joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ab60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x2f], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0x6b6a6dbc
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x12
ja 0x43abd5
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
add al, 0x32
xor al, byte [esp + ecx + 0x20]
add al, 0xa2
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x20], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x13
jb 0x43abb0
mov eax, dword [esp + 0x20]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
mov ecx, dword [ecx*4 + 0x448620]
mov edx, 0xd888eca2
xor edx, dword [0x448628]
add ecx, edx
inc ecx
jmp ecx

Function at 0x43ad20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov byte [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x7b787956
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x1c
ja 0x43adc2
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
movzx edx, byte [esp + edx + 0x10]
lea esi, [eax + edx]
add esi, 0xf08e2eef
add eax, 0xf08e2eef
and eax, edx
add eax, eax
mov edx, eax
xor edx, esi
not eax
and eax, esi
add eax, eax
sub eax, edx
add al, 0x77
mov edx, dword [esp + 0xc]
mov byte [esp + edx + 0x10], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x1d
jb 0x43ad80
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor edx, edx
cmp dword [ebp + 8], 0
sete dl
mov edx, dword [edx*4 + 0x448790]
mov esi, 0x2ffd3358
xor esi, dword [0x448798]
add edx, esi
inc edx
jmp edx

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5eb35c41
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
mov ecx, 0x6e6031cd
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001150
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
or eax, 0xffffffff
xor esi, esi
test edi, edi
je 0x1000117e
push ebx
mov ebx, dword [ebp + 8]
movzx edx, byte [esi + ebx]
inc esi
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + section..data]
cmp esi, edi
jb 0x10001165
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x10001190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
xor esi, esi
test edi, edi
je 0x100011c0
push ebx
mov ebx, dword [ebp + 8]
mov edx, eax
lea ecx, [eax + eax]
shl edx, 8
cmp esi, 4
cmovae edx, ecx
movzx ecx, byte [esi + ebx]
xor edx, ecx
inc esi
xor eax, edx
cmp esi, edi
jb 0x100011a4
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x10002760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x10172044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x168], edi
test ecx, ecx
je 0x10002925
push 0x40
lea eax, [ebp - 0x6c]
mov dword [edi], ecx
push eax
push 0
call fcn.100043c0
mov ecx, dword [ebp - 0x30]
mov eax, 0x5a4d
mov dword [edi + 0xc], ecx
cmp word [ebp - 0x6c], ax
je 0x100027b3
mov eax, dword [edi]
cmp ecx, dword [eax + 0x56]
ja 0x10002925
push 0xf8
lea eax, [ebp - 0x164]
push eax
push ecx
mov ecx, dword [edi]
call fcn.100043c0
cmp dword [ebp - 0x164], 0x4550
jne 0x10002925
mov ax, word [ebp - 0x14c]
mov edx, 0x10b
movzx ecx, word [ebp - 0x15e]
mov dword [edi + 8], ecx
cmp ax, dx
jne 0x100027fb
mov dword [edi + 4], 1
jmp 0x1000280c
mov edx, 0x20b
cmp ax, dx
jne 0x1000280c
mov dword [edi + 4], 2
mov eax, dword [ebp - 0xcc]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0xc8]
mov dword [edi + 0x20], eax
cmp ecx, 0x100
ja 0x10002925
lea eax, [ecx + ecx*4]
mov ecx, dword [edi]
shl eax, 3
push eax
call fcn.10001100
mov esi, eax
mov dword [ebp - 0x170], esi
test esi, esi
je 0x10002925
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0xc]
push ebx
lea ecx, [ecx + ecx*4]
shl ecx, 3
push ecx
movzx ecx, word [ebp - 0x150]
add ecx, 0x18
add eax, ecx
mov ecx, dword [edi]
push esi
push eax
