esi], al
rol al, cl
inc esi
loop 0x446809
mov ecx, 0x98
lea esi, [ebp - 0x268]
mov edi, 0x448428
rep movsd dword es:[edi], dword [esi]
call fcn.00446593
mov esp, ebp
pop ebp
ret
Function at 0x44cf80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24000]
push edi
jmp 0x44cf9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44cfa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44cf90
mov eax, 1
add ebx, ebx
jne 0x44cfb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44cfa8
jne 0x44cfc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44cfa8
xor ecx, ecx
sub eax, 3
jb 0x44cfd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44d04a
mov ebp, eax
add ebx, ebx
jne 0x44cfe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x44cff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44d014
inc ecx
add ebx, ebx
jne 0x44d000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44cff5
jne 0x44d011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44cff5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44d034
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44d025
jmp 0x44cf96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44d034
add edi, ecx
jmp 0x44cf96
pop esi
mov edi, esi
mov ecx, 0x1e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44d052
cmp byte [edi], 0
jne 0x44d052
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44d057
lea edi, [esi + 0x4a000]
mov eax, dword [edi]
or eax, eax
je 0x44d0c6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4d000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4d03c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44d084
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4d040]
or eax, eax
je 0x44d0c0
mov dword [ebx], eax
add ebx, 4
jmp 0x44d0a1
call dword [esi + 0x4d050]
mov ebp, dword [esi + 0x4d044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44d0fa
sub esp, 0xffffff80
jmp 0x40105b
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10001071
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x10001071
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1000105a
jmp 0x10001071
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1001f050
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9a06
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x101040b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x1013b360]
test al, 1
jne 0x1001f192
or eax, 1
mov dword [0x1013b360], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100f8660]
pxor xmm0, xmmword [0x100f82a0]
mov dword [ebp - 0x1c], 0x31c031c
mov dword [ebp - 0x18], 0x6503611b
mov word [ebp - 0x14], 0x2312
movups xmmword [ebp - 0x2c], xmm0
xor byte [ebp + eax - 0x2c], 0x23
inc eax
cmp eax, 0x1a
jb 0x1001f0d4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x48], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001f0f7
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.10025140
mov byte [ebp - 4], 1
mov edx, dword [0x1013b464]
test edx, edx
je 0x1001f120
mov edx, dword [edx + 0x50]
jmp 0x1001f122
xor edx, edx
mov eax, dword [0x1013b45c]
test eax, eax
je 0x1001f130
mov eax, dword [eax + 0x18]
jmp 0x1001f132
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.1001ec40
mov eax, dword [ebp - 0x30]
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov dword [0x1013b368], eax
cmp edx, 0x10
jb 0x1001f189
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001f17a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001f17a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100e7cba
mov eax, dword [0x1013b368]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1001f197
mov eax, dword [0x1013b368]
test eax, eax
je 0x1001f19f
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100257e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9d30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101040b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x428
call fcn.100e7846
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100f66f0
mov eax, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov byte [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov word [edi + 0x3f0], 0
mov dword [edi + 0x40c], 0
mov dword [edi + 0x410], 0xf
mov dword [ebp - 0x18], edi
mov byte [edi + 0x3fc], 0
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.1001f260
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101040b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1002c5f3
cmp byte [esi + 0x3d], 0
je 0x1002c5f3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002c5a8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002c5ba
sub eax, 1
je 0x1002c5be
sub eax, 2
je 0x1002c5f3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e7827
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002c5dc
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002c5a8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e7827
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100e7827
mov esp, ebp
pop ebp
ret
Function at 0x1002df40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea126
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
push edi
mov eax, dword [0x101040b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov eax, dword [0x10140874]
test al, 1
jne 0x1002e08e
or eax, 1
mov dword [0x10140874], eax
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x100f8c80]
movaps xmm2, xmmword [0x100f8660]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x14], 0x1517
movaps xmm0, xmmword [0x100f8230]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x12], 0x23
movups xmm0, xmmword [ebp + eax - 0x34]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x34], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x1002dfb0
cmp eax, 0x23
jae 0x1002dfdb
nop
xor byte [ebp + eax - 0x34], 0x23
inc eax
cmp eax, 0x23
jb 0x1002dfd0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x4c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002dff3
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.10025140
mov byte [ebp - 4], 1
mov edx, dword [0x1013b464]
test edx, edx
je 0x1002e01c
mov edx, dword [edx + 0x50]
jmp 0x1002e01e
xor edx, edx
mov eax, dword [0x1013b45c]
test eax, eax
je 0x1002e02c
mov eax, dword [eax + 0x18]
jmp 0x1002e02e
xor eax, eax
lea ecx, [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.1001ec40
mov eax, dword [ebp - 0x10]
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x38]
mov dword [0x1014087c], eax
cmp edx, 0x10
jb 0x1002e085
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002e076
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002e076
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100e7cba
mov eax, dword [0x1014087c]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1002e093
mov eax, dword [0x1014087c]
test eax, eax
je 0x1002e09c
push esi
mov ecx, edi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret