joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455e84
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45602f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x456010
mov dl, 1
mov eax, dword [0x4120cc]
call fcn.004035c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404364
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x455fff
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004435d4
test al, al
je 0x455ff2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x456040
lea eax, [ebp - 0x254]
call fcn.00409488
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x455ff2
xor eax, eax
push ebp
push 0x455feb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x456078
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x455fd4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004045cc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x455fd4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004045cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455ff2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x455ef5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041622c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456036
lea eax, [ebp - 0x260]
call fcn.00404364
ret

Function at 0x456964
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x463c28]
cmp byte [eax + 0xa5], 0
jne 0x4569d5
cmp dword [0x463c40], 0
jne 0x456996
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x456920
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x463c40], eax
cmp dword [0x463c3c], 0
jne 0x4569b1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x463c3c], eax
cmp dword [0x463c44], 0
jne 0x4569d5
push esp
push 0
push 0
push 0x4568c4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x463c44], eax
pop edx
ret
Function at 0x456acc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x456ae3
add esp, 0xfffffff0
call fcn.0040395c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041bb94
mov eax, dword [0x461f80]
cmp word [eax + 2], 0
jne 0x456b0b
mov eax, dword [0x461f80]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458100
mov eax, dword [0x46200c]
cmp word [eax + 2], 0
jne 0x456b25
mov eax, dword [0x46200c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004582f8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411bdc]
call fcn.004035c8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411bdc]
call fcn.004035c8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41e054]
call fcn.00425a18
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x456cac
mov eax, dword [0x461eb4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00425de8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x458868
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x461eb4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ae08
test eax, eax
je 0x456c1a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408de4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ae30
test eax, eax
je 0x456c2e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.004045cc
mov eax, dword [0x461db0]
cmp byte [eax], 0
jne 0x456c62
mov eax, ebx
call fcn.00456dd4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00458a44
mov eax, ebx
call fcn.00459384
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x456ca2
call fcn.004039b4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457048
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x463c28]
cmp dword [eax + 0x30], 0
je 0x4570f2
cmp dword [ebx + 0x94], 0
jne 0x4570ec
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x456fd8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4570ec
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4570b2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4570ec
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041427c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4570c1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457bd0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x457c05
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404454
jmp 0x457c12
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004043b8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x458c20
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x458c61
mov eax, esi
call fcn.0043ecc8
test al, al
je 0x458c61
mov eax, dword [ebx + 0x84]
call fcn.0043e9c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x458c61
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e9c4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45fc24
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404804
mov eax, dword [ebp - 8]
call fcn.00404804
xor eax, eax
push ebp
push 0x45fccd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, 0x45fce4
mov edx, dword [ebp - 4]
call fcn.00404668
lea eax, [ebp - 0x10]
mov ecx, 0x45fce4
mov edx, dword [ebp - 8]
call fcn.00404668
mov eax, dword [0x461ff8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], 2
lea eax, [ebp - 0xc]
call fcn.0040486c
mov dword [ebp - 0x26], eax
lea eax, [ebp - 0x10]
call fcn.0040486c
mov dword [ebp - 0x22], eax
mov word [ebp - 0x1e], 0x50
lea eax, [ebp - 0x2e]
push eax
call sub.shell32.dll_SHFileOperationA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fcd4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404388
ret
Function at 0x50a5d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb2000]
mov dword [edi + 0xe3228], 0x13365003
push edi
or ebp, 0xffffffff
jmp 0x50a5fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50a601
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50a5f0
mov eax, 1
add ebx, ebx
jne 0x50a613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50a624
jne 0x50a643
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50a643
dec eax
add ebx, ebx
jne 0x50a630
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50a608
add ebx, ebx
jne 0x50a63f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x50a695
xor ecx, ecx
sub eax, 3
jb 0x50a65b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50a6ca
sar eax, 1
mov ebp, eax
jmp 0x50a666
add ebx, ebx
jne 0x50a666
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50a634
inc ecx
add ebx, ebx
jne 0x50a674
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50a634
add ebx, ebx
jne 0x50a681
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50a676
jne 0x50a692
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50a676
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50a6b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50a6a6
jmp 0x50a5f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50a6b4
add edi, ecx
jmp 0x50a5f6
pop esi
mov edi, esi
mov ecx, 0x486c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50a6d2
cmp byte [edi], 0x1f
jne 0x50a6d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50a6d7
lea edi, [esi + 0x107000]
mov eax, dword [edi]
or eax, eax
je 0x50a74f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10ea28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10eb18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50a704
mov ecx, edi
jns 0x50a733
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10eb1c]
or eax, eax
je 0x50a749
mov dword [ebx], eax
add ebx, 4
jmp 0x50a721
call dword [esi + 0x10eb2c]
mov ebp, dword [esi + 0x10eb20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50a783
sub esp, 0xffffff80
jmp 0x4013c0
Function at 0x10007dd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f1960
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10244c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 0
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
mov edx, dword [esi + 0x24]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 1
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 8
test ecx, ecx
je 0x10007e48
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x10007e59
push 0x40
push esi
call fcn.100ef2b4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10008450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f1920
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10244c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 0
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x100084b4
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x100084c5
push 0x48
push esi
call fcn.100ef2b4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b670
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1000b692
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x48]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x1000b680
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret
Function at 0x1001b0c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1001b0fd
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0
push 0x1001be20
push 0
push 0
mov dword [0x10247ba4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edi
push 0x1001a670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov eax, 1
pop ebp
ret 0xc

Function at 0x1001b110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x100ffc7d], 0
movq xmm0, qword [0x100ffc74]
mov ax, word [0x100ffc7c]
push esi
mov esi, ecx
movq qword [ebp - 0xc], xmm0
mov word [ebp - 4], ax
je 0x1001b16a
push ebx
xor ebx, ebx
nop dword [eax]
mov eax, 0x29e4129f
mov cl, bl
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul eax, eax, 0x37
sub cl, al
add cl, 0x37
xor byte [ebp + ebx - 0xc], cl
inc ebx
cmp ebx, 0xa
jl 0x1001b140
pop ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
test edx, edx
je 0x1001b195
xor al, al
movsx ecx, al
cmp byte [ecx + edx], 0xb8
je 0x1001b1a8
inc al
cmp al, 0xf
jl 0x1001b186
xor eax, eax
mov ecx, esi
push eax
call fcn.1001b1c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx + edx + 1]
mov ecx, esi
push eax
call fcn.1001b1c0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b1c0
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, dword [ebx + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1001b3f4
movups xmm0, xmmword [str._WN_f]
mov dword [ebp - 0x30], 0xb8909090
mov byte [ebp - 0x28], 0xba
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x23], 0xd2ff
psrldq xmm0, 0xf
movd eax, xmm0
mov byte [ebp - 0x21], 0xc3
test al, al
je 0x1001b36c
xor ecx, ecx
cmp dword [0x1024a180], 2
mov dword [ebp - 4], ecx
jl 0x1001b340
movaps xmm0, xmmword [0x100ffd10]
movaps xmm4, xmmword [0x100ffcd0]
movaps xmm3, xmmword [0x100ffd00]
movaps xmm5, xmmword [0x100ffce0]
movups xmm6, xmmword [0x100ffcf0]
movaps xmmword [ebp - 0x20], xmm0
mov edx, dword [ebp - 0x20]
nop word [eax + eax]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x40]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + ecx - 0x40], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + ecx - 0x3c]
xorps xmm2, xmm0
movd dword [ebp + ecx - 0x3c], xmm2
add ecx, 8
cmp ecx, 0x10
jl 0x1001b260
jmp 0x1001b36c
mov eax, 0x94f2095
imul ecx
mov al, 1
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub al, cl
mov ecx, dword [ebp - 4]
movsx eax, al
imul eax, eax, 0x37
add al, cl
xor byte [ebp + ecx - 0x40], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x10
jl 0x1001b340
cmp byte [0x100ffc89], 0
movq xmm0, qword [str.YL_VW]
mov ax, word [0x100ffc88]
movq qword [ebp - 0x1c], xmm0
mov word [ebp - 0x14], ax
je 0x1001b3b9
xor ecx, ecx
nop
mov eax, 0x29e4129f
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov dl, cl
shr eax, 5
movsx eax, al
imul eax, eax, 0x37
sub dl, al
add dl, 0x37
xor byte [ebp + ecx - 0x1c], dl
inc ecx
cmp ecx, 0xa
jl 0x1001b390
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
push 0x3000
push 0x10
mov eax, dword [eax]
push 0
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi], eax
test eax, eax
je 0x1001b3f4
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x1001c3a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test ecx, ecx
jg 0x1001c3ca
jl 0x1001c3be
test eax, eax
jne 0x1001c3ca
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1001c3e3
push ecx
push eax
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov ecx, ebx
mov edi, eax
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov ecx, eax
test ecx, ecx
je 0x1001c428
mov esi, dword [ebp + 0xc]
cmp ecx, esi
cmovb esi, ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
mov edi, dword [ebp - 4]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add edi, esi
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, ebx
mov edi, dword [ebp + 0xc]
sub edi, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov esi, dword [ebp - 4]
cmp dword [ebx + 0x4c], 0
je 0x1001c498
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x1001c44d
push dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
mov ecx, ebx
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x1001c486
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1001c498
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1001c460
test ecx, ecx
je 0x1001c498
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001c4b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1001c4d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x1001c540
jg 0x1001c4fb
test esi, esi
je 0x1001c540
test ecx, ecx
jl 0x1001c57a
jg 0x1001c505
test eax, eax
je 0x1001c57a
cmp edi, ecx
jg 0x1001c515
jl 0x1001c50f
cmp esi, eax
jae 0x1001c515
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x1001c567
jg 0x1001c54d
test esi, esi
je 0x1001c567
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x1001c567
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x1001c54d
Function at 0x1001ca60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp byte [esi + 0x15], 0
je 0x1001cb42
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x100ffcf0]
movaps xmm1, xmmword [0x10217240]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x10217250]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x10217260]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x10217270]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 5]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x1001cb30
mov byte [esi + 0x15], 0
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.100088e0
add esp, 8
mov eax, esi
pop esi
pop ebp
ret