joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fb69
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00434bd1
xor ebx, ebx
cmp dword [0x464354], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43fc3f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43fd1f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43fd1f
push eax
call fcn.00434b63
mov dword [esp], 0x44e350
push edi
mov dword [0x464354], eax
call esi
push eax
call fcn.00434b63
mov dword [esp], 0x44e33c
push edi
mov dword [0x464358], eax
call esi
push eax
call fcn.00434b63
mov dword [0x46435c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042e994
test eax, eax
pop ecx
pop ecx
je 0x43fc0d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043570f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43fc3f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00434b63
cmp eax, ebx
pop ecx
mov dword [0x464364], eax
je 0x43fc3f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00434b63
pop ecx
mov dword [0x464360], eax
mov eax, dword [0x464360]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43fcc4
cmp dword [0x464364], ecx
je 0x43fcc4
push eax
call fcn.00434bda
push dword [0x464364]
mov esi, eax
call fcn.00434bda
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43fcc4
cmp edi, ebx
je 0x43fcc4
call esi
cmp eax, ebx
je 0x43fc91
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43fc91
test byte [ebp - 0x18], 1
jne 0x43fcc4
lea eax, [ebp - 0x10]
push eax
call fcn.0042e9cb
test eax, eax
pop ecx
je 0x43fcac
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043570f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43fcbb
or dword [ebp + 0x10], 0x200000
jmp 0x43fcff
or dword [ebp + 0x10], 0x40000
jmp 0x43fcff
mov eax, dword [0x464358]
cmp eax, dword [ebp - 8]
je 0x43fcff
push eax
call fcn.00434bda
cmp eax, ebx
pop ecx
je 0x43fcff
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43fcff
mov eax, dword [0x46435c]
cmp eax, dword [ebp - 8]
je 0x43fcff
push eax
call fcn.00434bda
cmp eax, ebx
pop ecx
je 0x43fcff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x464354]
call fcn.00434bda
cmp eax, ebx
pop ecx
je 0x43fd1f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43fd21
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x445429
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x45fd70]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004453be
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042e530
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x445478
cmp dword [ebp - 0x1c], 5
jb 0x445490
jmp 0x44548c
cmp dword [ebp - 0x10], 1
jne 0x445490
cmp dword [ebp - 0x1c], 4
ja 0x44548c
jne 0x445490
cmp dword [ebp - 0x18], 0
jbe 0x445490
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44f398
call fcn.00445292
test eax, eax
jge 0x4454b1
mov byte [0x464678], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042da1d
add ebp, 0x78
leave
ret
Function at 0x10106b50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025faa0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102f8be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x10106b99
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x102f254c], 0
jne 0x10106bb0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x10106bfd
mov eax, dword [esi]
test eax, eax
je 0x10106b82
cmp dword [esi + 4], 0
je 0x10106b82
push eax
call fcn.10207540
add esp, 4
push dword [esi + 4]
call fcn.10207540
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x10106bee
push eax
call fcn.10207540
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10106c35
push eax
call fcn.10207540
jmp 0x10106c32
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.10207540
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.10207540
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.10207540
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.10207540
add esp, 4
push 8
call fcn.10207540
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10106c70
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10207540
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101a1930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102615ee
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102f8be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.101a3000
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.101a2fe0
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x102063a0
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x102063b1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x10236040
push 0x100
push 0
push 0x102fbb38
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
nop word [eax + eax]
mov byte [eax + 0x102fbc38], al
inc eax
cmp eax, 0x100
jl 0x10236060
push esi
push edi
push 0x100
push 0xff
push 0x102fbd38
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0xfe317780
mov edx, 0xfc403180
mov esi, 0xf6b26d80
mov edi, 0xf8a3b8c0
xor eax, eax
nop dword [eax]
mov dword [eax + 0x102fbe38], edi
add edi, 0x166e9
mov dword [eax + 0x102fe838], esi
add esi, 0x1c5a2
mov dword [eax + 0x10301238], edx
add edx, 0xb6d2
