joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042353
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [ebp - 0x10], 2
and dword [ebp - 4], 0
lea eax, [esi + 0x10098d50]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x18
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor edi, edi
add eax, esi
inc edi
shl eax, 8
lea eax, [eax + ecx + 0xc]
mov byte [ebx], 0
mov dword [ebp - 0x18], eax
movzx eax, byte [edi + 0x10098c50]
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx]
add eax, ecx
cdq
mov ecx, 0xff
idiv ecx
mov ecx, dword [ebp - 0x18]
mov al, byte [edx + 0x10098b50]
mov byte [ecx + edi], al
inc edi
mov eax, 0x100
cmp edi, eax
jb 0x10042399
inc dword [ebp - 4]
add ebx, eax
inc dword [ebp - 8]
dec dword [ebp - 0xc]
jne 0x10042381
add esi, 0x18
dec dword [ebp - 0x10]
jne 0x1004236d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100423e5
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp byte [ebp + 0xc], 1
push edi
mov dword [ebp - 4], eax
mov edi, 0xff
jne 0x10042436
movzx ecx, byte [eax + esi]
xor ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
and ecx, edi
shr edx, 8
xor edx, dword [ecx*4 + 0x10098750]
inc eax
cmp eax, 0x810
mov dword [ebp - 4], edx
jl 0x10042400
push 4
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x810]
push eax
call fcn.10062770
add esp, 0xc
cmp byte [ebp + 0xc], 2
jne 0x100424a4
cmp byte [ebp + 0x10], 1
push 0x10
pop eax
jne 0x1004246e
movzx ecx, byte [eax + esi]
xor ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
and ecx, edi
shr edx, 8
xor edx, dword [ecx*4 + 0x10098750]
inc eax
cmp eax, 0x818
mov dword [ebp - 4], edx
jl 0x10042445
add esi, 0x818
jmp 0x10042495
movzx ecx, byte [eax + esi]
xor ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
and ecx, edi
shr edx, 8
xor edx, dword [ecx*4 + 0x10098750]
inc eax
cmp eax, 0x92c
mov dword [ebp - 4], edx
jl 0x1004246e
add esi, 0x92c
push 4
lea eax, [ebp - 4]
push eax
push esi
call fcn.10062770
add esp, 0xc
pop edi
pop esi
leave
ret 0xc

Function at 0x100424af
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0xc
pop esi
lea eax, [edi + 0x81d]
mov dword [ebp - 4], 0x2b
and dword [ebp + 8], 0
movzx edx, byte [edi + esi]
add edx, dword [ebp + 8]
add esi, 0x56
add edx, ecx
mov bl, byte [edx + 0xc]
xor byte [eax - 1], bl
mov dl, byte [edx + 0x180c]
xor byte [eax + 0x55], dl
movzx edx, byte [edi + esi - 0x55]
add edx, dword [ebp + 8]
add dword [ebp + 8], 0x100
add edx, ecx
mov bl, byte [edx + 0xc]
xor byte [eax], bl
mov dl, byte [edx + 0x180c]
xor byte [eax + 0x56], dl
cmp dword [ebp + 8], 0x1800
jl 0x100424cf
inc eax
inc eax
sub esi, 0x80e
dec dword [ebp - 4]
jne 0x100424cb
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1004252b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
lea edx, [esi + 0x8610]
push edi
lea eax, [ecx + 0x8bd]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0x1a
and dword [ebp + 8], 0
mov edi, dword [ebp - 4]
add dword [ebp - 4], 0x3b20
mov edx, dword [edi - 4]
movzx edx, byte [ecx + edx]
add edx, dword [ebp + 8]
add edx, esi
mov bl, byte [edx + 0x300c]
xor byte [eax - 1], bl
mov dl, byte [edx + 0x5b0c]
xor byte [eax + 0x33], dl
mov edx, dword [edi]
movzx edx, byte [ecx + edx]
add edx, dword [ebp + 8]
add dword [ebp + 8], 0x100
add edx, esi
mov bl, byte [edx + 0x300c]
xor byte [eax], bl
mov dl, byte [edx + 0x5b0c]
xor byte [eax + 0x34], dl
add edi, 0x160
cmp dword [ebp + 8], 0x2b00
jl 0x1004255e
sub dword [ebp - 4], 0x39c8
inc eax
inc eax
dec dword [ebp - 8]
jne 0x10042550
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100426a6
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 0xc], 1
push edi
mov dword [ebp - 4], eax
mov edi, 0xff
jne 0x100426f3
movzx ecx, byte [eax + esi]
xor ecx, ebx
and ecx, edi
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10098750]
inc eax
cmp eax, 0x810
jb 0x100426c4
push 4
lea eax, [esi + 0x810]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10062770
add esp, 0xc
cmp byte [ebp + 0xc], 2
jne 0x10042753
cmp byte [ebp + 0x10], 1
push 0x10
pop eax
jne 0x10042724
movzx ecx, byte [eax + esi]
xor ecx, ebx
and ecx, edi
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10098750]
inc eax
cmp eax, 0x818
jb 0x10042702
add esi, 0x818
jmp 0x10042744
movzx ecx, byte [eax + esi]
xor ecx, ebx
and ecx, edi
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10098750]
inc eax
cmp eax, 0x92c
jb 0x10042724
add esi, 0x92c
push 4
lea eax, [ebp - 4]
push esi
push eax
call fcn.10062770
add esp, 0xc
cmp ebx, dword [ebp - 4]
pop edi
pop esi
sete al
pop ebx
leave
ret 0xc

Function at 0x10042765
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0xac
push 0
push ebx
mov edi, ecx
call fcn.100620c0
mov edx, dword [ebp + 8]
add esp, 0xc
push 0xc
pop esi
lea eax, [ebx + 1]
mov dword [ebp + 8], 0x2b
and dword [ebp + 0xc], 0
movzx ecx, byte [edx + esi]
add ecx, dword [ebp + 0xc]
add esi, 0x56
add ecx, edi
mov bl, byte [ecx + 0xc]
xor byte [eax - 1], bl
mov cl, byte [ecx + 0x180c]
xor byte [eax + 0x55], cl
movzx ecx, byte [edx + esi - 0x55]
add ecx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0x100
add ecx, edi
mov bl, byte [ecx + 0xc]
xor byte [eax], bl
mov cl, byte [ecx + 0x180c]
xor byte [eax + 0x56], cl
cmp dword [ebp + 0xc], 0x1800
jl 0x10042796
inc eax
inc eax
sub esi, 0x80e
dec dword [ebp + 8]
jne 0x10042792
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1004284c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x68
push 0
push edi
mov esi, ecx
call fcn.100620c0
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x8610]
add esp, 0xc
lea eax, [edi + 1]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x1a
and dword [ebp + 0xc], 0
mov edi, dword [ebp - 4]
add dword [ebp - 4], 0x3b20
mov ecx, dword [edi - 4]
movzx ecx, byte [edx + ecx]
add ecx, dword [ebp + 0xc]
add ecx, esi
mov bl, byte [ecx + 0x300c]
xor byte [eax - 1], bl
mov cl, byte [ecx + 0x5b0c]
xor byte [eax + 0x33], cl
mov ecx, dword [edi]
movzx ecx, byte [edx + ecx]
add ecx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0x100
add ecx, esi
mov bl, byte [ecx + 0x300c]
xor byte [eax], bl
mov cl, byte [ecx + 0x5b0c]
xor byte [eax + 0x34], cl
add edi, 0x160
cmp dword [ebp + 0xc], 0x2b00
jl 0x1004288c
sub dword [ebp - 4], 0x39c8
inc eax
inc eax
dec dword [ebp - 8]
jne 0x1004287e
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10042ba9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 1
mov esi, 0x800
push esi
call fcn.10064c9d
pop ecx
pop ecx
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10042beb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10042c17
push edi
lea eax, [ebp - 8]
push eax
push esi
mov esi, dword [ebp - 4]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10042c06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp + 8]
mov ecx, 0x200
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call fcn.10063d62
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10042d74
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 1
mov ebx, 0x800
xor edi, edi
push ebx
mov dword [ebp - 4], edi
call fcn.10064c9d
pop ecx
pop ecx
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x10042dbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
jmp 0x10042dfe
push edi
lea ecx, [ebp - 4]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10042dd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp + 8]
mov edi, eax
push ebx
add eax, 0x11000
push 0
mov ecx, 0x200
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.100620c0
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call fcn.10063d62
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10045d34
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
cmp byte [eax], dl
jne 0x10045daa
mov cl, 0xff
cmp byte [eax + 1], cl
jne 0x10045daa
cmp byte [eax + 2], cl
jne 0x10045daa
cmp byte [eax + 3], cl
jne 0x10045daa
cmp byte [eax + 4], cl
jne 0x10045daa
cmp byte [eax + 5], cl
jne 0x10045daa
cmp byte [eax + 6], cl
jne 0x10045daa
cmp byte [eax + 7], cl
jne 0x10045daa
cmp byte [eax + 8], cl
jne 0x10045daa
cmp byte [eax + 9], cl
jne 0x10045daa
cmp byte [eax + 0xa], cl
jne 0x10045daa
cmp byte [eax + 0xb], dl
jne 0x10045daa
test byte [eax + 0xf], 3
je 0x10045daa
add dword [0x1009c308], 1
lea ecx, [eax + 0xc]
push esi
adc dword [0x1009c30c], edx
mov edx, 0x10098fd8
sub edx, eax
mov eax, 0x249
mov esi, dword [edx + ecx]
xor dword [ecx], esi
add ecx, 4
dec eax
jne 0x10045d9e
pop esi
pop ebp
ret 4

Function at 0x10045e8a
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x1008963e
call fcn.10063057
mov ecx, dword [ebp + 0x14]
and dword [ebp - 0x24], 0
xor eax, eax
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov al, byte [ecx]
push 5
inc ecx
mov byte [ebp - 0x18], al
push ecx
lea eax, [ebp - 0x17]
push eax
call fcn.10062770
or byte [ebp - 0x12], 1
add esp, 0xc
push 0
lea eax, [ebp - 0x24]
push eax
push 0x10
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10045f2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1010
mov esi, eax
call fcn.10062b5c
pop ecx
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
test eax, eax
je 0x10045f17
push esi
push 0x100055c0
push esi
push 5
push eax
call fcn.10037a50
add esp, 0x14
jmp 0x10045f19
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], eax
push 0x1008bdb8
lea eax, [ebp - 0x2c]
push eax
call fcn.1006330f
cmp dword [ebp - 0x24], 0x10
je 0x10045f79
push 0x1010
call fcn.10062b5c
pop ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x10045f66
push 0x10
push dword [ebp - 0x24]
push 0x10005558
push 0
push 0xa
push eax
call fcn.10037a50
add esp, 0x18
jmp 0x10045f68
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], eax
push 0x1008bdb8
lea eax, [ebp - 0x28]
jmp 0x10045f28
call fcn.100630e9
ret 0x10
Function at 0x100468d6
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
xor eax, eax
xor edx, edx
push edi
movzx esi, byte [edx + ecx]
movzx edi, ax
shr edi, 8
shl eax, 8
xor esi, edi
xor ax, word [esi*2 + 0x10098dd8]
inc edx
cmp edx, 0xa
movzx eax, ax
jl 0x100468e4
mov edx, eax
shr edx, 8
not dl
not al
pop edi
mov byte [ecx + 0xa], dl
mov byte [ecx + 0xb], al
pop esi
pop ebp
ret 4
Function at 0x1005ce51
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1009a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
xor edx, edx
push 0x10
mov word [esi + 0x10], dx
mov ecx, esi
pop edx
movzx ebx, byte [ecx]
movzx edi, ax
shr edi, 8
shl eax, 8
xor edi, ebx
xor ax, word [edi*2 + 0x1000a748]
inc ecx
dec edx
movzx eax, ax
jne 0x1005ce76
not eax
movzx eax, ax
mov ecx, eax
shr ax, 8
shl ecx, 8
add cx, ax
lea eax, [ebp - 0x68]
push 0x1000a954
push eax
mov word [esi + 0x10], cx
call fcn.10062ada
pop ecx
pop ecx
push 0x12
lea edi, [ebp + eax - 0x68]
pop ebx
movzx eax, byte [esi]
push eax
push 0x1000a94c
push edi
call fcn.10062ada
add esp, 0xc
add edi, eax
inc esi
dec ebx
jne 0x1005cebf
push 0x1000a948
push edi
call fcn.10062ada
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10062074
leave
ret 4

Function at 0x1005d4e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 8
mov eax, 0x1008b162
call fcn.10062fe4
mov esi, ecx
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea edi, [esi + 0x1272]
push edi
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x1005d55e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1010
mov esi, eax
call fcn.10062b5c
pop ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
test eax, eax
je 0x1005d547
push esi
push dword [ebp + 8]
push 0x1000a9f0
push esi
push 5
push eax
call fcn.10037a50
add esp, 0x18
jmp 0x1005d549
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp + 8], eax
push 0x1008bdb8
lea eax, [ebp + 8]
push eax
call fcn.1006330f
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
jne 0x1005d5b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1010
mov esi, eax
call fcn.10062b5c
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x1005d5a6
push esi
push esi
push dword [ebp + 8]
push 0x1000a988
push esi
push 5
push eax
call fcn.10037a50
add esp, 0x1c
jmp 0x1005d5a8
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
push 0x1008bdb8
lea eax, [ebp - 0x14]
jmp 0x1005d558
lea eax, [esi + 0x1172]
cmp byte [eax], 0
jne 0x1005d5e2
cmp dword [ebp - 0x10], 0
push 0xff
je 0x1005d5d4
push dword [ebp - 0x10]
jmp 0x1005d5d9
push 0x1000a980
push eax
call fcn.10062580
add esp, 0xc
call fcn.100630d0
ret 4
Function at 0x1005da69
Capabilities:
Enumerate files on windows

Disassembly:
push 0x360
mov eax, 0x1008b235
call fcn.10063057
lea ebx, [ecx + 0x1272]
push ebx
lea eax, [ebp - 0x11c]
push 0x10003a30
push eax
mov dword [ebp - 0x368], ecx
call fcn.10062ada
add esp, 0xc
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x364], eax
cmp eax, 0xffffffff
jne 0x1005db11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1010
mov esi, eax
call fcn.10062b5c
pop ecx
mov dword [ebp - 0x368], eax
and dword [ebp - 4], 0
test eax, eax
je 0x1005daf4
push esi
lea ecx, [ebp - 0x11c]
push ecx
push 0x1000acd8
push esi
push 5
push eax
call fcn.10037a50
add esp, 0x18
jmp 0x1005daf6
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x364], eax
push 0x1008bdb8
lea eax, [ebp - 0x364]
push eax
call fcn.1006330f
mov esi, dword [ebp - 0x360]
and esi, 0x10
je 0x1005db40
cmp byte [ebp - 0x334], 0x2e
jne 0x1005db40
lea eax, [ebp - 0x334]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005db2e
sub eax, edx
cmp eax, 1
je 0x1005dbc9
test esi, esi
je 0x1005db6d
cmp byte [ebp - 0x334], 0x2e
jne 0x1005db6d
cmp byte [ebp - 0x333], 0x2e
jne 0x1005db6d
lea eax, [ebp - 0x334]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005db5f
sub eax, edx
cmp eax, 2
je 0x1005dbc9
lea eax, [ebp - 0x334]
push eax
push ebx
lea eax, [ebp - 0x220]
push 0x10002638
push eax
call fcn.10062ada
push 0x1390
call fcn.10062b5c
mov ecx, eax
add esp, 0x14
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 4], 1
test ecx, ecx
je 0x1005dbc5
push dword [ebp - 0x368]
lea eax, [ebp - 0x220]
push dword [ebp - 0x360]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.1005d86b
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x360]
push eax
push dword [ebp - 0x364]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1005db11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x364]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0x12
je 0x1005dc50
push 0x1010
call fcn.10062b5c
pop ecx
mov dword [ebp - 0x36c], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x1005dc34
push esi
lea ecx, [ebp - 0x11c]
push ecx
push 0x1000ac88
push esi
push 5
push eax
call fcn.10037a50
add esp, 0x18
jmp 0x1005dc36
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x368], eax
push 0x1008bdb8
lea eax, [ebp - 0x368]
jmp 0x1005db0b
call fcn.100630e9
ret
Function at 0x10060427
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1009a008]
xor eax, ebp
mov dword [ebp - 4], eax
movzx edx, byte [ecx + 1]
push ebx
push esi
movzx esi, byte [ecx + 4]
shl esi, 8
mov dword [ebp - 0x14], edx
movzx edx, byte [ecx + 2]
push edi
movzx edi, byte [ecx]
movzx ecx, byte [ecx + 3]
or esi, ecx
shl esi, 8
or esi, edx
lea ecx, [esi + esi + 8]
and edx, 7
sub ecx, edx
and dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov edx, 0xff
mov esi, ecx
shr esi, 8
and esi, edx
movzx esi, byte [esi + 0x10099d08]
mov ebx, ecx
and ebx, edx
movzx ebx, byte [ebx + 0x10099d08]
shl ebx, 8
or esi, ebx
mov ebx, ecx
shr ebx, 0x10
and ebx, edx
movzx edx, byte [ebx + 0x10099d08]
shl esi, 8
shr ecx, 0x18
movzx ecx, byte [ecx + 0x10099d08]
or esi, edx
shl esi, 8
or edi, 0x100
or esi, ecx
and dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x14]
mov cl, byte [ecx + 0x10099a08]
xor cl, byte [edi + 0x10099b08]
mov edx, edi
shr edx, 1
mov dword [ebp - 0x14], edx
movzx edx, cl
mov ecx, esi
shr ecx, 0x13
mov ebx, esi
shr ebx, 0xb
xor cl, bl
mov ebx, esi
shr ebx, 0xa
xor cl, bl
mov ebx, esi
shr ebx, 7
xor cl, bl
movzx ecx, cl
and edi, 1
mov ebx, ecx
shl ebx, 0x18
shr esi, 8
shl edi, 8
xor edi, edx
or esi, ebx
movzx ebx, byte [edx + 0x10099d08]
movzx edx, byte [ebp + 0xc]
xor edx, ecx
add edx, dword [ebp - 0x18]
lea ecx, [edx + ebx]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0xc], cl
shr ecx, 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
mov dword [ebp - 0x18], ecx
jl 0x100604bb
movzx edx, byte [eax + 4]
mov dl, byte [edx + str.3s_ckv_6n.f]
mov cl, byte [eax + 3]
xor dl, cl
xor dl, byte [ebp - 8]
movzx ecx, cl
mov byte [eax + 4], dl
mov cl, byte [ecx + str.3s_ckv_6n.f]
mov dl, byte [eax + 2]
xor cl, dl
xor cl, byte [ebp - 9]
movzx edx, dl
mov byte [eax + 3], cl
mov dl, byte [edx + str.3s_ckv_6n.f]
mov cl, byte [eax + 1]
xor dl, cl
xor dl, byte [ebp - 0xa]
movzx ecx, cl
mov byte [eax + 2], dl
mov cl, byte [ecx + str.3s_ckv_6n.f]
mov dl, byte [eax]
xor cl, dl
xor cl, byte [ebp - 0xb]
movzx edx, dl
mov byte [eax + 1], cl
mov dl, byte [edx + str.3s_ckv_6n.f]
mov cl, byte [eax + 4]
xor dl, cl
xor dl, byte [ebp - 0xc]
movzx ecx, cl
mov byte [eax], dl
mov cl, byte [ecx + str.3s_ckv_6n.f]
mov dl, byte [eax + 3]
xor cl, dl
xor cl, byte [ebp - 8]
movzx edx, dl
mov byte [eax + 4], cl
mov dl, byte [edx + str.3s_ckv_6n.f]
mov cl, byte [eax + 2]
xor dl, cl
xor dl, byte [ebp - 9]
movzx ecx, cl
mov byte [eax + 3], dl
mov cl, byte [ecx + str.3s_ckv_6n.f]
mov dl, byte [eax + 1]
xor cl, dl
xor cl, byte [ebp - 0xa]
movzx edx, dl
mov byte [eax + 2], cl
mov dl, byte [edx + str.3s_ckv_6n.f]
mov cl, byte [eax]
xor dl, cl
xor dl, byte [ebp - 0xb]
movzx ecx, cl
mov byte [eax + 1], dl
mov cl, byte [ecx + str.3s_ckv_6n.f]
xor cl, byte [ebp - 0xc]
pop edi
mov byte [eax], cl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10062074
leave
ret 8
Function at 0x10066f15
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x1000c528
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x10066f67
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000c594
push edi
call esi
push 0x1000c588
push edi
mov dword [0x1009c3a8], eax
call esi
push 0x1000c57c
push edi
mov dword [0x1009c3ac], eax
call esi
push 0x1000c574
push edi
mov dword [0x1009c3b0], eax
call esi
mov dword [0x1009c3b4], eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0x1009c3a8], ebx
je 0x10066f8d
cmp dword [0x1009c3ac], ebx
je 0x10066f8d
cmp dword [0x1009c3b0], ebx
je 0x10066f8d
cmp dword [0x1009c3b4], ebx
jne 0x10066fb1
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x1009c3ac], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x1009c3a8], 0x10066b64
mov dword [0x1009c3b0], esi
mov dword [0x1009c3b4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1009a49c], eax
cmp eax, 0xffffffff
je 0x10067024
push dword [0x1009c3ac]
push eax
call esi
test eax, eax
je 0x10067024
call fcn.10066a1f
push dword [0x1009c3a8]
call fcn.10066a66
push dword [0x1009c3ac]
mov dword [0x1009c3a8], eax
call fcn.10066a66
push dword [0x1009c3b0]
mov dword [0x1009c3ac], eax
call fcn.10066a66
push dword [0x1009c3b4]
mov dword [0x1009c3b0], eax
call fcn.10066a66
add esp, 0x10
mov dword [0x1009c3b4], eax
call fcn.1006c81d
test eax, eax
jne 0x1006702a
call fcn.10066ba1
xor eax, eax
pop edi
pop esi
pop ebx
ret
push fcn.10066d50
push dword [0x1009c3a8]
call fcn.10066aec
pop ecx
call eax
mov dword [0x1009a4a0], eax
cmp eax, 0xffffffff
je 0x1006701f
push 0x214
push 1
call fcn.10072147
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x1006701f
push esi
push dword [0x1009a4a0]
push dword [0x1009c3b0]
call fcn.10066aec
pop ecx
call eax
test eax, eax
jne 0x1006707d
push esi
call fcn.10063d62
pop ecx
jmp 0x1006701f
push ebx
push esi
call fcn.10066be3
or dword [esi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x10067026
Function at 0x1006d520
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x1009ad30]
je 0x1006d546
inc esi
mov dword [ebp - 4], esi
cmp esi, 0x17
jb 0x1006d534
cmp esi, 0x17
jae 0x1006d6a0
push 3
call fcn.100740f0
pop ecx
cmp eax, 1
je 0x1006d66a
push 3
call fcn.100740f0
pop ecx
test eax, eax
jne 0x1006d579
cmp dword [0x1009c338], 1
je 0x1006d66a
cmp edi, 0xfc
je 0x1006d6a0
push 0x1000cce0
mov edi, 0x314
push edi
mov esi, 0x1009ca40
push esi
call fcn.100643eb
add esp, 0xc
test eax, eax
je 0x1006d5af
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100688c2
add esp, 0x14
mov byte [0x1009cb5d], bl
push 0x104
mov ebx, 0x1009ca59
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1006d5f2
push 0x1000ccc8
push 0x2fb
push ebx
call fcn.100643eb
add esp, 0xc
test eax, eax
je 0x1006d5f2
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.100688c2
add esp, 0x14
push ebx
push edi
push esi
call fcn.10071237
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x1006d610
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100688c2
add esp, 0x14
push 0x10004ff0
push edi
push esi
call fcn.10071237
add esp, 0xc
test eax, eax
je 0x1006d630
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100688c2
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x1009ad34]
push edi
push esi
call fcn.10071237
add esp, 0xc
test eax, eax
je 0x1006d655
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100688c2
add esp, 0x14
push 0x12010
push 0x1000cca0
push esi
call fcn.10073f49
add esp, 0xc
jmp 0x1006d6a0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x1006d6a0
cmp edi, 0xffffffff
je 0x1006d6a0
mov edx, dword [esi*8 + 0x1009ad34]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006d689
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret