joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100019f0
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001a00
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10001a0c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001a16
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001a20
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10001a2a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001a34
or eax, 4
shr ecx, 1
test cl, 1
je 0x10001a3e
or eax, 2
test cl, 2
je 0x10001a46
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001b00
test al, 1
je 0x10001b0d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001b00
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x100019f4
pop edi
pop ebx
ret

Function at 0x10001b30
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x100142a8
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10001b62
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001b90
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10001bf3
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10001bd9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001bb8
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001bb0
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10002120
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x100023c0
push 0x4d9d0e
mov bl, 0xe8
call fcn.10011270
push 0x10002560
push 0x40b154
mov bl, 0xe9
call fcn.10011270
push 0x100025e0
push 0x64a79a
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x64a85f
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x656e03
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x64ab3d
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x64ac02
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x63ddf2
or bl, 0xff
call fcn.10011270
add esp, 0x40
push 0x100025e0
push 0x63df89
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x63ea4c
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x64ca0c
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x77faf9
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x81071b
or bl, 0xff
call fcn.10011270
push 0x100025e0
push 0x81079b
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x47fe31
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x59890d
or bl, 0xff
call fcn.10011270
add esp, 0x40
push 0x100024a0
push 0x59a399
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x59a93c
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x59b13b
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x5a4261
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x5a4d52
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x5b6117
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x65a6ce
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x727987
or bl, 0xff
call fcn.10011270
add esp, 0x40
push 0x100024a0
push 0x7861f1
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x7d32fa
or bl, 0xff
call fcn.10011270
push 0x100024a0
push 0x7d3b0d
or bl, 0xff
call fcn.10011270
push 0x10002520
push 0x7d2b0c
mov bl, 0xe8
call fcn.10011270
push 0x10002610
push 0x8317bd
mov bl, 0xe9
call fcn.10011270
push 0x59b00e
push 0x59affa
mov bl, 0xe8
call fcn.10011270
push 0x720894
push 0x71ae92
mov bl, 0xe9
call fcn.10011270
push 0x720894
push 0x71b1a3
call fcn.10011270
add esp, 0x40
push 0x58811f
push 0x5880f0
call fcn.10011270
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x588447
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x588447], 0xfff
mov edx, dword [ebp - 4]
push edx
push 4
push 0x588447
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100037b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10003740
test eax, eax
je 0x100038a6
push ebx
push esi
push 0x10003a10
push 0x4d2882
mov bl, 0xe8
call fcn.10011270
push 0x10003a50
push 0x4d28eb
call fcn.10011270
push 0x10003a90
push 0x4d2957
call fcn.10011270
push 0x10003a10
push 0x4d29c1
call fcn.10011270
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2887
call esi
mov bl, 0x90
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d2887], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d28f0
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d28f0], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d295c
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d295c], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d29c6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d29c6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d29c6
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.10004760
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add esp, 4
test al, al
je 0x10004890
xor ecx, ecx
test edi, edi
jle 0x10004890
mov dl, byte [0x1012a461]
mov al, dl
imul byte [0x1012a460]
push ebx
mov bl, byte [ecx + esi]
add bl, al
xor bl, dl
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x10004880
pop ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [0x1012a464]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x100048b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ecx, ecx
mov edi, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x14], edi
lea esi, [ecx + 1]
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a03e8]
mov byte [ebp - 1], al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a03e9]
movzx edx, byte [edi + 0x100a037b]
mov byte [ebp - 3], al
mov byte [ebp - 2], dl
mov eax, 0xf0f0f0f1
mul edi
mov edi, dword [ebp - 0xc]
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a03ea]
movzx edx, byte [edi + 0x100a037b]
mov byte [ebp - 5], al
mov byte [ebp - 4], dl
mov bl, byte [esi + 0x100a037b]
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a03eb]
movzx edx, byte [ecx + 0x100a037f]
mov byte [ebp - 6], al
mov al, byte [ebp - 1]
mov byte [ebp - 7], dl
mov dl, bl
sub bl, al
xor dl, al
movzx eax, bl
movzx edi, dl
add di, word [ebp - 0x10]
mov dl, byte [ebp - 3]
xor di, ax
mov al, byte [ebp - 2]
mov bl, al
xor bl, dl
sub al, dl
movzx ebx, bl
add di, bx
movzx edx, al
mov al, byte [ebp - 4]
xor di, dx
mov dl, byte [ebp - 5]
mov bl, al
xor bl, dl
movzx ebx, bl
sub al, dl
mov dl, byte [ebp - 6]
add di, bx
movzx eax, al
xor di, ax
mov al, byte [ebp - 7]
mov bl, dl
xor bl, al
movzx ebx, bl
add di, bx
sub al, dl
add dword [ebp - 0xc], 4
movzx edx, al
xor di, dx
movzx eax, di
mov edi, dword [ebp - 0x14]
add esi, 4
add edi, 4
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp esi, 0x21
jb 0x100048d0
mov edx, dword [0xd227b0]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax - 0x56]
mov byte [0x1012a461], cl
lea ecx, [ebp - 0x14]
push ecx
shr eax, 8
sub al, 0x45
push 0x40
mov byte [0x1012a460], al
mov eax, dword [0xd227f8]
push 4
push 0xd227b0
mov dword [0x1012a468], edx
mov dword [0x1012a464], eax
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xd227b0], 0x100047f0
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xd227b0
call esi
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 4
push 0xd227f8
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xd227f8], 0x10004850
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xd227f8
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
mov bl, 0xeb
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf8], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebfe], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee42], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee48], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
mov byte [0x62eeeb], bl
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
mov bl, 0x69
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf7], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee41], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee4], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee4
call esi
push 0x10008060
push 0x520ecf
mov bl, 0xe8
call fcn.10011270
push 0x10008060
push 0x520f1f
call fcn.10011270
push 0x10008060
push 0x63e743
call fcn.10011270
push 0x10008060
push 0x640eb2
call fcn.10011270
push 0x10008060
push 0x7d2dd9
call fcn.10011270
push 0x10008060
push 0x7e6c0f
call fcn.10011270
push 0x10008060
push 0x84aef7
call fcn.10011270
push 0x100080b0
push 0x47fe12
call fcn.10011270
add esp, 0x40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b85
call esi
mov bl, 0xff
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b85], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b85
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b86
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b86], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b86
call esi
push 0x10008240
push 0x4e199d
mov bl, 0xe8
call fcn.10011270
push 0x10008240
push 0x587049
call fcn.10011270
push 0x10008240
push 0x590ccc
call fcn.10011270
push 0x10008240
push 0x5bbee6
call fcn.10011270
push 0x10008240
push 0x64229d
call fcn.10011270
push 0x10008240
push 0x642d51
call fcn.10011270
push 0x10008240
push 0x643229
call fcn.10011270
push 0x10008240
push 0x65ea86
call fcn.10011270
add esp, 0x40
push 0x10008240
push 0x911a53
call fcn.10011270
push 0x10008240
push 0x911a6d
call fcn.10011270
push 0x10008240
push 0x911a87
call fcn.10011270
push 0x10008240
push 0x911aa1
call fcn.10011270
push 0x10008240
push 0x911abb
call fcn.10011270
add esp, 0x28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
fld dword [0x1012c6bc]
sub esp, 0x10
call fcn.10012d60
fld dword [0x1012c6c0]
push 0xa
add eax, 0x14
push 0xa
push eax
call fcn.10012d60
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000a3a8
push 1
mov ecx, 0x791070
call ecx
add esp, 4
test al, al
je 0x1000a3a8
push esi
mov edx, 0x83c080
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x1012c6d0], 1
je 0x1000a355
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0xa
push 0x4d9a02
mov dword [ebp - 0x10], 0x90909090
mov dword [ebp - 0xc], 0x90909090
mov word [ebp - 8], 0x9090
call esi
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, 0x4d9a02
mov dword [eax], edx
mov dx, word [ebp - 8]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
push 0xa
push 0x4d9a02
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
push 0x40
push 0xa
push 0x4d9a02
mov dword [ebp - 0x10], 0x17e8006a
mov dword [ebp - 0xc], 0x8300102e
mov word [ebp - 8], 0x4c4
call esi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, 0x4d9a02
mov dword [eax], ecx
mov cx, word [ebp - 8]
mov dword [eax + 4], edx
lea edx, [ebp - 4]
push edx
mov word [eax + 8], cx
mov eax, dword [ebp - 4]
push eax
push 0xa
push 0x4d9a02
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1000a5c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x1012c6bc]
call fcn.10012d60
fld dword [0x1012c6c0]
push 0xa
add eax, 0x64
push 0xa
push eax
call fcn.10012d60
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000a6b7
push 1
mov ecx, 0x791070
call ecx
add esp, 4
test al, al
je 0x1000a6b7
push esi
mov edx, 0x83c080
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x1012c6e0], 1
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x74cd30
je 0x1000a66f
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x74cd30], 0xc3
mov eax, dword [ebp - 4]
push eax
push 1
push 0x74cd30
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x771310
call esi
mov byte [0x771310], 0xc3
jmp 0x1000a69f
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x74cd30], 0x55
mov eax, dword [ebp - 4]
push eax
push 1
push 0x74cd30
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x771310
call esi
mov byte [0x771310], 0x55
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push 1
push 0x771310
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x1000a6c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x1012c6bc]
call fcn.10012d60
fld dword [0x1012c6c0]
push 0xa
add eax, 0x78
push 0xa
push eax
call fcn.10012d60
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x1000a805
push 1
mov ecx, 0x791070
call ecx
add esp, 4
test al, al
je 0x1000a805
push esi
mov edx, 0x83c080
call edx
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x1012c6e4], 1
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x626190
je 0x1000a796
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x626190], 0xc3
mov eax, dword [ebp - 4]
push eax
push 1
push 0x626190
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x72d1b0
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x72d1b0], 0xc3
mov eax, dword [ebp - 4]
push eax
push 1
push 0x72d1b0
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x6d9116
call esi
mov byte [0x6d9116], 0
jmp 0x1000a7ed
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x626190], 0x55
mov eax, dword [ebp - 4]
push eax
push 1
push 0x626190
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x72d1b0
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x72d1b0], 0x55
mov eax, dword [ebp - 4]
push eax
push 1
push 0x72d1b0
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x6d9116
call esi
mov byte [0x6d9116], 1
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push 1
push 0x6d9116
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1000b330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10016018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000b377
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001239d
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x1000b48c
cmp dword [ebp - 0x1e], 0x36
jne 0x1000b48c
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x1009fae4
je 0x1000b3b7
mov esi, 0x1009fb14
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x1009fb44]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x1009fb48]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x1009fb4c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x1009fb50]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x1009fb44]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x1009fb48]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x1009fb4c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x1009fb50]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x1009fb44]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x1009fb48]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x1009fb4c]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x1009fb50]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001239d
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.1001239d
mov esp, ebp
pop ebp
ret 8
Function at 0x1000cc70
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10016018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call fcn.100019f0
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x89ab8]
mov eax, str.ServerInfo.dat
call fcn.10001b30
test al, al
jne 0x1000ccd1
push str._Error__ReadMainFile_1:_Failed_to_calculate_CRC_for_the_main_file.
call fcn.100114a0
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1001239d
mov esp, ebp
pop ebp
ret
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.ServerInfo.dat
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000cd15
push str._Error__ReadMainFile_2:_Failed_to_open_the_main_file.
call fcn.100114a0
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1001239d
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x89ab4
je 0x1000cd4f
push str._Error__ReadMainFile_3:_Unexpected_size_for_the_main_file.
call fcn.100114a0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1001239d
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x89ab4
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000cd79
push str._Error__ReadMainFile_4:_Failed_to_read_the_main_file_data.
jmp 0x1000cd2a
xor eax, eax
jmp 0x1000cd80
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xca
mov byte [esi + eax], dl
inc eax
cmp eax, 0x89ab4
jb 0x1000cd80
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.1001239d
mov esp, ebp
pop ebp
ret
Function at 0x1000cdc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x518
mov eax, dword [0x10016018]
xor eax, esp
mov dword [esp + 0x514], eax
cmp dword [edi + 0xf4], 0
push ebx
push esi
je 0x1000cebd
push 0x103
lea eax, [esp + 0x415]
push 0
push eax
mov byte [esp + 0x41c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x414]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000ce36
push str._Error__CheckClientFile_1:_Failed_to_get_the_module_file_name.
call fcn.100114a0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ebx, [edi + 0xd3]
push ebx
lea esi, [esp + 0x414]
call fcn.100112f0
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x1000ce6c
push str._Error__CheckClientFile_2:_Unexpected_client_file_name.
call fcn.100114a0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [esp + 0x10]
call fcn.100019f0
mov edx, esi
push edx
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.10001b30
test al, al
jne 0x1000ce9c
push str._Error__CheckClientFile_3:_Failed_to_calculate_CRC_for_the_client_file.
call fcn.100114a0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0xf4]
cmp eax, dword [esp + 0xc]
je 0x1000cebd
push str._Error__CheckClientFile_4:_Client_file_CRC_does_not_match.
call fcn.100114a0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x51c]
pop esi
pop ebx
xor ecx, esp
call fcn.1001239d
mov esp, ebp
pop ebp
ret