joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51aa90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576866
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov esi, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea edi, [ecx + 2]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x51aaf5
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00407c80
mov dword [ebp - 4], 1
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov edx, 0x811c9dc5
cmp dword [ebp - 0x14], 8
cmovae edi, dword [ebp - 0x28]
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x51ab42
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x51ab31
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push edx
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebx + 0x34]
call fcn.0040add0
mov edi, dword [eax + 4]
test edi, edi
jne 0x51ab60
mov edi, dword [ebx + 0x38]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407f50
mov eax, ebx
cmp edi, dword [eax + 0x38]
jne 0x51ab88
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x51ab93
lea eax, [edi + 0x20]
mov ecx, esi
push eax
call fcn.00406c70
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521781
mov esp, ebp
pop ebp
ret 8
Function at 0x51b950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576b3d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x51b98a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x51b9ab
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x51b997
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.0040add0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x51b9dc
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x51bb27
lea eax, [ebx + 4]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x10], 0
call fcn.005217c3
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00427ab0
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x59f4b0]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x59f4b0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x51bab7
divss xmm0, xmm3
call fcn.0040ae60
call fcn.0053fd90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x51ba9b
cmp eax, 0x200
jae 0x51ba99
shl eax, 3
cmp eax, ecx
jae 0x51ba9b
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00426ec0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040add0
mov edx, dword [eax]
jmp 0x51baba
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x51baed
mov dword [ecx + eax*8], edi
jmp 0x51baff
cmp esi, edx
jne 0x51baf6
mov dword [ecx + eax*8], edi
jmp 0x51bb03
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x51bb03
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0051f895
int3
Function at 0x51bd20
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bb5d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.00409310
mov ecx, eax
test ecx, ecx
je 0x51be75
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebx]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x51bdcc
lea ecx, [eax - 1]
test ecx, ecx
js 0x51be7f
cmp ecx, eax
jg 0x51be7f
cmp word [edx + ecx*2], 0x5c
jne 0x51bdcc
push ecx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0040d100
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push eax
call fcn.00478220
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x51bdd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x51bdd5
push ebx
lea ecx, [ebp - 0x10]
call fcn.00478220
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, dword [ecx - 0xc]
jge 0x51be44
push 0x5c
push ecx
call fcn.0052324a
add esp, 8
test eax, eax
jne 0x51bdf6
or eax, 0xffffffff
jmp 0x51bdfa
sub eax, dword [edi]
sar eax, 1
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0040d100
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x51be26
push dword [edi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.0051bd20
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x51be44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x51be63
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00408fe0
push 0x80070057
call fcn.00408fe0
int3
Function at 0x51d370
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x20
mov eax, dword [0x5d8024]
xor eax, esp
mov dword [esp + 0x1c], eax
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x51d3a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00521781
add esp, 0x20
ret
push esi
push 0x14
push 0x59d4e8
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
je 0x51d404
lea eax, [esp + 8]
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x10], xmm0
movq qword [esp + 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x51d401
cmp dword [esp + 0xc], 4
je 0x51d41b
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x51d41b
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00521781
add esp, 0x20
ret
push esi
call edi
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
pop edi
xor ecx, esp
call fcn.00521781
add esp, 0x20
ret

Function at 0x520950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x520975
xor eax, eax
jmp 0x5209d1
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x5209a2
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x5209a2
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x520a56
cmp dword [edi + 0x4c], 0
je 0x5209cb
mov ecx, edi
call fcn.005205cb
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x5209e1
push dword [edi + 0x4c]
push ebx
call fcn.00520217
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x5209d0
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00521781
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x57929c]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x5209cb
cmp eax, 1
jle 0x520a29
cmp eax, 3
jne 0x5209cb
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x5209bd
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x520a46
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0052fc85
add esp, 0x10
cmp esi, eax
jne 0x5209cb
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x5209cb
mov ax, bx
jmp 0x5209d0

