joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, 0x113
je 0x10024d4b
cmp edi, 0x2e0
je 0x10024ca3
cmp edi, 0x4d2
jne 0x10024d6a
jmp 0x10024d63
cmp dword [0x1017b948], 0xffffffff
je 0x10024cd8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x1017b948]
cmp ecx, 0x64
jae 0x10024cde
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push 0x2e0
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1017b948], eax
lea ecx, [esi + 0x30]
movzx eax, bx
push eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov eax, dword [ebp + 0x10]
push 0x14
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, ecx
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
sub eax, edx
push eax
push ecx
push edx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x10024d6a
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
push dword [ebp + 0x10]
mov ecx, esi
push ebx
push edi
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push 0x463
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp ebx, 0x463
jne 0x10024d6a
mov ecx, esi
push 1
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
push dword [ebp + 0x10]
mov ecx, esi
push ebx
push edi
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10028f00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10100586
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x1017542c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea edx, [ebp - 0x94]
push edx
mov ecx, dword [edi + 0x108]
mov eax, dword [ecx]
call dword [eax + 4]
push str.closebtn
mov ecx, eax
mov dword [ebp - 4], 0
call sym.UserAndPayClient.dll_public:_bool___thiscall_xx_DuiLib::CDuiString::operator_wchar_t_const__const
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
test bl, bl
je 0x10028f74
push 0
jmp 0x10028fbe
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.buyVip
mov ecx, eax
mov dword [ebp - 4], 1
call sym.UserAndPayClient.dll_public:_bool___thiscall_xx_DuiLib::CDuiString::operator_wchar_t_const__const
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
test bl, bl
je 0x10028fc5
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov ecx, esi
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c1de9
mov esp, ebp
pop ebp
ret 4
Function at 0x100294c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, 0x2e0
jne 0x1002956a
cmp dword [0x1017b964], 0xffffffff
je 0x1002950d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x1017b964]
cmp ecx, 0x64
jae 0x10029513
push edi
push dword [ebp + 0xc]
mov ecx, esi
push 0x2e0
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1017b964], eax
lea ecx, [esi + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0xc]
mov edx, dword [edi]
sub eax, ecx
push 0x14
push eax
mov eax, dword [edi + 8]
sub eax, edx
push eax
push ecx
push edx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x1002956a
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
push edi
push dword [ebp + 0xc]
mov ecx, esi
push ebx
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1002a380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, 0x2e0
jne 0x1002a42a
cmp dword [0x1017b968], 0xffffffff
je 0x1002a3cd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x1017b968]
cmp ecx, 0x64
jae 0x1002a3d3
push edi
push dword [ebp + 0xc]
mov ecx, esi
push 0x2e0
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1017b968], eax
lea ecx, [esi + 0x30]
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0xc]
mov edx, dword [edi]
sub eax, ecx
push 0x14
push eax
mov eax, dword [edi + 8]
sub eax, edx
push eax
push ecx
push edx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x1002a42a
lea ecx, [esi + 0x30]
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
push edi
push dword [ebp + 0xc]
mov ecx, esi
push ebx
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1002c350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101019bb
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x1017542c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1002c280
xor esi, esi
cmp eax, 8
jl 0x1002c3b5
jne 0x1002c392
mov esi, 0x1f40
jmp 0x1002c3b5
cmp eax, 9
jne 0x1002c39e
mov esi, 0x2328
jmp 0x1002c3b5
cmp eax, 0xa
jne 0x1002c3aa
mov esi, 0x2710
jmp 0x1002c3b5
cmp eax, 0xb
mov ecx, 0x2af8
cmove esi, ecx
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100bf4c0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.100bf4c0
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.100bf4c0
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x830]
push eax
push 0
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100e1fa6
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100bf4c0
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x218]
push 0x101272ac
push eax
call fcn.1003e470
add esp, 0x48
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x848]
push 0x52
xor eax, eax
mov dword [ebp - 0x834], 7
push str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
mov dword [ebp - 0x838], 0
mov word [ebp - 0x848], ax
call fcn.10019e20
cmp dword [ebp - 0x834], 8
lea ecx, [ebp - 0x850]
push ecx
push 0x20006
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x834]
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp ecx, 8
jb 0x1002c4f5
inc ecx
push ecx
push dword [ebp - 0x848]
lea ecx, [ebp - 0x848]
call fcn.1001a0c0
test edi, edi
je 0x1002c5a4
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], 0
mov word [ebp - 0x848], ax
cmp word [ebp - 0x218], ax
jne 0x1002c527
xor ecx, ecx
jmp 0x1002c53f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002c530
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x848]
call fcn.10019e20
cmp dword [ebp - 0x834], 8
lea ecx, [ebp - 0x854]
push 4
push ecx
push 4
lea eax, [ebp - 0x848]
mov dword [ebp - 0x854], esi
cmovae eax, dword [ebp - 0x848]
push 0
push eax
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x834]
cmp eax, 8
jb 0x1002c5a4
inc eax
lea ecx, [ebp - 0x848]
push eax
push dword [ebp - 0x848]
call fcn.1001a0c0
mov eax, dword [ebp - 0x850]
test eax, eax
je 0x1002c5b5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c1de9
mov esp, ebp
pop ebp
ret
Function at 0x100318c0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push esi
push edi
call sym.UserAndPayClient.dll_public:_static_void___cdecl_Talk2Svr::CTalk2Svr::CopyTwoTag_struct_tag_Check_Vip_Info___struct_tag_Check_Vip_Info__
add esp, 8
lea eax, [esi + 0xd0]
lea ebx, [esi + 0xb8]
mov ecx, ebx
push eax
call fcn.10015890
test eax, eax
js 0x10031906
push ebx
lea ecx, [esi + 0xa0]
call fcn.10015890
test eax, eax
jns 0x10031906
mov byte [esi + 0x2f9], 1
jmp 0x1003190d
mov byte [esi + 0x2f9], 0
cmp dword [esi + 0x2c4], 0
jne 0x10031920
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [edi], 0xc8
jne 0x10031976
cmp dword [esi + 0x2f0], 0
jne 0x10031945
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 0x2f0], eax
push 0
push 0
push esi
push 0x1002e620
push 0
push 0
call fcn.100df671
add esp, 0x18
mov dword [esi + 0x2c4], eax
push 0
push 0
push 0x5f4
push dword [esi + 0x2e4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10032250
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x10031b90
push 0
push 0
call fcn.100df671
add esp, 0x18
mov dword [esi + 0x2ec], eax
pop esi
ret

Function at 0x100324e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10102350
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x1017542c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x818], 0
push 0x800
lea eax, [ebp - 0x814]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.100bf4c0
add esi, 0x32c
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x10032549
mov edx, dword [esi]
jmp 0x1003254b
mov edx, esi
cmp dword [ebp + 0x38], 0x10
lea ecx, [ebp + 0x24]
push edx
cmovae ecx, dword [ebp + 0x24]
lea edx, [ebp - 0x814]
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
push 0x800
cmovae eax, dword [ebp + 0xc]
push edx
push 0x10129196
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [esi + 0x14], 0x10
jb 0x10032583
mov esi, dword [esi]
cmp dword [ebp + 0x38], 0x10
lea ecx, [ebp - 0x814]
push ecx
lea eax, [ebp + 0x24]
cmovae eax, dword [ebp + 0x24]
push esi
push eax
push str.strSubKey:_s___s_____s_n
call fcn.100184c0
mov dword [edi + 0x14], 0xf
add esp, 0x10
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [ebp - 0x814], 0
jne 0x100325c2
xor ecx, ecx
jmp 0x100325d9
lea ecx, [ebp - 0x814]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100325d0
sub ecx, edx
push ecx
lea eax, [ebp - 0x814]
mov ecx, edi
push eax
call fcn.10019180
mov eax, dword [ebp + 0x20]
cmp eax, 0x10
jb 0x100325fd
inc eax
lea ecx, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.10019fa0
mov ecx, dword [ebp + 0x38]
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], 0
mov byte [ebp + 0xc], 0
cmp ecx, 0x10
jb 0x10032624
inc ecx
push ecx
push dword [ebp + 0x24]
lea ecx, [ebp + 0x24]
call fcn.10019fa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100c1de9
mov esp, ebp
pop ebp
ret 0x34
Function at 0x10033ec0
Capabilities:
Create process on windows
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x288], 0x10
lea esi, [edi + 0x274]
jb 0x10033ed7
mov eax, dword [esi]
jmp 0x10033ed9
mov eax, esi
push eax
push str.m_strQQ:_s
call fcn.100184c0
add esp, 8
cmp dword [edi + 0x284], 0
je 0x10033f0f
cmp dword [esi + 0x14], 0x10
jb 0x10033ef8
mov esi, dword [esi]
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
ret
cmp dword [edi + 0x2c8], 0
je 0x10033f34
push 0
push 0
push edi
push 0x10033e70
push 0
push 0
call fcn.100df671
add esp, 0x18
mov dword [edi + 0x2c8], eax
pop edi
pop esi
ret
Function at 0x1003d260
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x1003d27a
push 0
push dword [esi + 0x2e4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
cmp eax, 0x1017af84
je 0x1003d293
push 0xffffffffffffffff
push 0
push eax
mov ecx, 0x1017af84
call fcn.100195d0
push 0
push 0
push esi
push 0x1003a500
push 0
push 0
call fcn.100df671
add esp, 0x18
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x1003dfc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x1003dfda
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1003e060
test eax, eax
je 0x1003dfd1
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.100bf4c0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
call fcn.1003e0c0
test al, al
mov dword [ebp - 0x2c], esi
mov edx, str.runas
mov dword [ebp - 0x28], edi
mov ecx, 0x1012af84
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x20], 1
cmove ecx, edx
mov dword [ebp - 0x1c], 0
push eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003e0c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1017542c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.100bf4c0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1003e133
mov eax, dword [ebp - 0x114]
cmp eax, 5
jne 0x1003e128
cmp dword [ebp - 0x110], 1
jne 0x1003e133
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c1de9
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x1003e133
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.100c1de9
mov esp, ebp
pop ebp
ret
Function at 0x10041b00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x10041b0b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x10041bc7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
sub edi, 1
jne 0x10041b20
pop edi
test esi, esi
je 0x10041bea
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101246f8]
sub esi, 1
jne 0x10041bd0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x10042300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x10042343
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10042335
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x10042354
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.100bef40
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x100423bb
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100423b6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x100423e8
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x100423cc
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.100bef40
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x100423fc
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x100423f3
cmp byte [esi + 8], 0
je 0x100423f3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100424c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x100424f5
cmp byte [edi + 1], 0
je 0x100424ed
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x100424fb
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x1004251e
cmp byte [edi + 1], 0
je 0x10042517
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x10042521
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x10042530
mov eax, dword [edi + 0x1c]
mov ebx, 0xffff
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
cmp eax, ebx
jae 0x10042535
mov ebx, eax
mov dword [ebp - 0x10], eax
push esi
push 0x404
call fcn.100d945e
mov esi, eax
add esp, 4
test esi, esi
jne 0x10042553
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp ebx, eax
jbe 0x10042655
nop word [eax + eax]
mov edx, dword [ebp - 8]
add eax, 0x400
cmp eax, ebx
mov ecx, eax
mov eax, 0x404
cmova ecx, ebx
sub edx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x404
mov dword [ebp - 0x18], edx
mov ebx, ecx
cmova ebx, eax
cmp byte [edi], 0
je 0x100425bb
cmp byte [edi + 1], 0
je 0x10042655
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x100425be
mov dword [edi + 0x1c], edx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0xc], ebx
je 0x100425e6
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100425e1
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x1004260f
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x100425f9
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0xc], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.100bef40
mov eax, dword [ebp - 0xc]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x10042655
lea eax, [ebx - 3]
test eax, eax
js 0x10042640
nop
dec eax
cmp byte [eax + esi], 0x50
jne 0x1004263c
cmp byte [eax + esi + 1], 0x4b
jne 0x1004263c
cmp byte [eax + esi + 2], 5
jne 0x1004263c
cmp byte [eax + esi + 3], 6
je 0x10042668
test eax, eax
jns 0x10042620
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10042655
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
cmp eax, ebx
jb 0x10042570
push esi
call fcn.100d9469
mov eax, dword [ebp - 4]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x10042643