call fcn.100043c0
mov eax, dword [edi + 8]
mov ecx, 1
mov dword [ebp - 0x16c], ecx
cmp eax, ecx
jbe 0x100028f3
nop dword [eax]
lea ebx, [eax - 1]
cmp ebx, ecx
jb 0x100028e8
lea eax, [ebx + ebx*4]
sub ebx, ecx
lea esi, [esi + eax*8]
add esi, 0xffffffd8
inc ebx
mov eax, dword [esi + 0x3c]
cmp eax, dword [esi + 0x14]
jae 0x100028d1
mov ecx, dword [ebp - 0x168]
lea edi, [esi + 0x28]
push 0x28
push edi
lea eax, [ebp - 0x2c]
mov ecx, dword [ecx]
push eax
call fcn.10004c40
push 0x28
push esi
push edi
mov edi, dword [ebp - 0x168]
mov ecx, dword [edi]
call fcn.10004c40
mov ecx, dword [edi]
lea eax, [ebp - 0x2c]
push 0x28
push eax
push esi
call fcn.10004c40
sub esi, 0x28
sub ebx, 1
jne 0x10002893
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0x16c]
mov esi, dword [ebp - 0x170]
inc ecx
mov dword [ebp - 0x16c], ecx
cmp ecx, eax
jb 0x10002880
mov ebx, dword [edi]
lea eax, [eax + eax*4]
lea esi, [esi + eax*8]
mov eax, dword [esi - 0x14]
add eax, dword [esi - 0x18]
mov edx, dword [ebx + 0x56]
sub edx, dword [edi + 0x20]
cmp edx, eax
jbe 0x10002917
mov dword [edi + 0x14], eax
sub edx, dword [esi - 0x18]
sub edx, dword [esi - 0x14]
mov dword [edi + 0x18], edx
push dword [ebp - 0x170]
mov ecx, ebx
call fcn.100010e0
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100ad43d
mov esp, ebp
pop ebp
ret 4
Function at 0x10004530
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
movsx eax, byte [ebx + 0x10]
push esi
movzx esi, word [ebx + 0x14]
push edi
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
push esi
push dword [ebx + 0xc]
pshufd xmm0, xmm0, 0
mov dword [ebp - 4], ecx
movaps xmmword [ebp - 0x20], xmm0
call fcn.10003bf0
test al, al
je 0x10004643
mov edi, dword [ebx + 8]
mov ecx, dword [ebp - 4]
push esi
push edi
call fcn.10003bf0
test al, al
je 0x10004643
xor edx, edx
test esi, esi
je 0x10004622
mov ecx, dword [ebx + 0xc]
cmp esi, 0x40
jb 0x10004625
lea eax, [edi - 1]
add eax, esi
cmp ecx, eax
ja 0x100045b9
lea eax, [ecx - 1]
add eax, esi
cmp eax, edi
jae 0x10004625
movaps xmm1, xmmword [ebp - 0x20]
lea ecx, [edi + 0x30]
mov eax, esi
mov esi, edi
and eax, 0xffffffc0
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0xc]
add eax, 0x10
sub esi, dword [ebx + 0xc]
mov dword [ebp - 4], esi
movzx esi, word [ebx + 0x14]
mov edi, dword [ebp - 4]
nop dword [eax]
movups xmm0, xmmword [ecx - 0x30]
add edx, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [edi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edx, dword [ebp - 8]
jl 0x100045e0
mov edi, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
cmp edx, esi
jge 0x10004643
sub edi, dword [ebx + 0xc]
add ecx, edx
sub esi, edx
mov dl, byte [ebx + 0x10]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x10004633
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10

Function at 0x10004650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
movzx ebx, word [ebp + 0x14]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.10003bf0
test al, al
je 0x100046a1
mov ecx, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.10003bf0
test al, al
je 0x100046a0
test ebx, ebx
je 0x100046a0
mov edx, dword [ebp + 0x10]
lea ecx, [ebx - 1]
shr ecx, 2
sub edi, esi
inc ecx
nop
mov eax, dword [edi + esi]
lea esi, [esi + 4]
xor eax, edx
mov dword [esi - 4], eax
sub ecx, 1
jne 0x10004690
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100046d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
movzx ebx, word [ebp + 0x14]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.10003bf0
test al, al
je 0x10004724
mov ecx, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.10003bf0
test al, al
je 0x10004723
test ebx, ebx
je 0x10004723
mov dx, word [ebp + 0x10]
lea ecx, [ebx - 1]
shr ecx, 1
sub edi, esi
inc ecx
nop
mov ax, word [edi + esi]
lea esi, [esi + 2]
xor ax, dx
mov word [esi - 2], ax
sub ecx, 1
jne 0x10004710
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100222c0
Capabilities:
Parse pe header
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ecx + 0x775f]
movzx eax, word [esi + 0x1a]
cmp eax, 1
jne 0x1002251f
cmp dword [esi + 0x56], 0x10000
ja 0x10022566
mov eax, dword [esi + 0xa7a]
mov ecx, eax
shr ecx, 8
movzx edx, ax
cmp eax, 0x38464947
je 0x10022566
mov ebx, 0xd8ff
cmp dx, bx
je 0x10022566
mov ebx, 0x4d42
cmp dx, bx
je 0x10022566
cmp eax, 0x46464952
je 0x10022566
cmp eax, 0x10000
jne 0x1002233f
mov ebx, 0x1010
cmp word [esi + 0xa80], bx
je 0x10022566
cmp eax, 0x100
jne 0x1002235c
cmp byte [esi + 0xa7e], 0
jne 0x1002235c
cmp byte [esi + 0xa7f], 0x20
jbe 0x10022566
mov ebx, 0x5f3f
cmp dx, bx
je 0x10022566
cmp eax, 0x46445025
je 0x10022566
cmp eax, 0x46535449
je 0x10022566
cmp eax, 0x4643534d
je 0x10022566
cmp eax, 0x5446534d
je 0x10022566
cmp eax, 0x7263694d
je 0x10022566
cmp eax, 0x5243494d
je 0x10022566
cmp eax, 0x6f006e
je 0x10022566
cmp eax, 0x20101
je 0x10022566
cmp eax, 0x4034b50
je 0x10022566
cmp al, 0xff
jne 0x100223e5
mov al, cl
and al, 0xe0
cmp al, 0xe0
jne 0x100223e5
and cl, 6
cmp cl, 2
je 0x10022566
mov eax, dword [esi + 0x4a7a]
movzx ecx, ax
cmp eax, 0xf0f0f0f
je 0x10022566
test eax, eax
jne 0x10022405
cmp dword [esi + 0x4a7e], eax
jmp 0x10022408
cmp eax, 0x4c
je 0x10022566
mov edx, 0xbbef
cmp cx, dx
je 0x10022566
mov edx, 0xfeff
cmp cx, dx
je 0x10022566
mov edx, 0xcfd0
cmp cx, dx
je 0x10022566
mov edx, 0xa0d
cmp cx, dx
je 0x10022566
cmp eax, 0x4c4f5449
je 0x10022566
cmp dword [esi + 0x56], 0x10
jb 0x10022566
xor ecx, ecx
xor edx, edx
nop
mov al, byte [ecx + esi + 0x4a7a]
cmp al, 9
je 0x1002247c
cmp al, 0xc
je 0x1002247c
cmp al, 0xd
je 0x1002247c
cmp al, 0xa
je 0x1002247c
cmp al, 0xa0
jb 0x10022482
inc edx
inc ecx
cmp ecx, 8
jl 0x10022460
cmp edx, 8
je 0x10022566
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + esi + 0x4a7a]
cmp al, 9
je 0x100224b5
cmp al, 0xc
je 0x100224b5
cmp al, 0xd
je 0x100224b5
cmp al, 0xa
je 0x100224b5
cmp al, 0xf
je 0x100224b5
sub al, 0x20
cmp al, 0x5e
ja 0x1002256e
inc ecx
cmp ecx, 2
jl 0x10022490
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + esi + 0x4ada]
cmp al, 9
je 0x100224e5
cmp al, 0xc
je 0x100224e5
cmp al, 0xd
je 0x100224e5
cmp al, 0xa
je 0x100224e5
cmp al, 0xf
je 0x100224e5
sub al, 0x20
cmp al, 0x5e
ja 0x1002256e
inc ecx
cmp ecx, 4
jl 0x100224c0
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + esi + 0x2a6a]
cmp al, 9
je 0x10022511
cmp al, 0xc
je 0x10022511
cmp al, 0xd
je 0x10022511
cmp al, 0xa
je 0x10022511
cmp al, 0xf
je 0x10022511
sub al, 0x20
cmp al, 0x5e
ja 0x1002256e
inc ecx
cmp ecx, 2
jl 0x100224f0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x10022553
mov dword [ebp - 4], 0
mov eax, dword [esi + 0xab6]
test eax, eax
je 0x1002256e
cmp dword [esi + 0x56], eax
jbe 0x1002256e
push 2
lea ecx, [ebp - 4]
push ecx
push eax
mov ecx, esi
call fcn.10004380
mov eax, 0x4550
cmp word [ebp - 4], ax
jmp 0x10022564
cmp eax, 9
jne 0x1002256e
mov eax, 0x5a4d
cmp word [esi + 0x4a7a], ax
jne 0x1002256e
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
mov dword [ebp - 8], edi
cmp word [edi + 0x1e83], 5
je 0x10032ed2
mov eax, 5
pop edi
mov esp, ebp
pop ebp
ret 4
movzx eax, word [ebp + 8]
add eax, 0x1e7a
add eax, edi
push ebx
mov dword [ebp + 8], eax
mov bl, 5
lea eax, [edi + 0x1e85]
mov edi, dword [ebp + 8]
push esi
mov esi, 5
mov dword [ebp - 4], eax
mov edx, eax
mov al, byte [edi]
lea edx, [edx + 1]
xor al, byte [edx - 1]
mov ecx, esi
and ecx, 7
dec esi
rol al, cl
mov byte [edx - 1], al
add bl, 0xff
jne 0x10032ef7
mov edi, dword [ebp - 8]
mov ecx, edi
push 5
push dword [ebp - 4]
push dword [edi + 0x13a7c]
call fcn.10004450
push 0xc00
push 0
push dword [edi + 0x13a80]
mov ecx, edi
call fcn.10003b20
pop esi
pop ebx
mov eax, 3
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10032f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov si, word [ebp + 8]
mov eax, 0x200
cmp si, ax
mov edx, 0x2f
push edi
mov edi, ecx
sbb eax, eax
and eax, 0xffffd000
lea ebx, [edi + 0x4a7a]
add ebx, eax
mov eax, dword [edi + 0x1ab5]
mov dword [ebp + 8], eax
cmp si, dx
jbe 0x10032fa3
movzx ecx, dx
add edx, 4
mov eax, dword [ecx + ebx]
xor eax, dword [ebp + 8]
xor eax, 0x130
mov dword [ecx + edi + 0x2a7a], eax
cmp dx, si
jb 0x10032f86
pop edi
movzx eax, si
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100364f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100365af
cmp dword [0x10172ac0], 0
jne 0x10036543
push 0x1c
call fcn.100ad5f5
add esp, 4
test eax, eax
je 0x1003652a
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
jmp 0x1003652c
xor eax, eax
mov dword [0x10172ac0], eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
push 0x100c0738
push esi
call fcn.100b09b7
mov esi, eax
add esp, 8
test esi, esi
je 0x100365af
push edi
push esi
push 0x1c
push 1
push dword [0x10172ac0]
call fcn.100b0e7f
mov eax, dword [0x10172ac0]
add esp, 0x10
mov edi, dword [eax + 4]
mov eax, dword [0x10172ac4]
sub edi, 0x1c
test eax, eax
jne 0x1003659b
push edi
call fcn.100ad633
push edi
push 0
push eax
mov dword [0x10172ac4], eax
call fcn.100ae3d0
mov eax, dword [0x10172ac4]
add esp, 0x10
push esi
push edi
push 1
push eax
call fcn.100b0e7f
push esi
call fcn.100b0876
add esp, 0x14
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10036690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0x100c0738
push edi
call fcn.100b09b7
add esp, 8
mov dword [esi + 0x44], eax
test eax, eax
jne 0x100366e3
push edi
push str.AVScanExe
push str.__s__LoadVLB__s_fail__not_found.
push 0x68
push str.D:_srcKVCloud_CmakeKVPAV2017AVE_KVEAVMakeLibFTLibCheck.cpp
push str.FTRecLib::InitLoadLib
push eax
push str.avsdk
call dword [sym.imp.avutil.dll_void___cdecl_avutil_ffl_log_char_const___int__char_const___char_const___unsigned_int__char_const__]
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push 2
push 0
push eax
call fcn.100b0c88
push dword [esi + 0x44]
call fcn.100b1507
push 0
push 0
push dword [esi + 0x44]
mov ebx, eax
mov dword [ebp - 8], ebx
call fcn.100b0c88
push dword [esi + 0x44]
push 0x40
push 1
push esi
call fcn.100b0e7f
mov dl, byte [esi + 0x2f]
add esp, 0x2c
movzx ecx, dl
inc ecx
shl ecx, 0xc
mov dword [ebp + 8], ecx
cmp eax, 0x40
jne 0x10036819
cmp dword [esi], 0x424c764b
jne 0x10036819
cmp dword [esi + 4], 0
je 0x10036819
lea eax, [ecx + 0x40]
cmp ebx, eax
jb 0x10036819
test dl, dl
jne 0x10036762
movzx eax, word [esi + 0x2c]
mov dl, 3
mov word [esi + 0x3e], ax
mov byte [esi + 0x2f], 3
jmp 0x10036766
movzx eax, word [esi + 0x3e]
movzx ebx, dl
inc ebx
mov dword [ebp - 4], eax
shl ebx, 0xc
push ebx
call fcn.100ad633
mov ecx, eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0x40], ecx
cmp ebx, eax
jbe 0x10036798
sub ebx, eax
add eax, ecx
push ebx
push 0
push eax
call fcn.100ae3d0
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10036800
push dword [esi + 0x44]
push eax
push 1
push ecx
call fcn.100b0e7f
add esp, 0x10
cmp eax, dword [ebp + 8]
jne 0x10036800
mov eax, dword [ebp - 4]
movzx edx, ax
mov eax, dword [esi + 0x40]
add edx, edx
mov ecx, dword [eax + edx*8 + 8]
add ecx, dword [eax + edx*8 + 4]
cmp dword [ebp - 8], ecx
jb 0x10036800
push edi
push str.AVScanExe
push str.__s__LoadVLB__s_OK.
push 0x90
push str.D:_srcKVCloud_CmakeKVPAV2017AVE_KVEAVMakeLibFTLibCheck.cpp
push str.FTRecLib::InitLoadLib
push 0
push str.avsdk
call dword [sym.imp.avutil.dll_void___cdecl_avutil_ffl_log_char_const___int__char_const___char_const___unsigned_int__char_const__]
add esp, 0x20
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.10036610
push edi
push str.AVScanExe
push str.__s__LoadVLB__s_fail_2__Bad_file.
push 0x8d
jmp 0x1003682d
mov ecx, esi
call fcn.10036610
push edi
push str.AVScanExe
push str.__s_LoadVLB__s_fail__Bad_file._
push 0x76
push str.D:_srcKVCloud_CmakeKVPAV2017AVE_KVEAVMakeLibFTLibCheck.cpp
push str.FTRecLib::InitLoadLib
push 0
push str.avsdk
call dword [sym.imp.avutil.dll_void___cdecl_avutil_ffl_log_char_const___int__char_const___char_const___unsigned_int__char_const__]
add esp, 0x20
mov eax, 0xfffffffe
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10036860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.10036690
test eax, eax
je 0x1003687a
or eax, 0xffffffff
pop esi
pop ebp
ret 4
push dword [esi + 0xc]
call fcn.100ad633
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x40]
push 0
push dword [eax + 4]
push dword [esi + 0x44]
call fcn.100b0c88
push dword [esi + 0x44]
push dword [esi + 0xc]
push 1
push dword [esi + 0x48]
call fcn.100b0e7f
push dword [esi + 0x44]
call fcn.100b0876
add esp, 0x24
mov dword [esi + 0x44], 0
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x10037450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x10172044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
call dword [sym.imp.avutil.dll_void____stdcall_AVCreateLock_void_]
push 0x104
mov dword [0x10172ad4], eax
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.100ae3d0
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.100ae3d0
push 0x5c
push edi
call fcn.100ae8e0
add esp, 0x20
test eax, eax
jne 0x100374bc
push 0x2f
push edi
call fcn.100ae8e0
add esp, 8
test eax, eax
mov eax, 0x100c0910
je 0x100374c1
mov eax, 0x100c090c
push str.FTSignBuild_0001.vlb
push eax
push edi
push str._s_s_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.10036a90
lea esi, [ebp - 0x108]
add esp, 0x18
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x100374f0
sub esi, ecx
call dword [sym.imp.avutil.dll_class_IOSBase____stdcall_EnvGet_void_]
push 0x104
lea edx, [ebp - 0x310]
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x108]
push esi
push edx
push 0
push 0
push eax
call dword [ecx + 0x20]
lea eax, [ebp - 0x108]
push eax
call fcn.100364f0
add esp, 4
mov dword [0x10173cfc], 1
mov ecx, 0x101740d8
mov dword [0x10173d00], 1
mov dword [0x10173dd8], 1
mov dword [0x10173ddc], 1
push 1
push 0x10173cd8
push edi
mov dword [0x10173de0], 1
mov dword [0x10173de4], 1
mov dword [0x10173de8], 1
mov dword [0x10173dec], 1
mov dword [0x10173dfc], 1
mov dword [0x10173e18], 1
mov dword [0x10173e1c], 1
mov dword [0x10173e20], 1
mov dword [0x10173e24], 1
mov dword [0x10173e28], 1
mov dword [0x10173e2c], 1
mov dword [0x10173e3c], 1
mov dword [0x10173e58], 1
mov dword [0x10173e5c], 1
mov dword [0x10173e60], 1
mov dword [0x10173e64], 1