Function at 0x5396ed
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053939e
Function at 0x5396f8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00539528
Function at 0x407701
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x407710
pop dword [ebp - 0x1c]
mov eax, 0xa8510fa3
sub eax, 0xa8109893
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x995ec3f8
add dword [ebp - 0x2c], 0xb4f38153
mov dword [ebp - 0x28], 0xdc7022a4
add dword [ebp - 0x28], 0x55c329a1
mov dword [ebp - 0x24], 0xd3e004df
sub dword [ebp - 0x24], 0x8793c0b1
mov dword [ebp - 0x20], 0x6082f3f5
add dword [ebp - 0x20], 0x9f7d0c0b
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xcf8ef05b
sub eax, 0xcf4e7047
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xeed555b
sub dword [ebp - 0x2c], 0x9a7aec05
mov dword [ebp - 0x28], 0xc527ef67
add dword [ebp - 0x28], 0x7c44720e
mov dword [ebp - 0x24], 0x8707d27e
add dword [ebp - 0x24], 0xdc6799ee
mov dword [ebp - 0x20], 0x3d3735fd
sub dword [ebp - 0x20], 0x3d3735fd
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x6d8e832a
sub eax, 0x6d4e031a
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x37d3c
push 0
call eax
mov ecx, 0x1d998f2b
add ecx, 0xe266bb7f
xor ebx, ebx
add ebx, eax
mov esi, 0x3449aa99
sub esi, 0x3408be99
add esi, dword [ebp - 0x1c]
mov edi, 0x5248592
mov edx, dword [esi]
xor edx, edi
mov dword [ebp - 0xc], 0xefa88cfc
mov dword [ebx], edx
add ebx, 4
add esi, 4
loop 0x40782e
add eax, 0x11d7b
mov ebx, eax
add eax, 0x37f75123
sub eax, 0x37f7511e
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x405b32
pop dword [ebp - 0x40]
mov eax, 0xae6664f0
add eax, 0x51d9f642
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x21480ffd
add dword [ebp - 0x50], 0x2d0a354e
mov dword [ebp - 0x4c], 0xd049e2f7
add dword [ebp - 0x4c], 0x61e9694e
mov dword [ebp - 0x48], 0x8b8362d3
add dword [ebp - 0x48], 0xc0c8e15b
mov dword [ebp - 0x44], 0x8d0236f
sub dword [ebp - 0x44], 0x8d0236f
lea eax, [ebp - 0x50]
push eax
mov eax, 0x6707902a
sub eax, 0x66c70fb2
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf8373e5f
add dword [ebp - 0x50], 0x7c3b2af7
mov dword [ebp - 0x4c], 0x7c9d2cba
sub dword [ebp - 0x4c], 0x3b30cb45
mov dword [ebp - 0x48], 0xc740912e
add dword [ebp - 0x48], 0x9c2edb3e
mov dword [ebp - 0x44], 0xb88e0bcd
sub dword [ebp - 0x44], 0xb88e0bcd
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x2870e39b
sub eax, 0x2830631f
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x39908
push 0
call eax
mov ecx, 0xad6fd3d5
sub ecx, 0xad6f819d
xor esi, esi
add esi, eax
mov edi, 0x76f99c11
sub edi, 0x76b48811
add edi, dword [ebp - 0x40]
mov edx, 0x5995eab4
xor dword [ebp - 4], 0x1d367a6c
mov ebx, dword [edi]
add dword [ebp - 0x1c], 0x705ba38c
sub ebx, edx
mov dword [esi], ebx
mov dword [ebp - 0x3c], 0x51ab5a19
add esi, 0x6230067e
add esi, 0x9dcff986
add edi, 4
loop 0x405c50
add eax, 0x13bb3
mov ebx, eax
add eax, 0x749b6e2e
sub eax, 0x749b6e29
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x407e17
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e86
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e62
push ebx
push edi
push eax
call fcn.0040ba60
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e7d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x41aed3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x41aee2
pop dword [ebp - 0x40]
mov eax, 0x41aee2
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3e402
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x95c3a250
sub ecx, 0x95c35b3e
mov esi, eax
mov edi, 0x43b200
add edi, dword [ebp - 0x40]
mov edx, 0x4ee5bd03
sub edx, 0x6aa7bda2
xor dword [ebp - 0x3c], 0x842ed98
mov ebx, dword [edi]
add dword [ebp - 0x24], eax
sub ebx, edx
xor dword [ebp - 0x28], 0x4cc58ec5
mov dword [esi], ebx
add dword [ebp - 0x3c], eax
add esi, 4
add edi, 0x265d88b5
add edi, 0xd9a2774f
loop 0x41af31
add eax, 0x45002167
add eax, 0xbb00edb4
mov ebx, eax
add eax, 0x71a21284
add eax, 0x8e5ded81
mov ecx, 0x4ec45a57
sub ecx, 0x4e845a57
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10
Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x401260
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
sub esp, 0x60
lea eax, [esp]
push esi
push eax
mov dword [esp + 8], 0
call fcn.004011c0
add esp, 4
test eax, eax
jne 0x401281
pop esi
add esp, 0x60
ret
mov ecx, 0x10
lea eax, [esp + 8]
lea ebx, [ebx]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x401290
mov ecx, 0x44
lea eax, [esp + 0x18]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x4012a4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x38], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
pop esi
add esp, 0x60
ret

Function at 0x1008c2b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1008c66
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1008c43
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1008c82
dec esi
je 0x1008c7b
dec esi
jne 0x1008c87
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
fsubr st(4)
sub dword [ecx], ebp
or byte [ebx - 0x497aebc0], cl
je 0x40a410
retf 0xc70
in eax, dx
cmp ecx, dword [esi]
add byte [ebp - 0x58], bl
cdq
add byte [eax - 0x2f6f2270], dl
nop
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx