joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001238
Capabilities:
Accept command line arguments
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x428]
push eax
xor edi, edi
push 0x10011d0
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x10011b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 4], eax
je 0x10012b7
and dword [ebp - 0xc], 0
push 0x10011a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10012a9
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0xc]
jmp 0x100132f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x220]
push 0x1001138
push eax
call esi
push edi
lea eax, [ebp - 0x20]
push 0x1001120
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x1001108
lea eax, [ebp - 0x20]
push eax
call ebx
mov eax, dword fs:[0x18]
test eax, eax
je 0x100132e
push dword [eax + 0xbf4]
lea eax, [ebp - 0x220]
push 0x10010d4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x10010b8
lea eax, [ebp - 0x20]
push eax
call ebx
inc edi
cmp dword [ebp - 4], 0
jne 0x100133e
cmp edi, 0xa
jle 0x100126c
cmp edi, 0xa
jle 0x100139d
lea eax, [ebp + 0xc]
push eax
push 0xf003f
push 0
push 0x100109c
push 0x80000002
mov dword [ebp + 0x14], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100139d
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
pop edi
push edi
lea eax, [ebp + 0x14]
push eax
push edi
push 0
push 0x1001088
push dword [ebp + 0xc]
call esi
push edi
lea eax, [ebp + 0x14]
push eax
push edi
push 0
push 0x100105c
push dword [ebp + 0xc]
mov dword [ebp + 0x14], 1
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x908bdf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x909bfa
call fcn.00908bdf
jne 0x8c3b62
mov bx, 0xd03
pop ebx
jmp 0x8c3ae3
mov ecx, 0xe9acf3e0
jmp 0x9089fa
not edx
lea edx, [esi + 0xea]
jmp 0x908acd
mov byte [eax + esi + 0x18], cl
clc
sub esp, 0x11
sub esp, 0x17
jmp 0x908a02
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
dec edi
jmp 0x9089e2
lea esp, [esp + 0x28]
inc eax
inc dword [ebp + 8]
pushal
jmp 0x908a11
push word [esp + 0xc]
lea esp, [esp + 2]
jmp 0x908a3d
lea esp, [esp + 0x20]
cmp eax, 0x40
jne 0x8c3b11
mov ah, 0x54
jmp 0x908b26
movzx edx, byte [eax + 1]
movzx ebx, byte [eax]
push sp
call fcn.00908ab7
push edi
mov edi, eax
add edi, reloc.KERNEL32.dll_GetStartupInfoA
movzx ebx, byte [edi]
jmp 0x908b04
pop edi
shl edx, 8
pushal
or edx, ebx
jmp 0x908b46
shl edx, 8
cmc
jmp 0x908b30
xor ecx, ecx
lea eax, [esi + 0x1a]
jmp 0x8c3ba4
or edx, ebx
jmp 0x908b7e
xor bx, dx
ror ebx, cl
bsf bx, bp
xchg bh, bl
movzx ebx, byte [eax - 2]
jmp 0x908b0d
inc ecx
call fcn.00908bc3
cmp ecx, 0x10
jb 0x8c3ba4
lea ecx, [eax + eax]
mov ax, 0x9842
jmp 0x908ba5
mov dword [ebp + ecx*4 - 0x40], edx
sub esp, 0xa
lea esp, [esp + 2]
lea esp, [esp + 0x2c]
jmp 0x908b57
bswap eax
lea ecx, [esi + 8]
lea eax, [esp + 8]
call fcn.00908b8f
jbe 0x908c16
mov al, byte [0x37a0e33e]
mov esp, 0x1b3a3f30
invalid
call fcn.008dfe6c
jmp 0x909c10
lea esp, [esp + 4]
test edi, edi
jmp 0x8c3b16
test byte [ebx + 0x752886bd], bl
je 0x908bd5
loop 0x908baa
mov ecx, dword [eax + 0xa]
lodsb al, byte [esi]
sbb al, al
adc ecx, dword [edi + ebp*2 + reloc.KERNEL32.dll_GetStartupInfoA]
sbb eax, 0xe2de4728
mov al, 0x1d
sbb eax, 0xf40ee1c0
out 0xab, al
out 0x6c, eax
inc esp
pushal
sbb byte [ebx + 0x191854bb], dl
sal byte [eax], 0x87
dec esi
xchg ebx, eax
in al, 0xb7
cmp edi, dword [edi + 0x22]
dec eax
les eax, [eax - 0x3feca085]
pop edx
mov ah, byte ds:[ebx + 0x40]
mov al, byte [0x5fc63564]
wait
retf 0x42a5
pop edi
jmp 0x909c2d
xor eax, eax
jmp 0x8c3b11
leave
ret
Function at 0x9af84d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea eax, [eax + esi]
mov byte [esp + 0x22], cl
sub esp, 0xa
mov ch, cl
jmp 0x9af85f
neg ch
mov bx, cx
mov byte [esp + 0x17], dl
xchg word [esp + 0x18], bx
cpuid
jmp 0x9af837
mov word [esp + 0x27], sp
bsr edx, eax
push word [esp + 0x1d]

Function at 0x9afa96
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1d
lea esp, [esp + 0x49]
mov eax, dword [esp]
clc
jmp 0x9afacf

Function at 0x9afc8e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt cx, si
mov byte [esp + 1], ah
lea edx, [esi + 0xa4]
push word [esp + 4]
jmp 0x9afcbd
push dword [esp + 5]
mov dword [esp + 1], esi
lea esi, [edx + 0x72]
pop word [esp + 4]

Function at 0x9b3953
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.009b301d
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0x9b3973
pop word [esp]
push word [esp]
jmp 0x9b3939
mov eax, dword [eax]
jmp 0x9b3997
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x9b395d
mov eax, dword [eax + 8]
push eax
jmp 0x9b3018
Function at 0x401e40
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x41a8e4
call sym._EnterCriticalSection_4
mov ebx, dword [0x41a8dc]
sub esp, 4
test ebx, ebx
je 0x401e8b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e84
test esi, esi
je 0x401e84
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e60
mov dword [esp], 0x41a8e4
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402070
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4020c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402198
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4020fe
cmp eax, 4
jne 0x402120
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40210e
cmp edx, 4
je 0x40210e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402070
Function at 0x40185a
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
cmp dword [0x4063af], 0
jne 0x40189b
push 0x18
push 0x6a4abc5b
call fcn.004018b4
mov dword [0x4063af], eax
cmp dword [0x4063af], 0
jne 0x40189b
mov eax, 0
jmp 0x4018ae
push dword [ebp + 8]
push dword [0x4063af]
call fcn.00401904
jmp 0x4018ae
mov esp, ebp
pop ebp
ret 4

Function at 0x4018b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
test esi, esi
je 0x4018f0
mov ecx, dword [ebp + 0xc]
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4018d9
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4018d0
cmp edi, dword [ebp + 8]
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4018c4
mov eax, ebx
leave
ret 8
xor eax, eax
jmp 0x4018ec

Function at 0x401904
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x401963
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x401990
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40197f
xor ecx, eax
xor edx, ebx
dec edi
jne 0x401970
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x4019b6
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x401957
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x4023f9
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
cmp dword [0x4063cb], 0
jne 0x40243a
push 0x12
push 0x3cfa685d
call fcn.004018b4
mov dword [0x4063cb], eax
cmp dword [0x4063cb], 0
jne 0x40243a
mov eax, 0
jmp 0x40244d
push dword [ebp + 8]
push dword [0x4063cb]
call fcn.00401904
jmp 0x40244d
mov esp, ebp
pop ebp
ret 4
Function at 0x4ea3a3
Capabilities:
Encode data using xor

Disassembly:
fild word [ecx]
dec edi
sbb dh, bh
xchg ebp, eax
sti
push ecx
mov bh, 0xdd
cmp esp, 0x707cf1b6
mov dword [edi - 0x6dbf7e84], ebx
aaa
push ebx
push esp
jns 0x4ea321
mov ebp, 0xdf11343a
fcom qword [ebp + 0x6c]
out 0x9c, al
xchg esi, eax
inc edx
retf
fistp word [edx + 0x5d]
inc ecx
jne 0x4ea36c
and edi, dword [0x5cf3e561]
adc dword [esi + ebp*2 - 0x702c58e9], ecx
mov bl, 0x64
sbb al, 0xae
and ebp, dword [ebx - 0x1d263d84]
pushfd
into
nop
lea edx, [eax + ebx*4 - 0x7f]
cmp al, 0xf1
int1
jmp 0x4ea2e8
pop eax
jae 0x4ea346
out 0x6a, eax
stosb byte es:[edi], al
salc
movsd dword es:[edi], dword [esi]
cmp eax, 0x50cdb3fc
popfd
sbb esp, dword [eax + 0x72]
std
mov edx, 0x42918aa3
adc cl, dh
mov cl, 0x40
and al, byte [ecx + 0x34cb7a31]
pop ebx
popfd
add ecx, esi
adc al, 0xc8
dec ecx
lcall 0x8fc2, 0xb43f21bd
dec ebx
cmp al, 0xc2
push ds
mov word [edi], ds
insb byte es:[edi], dx
pop esi
cmp eax, 0x8c191247
mov ecx, esi
test al, 0x79
push ecx
push ds
cmp al, 0xe9
push esp
or al, 4
loope 0x4ea40a
outsb dx, byte [esi]
jae 0x4ea347
sti
cmp eax, 0x17d2b238
add byte [ecx + 0x3c], ch
cmpsd dword [esi], dword es:[edi]
insb byte es:[edi], dx
push 0xc4f32829
mov bl, 0x12
and byte [edi], cl
pushal
imul byte [ecx - 0x6c750214]
clc
test eax, 0xe9653edd
mov word [edx + 0x13f69edd], es
pop edx
jle 0x4ea42f
adc bl, byte [edi - 0x40]
pushfd
jns 0x4ea442
cmp al, byte [edx]
cmp eax, 0x3f7bee4c
sub al, 0xf
fisub word [ecx - 0x3d3a6150]
sub eax, 0x78b47c51
jl 0x4ea47b
invalid
les esi, [ebx]
adc bh, byte [ebp - 0x61]
push 0x57d09708
wait
pop dword fs:[ebp - 0x4d8b22f2]
cli
inc edx
shr byte [0x8cf3ce0c], cl
aaa
cmp byte [ebx], ch
cmp al, 0x5c
bound ebp, qword [eax]
movsd dword es:[edi], dword [esi]
push 0x58
into
invalid
insb byte es:[edi], dx
popal
fldcw word [eax]
ret
jo 0x4ea4c0
in al, 0x13
insb byte es:[edi], dx
loope 0x4ea4ad
push edx
dec eax
add dword [ebx + 0x3f], ecx
push esi
bound edi, qword [eax - 0x383d1104]
cmp ebx, 0x58
aad 0xe7
xchg edx, eax
adc al, 0xa1
movnti dword [edi + edi], edi
add esi, ecx
ficomp dword [esi + 0x48ae5c9f]
pop ss
or al, 0x4c
iretd
mov byte [0x31a57a8a], al
inc ebx
in eax, dx
jp 0x4ea422
xor dword [ebx - 0x13], eax
or dh, byte [ebx + 0x426d5549]
leave
imul ebp, dword [esi + 0x34], 0xffffffb7
enter 0xffffffffffffbcf0, 0xfffffffffffffff3
imul ebp, dword [edi], 0xffffff8c
lds ecx, [ebp - 0x10]
insb byte es:[edi], dx
in al, dx
xor eax, 0xc2100391
mov word [esi - 0x51], ds
push cs
inc ebx
jl 0x4ea479
cmp byte [eax + 0x3c], bh
fiadd word [eax]
idiv byte [0xbc569f55]
jp 0x4ea4cc
mov esp, 0xc1f51c7a
pushfd
add dh, byte [ebp - 0x7ffa20c9]
cmc
rcr dword [edx + eax + 0x5df37b5], 0x80
in al, dx
pop esi
iretd
int3
sub byte [ebp - 0x34], cl
push eax
inc esp
test eax, 0x54c59f48
lodsb al, byte [esi]
cld
inc eax
sbb ah, bh
scasb al, byte es:[edi]
dec esp
jmp 0xb1adcfe
Function at 0x53936f
Capabilities:
Encode data using xor

Disassembly:
popfd
push eax
lahf
shl dh, cl
xchg byte [ecx - 0x67158070], ah
shl byte [esi + 0x39610f80], cl
in al, dx
aas
sal dword [eax - 0x541eba68], 1
xor ch, byte [ebp + 0x3dc67312]
mov al, byte [0x617db1ee]
insd dword es:[edi], dx
nop
scasd eax, dword es:[edi]
ret 0xf2ed
jl 0x539311
test eax, 0xa69085ba
push edx
js 0x5393c2
xchg esp, eax
pop eax
sub byte [ebx - 0x4f7f15fc], ah
and ebp, esi
inc esp
add ch, dh
dec ecx
cld
invalid
or ebx, dword [edi]
inc ebp
bound eax, qword [edx]
shr dword [ebx + edx*8 + 0x7152ec35], cl
pop ebp
mov bl, al
xor dh, byte [ebx - 0x72]
cmc
invalid

Function at 0x58da5f
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x38
invalid
lds esp, [edx - 0x45f3cb0]
cmp esp, esi
jl 0x58dab9
out 0x7c, al
push eax
xchg edx, eax
xor al, 0x80
jb 0x58da66
mov ah, 0x85
scasb al, byte es:[edi]
in al, dx
and al, 0xdd
shr esp, cl
sahf
dec esp
xor dl, byte [0x212fa9fe]
jno 0x58da71
adc esp, dword cs:[ebx + 0x28]
add dh, byte [0x98daebcf]
jb 0x58da5c
invalid
insd dword es:[edi], dx
push cs
hlt

Function at 0x5d938b
Capabilities:
Encode data using xor

Disassembly:
and dword [edi], 0xffffffc7
lds esi, [edi + 0x3f59acc1]
js 0x5d93cb
mov word [eax - 5], gs
add eax, 0x23fd5eda
hlt
imul ebx, dword [ecx], 0xaca98f1d
sbb al, 0x1c
push eax
sbb dword [0x1caca98f], ebx
sbb al, 0x50
dec ecx
xor eax, dword [esi]
mov ebx, 0x961daa6a
or dl, byte [eax]
xor eax, 0xf9401849
adc byte [eax + 0x4cb0e823], bh
inc edx
scasb al, byte es:[edi]
sbb dl, byte [eax + 0x6a52fe7c]
xchg ebx, eax
dec ebx
sub byte [edi - 0x37], dh
jns 0x5d93ca
aas
cmc
inc esp
das
das
jne 0x5d9477
jmp 0x5d946f
cmpsb byte [esi], byte es:[edi]
mov al, byte [0xba0b48f6]
or dh, byte [ebp + 0x56]
push esi
push 0x60
lcall 0x6abe, 0x111a2980
shl ebp, 0xc2
adc al, 0xf5
invalid

Function at 0x625867
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x802be671
test al, 0xd3
mov al, al
mov dl, byte [esi - 0x45]
inc ebp
aaa
aaa
sub al, 0x82
insd dword es:[edi], dx
add ebx, dword [ebp + 0x50cc22d]
test al, 0x9e
invalid
inc edx
in eax, dx
fsubr st(5), st(0)
test eax, 0x8ea4c3a3
pop edx
cdq
in al, dx
push eax
mov dl, 0x5c
jg 0x6258a3
jne 0x625805
jecxz 0x6258bf
pushal
invalid
lcall 0xe5a6, 0xc71d522b
retf 0xd99f
xchg ebx, eax
adc edx, dword [ecx - 0x18]
loop 0x62587d
cdq
insd dword es:[edi], dx
rcl dword [edx + 0x5e], cl
inc edx
cmc
test dword [ecx + 0x6891a5fd], esp
daa
cmpsb byte [esi], byte es:[edi]
nop
inc edx
or al, 0x15
nop
out 0x12, eax
or bl, byte [ebx]
int3
Function at 0x10003fdf
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x100626c1], 0
je 0x10003ff2
cmp byte [0x100626d6], 0
jne 0x10003ff2
ret
cmp dword [0x10052449], 0
jne 0x1000402e
call fcn.10003e62
or eax, eax
jne 0x1000401c
mov dword [0x1005244d], 0
mov dword [0x10052449], 0
or al, 0xff
jmp 0x10004085
mov dword [0x1005244d], eax
push dword [eax + 4]
pop dword [0x10052449]
xor al, al
jmp 0x10004085
push dword [0x10052449]
call fcn.10046de4
or eax, eax
je 0x10004073
cmp eax, dword [0x1005244d]
je 0x10004047
jmp 0x10003ffb
cmp byte [eax + 0x20], 0
jne 0x1000405b
cmp word [eax + 0x3c], 0
jne 0x1000406f
cmp word [eax + 0x40], 0
je 0x1000406f
push 0
pop dword [0x1005244d]
push 0
pop dword [0x10052449]
mov al, 1
jmp 0x10004085
xor al, al
jmp 0x10004085
push 0
pop dword [0x1005244d]
push 0
pop dword [0x10052449]
or al, 0xff
cmp al, 1
jne 0x100040c7
cmp byte [0x10053503], 0
jne 0x10004099
mov eax, 0x11
jmp 0x1000409e
mov eax, 0x1e
cmp byte [0x1005350e], 0
jne 0x100040b5
push eax
call fcn.10030cee
push eax
call fcn.10032df2
jmp 0x100040bb
push eax
call fcn.10032e9c
call fcn.1005103e
mov dword [0x1006281e], eax
jmp 0x100040f7
or al, al
jne 0x100040d7
call fcn.1005103e
mov dword [0x1006281e], eax
jmp 0x100040f7
cmp dword [0x1006281e], 0
jne 0x100040e2
jmp 0x10004089
call fcn.1005103e
sub eax, dword [0x1006281e]
cmp eax, dword [0x100534ff]
jbe 0x100040f7
jmp 0x10004089
ret

Function at 0x1000455a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
call fcn.1005103e
sub eax, dword [0x1006b6c1]
cmp eax, 0x1388
jb 0x100046f8
mov eax, dword [0x1005d857]
mov eax, dword [eax]
mov byte [ebp - 0x64], 0
or eax, eax
je 0x10004598
movzx ecx, byte [eax - 4]
inc ecx
push ecx
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.10051110
mov byte [ebp - 0x124], 0
cmp byte [0x1005339d], 1
jne 0x10004660
cmp dword [0x1006b6b9], 0
je 0x10004660
lea eax, [ebp - 0x32]
push eax
push dword [0x1006b6bd]
push 0x148
push 0xdae
push dword [0x100523ca]
call fcn.10015391
or eax, eax
je 0x1000463f
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx ecx, word [eax + 8]
movzx edx, word [eax + 0xa]
jmp 0x1000461b
push edx
push ecx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x32]
push eax
push 0x100045ed
lea eax, [ebp - 0x124]
push eax
call fcn.10050e22
add esp, 0x18
mov dword [ebp - 0x128], eax
mov eax, dword [0x1006b6b9]
cmp eax, dword [0x1006b6bd]
ja 0x10004658
mov dword [0x1006b6bd], 0
jmp 0x100046ca
inc dword [0x1006b6bd]
jmp 0x100046ca
cmp byte [0x1005339d], 2
jne 0x100046ca
mov eax, dword [0x1005d7bb]
mov eax, dword [eax]
movzx ecx, word [eax + 8]
movzx edx, word [eax + 0xa]
jmp 0x100046aa
push edx
push ecx
lea eax, [ebp - 0x64]
push eax
push 0x1000467a
lea eax, [ebp - 0x124]
push eax
call fcn.10050e22
add esp, 0x14
mov dword [ebp - 0x128], eax
cmp byte [ebp - 0x124], 0
je 0x100046ee
or dword [ebp - 0x12c], 0xffffffff
mov eax, dword [0x1005d7cb]
mov eax, dword [eax]
mov eax, dword [eax]
lea edx, [ebp - 0x124]
call fcn.1004791b
call fcn.1005103e
mov dword [0x1006b6c1], eax
leave
ret
Function at 0x100046fa
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14c
push esi
push 0x104
lea eax, [esp + 0x50]
push eax
call fcn.1005104a
mov ecx, dword [0x1005d531]
push ecx
xor esi, esi
call fcn.10051116
dec eax
js 0x10004733
mov ecx, dword [0x1005d531]
nop
mov dl, byte [eax + ecx]
mov byte [esp + esi + 0x2c], dl
inc esi
dec eax
jns 0x10004728
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x50]
push ecx
mov byte [esp + esi + 0x34], 0
call fcn.100510f8
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x64]
push edx
call fcn.10050fc0
mov esi, eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
mov eax, 0x4fa2c0
call dword [eax]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
call fcn.10050fde
mov ax, word [esp + 0xc]
xor ax, 0xd05
cmp ax, 0xad2
mov word [esp + 0xc], ax
jne 0x100047a4
call fcn.10016f5c
push esi
call fcn.10050fb4
pop esi
add esp, 0x14c
ret
Function at 0x10006ff9
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov word [ebp - 0x10], 0x7d5
mov word [ebp - 2], 0x29a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100510ce
push 0
call fcn.1005100e
mov dword [ebp - 0x124], eax
push 0x104
push 0
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x124]
call fcn.10051008
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push 0
lea eax, [ebp - 0x11c]
push eax
mov eax, 0x4fa190
call dword [eax]
mov dword [ebp - 0x120], eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x120]
call fcn.100510bc
push dword [ebp - 0x120]
call fcn.10050fb4
leave
ret
Function at 0x1000a73c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
call fcn.1005103e
sub eax, dword [0x1006bab7]
cmp eax, 0x2710
jbe 0x1000a7e0
call fcn.1005103e
mov dword [0x1006bab7], eax
lea eax, [ebp - 0x18]
push eax
call fcn.10050e9a
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.10050e94
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
push 0
call fcn.10050f30
push dword [ebp - 8]
push dword [0x1006b428]
push dword [ebp - 0x18]
call fcn.1005108c
mov dword [ebp - 0x18], eax
push dword [ebp - 4]
push dword [0x1006b42c]
push dword [ebp - 0x14]
call fcn.1005108c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp eax, dword [0x1006b428]
ja 0x1000a7e0
cmp edx, dword [0x1006b42c]
ja 0x1000a7e0
lea ebx, [ebp - 0x18]
mov word [ebx + 4], ax
mov word [ebx + 6], dx
call fcn.1003f797
call fcn.1005103e
mov dword [0x1006bab7], eax
pop ebx
leave
ret 4
Function at 0x1000ac96
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
or byte [ebp - 0xd], 0xff
cmp dword [ebp + 8], 0
jne 0x1000acfb
lea ebx, [ebp - 0x71]
jmp 0x1000acb1
push 0x1000acac
push ebx
call fcn.1002f616
add ebx, eax
mov eax, dword [0x1005d88b]
mov eax, dword [eax]
or eax, eax
je 0x1000ad45
mov eax, dword [eax + 0x2ae90]
or eax, eax
je 0x1000acf9
movzx ecx, byte [eax - 4]
push ecx
push ecx
push eax
push ebx
call fcn.1002f4e9
pop eax
add ebx, eax
jmp 0x1000acea
push 0x1000ace5
push ebx
call fcn.1002f616
mov byte [ebp - 0xd], 0
jmp 0x1000ad45
lea ebx, [ebp - 0x71]
jmp 0x1000ad05
push 0x1000ad00
push ebx
call fcn.1002f616
add ebx, eax
mov eax, dword [ebp]
mov eax, dword [eax - 0x8c]
or eax, eax
je 0x1000ad45
movzx ecx, byte [eax - 4]
push ecx
push ecx
push eax
push ebx
call fcn.1002f4e9
pop eax
add ebx, eax
jmp 0x1000ad36
push 0x1000ad31
push ebx
call fcn.1002f616
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
jne 0x1000adf3
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x71]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x1000adf3
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x1000ad88
push 0
push dword [ebp - 4]
call fcn.10050ff6
jmp 0x1000ad8d
mov eax, 4
mov dword [ebp - 8], eax
inc eax
push eax
push 0
call fcn.1003d03c
or eax, eax
je 0x1000adf3
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.1005109e
push dword [ebp - 4]
call fcn.10050fb4
mov eax, dword [ebp - 0xc]
movzx edx, word [eax]
mov dword [0x1006b428], edx
movzx edx, word [eax + 2]
mov dword [0x1006b42c], edx
cmp dword [ebp + 0xc], 0
je 0x1000adea
push 0x10052326
call fcn.1003d00f
push dword [ebp - 0xc]
call fcn.1000ae94
lea eax, [ebp - 0xc]
push eax
call fcn.1003d00f
pop ebx
leave
ret 8

Function at 0x1000adf8
Capabilities:
Encode data using xor
Get common file path
Write file on windows

Disassembly:
sub esp, 0x918
xor eax, eax
jmp 0x1000ae08
mov cl, byte [eax + 0x1006a000]
xor cl, 0x55
mov byte [esp + eax + 0x118], cl
inc eax
cmp eax, 0x800
jl 0x1000ae08
push esi
lea edx, [esp + 0x18]
push edx
push 0x104
mov dword [esp + 0x10], 0x79736a
call fcn.10051038
push 0x1006b4aa
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.10051032
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x1006b4aa
call fcn.10050fc0
push 0
lea edx, [esp + 8]
push edx
mov esi, eax
push 0x800
lea eax, [esp + 0x128]
push eax
push esi
call fcn.100510ec
push esi
call fcn.10050fb4
pop esi
add esp, 0x918
ret