mov dword [eax + 0x10303c38], ecx
add eax, 4
add ecx, 0x581a
cmp eax, 0x29e0
jle 0x102360a0
xorps xmm0, xmm0
mov dword [0x10305148], 0
pop edi
movups xmmword [0x10305128], xmm0
mov dword [0x10302748], 0
movups xmmword [0x10305138], xmm0
mov dword [0x102ffd48], 0
movups xmmword [0x10302728], xmm0
mov dword [0x102fd348], 0
movups xmmword [0x10302738], xmm0
pop esi
movups xmmword [0x102ffd28], xmm0
movups xmmword [0x102ffd38], xmm0
movups xmmword [0x102fd328], xmm0
movups xmmword [0x102fd338], xmm0
ret

Function at 0x10207540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1020754f
pop dword [ebp - 0x20]
mov eax, 0x9ad3e027
add eax, 0x754c9528
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x387f3f8a
sub dword [ebp - 0x30], 0xea2cfa3f
mov dword [ebp - 0x2c], 0xa0cbc42e
add dword [ebp - 0x2c], 0x91678817
mov dword [ebp - 0x28], 0x8d3b84ce
sub dword [ebp - 0x28], 0x40ef40a0
mov dword [ebp - 0x24], 0xfb1dfaf3
add dword [ebp - 0x24], 0x4e2050d
lea eax, [ebp - 0x30]
push eax
mov eax, 0x966ad307
add eax, 0x79be1d21
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xa8c5307d
sub dword [ebp - 0x30], 0x3452c727
mov dword [ebp - 0x2c], 0xa8e9ed2e
add dword [ebp - 0x2c], 0x98827447
mov dword [ebp - 0x28], 0x71e1b7d4
add dword [ebp - 0x28], 0xf18db498
mov dword [ebp - 0x24], 0x99b10369
sub dword [ebp - 0x24], 0x99b10369
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x6b48d
push 0
call eax
mov ecx, 0x95a1c164
add ecx, 0x6a5e8fac
mov edx, eax
mov ebx, 0x1031ac00
add ebx, dword [ebp - 0x20]
mov edi, 0xd5d91b7a
xor dword [ebp - 0x10], ebx
mov esi, dword [ebx]
mov dword [ebp - 8], 0x2ec79465
sub esi, edi
sub dword [ebp - 0x10], 0x2f93798f
mov dword [edx], esi
mov dword [ebp - 8], 0x30db2c80
add edx, 0x792c0ded
sub edx, 0x792c0de9
add ebx, 0xf6dabf9c
add ebx, 0x9254068
loop 0x10207660
add eax, 0xb1f5f466
add eax, 0x4e0b42ad
xor ebx, ebx
add ebx, eax
add eax, 0xcbcc9802
sub eax, 0xcbcc97fd
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1021a3d0
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x1021a3e1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1025d420
movss xmm5, dword [0x102d91f4]
movss xmm4, dword [0x102d91fc]
movss xmm6, dword [0x102d91f0]
movss xmm7, dword [0x102d91e8]
movss xmm3, dword [0x102926c8]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x102e4250]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x10306650], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x102d91f8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102d91e0]
add eax, edx
mov dword [esi*4 + 0x10306e50], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x102d91ec]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102d91e4]
add eax, ecx
mov dword [esi*4 + 0x10306a50], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
mov dword [esi*4 + 0x10307250], eax
mulss xmm0, dword [0x102d9204]
mov dword [esi*4 + 0x10307a50], edx
mov dword [esi*4 + 0x10307650], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
mov dword [esi*4 + 0x10307e50], eax
mulss xmm0, dword [0x102d9208]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
movaps xmm0, xmm2
mov dword [esi*4 + 0x10308250], eax
mulss xmm0, dword [0x102d920c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10207540
mov dword [esi*4 + 0x10308650], eax
mulss xmm2, dword [0x102d9200]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.10207540
mov dword [esi*4 + 0x10308a50], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1025d450
pop esi
ret
Function at 0x40afa7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40aff1
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40afc0
jmp 0x40aff1
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40afe1
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40c087
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c0bc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c0e6
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c0e6
test edi, edi
je 0x40c0b3
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c0b3
test edi, edi
je 0x40c0ee
mov eax, edi
jmp 0x40c0b5
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c0b5
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040fdfa
add esp, 0xc
int3
Function at 0x40fe2e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestMacroForEach.exe_gMozillaPoisonSize], eax
call fcn.0040c087
pop ecx
mov ecx, dword [sym.TestMacroForEach.exe_gMozillaPoisonSize]
mov dword [sym.TestMacroForEach.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40fe66
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestMacroForEach.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x4b77e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4b7805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x4b7878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4b783a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x4b786d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x4b786b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x4b7831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4b77fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40596d
pop dword [ebp - 0x44]
mov eax, 0x40596d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xf0881de6
add dword [ebp - 0x54], 0x5dca2765
mov dword [ebp - 0x50], 0x11ab0fb4
sub dword [ebp - 0x50], 0xdf77c36f
mov dword [ebp - 0x4c], 0xbc36cc5d
sub dword [ebp - 0x4c], 0x6fea882f
mov dword [ebp - 0x48], 0x387fe276
add dword [ebp - 0x48], 0xc7801d8a
lea eax, [ebp - 0x54]
push eax
mov eax, 0xbad0cdcd
sub eax, 0xba905d6d
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3dccde65
add dword [ebp - 0x54], 0x36a58af1
mov dword [ebp - 0x50], 0x11c020cc
sub dword [ebp - 0x50], 0xd053bf57
mov dword [ebp - 0x4c], 0xa8b71083
add dword [ebp - 0x4c], 0xbab85be9
mov dword [ebp - 0x48], 0x3e5f1fbe
add dword [ebp - 0x48], 0xc1a0e042
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xb7616da2
add eax, 0x48df035e
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3b7db
push 0
call eax
mov ecx, 0x5b19
xor edx, edx
add edx, eax
mov edi, 0xd52bf53b
sub edi, 0xd4eaf53b
add edi, dword [ebp - 0x44]
mov esi, 0x21e1e4e7
add dword [ebp - 0x30], 0x1f835038
mov ebx, dword [edi]
sub dword [ebp - 8], eax
add ebx, esi
xor dword [ebp - 0x3c], edx
mov dword [edx], ebx
add dword [ebp - 0x30], 0xc8627a10
add edx, 0x3e7eb8b4
sub edx, 0x3e7eb8b0
add edi, 4
loop 0x405a80
add eax, 0x32fcff27
add eax, 0xcd046010
xor ebx, ebx
add ebx, eax
add eax, 0xb5ba866e
sub eax, 0xb5ba8669
mov ecx, 0xeb867840
add ecx, 0x14b987c0
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x1001b611
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001b620
pop dword [ebp - 0x1c]
mov eax, 0x1001b620
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x418a2
push 0
mov eax, 0x2d24c45b
sub eax, 0x1d21637f
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x1f1e8be1
sub ecx, 0x1f1e3f76
mov edx, eax
mov esi, 0xbd044231
sub esi, 0xad008431
add esi, dword [ebp - 0x1c]
mov ebx, 0x461d1c7a
mov dword [ebp - 0x14], 0xcb480c52
mov edi, dword [esi]
xor edi, ebx
mov dword [ebp - 0x14], 0xf2d95811
mov dword [edx], edi
sub dword [ebp - 8], esi
add edx, 4
add esi, 0xcd442218
add esi, 0x32bbddec
loop 0x1001b674
add eax, 0xe883b99f
add eax, 0x177d6ae0
mov ebx, eax
add eax, 5
mov ecx, 0x104ddad3
add ecx, 0xffb2252d
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001b611
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001b611
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x10002070
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
aeskeygenassist xmm0, xmmword [edx], 2
movdqa xmmword [ecx], xmm0
pop ebp
ret
Function at 0x10018010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.1001802a
Function at 0x1002ca20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x1002ca78
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x1002ca70
cmp eax, ebx
jb 0x1002caf2
cmp eax, dword [ebp + 0x10]
ja 0x1002cb03
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x1002ca72
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x1002ca60
jmp 0x1002cacf
ja 0x1002ca78
cmp edx, edi
mov ebx, eax
jne 0x1002ca32
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x1002cad3
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x1002cab0
mov esi, edi
sub ecx, ebx
jns 0x1002cac7
jmp 0x1002cad5
cmp edi, edx
je 0x1002cadc
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x1002cad5
xor al, 1
cmp esi, edx
jne 0x1002ca90
jmp 0x1002cad5
xor eax, eax
jmp 0x1002cad5
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x102c2cd8
push 0x2b
push str.called__Option::unwrap____on_a__None__valueassertion_failed:__buf.is_empty__
call fcn.10027330
add esp, 0xc
ud2
push 0x102c2ce8
push eax
push ebx
call fcn.1002ac90
add esp, 0xc
ud2
push 0x102c2ce8
push dword [ebp + 0x10]
push eax
call fcn.1002ac30
add esp, 0xc
ud2
Function at 0x1002f6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x80
jb 0x1002f8b3
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x102c7310]
add edx, 0x40
add eax, 0xffffffc0
movd xmm0, ecx
pxor xmm0, xmm4
movdqa xmm4, xmmword [0x102c7300]
nop word cs:[eax + eax]
nop
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [edx]
add eax, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm7, xmm5, 0x11
pxor xmm0, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp eax, 0x3f
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pxor xmm1, xmm7
ja 0x1002f730
movdqa xmm4, xmmword [0x102c7320]
movdqa xmm5, xmmword [0x102c7330]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm1
jb 0x1002f847
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm1, xmmword [edx]
movdqa xmm2, xmm0
add eax, 0xfffffff0
pclmulqdq xmm0, xmm5, 0x11
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm2, xmm1
pxor xmm0, xmm2
ja 0x1002f820
movdqa xmm1, xmmword [0x102c7330]
pxor xmm2, xmm2
test eax, eax
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x102c7340], 0
pxor xmm0, xmm2
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x102c7350], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x102c7360], 0
pxor xmm2, xmm0
pextrd ecx, xmm2, 1
not ecx
je 0x1002f8be
push eax
call fcn.1002f210
add esp, 4
pop ebp
ret
mov eax, ecx
pop ebp
ret