mov dword [0x10173e94], 1
mov dword [0x10173cec], 1
mov dword [0x10173cf4], 1
mov dword [0x10173cf8], 1
mov dword [0x10173d38], 1
mov dword [0x10173d14], 1
mov dword [0x10173d18], 1
mov dword [0x10173ce0], 1
call fcn.10036930
test eax, eax
jne 0x100376fa
mov edx, 0x100e586e
lea esi, [eax + 0xc]
xor ecx, ecx
cmp byte [edx], cl
jbe 0x1003767d
nop dword [eax]
xor byte [edx + ecx + 1], 0x11
inc ecx
movzx eax, byte [edx]
cmp ecx, eax
jl 0x10037670
add edx, 0x73
sub esi, 1
jne 0x10037666
mov esi, 0x100e5ec6
mov edi, 0x505
nop
xor edx, edx
cmp byte [esi], dl
jbe 0x100376ae
lea ecx, [esi + 1]
nop dword [eax]
xor byte [ecx], 0x11
lea ecx, [ecx + 1]
movzx eax, byte [esi]
inc edx
cmp edx, eax
jl 0x100376a0
add esi, 0x73
sub edi, 1
jne 0x10037690
mov esi, 0x1010a006
mov edi, 0x9f
xor edx, edx
cmp byte [esi], dl
jbe 0x100376de
lea eax, [esi + 1]
nop dword [eax]
xor byte [eax], 0x11
lea eax, [eax + 1]
movzx ecx, byte [esi]
inc edx
cmp edx, ecx
jl 0x100376d0
add esi, 0x73
sub edi, 1
jne 0x100376c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad43d
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.100ad43d
mov esp, ebp
pop ebp
ret 4
Function at 0x1003fb10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x2a96]
test al, al
je 0x1003fbb3
cmp al, 4
ja 0x1003fbb3
mov al, byte [ebx + 0x2a97]
mov ecx, dword [ebx + 0x2a92]
mov byte [ebp + 0xb], al
mov ax, word [ebp + 0x14]
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebx + 0x2a8e]
test ax, ax
je 0x1003fbb2
push edi
movzx edi, ax
test edi, edi
je 0x1003fbb1
mov eax, dword [ebp + 0xc]
dec edi
mov edx, dword [ebp + 0x10]
sub eax, edx
shr edi, 2
mov dword [ebp + 0xc], eax
inc edi
mov eax, dword [eax + edx]
xor eax, esi
mov dword [edx], eax
movzx eax, byte [ebx + 0x2a96]
dec eax
cmp eax, 3
ja case.default.0x1003fb7c
jmp dword [eax*4 + 0x1003fbb8]
add esi, ecx
jmp case.default.0x1003fb7c
movzx ecx, byte [ebp + 0xb]
and ecx, 0x1f
rol esi, cl
mov ecx, dword [ebp - 4]
add esi, ecx
jmp case.default.0x1003fb7c
add esi, dword [ebp - 4]
movzx ecx, byte [ebp + 0xb]
and ecx, 0x1f
rol esi, cl
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
add edx, 4
sub edi, 1
jne 0x1003fb68
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10057710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
cmp ecx, 0x2000
jae 0x10057792
imul eax, ecx, 0xfffffff8
push ebx
push esi
mov dword [ebp + 8], eax
nop dword [eax + eax]
mov ecx, dword [edi]
mov ebx, 0x3f
mov eax, dword [edi + 4]
mov dword [ebp - 4], ecx
nop dword [eax]
mov edx, dword [ebp + 0xc]
mov ecx, ebx
and ecx, 7
mov esi, dword [edx + ecx*4]
mov edx, eax
mov ecx, eax
shr edx, 8
shl ecx, 6
xor edx, ecx
mov dword [edi], eax
mov ecx, dword [ebp + 8]
sub ecx, edx
sub ecx, esi
sub ecx, eax
sub ecx, ebx
add ecx, dword [ebp - 4]
sub ebx, 1
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [edi + 4], eax
jns 0x10057740
add edi, 8
cmp dword [ebp + 0x10], 8
je 0x10057790
mov ecx, dword [ebp + 0x14]
sub dword [ebp + 8], 8
inc ecx
mov dword [ebp + 0x14], ecx
cmp ecx, 0x2000
jb 0x10057730
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret