joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bf330
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x100cd680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [0x10144f74]
imul eax, dword [0x10144f78]
xor eax, 0x1bae1844
xor eax, 0xb37b0436
xor eax, 0x692c8610
xor eax, 0x7692e874
and eax, 0x3c0d38d5
mov ecx, 0x7e9c6468
xor edx, edx
div ecx
add eax, 0xf28252a
add eax, 0x7ddb591f
mov ecx, 0xc084a5cd
xor edx, edx
div ecx
imul eax, eax, 0xd74e18d9
and eax, 0x474661d0
xor eax, 0xad5efaf8
mov ecx, 0x1c996017
xor edx, edx
div ecx
xor eax, 0x309c9b34
or eax, 0x331da836
and eax, 0x86252370
and eax, 0x8d2a3640
mov ecx, 0x3247e144
xor edx, edx
div ecx
or eax, 0x406ab2d2
sub eax, 0x14c105ef
cmp eax, 0xf80b887d
ja 0x100cd79f
mov eax, dword [0x10144f7c]
mov ecx, dword [0x10144f80]
and eax, ecx
add eax, 0x58256093
xor eax, 0xe071ffc
imul eax, eax, 0x87bb99d4
add eax, 0x3c668d81
xor eax, 0x1840104
or eax, 0x39000
and eax, 0x1ba7910d
imul eax, eax, 0x802c7571
add eax, 0x9279e7de
xor eax, 0x2424025
and eax, 0x264340a5
imul eax, eax, 0xa9efe937
xor eax, 0x9aa69cca
mov ecx, 0x921dc369
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 0x1e
imul eax, eax, 0xddb914bf
and eax, 0x12aa931
push eax
mov ecx, esp
mov dword [ecx], edx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 8], ecx
cmp eax, 0xc291be1f
ja 0x100cd715
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push eax
mov eax, esp
mov dword [eax], ecx
jmp 0x100cd715
Function at 0x100d02a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [0x101451f4]
or eax, dword [0x101451f8]
and eax, 0xd714de9b
and eax, 0xdb0352b6
sub eax, 0xaf7e9077
sub eax, 0xaced6dd3
or eax, 0x26f05671
and eax, 0x9ad477
imul eax, eax, 0x2a7a9b6e
sub eax, 0xdac519ff
sub eax, 0x787246ed
mov ecx, 0x8dc9707e
xor edx, edx
div ecx
and eax, 0x95299e61
and eax, 0x76e9bad2
xor eax, 0xa853b30a
and eax, 0x1648fe42
xor eax, 0x4955ac12
and eax, 0x4550c11a
sub eax, 0xfa514f48
xor eax, 0x94d7901f
or eax, 0xf9b4754
sub eax, 0x84264ed6
cmp eax, 0x1e816999
je 0x100d0465
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ebp - 8], eax
push eax
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [eax]
call fcn.100cea00
mov eax, dword [ebp - 8]
cmp eax, 0x8d852dc1
je 0x100d0465
mov eax, dword [0x10145204]
imul eax, dword [0x10145208]
mov ecx, 0xed11d4b6
xor edx, edx
div ecx
sub eax, 0xa1e5a9ee
sub eax, 0x8acd2bbb
sub eax, 0xc8a43c08
mov ecx, 0xbb8aa93c
xor edx, edx
div ecx
or eax, 0x83167d36
and eax, 0xb0177a7e
add eax, 0x9e51b314
mov ecx, 0x381275c9
xor edx, edx
div ecx
imul eax, eax, 0x37619e30
imul eax, eax, 0x5f9321d1
or eax, 0x759e494e
sub eax, 0x5de246d7
imul eax, eax, 0x46cc05ff
add eax, 0x4f821a7d
xor eax, 0x52f21d96
and eax, 0xb5e98147
sub eax, 0xfbc9e3ad
imul eax, eax, 0xe869dbf4
imul eax, eax, 0xa25255de
cmp eax, 0xa8fa9c3
jb 0x100d050e
mov eax, dword [str.8_br_]
imul eax, dword [0x10145210]
mov ecx, 0x561320c5
xor edx, edx
div ecx
sub eax, 0xa14c54cc
sub eax, 0x4410b9c2
add eax, 0x78929ac2
imul eax, eax, 0x666e02b6
and eax, 0x8da5b3d4
sub eax, 0x774fac92
xor eax, 0x733fef1b
add eax, 0x45eff96c
add eax, 0xec68e4bc
imul eax, eax, 0x93f83314
xor eax, 0x66f16bd7
and eax, 0x1aebe14f
imul eax, eax, 0x1d798f1a
mov ecx, 0xcb348577
xor edx, edx
div ecx
mov ecx, 0x5193e14d
xor edx, edx
div ecx
imul eax, eax, 0x804f2b3f
or eax, 0x4e529dcb
and eax, 0x90a588d3
add eax, 0x6a0bf98f
cmp eax, 0x89629c72
ja 0x100d03d6
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10145214]
add eax, dword [0x10145218]
sub eax, 0xc1d7e5a2
add eax, 0x657cfe31
or eax, 0x977252d
mov ecx, 0xd4ee1329
xor edx, edx
div ecx
xor eax, 0xf708bfcb
and eax, 0xd0b695d7
xor eax, 0x37b79cc2
or eax, 0xf3319b51
sub eax, 0xcd48a40c
and eax, 0xb269f4a9
imul eax, eax, 0x9b9578dd
add eax, 0x90e28a1c
xor eax, 0x52e2bd30
or eax, 0xf424ddad
xor eax, 0x3b1f8e71
or eax, 0x294a62a8
xor eax, 0x2ea7d340
and eax, 0xbbe5991c
and eax, 0xf2384c1f
xor eax, 0x5f96cad5
cmp eax, 0xc6d91911
jb 0x100d0513
mov ecx, dword [ebp - 4]
mov eax, 0x44a16f2
mov dword [ebp - 0xc], eax
push eax
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [eax]
call fcn.100cea00
mov eax, dword [ebp - 0xc]
cmp eax, 0x8f9f0d19
jae 0x100d04e4
jmp 0x100d0328
jmp 0x100d03d6
mov ecx, dword [ebp - 4]
push eax
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [eax]
call fcn.100cea00
jmp 0x100d04e4
Function at 0x100e2bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [0x10146194]
imul eax, dword [0x10146198]
sub eax, 0xd2399700
xor eax, 0x2d15ca22
imul eax, eax, 0x420abd1e
imul eax, eax, 0x5ba992ef
mov ecx, 0x8f67bc89
xor edx, edx
div ecx
imul eax, eax, 0x37111e7a
xor eax, 0xa89cde55
mov ecx, 0x6a8eec3a
xor edx, edx
div ecx
sub eax, 0x13be6611
imul eax, eax, 0xecae6e8
mov ecx, 0xd71494bb
xor edx, edx
div ecx
and eax, 0x5982c875
or eax, 0x4d6ade01
xor eax, 0x87da1163
mov ecx, 0xc614c853
xor edx, edx
div ecx
or eax, 0x5bb2cc8a
imul eax, eax, 0x771bbc89
and eax, 0x5c17f692
or eax, 0x75b77287
imul eax, eax, 0xb6830c05
cmp eax, 0xfb9f1410
je 0x100e2cd6
mov eax, dword [0x1014619c]
mov ecx, dword [0x101461a0]
sub eax, ecx
imul eax, eax, 0xbba17b9d
xor eax, 0x7c4af0d4
mov ecx, 0x99219eb1
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 0x1e
imul eax, eax, 0xb107cfd9
add eax, 0xf4cac3e5
xor eax, 0x4164896
add eax, 0xe259d02b
and eax, 0x40c2500
add eax, 0xae98496b
or eax, 0x2a4353f
add eax, 0xea81e322
and eax, 0x5100001
imul eax, eax, 0x5b4e32a7
add eax, 0xb74c3110
or eax, 0x2e4a6b43
push eax
mov ecx, esp
mov dword [ecx], edx
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
mov ecx, dword [ecx + 4]
mov dword [ebp - 8], ecx
cmp eax, 0x28d90af4
je 0x100e2c4a
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push eax
mov eax, esp
mov dword [eax], ecx
jmp 0x100e2c4a

Function at 0x10101a51
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10101a90
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10101a90
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10101a90
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10101a90
cmp dword [ecx + 0x74], 0xe
jbe 0x10101a90
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1010c790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1010c7bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1010c7bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1010ccc9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101319c8
push 0x101319c0
push 0x101319c8
push 0x1f
call fcn.1010d6ea
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010ccfd
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1010cd03
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1010cd47
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101319ec
push 0x101319e4
push 0x101319ec
push 0x21
call fcn.1010d6ea
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010cd7e
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1010cd86
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10131a00
push 0x101319f8
push 0x10131a00
push 0x22
call fcn.1010d6ea
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1010cdc0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1011593d
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x10146298]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x10115988
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.10115c2f
test al, al
jne 0x10115982
sub edx, 2
cmp edx, edi
jne 0x10115968
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x101159aa
lea eax, [edi + 2]
cmp edx, eax
je 0x101159aa
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.10115889
add esp, 0x10
jmp 0x10115aa4
push esi
lea ecx, [ebp - 0x255]
call fcn.10115c2f
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x101159ed
push dword [ebp - 0x25c]
jmp 0x1011599a
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x10115a2a
cmp word [ebp - 0x226], 0
je 0x10115a4b
cmp word [ebp - 0x226], ax
jne 0x10115a2a
cmp word [ebp - 0x224], 0
je 0x10115a4b
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.10115889
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x10115a97
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x10115a04
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x10115a7f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x10115aa4
push 0x10115c6d
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.10124ff0
add esp, 0x10
jmp 0x10115a74
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e332f
leave
ret
Function at 0x1011655d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x101165fa
push ebx
push esi
call fcn.10116660
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10116461
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x101165a7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101165f9
push edi
push eax
call fcn.101107c9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x101165c7
call fcn.1010f5f1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101165f8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10116461
add esp, 0x20
test eax, eax
jne 0x101165e6
push edi
call fcn.1010f5f1
jmp 0x101165ee
push ebx
call fcn.1010f5f1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x101165fd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1011660e
pop esi
ret
push ebx
push edi
push esi
call fcn.10116660
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.101107c9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10116636
push ebx
push esi
push edi
call fcn.100e61f0
add esp, 0xc
push 0
call fcn.1010f5f1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10116707
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10116996
Function at 0x101218eb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10146298]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1010de29
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1010de29
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10121962
cmp word [ecx], dx
je 0x10121962
mov eax, dword [0x1013580c]
push edi
dec eax
push eax
push 0x101356f8
call fcn.10121adb
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x101219d5
cmp word [eax], dx
je 0x101219d5
mov eax, dword [edi]
test eax, eax
je 0x10121986
cmp word [eax], dx
je 0x10121986
lea eax, [ebp - 0x10]
push eax
call fcn.10121b3c
jmp 0x1012198f
lea eax, [ebp - 0x10]
push eax
call fcn.10121e2a
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x101219ff
mov eax, dword [0x101356f4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x101353e8
call fcn.10121adb
add esp, 0xc
test al, al
je 0x101219ff
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x101219ca
cmp word [eax], di
je 0x101219ca
lea eax, [ebp - 0x10]
push eax
call fcn.10121b3c
pop ecx
jmp 0x10121a01
lea eax, [ebp - 0x10]
push eax
call fcn.10121e2a
jmp 0x101219c7
mov eax, dword [edi]
test eax, eax
je 0x101219ec
cmp word [eax], dx
je 0x101219ec
lea eax, [ebp - 0x10]
push eax
call fcn.10121f5e
pop ecx
jmp 0x101219ff
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10121aca
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1012206e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10121aca
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10121aca
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10121aca
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10121a57
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1010d0b4
test ebx, ebx
je 0x10121ac5
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1010d0b4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10121aca
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10121aca
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10128fe4
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10121acc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e332f
leave
ret
Function at 0x10122174
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1010de29
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x101221e3
cmp esi, dword [ebp - 4]
je 0x101221de
cmp dword [ebp + 0xc], 0
je 0x101221de
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x101221bb
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1012223d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x101221e5
xor eax, eax
inc eax
jmp 0x101221e5
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10126dd6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10147aa8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10126e16
cmp byte [ebx], 0xa
jne 0x10126e16
or byte [edi + eax + 0x28], 4
jmp 0x10126e1b
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10126f1a
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10126efd
inc eax
cmp dl, 0xd
je 0x10126e47
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10126e6d
cmp eax, ecx
jae 0x10126e7b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10126e2f
jmp 0x10126f1a
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10126ef8
cmp dword [ebp - 0x10], 0
je 0x10126ef8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10147aa8]
test byte [eax + edi + 0x28], 0x48
je 0x10126ed2
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10126ebd
mov byte [esi], dl
jmp 0x10126ece
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10147aa8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10126f1a
cmp byte [ebp - 1], 0xa
jne 0x10126ee1
cmp esi, ebx
jne 0x10126ee1
mov byte [esi], 0xa
jmp 0x10126f19
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10126106
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10126f1a
mov byte [esi], 0xd
jmp 0x10126f19
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10147aa8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10126f17
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10126f1a
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10126f23
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10147aa8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10126f69
cmp word [ebx], dx
jne 0x10126f69
or byte [eax + edi + 0x28], 4
jmp 0x10126f6e
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x101270d1
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x101270b1
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10126faf
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10126fe5
cmp eax, edx
jae 0x10126ff3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10126f8a
jmp 0x101270d1
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101270ac
cmp dword [ebp - 0x18], 0
je 0x101270ac
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10147aa8]
test byte [eax + edi + 0x28], 0x48
je 0x10127082
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10127046
mov word [esi], cx
jmp 0x1012707d
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10147aa8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10147aa8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10147aa8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x101270d1
pop eax
cmp word [ebp - 4], ax
jne 0x10127092
cmp esi, ebx
jne 0x10127092
mov word [esi], ax
jmp 0x101270ce
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10126106
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x101270d1
push 0xd
pop eax
jmp 0x1012708d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10147aa8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x101270cb
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x101270d1
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x10129f94
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1012a01c
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x304c3725
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x50260c24
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219