joyce8/EMBER2024-capa huggingface dataset:
Function at 0x538000
Capabilities:
Encode data using xor

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x53800c
pop ebx
sub ebx, 0x8d00c
push 0
pop ecx
push ebx
sub dword [ebx + 0x2dc], 0x5c7d551b
xor dword [ebx + 0x16c], 0x1f6e71d3
xor dword [ebx + 0x78], 0x48c038a0
add dword [ebx + 0x13c], 0x1dba3383
not dword [ebx + 0x1c4]
add dword [ebx + 0x8c], 0xf113dc0
xor dword [ebx + 0x2b4], 0x57292426
add dword [ebx + 0x90], 0x72815eba
add dword [ebx + 0xdc], 0x3f676a03
sub dword [ebx + 0xac], 0x2cf74d38
add dword [ebx + 0xe0], 0x6b69131d
add dword [ebx + 0x29c], 0x2c485d6c
xor dword [ebx + 0xf4], 0x608f0170
sub dword [ebx + 0xbc], 0x210a4531
xor dword [ebx + 0x30c], 0x594b469c
not dword [ebx + 0xa8]
add dword [ebx + 0x228], 0x44c32042
not dword [ebx + 0x28]
not dword [ebx + 0x168]
add dword [ebx + 0x44], 0x4a34433d
not dword [ebx + 0x290]
sub dword [ebx + 0x150], 0x23f9257e
xor dword [ebx + 0x25c], 0x75b06c62
sub dword [ebx + 0x200], 0x315606bb
add dword [ebx + 0x1dc], 0x544d5946
xor dword [ebx + 0x54], 0x48fb5edc
sub dword [ebx + 0x3c8], 0x4b566e4a
xor dword [ebx + 0x284], 0x59a63ad8
not dword [ebx + 0x3d4]
not dword [ebx + 0x12c]
not dword [ebx + 0x138]
add dword [ebx + 0x70], 0x61052e5c
add dword [ebx + 0x308], 0x6d9a177e
not dword [ebx + 0xb4]
not dword [ebx + 0x318]
not dword [ebx + 0x1b8]
add dword [ebx + 0xe8], 0x39d6514c
xor dword [ebx + 0xc0], 0x593a3e75
sub dword [ebx + 0x14], 0x34c7254a
xor dword [ebx + 0x144], 0x4b767c0f
xor dword [ebx + 0x2bc], 0xfe146f3
not dword [ebx + 0x1b4]
not dword [ebx + 0x18]
not dword [ebx + 0xec]
sub dword [ebx + 0x354], 0x511101c
xor dword [ebx + 0x1f4], 0x7c8b0113
add dword [ebx + 0x2e0], 0x4e59037f
xor dword [ebx + 0x204], 0xa74530b
not dword [ebx + 0x3f0]
not dword [ebx + 0x36c]
sub dword [ebx + 0xf0], 0x2e2716d5
add dword [ebx + 0x3a0], 0x7dcd5ad3
sub dword [ebx + 0x124], 0x45c12a3f
not dword [ebx + 0x3f8]
not dword [ebx + 0x7c]
add dword [ebx + 0x3bc], 0x4b5662fc
not dword [ebx + 0x38c]
add dword [ebx + 0x3b4], 0x4716e9b
sub dword [ebx + 0x268], 0x7b5e5ed3
xor dword [ebx + 0x64], 0x79ae5b82
xor dword [ebx + 0x68], 0x21a5808
xor dword [ebx + 0x1ac], 0x1b11c25
not dword [ebx + 0xe4]
xor dword [ebx + 0x238], 0x17d02532
not dword [ebx + 0x158]
not dword [ebx + 0x2d8]
xor dword [ebx + 0x384], 0x6b5c1d99
add dword [ebx + 0x4c], 0x7063f5f
add dword [ebx + 0x328], 0x35035334
xor dword [ebx + 0x114], 0x10564ac8
add dword [ebx + 0x1cc], 0x82f30d6
sub dword [ebx + 0x2a8], 0xa784eff
sub dword [ebx + 0x198], 0xe8654bf
add dword [ebx + 0x50], 0x63ca43fa
add dword [ebx + 0x194], 0x5a675ee3
sub dword [ebx + 0x3a4], 0x6a3c4d34
not dword [ebx + 0x60]
xor dword [ebx + 0x5c], 0xcb362ec
add dword [ebx + 0x3d8], 0x68ea7a5d
not dword [ebx + 0x244]
not dword [ebx + 0x378]
add dword [ebx + 0x154], 0x6cd729aa
add dword [ebx + 0x234], 0x6de47141
xor dword [ebx + 0xd0], 0x409c43f3
not dword [ebx + 0x2b8]
not dword [ebx + 0x14c]
not dword [ebx + 0x2d4]
xor dword [ebx + 0x270], 0x7f203390
xor dword [ebx + 0x210], 0x2ea761a0
sub dword [ebx + 0x2f4], 0x7aa66ab
xor dword [ebx + 0x98], 0x1baa4fc7
sub dword [ebx + 0x330], 0x3dad3c3a
xor dword [ebx + 0xc8], 0x3d13443
invalid
inc ebx
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.0040826a
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040826a
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40826a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x408279
pop dword [ebp - 0x2c]
mov eax, 0xb1de09a0
add eax, 0x4e6278d9
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3f6e9
push 0
mov eax, 0xb366f917
add eax, 0x4cdc8719
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x1ca0ef08
sub ecx, 0x1ca093fb
xor esi, esi
add esi, eax
mov edi, 0xfc29a39
sub edi, 0xf7dd439
add edi, dword [ebp - 0x2c]
mov edx, 0xafc15376
add edx, 0x9a8bc0a5
add dword [ebp - 0x24], 0xae6f914e
mov ebx, dword [edi]
xor dword [ebp - 0x20], ecx
sub ebx, edx
xor dword [ebp - 0x28], 0xfef0ec0e
mov dword [esi], ebx
xor dword [ebp - 0x14], edx
add esi, 0x8d66c54f
add esi, 0x72993ab5
add edi, 0x496c5917
sub edi, 0x496c5913
loop 0x4082da
add eax, 0xdd572152
sub eax, 0xdd55c24b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1000deb3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000df3b
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000deee
push 0x1e5f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x1000df39
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000df1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1000df39
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10033753
mov dword [eax], 0xff93
jmp 0x1000df11
jmp 0x1000df66
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push 0x11b
push 0
push 0x6249
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x1788
call fcn.10024251
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x100118cd
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100694f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10011a0d
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x101
mov dword [ebp - 0x24], 0x10007c78
cmp dword [ebp - 0x20], 0x360
jle 0x10011965
and dword [ebp - 0x18], 0
jmp 0x10011925
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x37b4
jge 0x10011965
and dword [ebp - 0x1c], 0
jmp 0x1001193b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x306
jge 0x10011963
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x10612a38
call fcn.100335a0
jmp 0x10011934
jmp 0x1001191e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x6c
jge 0x10011982
mov edx, dword [ebp - 0x24]
mov ecx, 0x10612a38
call fcn.1003504a
jmp 0x1001199e
or dword [ebp - 4], 0xffffffff
jmp 0x100119a8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10011a05
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x100119e6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x10011a03
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.10033753
mov dword [eax], 0xfffffff8
jmp 0x100119db
jmp 0x10011a0b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10011a38
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
push 0x1750
push 0
push 0x170
push dword [ebp - 0x40]
push 0x7e5c
push dword [ebp - 0x44]
call fcn.100250c4
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001be27
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001be7b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001be62
push 0
push 0x1900
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1001be79
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1001beb9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 0x2eec
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x6c50
push 0x3b81
push 0x6fe4
push 0x61e2
push 0
call fcn.10014637
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x10024f39
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10024fd7
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10024fb4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10024f95
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10024fb2
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10033753
mov dword [eax], 0x8bea1220
jmp 0x10024f8a
jmp 0x10024fd5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10024fd5
push 0
push 0x1900
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10024ff3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.1002f626
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100256d7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002573f
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10025712
push 0
push 0x1900
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1002573d
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002573d
push 0
push 0x1900
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10025753
push 0x4675
push 1
push 0x5f81
call fcn.1001ca6b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100272cc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10027344
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002732e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x1002732c
push 0
push 1
mov eax, dword [ebp - 8]
push dword [eax]
mov eax, dword [ebp - 0x20]
push dword [eax]
call fcn.10024d15
add esp, 0x10
jmp 0x10027342
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10027342
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1002737c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x1ce6
push 0x1c68
call fcn.10010b57
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x1004f489
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006a416
call fcn.10068fd8
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0x18], 0x2483
xor esi, esi
cmp dword [ebp - 0x18], 0x261c
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
jle 0x1004f4fa
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov eax, edi
mov dword [ebp - 0x1c], esi
cdq
idiv ebx
mov edi, edx
mov eax, edi
mov ecx, 0x10612a38
xor eax, esi
cdq
push edx
push eax
call fcn.100335a0
inc esi
cmp esi, 0x46c8
jl 0x1004f4c5
mov edi, dword [ebp - 0x14]
inc ebx
push 0
pop esi
cmp ebx, 0x1f6f
jl 0x1004f4bb
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x76d1
jl 0x1004f4b9
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x2150
jge 0x1004f515
mov edx, 0x1000c6d8
mov ecx, 0x10612a38
call fcn.1003504a
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x977
cmp dword [ebp - 0x1c], 0xc2a
jle 0x1004f585
mov edi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], 0x652b
mov ebx, esi
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.1000dd90
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004f555
mov eax, dword [eax]
push eax
call fcn.10053d16
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.10033a41
inc ebx
cmp ebx, 0x28ad
jl 0x1004f53a
dec edi
dec dword [ebp - 0x18]
jne 0x1004f538
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x39d8
jl 0x1004f52e
cmp dword [ebp - 0x1c], 0x638
jge 0x1004f599
push 0x1000c718
call fcn.10053d16
pop ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
cmp dword [eax + 4], esi
jne 0x1004f5b5
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [ebp + 0x1c]
cmp dword [eax], 0xffffffff
jg 0x1004f5b8
xor esi, esi
inc esi
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x20]
mov edi, dword [ebp + 0x28]
mov dword [ecx], esi
mov eax, dword [edx]
mov eax, dword [ecx]
mov ecx, dword [ebp + 0x24]
mov esi, dword [ebp + 0xc]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 0x5d1c
sete cl
mov dword [esi], ecx
xor ecx, ecx
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [edi]
sbb edx, edx
inc edx
cmp edx, eax
mov eax, dword [ebp + 8]
setl cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [esi]
cmp eax, 1
mov eax, dword [edi]
setne dl
sub edx, 0xacc0136e
neg edx
pop edi
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop esi
setge cl
xor eax, eax
cmp ecx, 3
mov ecx, dword [ebp - 0x28]
pop ebx
setne al
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100654a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10070750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10057648
mov dword [ebp - 0x14], eax
cmp dword [0x10613a9c], esi
jne 0x10065598
push 0x800
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10065525
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10065678
push esi
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10065678
push 0x10007528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10065678
push eax
call ebx
push 0x10007534
push edi
mov dword [0x10613a9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007544
push edi
mov dword [0x10613aa0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007558
push edi
mov dword [0x10613aa4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10613aac], eax
test eax, eax
je 0x10065595
push 0x10007574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10613aa8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100655bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100655b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100655d2
push 4
pop eax
jmp 0x1006567a
cmp dword [ebp - 0x14], esi
je 0x100655d2
push dword [0x10613a9c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100655b7
mov eax, dword [0x10613aa8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10065630
cmp dword [0x10613aac], edi
je 0x10065630
push eax
call ebx
push dword [0x10613aac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10065630
test eax, eax
je 0x10065630
call ecx
test eax, eax
je 0x10065625
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10065625
test byte [ebp - 8], 1
jne 0x10065630
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10065660
mov eax, dword [0x10613aa0]
cmp eax, edi
je 0x1006565d
push eax
call ebx
test eax, eax
je 0x1006565d
call eax
mov esi, eax
test esi, esi
je 0x1006565d
mov eax, dword [0x10613aa4]
cmp eax, edi
je 0x1006565d
push eax
call ebx
test eax, eax
je 0x1006565d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10613a9c]
call ebx
test eax, eax
je 0x10065678
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006567a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10054b5c
mov esp, ebp
pop ebp
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x406243
pop dword [ebp - 0x44]
mov eax, 0x406243
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xcbb0f1ec
sub dword [ebp - 0x54], 0x7d5eaca1
mov dword [ebp - 0x50], 0xa7420d00
sub dword [ebp - 0x50], 0x750ec0bb
mov dword [ebp - 0x4c], 0x850891af
add dword [ebp - 0x4c], 0xc743b27f
mov dword [ebp - 0x48], 0x88eceaf2
add dword [ebp - 0x48], 0x7713150e
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x93e90860
add dword [ebp - 0x54], 0xe08960f6
mov dword [ebp - 0x50], 0xd64cf832
add dword [ebp - 0x50], 0x6b1f6943
mov dword [ebp - 0x4c], 0xcc317be4
sub dword [ebp - 0x4c], 0x68c20f78
mov dword [ebp - 0x48], 0xc9043bc3
add dword [ebp - 0x48], 0x36fbc43d
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xb1601805
add eax, 0x4ee068fb
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37507
push 0
call eax
mov ecx, 0x492a
mov edi, eax
mov ebx, 0xceafb2b7
sub ebx, 0xce68ceb7
add ebx, dword [ebp - 0x44]
mov esi, 0x3319e23
add esi, 0xf2e2dbd7
add dword [ebp - 0x34], 0x75df1cd0
mov edx, dword [ebx]
add edx, esi
xor dword [ebp - 0x2c], 0x9ccbdf9b
mov dword [edi], edx
add dword [ebp - 0x30], edx
add edi, 0x1258ef9d
sub edi, 0x1258ef99
add ebx, 0x3e380e03
sub ebx, 0x3e380dff
loop 0x406355
add eax, 0x69eb3a42
sub eax, 0x69ea22c7
xor ebx, ebx
add ebx, eax
add eax, 0xde072310
sub eax, 0xde07230b
mov ecx, 0xe3f617c4
sub ecx, 0xe3b617c4
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc