joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57c8c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x695e80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push esi
mov eax, dword [esi]
call dword [eax + 0x20]
test eax, eax
je 0x57c910
push 0x8db
mov ecx, 0x6b8778
call fcn.0044a110
push eax
push 0x17
push 0x6b8778
call fcn.00449a00
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00585d34
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6c46a4]
mov dword [ebp - 0x210], 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
lea edx, [ebp - 0x210]
push edx
push 0x5c81a0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x134]
test eax, eax
je 0x57c8ff
cmp dword [esi + 0xc], 0
jne 0x57c975
push str.bdcap32.dll
mov ecx, esi
call fcn.0057caa0
test eax, eax
jns 0x57c95b
push 0x8dc
jmp 0x57c8e5
mov eax, dword [esi]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call dword [eax + 0xc]
cmp dword [esi + 0xc], 0
je 0x57ca3a
mov eax, dword [esi]
push 0x3c
push 0x1e
push esi
call dword [eax + 0x40]
mov ecx, esi
call fcn.0057cf00
push 0
mov ecx, 0x5ef6e0
call fcn.0045b4b0
push eax
lea eax, [ebp - 0x108]
push str._sScreenShot
push eax
call fcn.0058729c
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x57c9d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x57c9d1
push 0x8de
jmp 0x57c8e5
push 0x104
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
push 0x5c82d8
push str.Capture
lea eax, [ebp - 0x108]
push eax
call fcn.0057ce30
lea eax, [ebp - 0x20c]
mov ecx, 0x6b8778
push eax
push 0x8df
call fcn.0044a110
push eax
push 0x17
push 0x6b8778
call fcn.00449a00
add esp, 0x10
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
push 4
push 0
push eax
push esi
call fcn.0057d030
test eax, eax
js 0x57c8ff
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00585d34
mov esp, ebp
pop ebp
ret
Function at 0x59b4f7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x695e80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0058dbc7
mov dword [ebp - 0x14], eax
cmp dword [0x6d84e8], esi
jne 0x59b5ea
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x59b577
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x59b6ca
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x59b6ca
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x59b6ca
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x6d84e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x6d84ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x6d84f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x6d84f8], eax
test eax, eax
je 0x59b5e7
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x6d84f4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x59b60f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x59b602
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x59b624
push 4
pop eax
jmp 0x59b6cc
cmp dword [ebp - 0x14], esi
je 0x59b624
push dword [0x6d84e8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x59b609
mov eax, dword [0x6d84f4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x59b682
cmp dword [0x6d84f8], edi
je 0x59b682
push eax
call ebx
push dword [0x6d84f8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x59b682
test eax, eax
je 0x59b682
call ecx
test eax, eax
je 0x59b677
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x59b677
test byte [ebp - 8], 1
jne 0x59b682
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x59b6b2
mov eax, dword [0x6d84ec]
cmp eax, edi
je 0x59b6af
push eax
call ebx
test eax, eax
je 0x59b6af
call eax
mov esi, eax
test esi, esi
je 0x59b6af
mov eax, dword [0x6d84f0]
cmp eax, edi
je 0x59b6af
push eax
call ebx
test eax, eax
je 0x59b6af
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x6d84e8]
call ebx
test eax, eax
je 0x59b6ca
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x59b6cc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00585d34
mov esp, ebp
pop ebp
ret
Function at 0x20029da
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x3c
push 0x20244b8
call fcn.02007290
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
xor edi, edi
mov dword [ebp - 0x20], edi
xor edx, edx
mov dword [ebp - 0x24], edx
xor esi, esi
mov al, byte [ebp + 0x10]
mov byte [ebp + 0xf], al
mov eax, dword [0x20273e0]
mov dword [ebp - 0x28], eax
mov eax, dword [0x20273d4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x34]
jge 0x2002b6e
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [ebp - 0x19], al
mov ebx, edx
imul ebx, dword [ebp + 0x10]
add ebx, 0x2e
mov dword [ebp - 0x3c], ebx
cmp dword [0x20273ec], 0
je 0x2002a52
mov ecx, esi
imul ecx, ecx, 6
inc ecx
mov eax, edx
cdq
idiv ecx
imul eax, ebx
imul eax, dword [ebp + 0x10]
imul eax, eax, 5
add edi, eax
mov dword [ebp - 0x20], edi
xor byte [ebp - 0x19], bl
mov ecx, dword [0x20273d8]
movzx eax, cx
cdq
mov dword [ebp - 0x38], 0x14
idiv dword [ebp - 0x38]
add eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x44]
add ecx, eax
mov dword [0x20273d8], ecx
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp + 0xf]
jmp 0x2002abb
mov edx, dword [ebp + 8]
movzx ecx, dl
movzx eax, al
cmp dword [ebp + 0x10], 0
cmovne ecx, eax
mov byte [esi + edx], cl
cmp dword [0x20273e4], 0
je 0x2002aeb
mov eax, ebx
imul eax, esi
imul eax, dword [ebp + 0x10]
add eax, 6
imul eax, esi
add edi, eax
mov dword [ebp - 0x20], edi
mov eax, dword [0x20273e0]
mov dword [ebp - 0x28], eax
movzx ecx, al
movzx eax, word [0x20273e8]
imul ecx, eax
movzx eax, word [0x20273d4]
cdq
mov dword [ebp - 0x3c], 0x3f
idiv dword [ebp - 0x3c]
add ecx, eax
sub ecx, dword [ebp - 0x48]
mov dword [ebp - 0x2c], ecx
mov dword [0x20273d4], ecx
mov eax, ebx
imul eax, edi
imul eax, edi
add eax, 0x44
cdq
push 0xfffffffffffffffd
pop ecx
idiv ecx
mov edx, dword [ebp - 0x24]
add edx, eax
mov dword [ebp - 0x24], edx
cmp ebx, edi
jle 0x2002b41
dec edx
mov dword [ebp - 0x24], edx
cmp dword [0x20273e4], 0x200
jle 0x2002b68
cmp edx, esi
jge 0x2002b68
imul ebx, edx
imul ebx, edi
imul ebx, ebx, 0xffffffe7
mov eax, ebx
cdq
idiv dword [ebp + 0x10]
add edi, eax
mov dword [ebp - 0x20], edi
mov edx, dword [ebp - 0x24]
inc esi
jmp 0x2002a0e
call fcn.020072d5
ret 0xc
Function at 0x2010834
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x2026168]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0201032b
mov dword [ebp - 0x14], eax
cmp dword [0x2027ff4], edi
jne 0x2010925
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x20108b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x2010a05
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x2010a05
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x2010a05
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x2027ff4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x2027ff8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x2027ffc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2028004], eax
test eax, eax
je 0x2010922
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2028000], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x201094a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x201093d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x201095f
push 4
pop eax
jmp 0x2010a07
cmp dword [ebp - 0x14], edi
je 0x201095f
push dword [0x2027ff4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x2010944
mov eax, dword [0x2028000]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x20109bd
cmp dword [0x2028004], esi
je 0x20109bd
push eax
call ebx
push dword [0x2028004]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x20109bd
test eax, eax
je 0x20109bd
call ecx
test eax, eax
je 0x20109b2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x20109b2
test byte [ebp - 8], 1
jne 0x20109bd
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x20109ed
mov eax, dword [0x2027ff8]
cmp eax, esi
je 0x20109ea
push eax
call ebx
test eax, eax
je 0x20109ea
call eax
mov edi, eax
test edi, edi
je 0x20109ea
mov eax, dword [0x2027ffc]
cmp eax, esi
je 0x20109ea
push eax
call ebx
test eax, eax
je 0x20109ea
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x2027ff4]
call ebx
test eax, eax
je 0x2010a05
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x2010a07
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.020071d2
leave
ret
Function at 0x4068a7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4280b4], 0
jne 0x4068e5
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068bb
mov dword [ecx*4 + 0x4280b0], eax
inc ecx
cmp ecx, 0x100
jl 0x4068b6
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406912
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4280b0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068f3
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001cc00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1001cd95
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1001cd95
xor edx, edx
div dword [esi + 0x3cc]
mov dword [ebp - 4], eax
test edx, edx
jne 0x1001cd95
mov ecx, dword [ebp + 0x14]
push ebx
push edi
cmp ecx, 1
jne 0x1001ccca
mov eax, dword [ebp + 8]
xor ecx, ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0x14], ecx
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ecx
jbe 0x1001cd93
lea edi, [esi + 0x3f4]
nop word [eax + eax]
push ebx
push eax
mov ecx, esi
call sym.BLauncher.dll_private:_void___thiscall_AES::DecryptBlock_char_const___char__
cmp byte [esi + 4], 0
mov edx, ebx
je 0x1001cc92
xor ecx, ecx
cmp dword [esi + 0x3cc], ecx
jle 0x1001cc92
nop dword [eax + eax]
mov al, byte [edi + ecx]
lea edx, [edx + 1]
xor byte [edx - 1], al
inc ecx
cmp ecx, dword [esi + 0x3cc]
jl 0x1001cc80
push dword [esi + 0x3cc]
push dword [ebp + 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
add esp, 0xc
div ecx
add dword [ebp + 8], ecx
add ebx, ecx
inc dword [ebp + 0x14]
cmp dword [ebp + 0x14], eax
mov eax, dword [ebp + 8]
jb 0x1001cc60
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, 2
jne 0x1001cd60
mov edi, dword [ebp + 8]
xor ecx, ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0x14], ecx
test eax, eax
je 0x1001cd93
lea eax, [esi + 0x3f4]
nop dword [eax]
push ebx
push eax
mov ecx, esi
call sym.BLauncher.dll_private:_void___thiscall_AES::EncryptBlock_char_const___char__
cmp byte [esi + 4], 0
mov edx, ebx
je 0x1001cd22
xor ecx, ecx
cmp dword [esi + 0x3cc], ecx
jle 0x1001cd22
nop dword [eax + eax]
mov al, byte [ecx + edi]
lea edx, [edx + 1]
xor byte [edx - 1], al
inc ecx
cmp ecx, dword [esi + 0x3cc]
jl 0x1001cd10
push dword [esi + 0x3cc]
lea eax, [esi + 0x3f4]
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
add esp, 0xc
div ecx
inc dword [ebp + 0x14]
add edi, ecx
add ebx, ecx
cmp dword [ebp + 0x14], eax
lea eax, [esi + 0x3f4]
jb 0x1001ccf0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], edi
jbe 0x1001cd93
push eax
push ebx
mov ecx, esi
call sym.BLauncher.dll_private:_void___thiscall_AES::DecryptBlock_char_const___char__
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
inc edi
div ecx
add dword [ebp + 8], ecx
add ebx, ecx
cmp edi, eax
mov eax, dword [ebp + 8]
jb 0x1001cd70
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001e670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1001e805
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1001e805
mov ecx, dword [esi + 0x3cc]
xor edx, edx
div ecx
mov dword [ebp - 4], eax
test edx, edx
jne 0x1001e805
mov edx, dword [ebp + 0x14]
push ebx
push edi
cmp edx, 1
jne 0x1001e738
mov edi, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0x14], edx
mov dword [ebp - 4], edi
mov dword [ebp + 8], ebx
test eax, eax
je 0x1001e803
lea ebx, [esi + 0x3f4]
nop
cmp byte [esi + 4], 0
mov eax, ebx
je 0x1001e6f5
xor edx, edx
test ecx, ecx
jle 0x1001e6f5
sub edi, ebx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x1001e6e0
mov edi, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, esi
push ebx
call sym.BLauncher.dll_private:_void___thiscall_AES::EncryptBlock_char_const___char__
push dword [esi + 0x3cc]
push dword [ebp + 8]
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
add edi, ecx
div ecx
inc dword [ebp + 0x14]
add esp, 0xc
add dword [ebp + 8], ecx
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], eax
jb 0x1001e6d0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 2
jne 0x1001e7d0
mov edi, dword [ebp + 8]
xor ecx, ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0x14], ecx
test eax, eax
je 0x1001e803
lea eax, [esi + 0x3f4]
nop word [eax + eax]
push ebx
push eax
mov ecx, esi
call sym.BLauncher.dll_private:_void___thiscall_AES::EncryptBlock_char_const___char__
cmp byte [esi + 4], 0
mov edx, ebx
je 0x1001e792
xor ecx, ecx
cmp dword [esi + 0x3cc], ecx
jle 0x1001e792
nop dword [eax + eax]
mov al, byte [ecx + edi]
lea edx, [edx + 1]
xor byte [edx - 1], al
inc ecx
cmp ecx, dword [esi + 0x3cc]
jl 0x1001e780
push dword [esi + 0x3cc]
lea eax, [esi + 0x3f4]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
add esp, 0xc
div ecx
inc dword [ebp + 0x14]
add edi, ecx
add ebx, ecx
cmp dword [ebp + 0x14], eax
lea eax, [esi + 0x3f4]
jb 0x1001e760
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], edi
jbe 0x1001e803
push eax
push ebx
mov ecx, esi
call sym.BLauncher.dll_private:_void___thiscall_AES::EncryptBlock_char_const___char__
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [ebp + 0x10]
inc edi
div ecx
add dword [ebp + 8], ecx
add ebx, ecx
cmp edi, eax
mov eax, dword [ebp + 8]
jb 0x1001e7e0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001fd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1001fdb3
xor edx, edx
cmp dword [esi + 0x3cc], edx
jle 0x1001fdb3
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
nop
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x1001fda0
pop edi
pop esi
pop ebp
ret 8
Function at 0x1002f740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1002f28d
movsx edx, cx
cdq
lea eax, [ebp - 0x84]
push eax
call fcn.1002f29d
push eax
push esi
push dword [ebp + 8]
call fcn.1002f252
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x1002fa86
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.1002f1fe
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x1002f7fd
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.1002f1fe
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1002f7ca
call fcn.1002f28d
push ebp
imul eax, dword [edx + 0x3c7e8be3], 3
dec byte [ecx - 0x8743]
dec dword [ebx + 0x8087]
add byte [ebx], bh
ret
xor eax, eax
Function at 0x1002f9c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1002f964
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1002f982
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1002f9e0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
invalid
je 0x1002f9c7
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1002f9d0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1002f9da
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1002f9bc
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1002f946
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1002fa2d
dec eax
je 0x1002fa24
sub eax, 3
je 0x1002fa1b
mov dword [ebp - 4], 0x40
jmp 0x1002fa4a
mov dword [ebp - 4], 4
jmp 0x1002fa30
mov dword [ebp - 4], 0x20
jmp 0x1002fa30
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1002fa7c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1002f9fc
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1002f28d
pushal
scasd eax, dword es:[edi]
jl 0x1002faa3
push 0x8000
push ebx
push esi
call dword [ebp - 8]
cld
invalid
Function at 0x1002fae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1002f29d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1002f252
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
Function at 0x1003e710
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004fba7
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x1009455c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call fcn.100461a0
mulsd xmm0, qword [0x1005d630]
call fcn.100460f0
mov ecx, dword [ebp - 0x40]
mov ebx, edx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x60], eax
call fcn.100461a0
mulsd xmm0, qword [0x1005d630]
call fcn.100460f0
push 0x18
push str.Free__1_MB___Total__2_MB
mov edi, eax
mov esi, edx
call dword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____cdecl_QString::fromAscii_helper_char_const___int_]
mov dword [ebp - 0x58], eax
add esp, 4
mov byte [ebp - 0x54], 0x20
mov ecx, esp
mov dword [ebp - 4], 0
push dword [ebp - 0x54]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0xa
push 0
push esi
push edi
mov edi, dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_long_long___int64___int__int__class_QChar_]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x58]
call edi
mov esi, eax
push ecx
mov byte [ebp - 0x54], 0x20
mov ecx, esp
push dword [ebp - 0x54]
mov byte [ebp - 4], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0xa
push 0
push ebx
push dword [ebp - 0x60]
mov ebx, dword [ebp - 0x64]
mov ecx, esi
push ebx
call edi
lea ecx, [ebp - 0x5c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x58]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045fcb
mov esp, ebp
pop ebp
ret