joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x77b865f1
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7c0c410b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x410e4171
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xdcd0257
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100072d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ba7d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0xf
xor edx, edx
nop
mov al, byte [edx + str.Aui4Vvuj]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000731d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10007300
mov byte [ebp - 0x15], 0
mov edx, 0x100e4dfc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100220f0
mov dword [ebp - 0x1c], 0x46206f4e
mov dword [ebp - 0x18], 0x6873616c
mov byte [ebp - 0x14], 0
mov edx, 0x100e4df8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.100220f0
mov dword [ebp - 0x18], 0x46206f4e
mov word [ebp - 0x14], 0x676f
mov byte [ebp - 0x12], 0
mov edx, 0x100e4df9
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.100220f0
mov ecx, 0xb5
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x1009f9c8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x100073ad
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10007390
mov byte [ebp - 0x14], 0
mov edx, 0x100e4df6
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.100220f0
mov dword [ebp - 0x1c], 0x53206f4e
mov dword [ebp - 0x18], 0x656b6f6d
mov byte [ebp - 0x14], 0
mov edx, 0x100bdc87
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1c]
call fcn.100220f0
mov ecx, 0xb0
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + 0x1009f9d8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000741d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10007400
mov byte [ebp - 0x15], 0
mov edx, 0x100e4df5
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x20]
call fcn.100220f0
mov ecx, 0x96
xor edx, edx
mov al, byte [edx + 0x1009f9e4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000745f
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x10007442
mov byte [ebp - 0x12], 0
mov edx, 0x100e4dfd
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.100220f0
mov ecx, 0x5b
xor edx, edx
mov al, byte [edx + 0x1009f9f4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x100074a1
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10007484
mov byte [ebp - 0x15], 0
mov edx, 0x100e4df7
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.100220f0
mov dword [ebp - 0x1c], 0x776f6853
mov dword [ebp - 0x18], 0x53504620
mov byte [ebp - 0x14], 0
mov edx, 0x100e4dfb
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.100220f0
mov dword [ebp - 0x1c], 0x776f6853
mov dword [ebp - 0x18], 0x445548
mov edx, 0x100e4df4
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x1c]
call fcn.100220f0
mov dword [ebp - 0x1c], 0x63617274
mov dword [ebp - 0x18], 0x737265
mov edx, 0x100e4dfa
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x1c]
call fcn.100220f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049d20
mov esp, ebp
pop ebp
ret
Function at 0x10007860
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x10007882
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x10007870
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x10007890
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bb3d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0x69766e49
mov dword [ebp - 0x18], 0x6c626973
mov word [ebp - 0x14], 0x65
mov edx, 0x100e4e05
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.100220f0
mov dword [ebp - 0x1c], 0x43206f4e
mov dword [ebp - 0x18], 0x70696c
mov edx, 0x100e4e04
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.100220f0
mov dword [ebp - 0x1c], 0x65657053
mov dword [ebp - 0x18], 0x61482064
mov word [ebp - 0x14], 0x6b63
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.1001e380
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x30]
mov dword [esp], 0x3f800000
lea ecx, [ebp - 0x2c]
push 0x1009fa38
push eax
lea eax, [ebp - 0x18]
mov word [ebp - 0x2c], 0x83
push eax
push 0x100e4e08
xor edx, edx
mov byte [ebp - 0x2a], 0
mov dword [ebp - 0x30], 0x5dc
mov dword [ebp - 0x18], 0
call fcn.10021190
mov dword [ebp - 0x28], 0x706d754a
mov dword [ebp - 0x24], 0x63614820
mov word [ebp - 0x20], 0x6b
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push eax
call fcn.1001e380
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], 0x100a7a0
xor ecx, ecx
lea eax, [ecx + 0x23]
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 2
jb 0x100079a3
push ecx
mov dword [esp], 0x3f800000
lea eax, [ebp - 0x18]
push 0x1009fa38
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 0x29], 0
push eax
push 0x100e4e0c
xor edx, edx
mov dword [ebp - 0x18], 0x7d0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], 0
call fcn.10021190
add esp, 0x14
mov dword [ebp - 0x28], 0x20796c46
mov dword [ebp - 0x24], 0x6b636148
mov byte [ebp - 0x20], 0
mov edx, 0x100e4e06
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.100220f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049d20
mov esp, ebp
pop ebp
ret
Function at 0x1000bb90
Capabilities:
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bf8e
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], 0
jne 0x1000bcf4
push 0x10097078
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.1000c2a0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], 1
push eax
push 0
push 0
push 0x1009707c
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
call fcn.1000c580
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x48], 3
cmp ecx, 0xf
jbe 0x1000bc52
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000bc48
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000bc48
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10049e73
add esp, 8
movups xmm0, xmmword [ebp - 0x40]
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x30]
push eax
movq qword [ebp - 0x18], xmm0
call fcn.1000c3a0
call fcn.10001750
add esp, 0x18
test al, al
je 0x1000bd15
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000bb20
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10001530
push 0
push 0
call esi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x1000bcf4
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000bcea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000bcea
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10049e73
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049d20
mov esp, ebp
pop ebp
ret 0xc
movaps xmm0, xmmword [0x100a0e50]
lea ecx, [ebp - 0x3c]
push 0x10
push 0x10097078
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x100
call fcn.10007860
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1000bd70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x1000bd92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x1000bd80
mov byte [esi + 5], 0
pop esi
ret

Function at 0x1000bda0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x1000bdc2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x1000bdb0
mov byte [esi + 8], 0
pop esi
ret
Function at 0x1000be80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x1000bea2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x1000be90
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x1000bf20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x1000bf42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x1000bf30
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x1000bf50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x1000bf72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x1000bf60
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x1000bfc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x1000bfe2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x1000bfd0
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x1000c010
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x1000c032
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x1000c020
mov byte [esi + 0xc], 0
pop esi
ret

Function at 0x1000c040
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x1000c062
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x1000c050
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x1000c070
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1000c092
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x1000c080
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x1000c150
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x1000c172
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x1000c160
mov byte [esi + 9], 0
pop esi
ret

Function at 0x1000c180
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x1000c1a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x1000c190
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x1000c1b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x1000c1d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x23]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x1000c1c0
mov byte [esi + 0xa], 0
pop esi
ret
Function at 0x1000d310
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x100a4040]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x100e4e74]
lea eax, [esp + 0x24]
push esi
push edi
push eax
push dword [0x100e4e8c]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
movd xmm1, eax
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x30]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x20]
mov ecx, edi
sub ecx, dword [0x100e4e90]
mov esi, dword [esp + 0x24]
mov edx, esi
sbb edx, dword [0x100e4e94]
call fcn.1004b0a0
mov edx, dword [0x100e4e9c]
mov ecx, dword [0x100e4e98]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
call fcn.1004b0a0
movss xmm1, dword [esp + 0x10]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x100e4e94], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x100e4e90], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
mov ecx, dword [0x100e4e74]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
cmp byte [ecx + 0x36f], 0
lea esi, [ecx + 0xd8]
je 0x1000d44a
cvttss2si eax, dword [esi]
mov dword [esp + 0x10], eax
cvttss2si eax, dword [ecx + 0xdc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push dword [0x100e4e8c]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [0x100e4e8c]
jne 0x1000d4a4
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1000d4a4
lea eax, [esp + 0x18]
push eax
push dword [0x100e4e8c]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1000d4a4
movd xmm0, dword [esp + 0x18]
movd xmm1, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0xf0], 0
je 0x1000d4b2
or eax, 0xffffffff
jmp 0x1000d4bd
mov eax, dword [0x100e4e74]
mov eax, dword [eax + 0x1bd4]
cmp dword [0x100bd4e8], eax
je 0x1000d4cf
mov dword [0x100bd4e8], eax
call fcn.1000d1f0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10049d20
mov esp, ebp
pop ebp
ret
Function at 0x1000f090
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100e4ef4], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x1000f14a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x100e4ef0], eax
inc ebx
cmp ebx, 0x100
jb 0x1000f0b0
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x1000f176
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100e4ef0]
sub edi, 1
jne 0x1000f155
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000f1a8
nop dword [eax]
cmp cl, 0x23
jne 0x1000f18f
cmp byte [esi], cl
jne 0x1000f18f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100e4ef0]
test cl, cl
jne 0x1000f180
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1000fa50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000fa62
mov dword [edi], 0
mov edx, 0x1009fd98
call fcn.1000f920
mov esi, eax
test esi, esi
jne 0x1000fa76
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000fb10
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1000fb10
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000fb10
inc dword [0x100e4ea0]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1000fb10
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x1000faf9
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x100e4ea0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x1000fb08
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100159c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x100a4040]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], edi
xor ecx, ecx
mov dword [esp + 0x34], 0x4d464e71
mov dword [esp + 0x38], 0x1005c45
lea eax, [ecx + 0x26]
xor byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 6
jb 0x100159f6
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x4d464e71
mov dword [esp + 0x10], eax
xor ecx, ecx
mov dword [esp + 0x38], 0x1005c45
nop dword [eax]
lea eax, [ecx + 0x26]
xor byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 6
jb 0x10015a20
push 0
xor edx, edx
mov byte [esp + 0x3f], 0
lea ecx, [esp + 0x38]
call fcn.1000f090
mov ecx, dword [edi + 0x2b78]
lea esi, [edi + 0x2b74]
mov dword [esp + 0x18], eax
add esp, 4
mov eax, dword [esi]
mov dword [esp + 0x18], 0x10015490
mov dword [esp + 0x1c], 0x10015500
mov dword [esp + 0x20], 0x10015690
test eax, eax
jne 0x10015abb
cmp eax, ecx
jne 0x10015a9c
lea edi, [eax + 1]
test ecx, ecx
je 0x10015a86
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10015a8b
mov eax, 8
cmp eax, edi
mov ecx, esi
cmovg edi, eax
push edi
call fcn.1002ff00
mov edi, dword [esp + 0xc]
mov eax, dword [esi]
movups xmm0, xmmword [esp + 0x10]
lea ecx, [eax + eax*2]
mov eax, dword [esi + 8]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [esp + 0x20]
movq qword [eax + ecx*8 + 0x10], xmm0
jmp 0x10015b1a
cmp eax, ecx
jne 0x10015ae7
lea edi, [eax + 1]
test ecx, ecx
je 0x10015ad1
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10015ad6
mov eax, 8
cmp eax, edi
mov ecx, esi
cmovg edi, eax
push edi
call fcn.1002ff00
mov edi, dword [esp + 0xc]
mov eax, dword [esi]
test eax, eax
jle 0x10015b04
mov ecx, dword [esi + 8]
lea eax, [eax + eax*2]
shl eax, 3
push eax
push ecx
lea eax, [ecx + 0x18]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, dword [esi + 8]
movups xmm0, xmmword [esp + 0x10]
movups xmmword [eax], xmm0
movq xmm0, qword [esp + 0x20]
movq qword [eax + 0x10], xmm0
inc dword [esi]
mov ecx, dword [esp + 0x3c]
mov byte [edi], 1
pop edi
pop esi
xor ecx, esp
call fcn.10049d20
mov esp, ebp
pop ebp
ret
Function at 0x10015e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x100e4e74]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [esi + 0x2b64], 0
test eax, eax
je 0x10015f1c
push ebx
push edi
push 0
lea ecx, [esi + 0x2b68]
mov dword [esi + 0x2b64], 0
call fcn.1002fac0
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
lea ecx, [esi + 0x2b68]
call fcn.1002fcd0
xor ebx, ebx
cmp dword [esi + 0x2b74], ebx
jle 0x10015ee5
xor edi, edi
nop dword [eax]
mov eax, dword [esi + 0x2b7c]
lea ecx, [esi + 0x2b68]
add eax, edi
push ecx
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
inc ebx
add esp, 0xc
add edi, 0x18
cmp ebx, dword [esi + 0x2b74]
jl 0x10015ec0
mov edi, dword [esi + 0x2b68]
mov edx, 0x1009fd9c
mov ecx, dword [ebp - 8]
dec edi
mov ebx, dword [esi + 0x2b70]
call fcn.1000f920
mov esi, eax
test esi, esi
je 0x10015f1a
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret