joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b88d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add ecx, 0xdeadbeef
push ebx
mov ebx, dword [ebp + 8]
add ecx, edx
push esi
mov esi, ecx
mov dword [ebp + 0x10], esi
push edi
mov edi, ecx
cmp edx, 0xc
jbe switch.0x101b89db
add edx, 0xfffffff3
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 4], eax
jmp 0x101b8910
movzx esi, byte [ebx + 7]
movzx eax, byte [ebx + 6]
movzx edx, byte [ebx + 0xb]
shl esi, 8
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 4]
add edi, eax
shl esi, 8
movzx eax, byte [ebx + 0xa]
add edi, esi
movzx esi, byte [ebx + 8]
add edx, eax
movzx eax, byte [ebx + 9]
add esi, ecx
shl edx, 8
add edx, eax
shl edx, 8
add esi, edx
mov edx, dword [ebp + 8]
mov ebx, esi
rol ebx, 4
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx]
shl ecx, 8
add ecx, eax
sub ecx, esi
add esi, edi
add ecx, dword [ebp + 0x10]
xor ebx, ecx
sub edi, ebx
mov eax, ebx
add ebx, esi
rol eax, 6
xor eax, edi
sub esi, eax
mov edx, eax
rol edx, 8
add eax, ebx
xor edx, esi
sub ebx, edx
mov esi, edx
rol esi, 0x10
add edx, eax
xor esi, ebx
mov ebx, dword [ebp + 8]
mov edi, esi
sub eax, esi
ror edi, 0xd
add esi, edx
xor edi, eax
mov dword [ebp + 0x10], esi
sub edx, edi
mov ecx, edi
rol ecx, 4
add ebx, 0xc
xor ecx, edx
mov dword [ebp + 8], ebx
mov edx, dword [ebp + 0xc]
add edi, esi
sub edx, 0xc
dec dword [ebp - 4]
mov dword [ebp + 0xc], edx
jne 0x101b8910
cmp edx, 0xc
ja 0x101b8a47
jmp dword [edx*4 + 0x101b8a94]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add ecx, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add ecx, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add ecx, eax
movzx eax, byte [ebx + 8]
add ecx, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add esi, eax
movzx eax, byte [ebx]
add esi, eax
mov dword [ebp + 0x10], esi
xor ecx, edi
mov eax, edi
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov esi, ecx
xor esi, dword [ebp + 0x10]
rol eax, 0xb
sub esi, eax
xor edi, esi
mov eax, esi
ror eax, 7
sub edi, eax
mov eax, edi
xor ecx, edi
rol eax, 0x10
sub ecx, eax
mov eax, ecx
mov edx, ecx
rol eax, 4
xor edx, esi
sub edx, eax
mov eax, edx
xor edi, edx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor ecx, edi
ror eax, 8
sub ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101b8ad0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
shr ecx, 0x10
xor ecx, dword [ebp + 8]
imul ecx, ecx, 0x3be78908
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x9ea2e76d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret
Function at 0x101b8bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
lea edi, [edx - 0x21524111]
add edi, ecx
mov esi, edi
mov dword [ebp - 4], edi
add edi, ebx
cmp ecx, 0xc
jbe 0x101b8cca
mov ebx, dword [ebp + 8]
add ecx, 0xfffffff3
mov eax, 0xaaaaaaab
add ebx, 6
mul ecx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp + 8], eax
movzx ecx, byte [ebx + 1]
lea ebx, [ebx + 0xc]
movzx eax, byte [ebx - 0xc]
shl ecx, 8
add ecx, eax
movzx edx, byte [ebx - 0xa]
movzx eax, byte [ebx - 0xd]
add edx, edi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx - 0xe]
shl ecx, 8
add esi, eax
movzx eax, byte [ebx - 8]
add esi, ecx
movzx ecx, byte [ebx - 7]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx - 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx - 0x10]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx - 0xf]
shl ecx, 8
mov edi, edx
add ecx, eax
rol edi, 4
movzx eax, byte [ebx - 0x11]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx - 0x12]
shl ecx, 8
add ecx, eax
sub ecx, edx
add edx, esi
add ecx, dword [ebp - 4]
xor edi, ecx
sub esi, edi
mov eax, edi
add edi, edx
rol eax, 6
xor eax, esi
sub edx, eax
mov ecx, eax
rol ecx, 8
add eax, edi
xor ecx, edx
sub edi, ecx
mov edx, ecx
rol edx, 0x10
add ecx, eax
xor edx, edi
mov esi, edx
sub eax, edx
ror esi, 0xd
add edx, ecx
xor esi, eax
mov dword [ebp - 4], edx
sub ecx, esi
mov edi, esi
rol edi, 4
add esi, edx
xor edi, ecx
mov ecx, dword [ebp + 0xc]
sub ecx, 0xc
dec dword [ebp + 8]
mov dword [ebp + 0xc], ecx
jne 0x101b8c01
mov ebx, dword [ebp + 0x14]
cmp ecx, 0xc
ja case.0x101b8cd1.1
mov edx, dword [ebp + 0x10]
movzx eax, byte [ecx + 0x101b8d04]
jmp dword [eax*4 + 0x101b8cfc]
xor eax, eax
add eax, edx
pop edi
adc ebx, 0
pop esi
mov edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
add eax, dword [ebp + 0x10]
pop edi
adc ebx, 0
pop esi
mov edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101b9fa0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
shr ecx, 0x10
xor ecx, dword [ebp + 8]
imul ecx, ecx, 0xb38feacd
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x39c5ab56
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret

Function at 0x101b9fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
test ebx, ebx
jle 0x101ba0c3
mov edi, dword [ebp + 8]
test edi, edi
je 0x101ba0c3
mov eax, ebx
sar ebx, 2
and eax, 3
mov dword [ebp + 0xc], eax
push esi
mov esi, dword [ebp + 0x10]
test ebx, ebx
jle 0x101ba038
mov edi, edi
push edi
call fcn.101b9f90
movzx eax, ax
add esi, eax
lea eax, [edi + 2]
push eax
call fcn.101b9f90
movzx ecx, ax
dec ebx
mov eax, esi
add esp, 8
shl eax, 5
add edi, 4
xor ecx, eax
shl ecx, 0xb
xor esi, ecx
mov eax, esi
shr eax, 0xb
add esi, eax
test ebx, ebx
jg 0x101ba000
mov eax, dword [ebp + 0xc]
dec eax
je 0x101ba080
dec eax
je 0x101ba064
dec eax
jne 0x101ba092
push edi
call fcn.101b9f90
movzx eax, ax
add esp, 4
add esi, eax
movsx eax, byte [edi + 2]
shl eax, 2
xor eax, esi
shl eax, 0x10
xor esi, eax
mov eax, esi
shr eax, 0xb
jmp 0x101ba090
push edi
call fcn.101b9f90
movzx eax, ax
add esp, 4
add esi, eax
mov eax, esi
shl eax, 0xb
xor esi, eax
mov eax, esi
shr eax, 0x11
jmp 0x101ba090
movsx eax, byte [edi]
add esi, eax
mov eax, esi
shl eax, 0xa
xor esi, eax
mov eax, esi
shr eax, 1
add esi, eax
lea eax, [esi*8]
xor esi, eax
mov eax, esi
shr eax, 5
add esi, eax
mov eax, esi
shl eax, 4
xor esi, eax
mov eax, esi
shr eax, 0x11
add esi, eax
mov eax, esi
shl eax, 0x19
xor esi, eax
mov eax, esi
shr eax, 6
add eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
pop edi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x101ba280
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
shr ecx, 0x10
xor ecx, dword [ebp + 8]
imul ecx, ecx, 0xa357bd2b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x68ebd182
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret
Function at 0x101bafa0
Capabilities:
Encode data using xor
Resolve function by fin8 fasthash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x101bafb6
lea eax, [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x101bafc7
lea eax, [edi + 0x10]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov eax, ecx
push esi
shr eax, 3
push 0x880355f2
push 0x1e6d1965
push 0
lea esi, [edi + eax*8]
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 4]
push ecx
mov dword [ebp - 0x10], eax
call fcn.101c8330
xor eax, dword [ebp - 0xc]
mov ecx, edx
xor ecx, dword [ebp - 0x10]
mov edx, esi
sub edx, edi
mov dword [ebp - 0x14], 0
add edx, 7
mov dword [ebp - 4], eax
shr edx, 3
cmp edi, esi
mov dword [ebp - 8], ecx
cmova edx, dword [ebp - 0x14]
test edx, edx
je 0x101bb057
xor ebx, ebx
mov esi, edx
lea ecx, [ecx]
push dword [edi + 4]
push dword [edi]
call fcn.101bb1c0
xor edx, dword [ebp - 8]
add esp, 8
xor eax, dword [ebp - 4]
push 0x880355f2
push 0x1e6d1965
push edx
push eax
call fcn.101c8330
inc ebx
mov dword [ebp - 4], eax
mov ecx, edx
add edi, 8
mov dword [ebp - 8], ecx
cmp ebx, esi
jne 0x101bb020
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
xorps xmm0, xmm0
and edx, 7
movlpd qword [ebp - 0x18], xmm0
dec edx
cmp edx, 6
ja case.default.0x101bb06f
jmp dword [edx*4 + 0x101bb160]
movzx eax, byte [edi + 6]
xor esi, esi
cdq
mov ecx, eax
movzx eax, byte [edi + 5]
cdq
shl eax, 8
shl ecx, 0x10
xor ecx, eax
movzx eax, byte [edi + 4]
cdq
xor ecx, eax
jmp 0x101bb0cc
movzx eax, byte [edi + 5]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
cdq
xor esi, 0
shl eax, 8
xor esi, 0
xor ecx, eax
movzx eax, byte [edi + 4]
cdq
xor ecx, eax
jmp 0x101bb0cc
movzx eax, byte [edi + 4]
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
xor esi, 0
cdq
xor ecx, eax
jmp 0x101bb0cc
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movzx eax, byte [edi + 3]
cdq
shld edx, eax, 0x18
shl eax, 0x18
xor esi, eax
xor ecx, edx
jmp 0x101bb0e4
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movzx eax, byte [edi + 2]
cdq
shld edx, eax, 0x10
shl eax, 0x10
xor esi, eax
xor ecx, edx
jmp 0x101bb0fc
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movzx eax, byte [edi + 1]
cdq
shld edx, eax, 8
shl eax, 8
xor esi, eax
xor ecx, edx
jmp 0x101bb114
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movzx eax, byte [edi]
cdq
xor edx, ecx
xor eax, esi
push edx
push eax
call fcn.101bb1c0
xor edx, dword [ebp - 8]
add esp, 8
xor eax, dword [ebp - 4]
push 0x880355f2
push 0x1e6d1965
push edx
push eax
call fcn.101c8330
mov ecx, edx
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
sub edx, eax
mov dword [ebx + 8], eax
sbb esi, ecx
mov dword [ebx], edx
mov dword [ebx + 4], esi
xor eax, eax
pop esi
pop edi
mov dword [ebx + 0xc], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101bb1c0
Capabilities:
Resolve function by fin8 fasthash

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
shrd esi, edx, 0x17
push 0x2127599b
xor esi, dword [ebp + 8]
shr edx, 0x17
xor edx, dword [ebp + 0xc]
push 0xf4325c37
push edx
push esi
call fcn.101c8330
mov ecx, edx
xor edx, edx
mov esi, ecx
shr esi, 0xf
xor eax, esi
xor edx, ecx
pop esi
pop ebp
ret
Function at 0x101c08f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x101c0909
mov eax, 0x10
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x101c091a
lea eax, [esi + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax]
mov ecx, ebx
xor eax, 0x53c5ca59
xor ecx, 0x74743c1b
mul ecx
push edi
mov dword [ebp + 0x10], eax
mov edi, edx
cmp ebx, 8
jbe 0x101c0983
lea eax, [ebx - 9]
shr eax, 3
inc eax
mov dword [ebp - 4], eax
lea eax, [esi + 4]
push eax
call fcn.101ba1a0
push dword [ebp + 0xc]
mov esi, eax
xor esi, edi
xor esi, 0x74743c1b
call fcn.101ba1a0
mov ecx, eax
add esp, 8
xor ecx, dword [ebp + 0x10]
mov eax, esi
mov esi, dword [ebp + 0xc]
xor ecx, 0x53c5ca59
mul ecx
add esi, 8
sub ebx, 8
dec dword [ebp - 4]
mov edi, edx
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], esi
jne 0x101c0940
cmp ebx, 4
jb 0x101c09a3
push esi
call fcn.101ba1a0
xor dword [ebp + 0x10], eax
lea eax, [ebx - 4]
add eax, esi
push eax
call fcn.101ba1a0
add esp, 8
xor edi, eax
jmp 0x101c09b4
test ebx, ebx
je 0x101c09b4
push ebx
push esi
call fcn.101c0a60
add esp, 8
xor dword [ebp + 0x10], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 8], edi
xor edi, eax
add edi, dword [ebx]
push edi
mov dword [ebx + 4], eax
call fcn.101c0a40
add esp, 4
mov dword [ebx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101c23a0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, esi
mov dword [ebp + 0xc], edi
cmp esi, 4
jl 0x101c23f4
shr edi, 2
mov ecx, edi
neg ecx
lea esi, [esi + ecx*4]
jmp 0x101c23d0
imul edx, dword [eax], 0x5bd1e995
add eax, 4
imul ebx, ebx, 0x5bd1e995
mov ecx, edx
shr ecx, 0x18
xor ecx, edx
imul edx, ecx, 0x5bd1e995
xor ebx, edx
dec edi
jne 0x101c23d0
mov edi, dword [ebp + 0xc]
xor edx, edx
dec esi
je 0x101c240f
dec esi
je 0x101c2406
dec esi
jne 0x101c2414
movzx edx, byte [eax + 2]
shl edx, 0x10
movzx ecx, byte [eax + 1]
shl ecx, 8
xor edx, ecx
movzx eax, byte [eax]
xor edx, eax
imul ecx, edx, 0x5bd1e995
imul edx, edi, 0x5bd1e995
pop edi
pop esi
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, ebx, 0x5bd1e995
pop ebx
xor ecx, eax
mov eax, edx
shr eax, 0x18
xor eax, edx
imul ecx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor ecx, eax
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop ebp
ret
Function at 0x101c3390
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x101c33a1
mov eax, 0x10
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x101c339a
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, edx
mov dword [eax + 4], edx
shr esi, 2
push edi
mov edi, dword [eax]
lea ebx, [ecx + esi*4]
neg esi
je 0x101c33f1
nop
imul eax, dword [ebx + esi*4], 0xcc9e2d51
push 0xd
push 0xf
push eax
call fcn.101c34e0
imul eax, eax, 0x1b873593
add esp, 8
xor eax, edi
push eax
call fcn.101c34e0
add esp, 8
lea edi, [eax - 0x52250ec]
lea edi, [edi + edi*4]
inc esi
jne 0x101c33c0
and edx, 3
xor ecx, ecx
dec edx
je 0x101c340f
dec edx
je 0x101c3406
dec edx
jne 0x101c342d
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx eax, byte [ebx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [ebx]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
push 0xf
push eax
call fcn.101c34e0
imul eax, eax, 0x1b873593
add esp, 8
xor edi, eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x101c34b0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
shr ecx, 0x10
xor ecx, dword [ebp + 8]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret
Function at 0x101c3a30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x101c3a41
lea eax, [ebx + 0x10]
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x101c3a50
lea eax, [esi + 0x10]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebx]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x101c3a78
lea ebx, [ebx]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1024dfe8]
dec edi
jne 0x101c3a60
pop edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x101c3b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x101c3b21
lea eax, [ebx + 0x10]
pop ebx
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x101c3b30
lea eax, [edi + 0x10]
pop edi
pop ebx
pop ebp
ret
cmp dword [ebp + 0x10], 0
mov eax, dword [ebx]
push esi
mov esi, dword [ebx + 4]
je 0x101c3b6e
mov ebx, dword [ebp + 0x10]
nop
movzx ecx, byte [edi]
lea edi, [edi + 1]
mov edx, esi
shr edx, 0x18
xor edx, ecx
shld esi, eax, 8
and edx, 0xff
shl eax, 8
xor eax, dword [edx*8 + 0x1024e460]
xor esi, dword [edx*8 + 0x1024e464]
dec ebx
jne 0x101c3b40
mov ebx, dword [ebp + 8]
mov dword [ebx + 4], esi
pop esi
mov dword [ebx], eax
xor eax, eax
pop edi
pop ebx
pop ebp
ret

Function at 0x101c5710
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
xor ebx, eax
push edi
mov edi, dword [ebp + 0x14]
cmp eax, 8
jl 0x101c5782
mov ecx, eax
shr ecx, 3
mov dword [ebp + 8], ecx
neg ecx
lea eax, [eax + ecx*8]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
lea esp, [esp]
imul edx, dword [esi], 0x5bd1e995
imul ebx, ebx, 0x5bd1e995
imul edi, edi, 0x5bd1e995
mov ecx, edx
shr ecx, 0x18
xor ecx, edx
imul edx, ecx, 0x5bd1e995
mov ecx, dword [esi + 4]
add esi, 8
xor ebx, edx
imul edx, ecx, 0x5bd1e995
mov ecx, edx
shr ecx, 0x18
xor ecx, edx
imul edx, ecx, 0x5bd1e995
xor edi, edx
dec eax
jne 0x101c5740
mov eax, dword [ebp + 0xc]
cmp eax, 4
jl 0x101c57aa
mov ecx, dword [esi]
add esi, 4
imul edx, ecx, 0x5bd1e995
imul ebx, ebx, 0x5bd1e995
mov ecx, edx
shr ecx, 0x18
xor ecx, edx
imul edx, ecx, 0x5bd1e995
xor ebx, edx
sub eax, 4
dec eax
je 0x101c57c5
dec eax
je 0x101c57bc
dec eax
jne 0x101c57d0
movzx eax, byte [esi + 2]
shl eax, 0x10
xor edi, eax
movzx eax, byte [esi + 1]
shl eax, 8
xor edi, eax
movzx eax, byte [esi]
xor eax, edi
imul edi, eax, 0x5bd1e995
mov eax, edi
shr eax, 0x12
xor eax, ebx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0x16
xor eax, edi
imul edx, eax, 0x5bd1e995
pop edi
pop esi
pop ebx
mov eax, edx
shr eax, 0x11
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0x13
xor eax, edx
xor edx, edx
imul eax, eax, 0x5bd1e995
or edx, ecx
pop ebp
ret
Function at 0x401290
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x40], str.WindowsApp
mov dword [ebp - 0x60], sym._WindowProcedure_16
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x68], 0x30
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x50], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassExA
sub esp, 4
test ax, ax
jne 0x401344
mov dword [ebp - 0x6c], 0
jmp 0x401410
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x177
mov dword [esp + 0x18], 0x220
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], str.Windows_App
mov dword [esp + 4], str.WindowsApp
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
je 0x40140a
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_TranslateMessage
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_DispatchMessageA
sub esp, 4
jmp 0x4013c2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
leave
ret 0x10
Function at 0x401470
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.004019d0
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x4014a8
jmp 0x401546
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x4014a7
cmp cl, 0x22
je 0x401500
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x401520
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x401520
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x4014e0
jmp 0x401520
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x401500
cmp cl, 0x22
je 0x401582
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x401540
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x401530
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x401564
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x401520

Function at 0x401c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x432490
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ac1fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a036a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x432512
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049d870
mov eax, dword [eax]
push 0x5d8d40
push eax
call fcn.0048f804
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a05f5
test bl, bl
je 0x432512
push 0x5d8d40
lea ecx, [esp + 0xc]
call fcn.004a0985
push 0x5d8d4c
lea ecx, [esp + 0xc]
call fcn.004a0985
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43254e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a05f5
jmp 0x432619
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4325d2
lea edx, [esp + 0x7c]
push 0x5d8d48
push edx
call fcn.0048f804
add esp, 8
test eax, eax
je 0x4325d2
lea eax, [esp + 0x7c]
push 0x5d8d44
push eax
call fcn.0048f804
add esp, 8
test eax, eax
je 0x4325d2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x432562
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a05f5
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x432e20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x432e82
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc