joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42e59d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42e59d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402c00
pop dword [ebp - 8]
mov eax, 0x89234c0c
sub eax, 0x88e3200c
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x57aa0fd
sub dword [ebp - 0x18], 0xb7285bb2
mov dword [ebp - 0x14], 0x839ad1cb
sub dword [ebp - 0x14], 0x51678586
mov dword [ebp - 0x10], 0xa47cfae7
add dword [ebp - 0x10], 0xa7cf4947
mov dword [ebp - 0xc], 0xfe92b082
add dword [ebp - 0xc], 0x16d4f7e
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x2646ea8d
add dword [ebp - 0x18], 0x4e2b7ec9
mov dword [ebp - 0x14], 0x815231d
add dword [ebp - 0x14], 0x39573e58
mov dword [ebp - 0x10], 0x390221d6
add dword [ebp - 0x10], 0x2a6d4a96
mov dword [ebp - 0xc], 0xed77d366
sub dword [ebp - 0xc], 0xed77d366
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xcdba3b4a
add eax, 0x3286355e
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a99a
push 0
call eax
mov ecx, 0x57a5
xor edx, edx
add edx, eax
mov ebx, 0x7ef60025
sub ebx, 0x7eb50025
add ebx, dword [ebp - 8]
mov edi, 0x803bdea1
sub edi, 0xed2f4554
sub dword [ebp - 4], eax
mov esi, dword [ebx]
xor dword [ebp - 4], 0x1ac8af99
xor esi, edi
xor dword [ebp - 4], 0xd1c77982
mov dword [edx], esi
xor dword [ebp - 4], 0x2b91c58b
add edx, 0x4e30f73c
add edx, 0xb1cf08c8
add ebx, 0xea79dcce
sub ebx, 0xea79dcca
loop 0x402d19
add eax, 0xd1a25c01
sub eax, 0xd1a10a9a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf83442b
add ecx, 0xf0bcbbd5
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x403e59
pop dword [ebp - 0xc]
mov eax, 0x626c1f25
add eax, 0x9dd41f34
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x31ece590
sub dword [ebp - 0x1c], 0xe39aa045
mov dword [ebp - 0x18], 0x6c16ea8
sub dword [ebp - 0x18], 0xd48e2263
mov dword [ebp - 0x14], 0x7afe1566
sub dword [ebp - 0x14], 0x2eb1d138
mov dword [ebp - 0x10], 0xb50602b6
add dword [ebp - 0x10], 0x4af9fd4a
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x7e49a53e
sub dword [ebp - 0x1c], 0x9d73be8
mov dword [ebp - 0x18], 0xef7cacb9
add dword [ebp - 0x18], 0x51efb4bc
mov dword [ebp - 0x14], 0x2479a48e
add dword [ebp - 0x14], 0x3ef5c7de
mov dword [ebp - 0x10], 0x97ef2dc
add dword [ebp - 0x10], 0xf6810d24
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x75eb4567
sub eax, 0x75aad4bf
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3c59d
push 0
call eax
mov ecx, 0x5e6a
xor esi, esi
add esi, eax
mov edx, 0xa73e9666
add edx, 0x5902699a
add edx, dword [ebp - 0xc]
mov edi, 0x8d5599ef
sub edi, 0x88fa1ffd
sub dword [ebp - 8], 0x85713b06
mov ebx, dword [edx]
sub dword [ebp - 4], 0xf5ddc8d6
add ebx, edi
xor dword [ebp - 4], edi
mov dword [esi], ebx
add esi, 0x6bf7bd21
add esi, 0x940842e3
add edx, 0xf34c8811
sub edx, 0xf34c880d
loop 0x403f72
add eax, 0xb6cf82fb
sub eax, 0xb6ce1680
mov ebx, eax
add eax, 5
mov ecx, 0x21d38fd3
add ecx, 0xde6c702d
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000655b
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi - 0x6c]
mov ecx, esi
call fcn.100071f7
test eax, eax
jne 0x1000657b
mov eax, 0x80070005
jmp 0x100065ec
push esi
mov ecx, esi
call fcn.100071f7
test eax, eax
js 0x100065ea
cmp dword [edi + 0x44], 0
je 0x100065ea
and dword [ebp + 8], 0
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push eax
call esi
lea eax, [ebp - 8]
push eax
call esi
push 0x14
pop ecx
call fcn.100099b8
test eax, eax
je 0x100065c7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and dword [eax + 8], 0
mov dword [eax], vtable.CNameShowContactCardJob.0
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
jmp 0x100065c9
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.100071f7
mov esi, dword [ebp + 8]
test esi, esi
je 0x100065ea
mov ecx, dword [edi + 0x44]
push esi
call fcn.100071f7
test eax, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x100071f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10007206
pop dword [ebp - 0x30]
mov eax, 0x10007206
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x37402
push 0
mov eax, 0x4e2a450e
add eax, 0xc1d68bce
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xc98e8979
sub ecx, 0xc98e45bb
mov esi, eax
mov edx, 0x6f1b3260
add edx, 0xa0e61fa0
add edx, dword [ebp - 0x30]
mov ebx, 0xddc8a4a2
sub ebx, 0x740c7464
xor dword [ebp - 0xc], 0xc361288e
mov edi, dword [edx]
add dword [ebp - 0x24], 0xe94dcb00
add edi, ebx
xor dword [ebp - 0x2c], 0xddbd99a9
mov dword [esi], edi
add esi, 0x79f69f08
add esi, 0x860960fc
add edx, 0x89708f77
add edx, 0x768f708d
loop 0x10007260
add eax, 0x101cb
mov ebx, eax
add eax, 0xe03a5cdb
add eax, 0x1fc5a32a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a

Function at 0x1004eda7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10087268]
je 0x1004edc2
inc edi
cmp edi, 0x17
jb 0x1004edb3
cmp edi, 0x17
jae 0x1004ef42
push ebp
push 3
call fcn.10055799
cmp eax, 1
pop ecx
je 0x1004ef0e
push 3
call fcn.10055799
test eax, eax
pop ecx
jne 0x1004edf6
cmp dword [0x1008894c], 1
je 0x1004ef0e
cmp ebx, 0xfc
je 0x1004ef41
push 0x1000ae6c
mov ebx, 0x314
push ebx
mov ebp, 0x10088b00
push ebp
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee2c
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x104
mov esi, 0x10088b19
push esi
push 0
mov byte [0x10088c1d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004ee70
push 0x1000ae54
push 0x2fb
push esi
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee70
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004fb11
add esp, 0x14
push esi
call fcn.10055430
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004eeb5
push esi
call fcn.10055430
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10088e14
push 0x1000a540
sub ecx, eax
push ecx
push eax
call fcn.1006f61c
add esp, 0x14
test eax, eax
je 0x1004eeb5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
jmp 0x1004eeb7
xor esi, esi
push 0x1000ae50
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eed7
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push dword [edi*8 + 0x1008726c]
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eef9
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x12010
push 0x1000ae28
push ebp
call fcn.1006f61c
add esp, 0xc
jmp 0x1004ef41
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1004ef41
cmp ebp, 0xffffffff
je 0x1004ef41
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008726c]
push dword [esi]
call fcn.10055430
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1006e4e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
cmp dword [ebp + 8], edx
je 0x1006e521
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1004d2a6
add esp, 0xc
test eax, eax
jne 0x1006e575
push dword [ebp + 8]
push dword [ebp + 0x14]
push 1
push dword [ebp + 0x18]
call fcn.1004d204
sub eax, dword [ebp + 0x14]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0x1006e577
mov eax, dword [ecx + 0x82c]
cmp eax, edx
je 0x1006e54b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edx
push dword [ebp + 0xc]
push dword [ecx + 0x804]
call eax
add esp, 0x14
xor ecx, ecx
test eax, eax
setge cl
mov al, cl
jmp 0x1006e577
mov eax, dword [ecx + 0x830]
cmp eax, edx
je 0x1006e575
cmp byte [ebp + 0x1c], dl
jne 0x1006e55f
cmp dword [ebp + 0x10], edx
je 0x1006e575
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + 0x804]
call eax
add esp, 0x10
jmp 0x1006e540
xor al, al
pop ebp
ret 0x18
Function at 0x1006f309
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x20
push 0x100094f8
push dword [ebp + 8]
mov esi, ecx
call fcn.1006f61c
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
jne 0x1006f342
push ebx
push 0x12
push dword [ebp + 8]
mov ecx, esi
call fcn.1006f61c
xor al, al
jmp 0x1006f47e
push edi
push 1
lea eax, [ebp - 0x54]
push 0x30
push eax
call fcn.1004d204
add esp, 0x10
cmp eax, 1
je 0x1006f36e
push ebx
push 0xb
push dword [ebp + 8]
mov ecx, esi
call fcn.1006f61c
push edi
call fcn.1004b9b6
pop ecx
jmp 0x1006f33b
cmp word [ebp - 0x54], 0x4944
jne 0x1006f358
mov eax, dword [ebp - 0x3c]
imul eax, eax, 0x28
add eax, dword [ebp - 0x38]
push 1
push eax
push edi
call fcn.1004d2a6
add esp, 0xc
test eax, eax
jne 0x1006f358
push edi
call fcn.1005462a
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
push 0x1c
xor edx, edx
pop ecx
div ecx
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1006f3ee
dec dword [ebp - 4]
push edi
push 1
lea eax, [ebp - 0x24]
push 0x1c
push eax
call fcn.1004d204
add esp, 0x10
cmp eax, 1
jne 0x1006f358
cmp byte [esi + 0xc94], bl
jne 0x1006f3e9
cmp dword [ebp - 0x18], 2
jne 0x1006f3e9
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xc98], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0xc9c], ebx
mov dword [esi + 0xca0], eax
cmp dword [ebp - 4], ebx
jne 0x1006f3aa
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [esi + 0xc80]
je 0x1006f40f
mov eax, dword [esi + 0xc84]
cmp eax, ebx
je 0x1006f407
cmp ecx, eax
je 0x1006f40f
push ebx
push 0x14
jmp 0x1006f35b
push dword [ebp + 8]
call fcn.1007a2a0
pop ecx
push ebx
push ebx
push dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0xc90], eax
mov dword [esi + 0xc8c], edi
call fcn.1006f61c
push ebx
push dword [ebp - 8]
push edi
call fcn.1004d2a6
add esp, 0xc
test eax, eax
jne 0x1006f47c
mov eax, dword [ebp - 0x34]
push 0x1c
xor edx, edx
pop ecx
div ecx
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1006f47c
dec dword [ebp - 4]
push edi
push 1
lea eax, [ebp - 0x24]
push 0x1c
push eax
call fcn.1004d204
add esp, 0x10
cmp eax, 1
jne 0x1006f47c
lea eax, [ebp - 0x24]
push eax
push ebx
mov ecx, esi
call fcn.1006f61c
cmp dword [ebp - 4], ebx
jne 0x1006f452
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1006f61c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1006f62b
pop dword [ebp - 0xc]
mov eax, 0x3256c109
add eax, 0xddb03522
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x5875d
push 0
mov eax, 0x179af1db
add eax, 0xf8651f49
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x7f9a4a9e
sub ecx, 0x7f9a0835
mov ebx, eax
mov esi, 0x323495a1
add esi, 0xddd5765f
add esi, dword [ebp - 0xc]
mov edi, 0x9cdb155e
mov edx, dword [esi]
xor dword [ebp - 4], 0xf20e811a
sub edx, edi
xor dword [ebp - 8], ecx
mov dword [ebx], edx
xor dword [ebp - 8], 0x89966797
add ebx, 0xd8932b6d
sub ebx, 0xd8932b69
add esi, 4
loop 0x1006f684
add eax, 0xfc77
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x100126d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100126e3
pop dword [ebp - 0x48]
mov eax, 0x54cda8fc
add eax, 0xbb337de7
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xcc07733f
add dword [ebp - 0x58], 0x824ad20c
mov dword [ebp - 0x54], 0x10bc5763
sub dword [ebp - 0x54], 0xde890b1e
mov dword [ebp - 0x50], 0xe036e7
sub dword [ebp - 0x50], 0xb493f2b9
mov dword [ebp - 0x4c], 0x3c750eab
add dword [ebp - 0x4c], 0xc38af155
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x16b6a8b
add dword [ebp - 0x58], 0x7306fecb
mov dword [ebp - 0x54], 0x260b07d9
sub dword [ebp - 0x54], 0xe49ea664
mov dword [ebp - 0x50], 0x85aeaf89
sub dword [ebp - 0x50], 0x223f431d
mov dword [ebp - 0x4c], 0x1dd5377
sub dword [ebp - 0x4c], 0x1dd5377
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xd3f9b64d
add eax, 0x3c0839f7
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3c241
push 0
call eax
mov ecx, 0xa20debe
add ecx, 0xf5df7407
xor edx, edx
add edx, eax
mov ebx, 0x2e5ecc2c
sub ebx, 0x1e5bda2c
add ebx, dword [ebp - 0x48]
mov edi, 0x493e4e77
add edi, 0xc2864736
add dword [ebp - 8], 0xed0275df
mov esi, dword [ebx]
xor esi, edi
xor dword [ebp - 0x30], 0xc01104f
mov dword [edx], esi
xor dword [ebp - 0x28], edx
add edx, 0xbce2277e
sub edx, 0xbce2277a
add ebx, 0x52d0d450
sub ebx, 0x52d0d44c
loop 0x10012802
add eax, 0x13de7
xor ebx, ebx
add ebx, eax
add eax, 0x927fbd85
sub eax, 0x927fbd80
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.100126d4
pop ecx
pop edi
pop esi
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x401970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0x10]
push ebx
call sym.Argon2RefTestCI.exe_argon2_ctx
add esp, 8
test eax, eax
jne 0x401a37
mov esi, dword [ebx + 4]
xor dl, dl
test esi, esi
je 0x401a24
mov edi, dword [ebp + 0xc]
cmp esi, 0x20
jb 0x401a15
mov edx, dword [ebx]
mov ecx, esi
and ecx, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movups xmm0, xmmword [eax + edi]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmm0, xmmword [edx + eax + 0x10]
por xmm3, xmm1
movups xmm1, xmmword [eax + edi + 0x10]
add eax, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp eax, ecx
jb 0x4019b0
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd edx, xmm2
cmp eax, esi
jae 0x401a24
mov ebx, dword [ebx]
mov cl, byte [ebx + eax]
xor cl, byte [eax + edi]
inc eax
or dl, cl
cmp eax, esi
jb 0x401a17
movzx eax, dl
dec eax
and eax, 0x100
neg eax
sbb eax, eax
and eax, 0x23
add eax, 0xffffffdd
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4034c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov eax, 0xaaaaaaab
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mul ecx
shr edx, 1
lea esi, [edx*4]
lea eax, [edx + edx*2]
mov dword [ebp - 0x10], esi
mov edx, ecx
sub edx, eax
sub edx, 1
je 0x4034f5
sub edx, 1
jne 0x4034fb
inc esi
add esi, 2
mov dword [ebp - 0x10], esi
cmp ebx, esi
ja 0x403509
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
xor esi, esi
test ecx, ecx
je 0x40363d
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
dec ecx
shl edx, 8
inc ebx
add esi, 8
mov dword [ebp + 0xc], ecx
add edx, eax
mov dword [ebp + 8], ebx
cmp esi, 6
jb 0x4035c0
sub esi, 6
mov ebx, edx
mov ecx, esi
shr ebx, cl
and ebx, 0x3f
mov dword [ebp - 4], ebx
lea eax, [ebx - 0x1a]
add ebx, 0xffffffcc
shr eax, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, eax
xor ecx, 0x3e
shr ebx, 8
neg ecx
xor eax, 0x3f
shr ecx, 8
neg eax
not cl
shr eax, 8
and cl, 0xfb
not al
or cl, al
mov eax, dword [ebp - 4]
and ecx, 0xffffff2f
mov dword [ebp - 8], ecx
lea ecx, [eax - 0x3e]
sub al, 4
shr ecx, 8
and cl, al
mov al, bl
not al
and cl, al
mov al, byte [ebp - 0xc]
or byte [ebp - 8], cl
not al
mov ecx, dword [ebp - 4]
add ecx, 0x47
and cl, al
mov eax, dword [ebp - 8]
and cl, bl
or al, cl
mov ecx, dword [ebp - 4]
add cl, 0x41
and cl, byte [ebp - 0xc]
or al, cl
mov byte [edi], al
inc edi
cmp esi, 6
jae 0x403534
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x403518
test esi, esi
je 0x40363d
mov ecx, 6
sub ecx, esi
shl edx, cl
and edx, 0x3f
mov ecx, edx
xor ecx, 0x3e
neg ecx
lea eax, [edx - 0x1a]
shr ecx, 8
shr eax, 8
lea ebx, [edx - 0x34]
mov dword [ebp - 0xc], eax
not cl
mov eax, edx
shr ebx, 8
xor eax, 0x3f
and cl, 0xfb
neg eax
shr eax, 8
not al
or cl, al
lea eax, [edx - 4]
and ecx, 0xffffff2f
mov dword [ebp + 0xc], ecx
lea ecx, [edx - 0x3e]
shr ecx, 8
and cl, al
mov al, bl
not al
and cl, al
mov al, byte [ebp - 0xc]
or byte [ebp + 0xc], cl
not al
lea ecx, [edx + 0x47]
add dl, 0x41
and dl, byte [ebp - 0xc]
and cl, al
mov eax, dword [ebp + 0xc]
and cl, bl
or al, cl
or al, dl
mov byte [edi], al
inc edi
mov eax, dword [ebp - 0x10]
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0x10]
push ebx
call sym.Argon2Opt.exe_argon2_ctx
add esp, 8
test eax, eax
jne 0x401937
mov esi, dword [ebx + 4]
xor dl, dl
test esi, esi
je 0x401924
mov edi, dword [ebp + 0xc]
cmp esi, 0x20
jb 0x401915
mov edx, dword [ebx]
mov ecx, esi
and ecx, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movups xmm0, xmmword [eax + edi]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmm0, xmmword [edx + eax + 0x10]
por xmm3, xmm1
movups xmm1, xmmword [eax + edi + 0x10]
add eax, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp eax, ecx
jb 0x4018b0
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd edx, xmm2
cmp eax, esi
jae 0x401924
mov ebx, dword [ebx]
mov cl, byte [ebx + eax]
xor cl, byte [eax + edi]
inc eax
or dl, cl
cmp eax, esi
jb 0x401917
movzx eax, dl
dec eax
and eax, 0x100
neg eax
sbb eax, eax
and eax, 0x23
add eax, 0xffffffdd
pop edi
pop esi
pop ebx
pop ebp
ret