joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fc0c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne case.default.0x100fc0d1
mov eax, dword [ebp + 0x10]
cmp eax, 4
ja case.default.0x100fc0d1
jmp dword [eax*4 + 0x100fc114]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.100fd390
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1003a690
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1003a940
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1003bc80
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xcc]

Function at 0x100fc0ea
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne case.default.0x100fc0d1
mov eax, dword [ebp + 0x10]
cmp eax, 4
ja case.default.0x100fc0d1
jmp dword [eax*4 + 0x100fc114]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.100fd390
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1003a690
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1003a940
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1003bc80
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xcc]

Function at 0x101075e0
Capabilities:
Get number of processors

Disassembly:
push esi
mov esi, ecx
call sym.libnomacs.dll_public:_static_void___cdecl_nmc::DkSettings::setToDefaultSettings_void_
mov ecx, esi
call fcn.100c1660
mov ecx, esi
call fcn.101080a0
mov ecx, esi
pop esi
jmp fcn.101080c0
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne case.default.0x101075f1
mov eax, dword [ebp + 0x10]
cmp eax, 9
ja case.default.0x101075f1
jmp dword [eax*4 + 0x10107664]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.101076b0
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.101080e0
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.101080c0
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.101080a0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax + 4]
call fcn.100c1760
pop ebp
ret
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c1ef0
mov ecx, dword [ebp + 8]
pop ebp
jmp dword [sym.imp.QtGui4.dll_public:_bool___thiscall_QWidget::close_void_]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c1660
mov ecx, dword [ebp + 8]
pop ebp
jmp 0x100c2310
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.100bade0
pop ebp
ret
Function at 0x10120140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0xa8], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa0], 0
movzx eax, word [esi + 0x2c]
cmp eax, 0x1e
jb 0x10120178
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov cl, al
mov edi, 1
shl edi, cl
lea ebx, [edi + edi]
push ebx
mov dword [ebp + 8], ebx
call fcn.1011e0a0
add esp, 4
mov dword [esi + 0xa0], eax
test eax, eax
je 0x10120341
xor ecx, ecx
mov word [eax], cx
cmp edi, 1
jbe 0x1012028c
movsd xmm1, qword [0x1018e828]
mov eax, edi
movd xmm0, edi
mov ebx, 1
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1018f320]
subsd xmm0, xmm1
divsd xmm1, xmm0
movsd qword [ebp - 8], xmm1
mov edi, edi
movd xmm0, ebx
mov eax, ebx
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1018f320]
mulsd xmm0, xmm1
movsd xmm1, qword [0x10210998]
call sub.MSVCR120.dll___libm_sse2_pow
movsd xmm3, qword [0x102109a8]
movapd xmm4, xmm0
mulsd xmm4, qword [0x10196e48]
mov eax, dword [esi + 0xa0]
movsd xmm1, qword [0x102109a0]
addsd xmm4, qword [0x1018e820]
andpd xmm3, xmm4
movapd xmm0, xmm4
xorpd xmm0, xmm3
movapd xmm2, xmm4
cmpltsd xmm0, xmm1
andpd xmm1, xmm0
orpd xmm1, xmm3
addsd xmm2, xmm1
subsd xmm2, xmm1
movsd xmm1, qword [0x1018e828]
movapd xmm0, xmm2
subsd xmm0, xmm4
cmpnlesd xmm0, xmm3
andpd xmm0, xmm1
movsd xmm1, qword [ebp - 8]
subsd xmm2, xmm0
cvttsd2si ecx, xmm2
mov word [eax + ebx*2], cx
inc ebx
cmp ebx, edi
jb 0x101201e0
mov ebx, dword [ebp + 8]
movzx eax, word [esi + 0x74]
movzx ecx, word [esi + 0x3a]
sub ecx, eax
cmp ecx, 1
jle 0x101202de
push ebx
call fcn.1011e0a0
add esp, 4
mov dword [esi + 0xa4], eax
test eax, eax
je 0x101202ea
push ebx
push dword [esi + 0xa0]
push eax
call fcn.1011e120
push ebx
call fcn.1011e0a0
add esp, 0x10
mov dword [esi + 0xa8], eax
test eax, eax
je 0x101202ea
push ebx
push dword [esi + 0xa0]
push eax
call fcn.1011e120
add esp, 0xc
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x101202fd
push eax
call sub.MSVCR120.dll_free
add esp, 4
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x10120310
push eax
call sub.MSVCR120.dll_free
add esp, 4
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x10120323
push eax
call sub.MSVCR120.dll_free
add esp, 4
mov dword [esi + 0xa8], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa0], 0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101401b0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x102a28f8], 0
jne 0x1014027a
xor ecx, ecx
nop
lea eax, [ecx - 0xff]
cdq
lea ecx, [ecx + 1]
xor eax, edx
sub eax, edx
mov byte [ecx + 0x102a28ff], al
shr al, 1
mov byte [ecx + 0x102a2aff], al
lea eax, [ecx - 0xff]
cmp eax, 0xff
jle 0x101401c0
mov eax, 0xfffffc04
mov edx, 0x7f
cmp eax, 0xffffff80
jge 0x101401ff
mov ecx, 0xffffff80
jmp 0x10140207
cmp eax, 0x7f
mov ecx, eax
cmovg ecx, edx
mov byte [eax + 0x102a30fc], cl
inc eax
cmp eax, 0x3fc
jle 0x101401f3
mov eax, 0xffffff90
lea edx, [eax + 0x7f]
lea ecx, [ecx]
cmp eax, 0xfffffff0
jge 0x1014022c
mov ecx, 0xfffffff0
jmp 0x10140234
cmp eax, 0xf
mov ecx, eax
cmovg ecx, edx
mov byte [eax + 0x102a3570], cl
inc eax
cmp eax, 0x70
jle 0x10140220
mov eax, 0xffffff01
mov edx, 0xff
lea ebx, [ebx]
test eax, eax
jns 0x10140258
xor ecx, ecx
jmp 0x10140262
cmp eax, 0xff
mov ecx, eax
cmovg ecx, edx
mov byte [eax + 0x102a36e7], cl
inc eax
cmp eax, 0x1fe
jle 0x10140250
mov dword [0x102a28f8], 1
ret
Function at 0x10145450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebx]
lea eax, [eax + esi*2]
add eax, esi
imul ecx, eax, 0x2c
mov eax, dword [ebx + 4]
add ecx, dword [ebx + 0x14]
test eax, eax
jns 0x10145490
mov eax, dword [ecx]
cmp eax, 0xffff0000
jb 0x10145481
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, eax
jg 0x101455f4
push edi
mov edi, 2
mov edi, edi
mov eax, dword [ecx]
cmp eax, 0xffff0000
jb 0x101454b1
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx], eax
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
test edx, edx
jne 0x101454f9
mov eax, dword [ecx + 4]
inc esi
cmp eax, 0xffff0000
jb 0x101454d6
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx + 4], eax
movzx eax, byte [esi + 0x1022c4c8]
imul ecx, eax, 0x84
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
add ecx, dword [ebx + 0x14]
test edx, edx
je 0x101454c3
mov eax, dword [ecx + 4]
inc esi
mov dword [ebp - 4], esi
cmp eax, 0xffff0000
jb 0x1014550f
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx + 4], eax
lea eax, [edx + 1]
cmp edi, eax
mov eax, dword [ecx + 8]
sbb edi, edi
neg edi
cmp eax, 0xffff0000
jb 0x10145532
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
add eax, edi
mov dword [ecx + 8], eax
test edi, edi
jne 0x10145558
movzx eax, byte [esi + 0x1022c4c8]
imul ecx, eax, 0x84
add ecx, 0x2c
add ecx, dword [ebx + 0x14]
jmp 0x101455e5
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, 0x43
cmp eax, 0x43
cmovg eax, edx
xor edi, edi
movzx ebx, word [eax*4 + 0x1022f87c]
shr ebx, 1
movzx edx, word [eax*4 + 0x1022f87e]
mov dword [ebp + 8], edx
je 0x101455cd
mov esi, dword [ebp + 8]
lea edx, [ecx + 0xc]
lea esp, [esp]
test bl, 1
je 0x101455c2
mov ecx, edi
mov eax, 2
shl eax, cl
mov ecx, dword [edx]
and eax, esi
neg eax
sbb eax, eax
neg eax
cmp ecx, 0xffff0000
jb 0x101455b9
inc ecx
shr ecx, 1
and ecx, 0x7fff7fff
add eax, 0x10000
add eax, ecx
mov dword [edx], eax
inc edi
add edx, 4
sar ebx, 1
jne 0x10145590
mov esi, dword [ebp - 4]
movzx eax, byte [esi + 0x1022c4c8]
mov ebx, dword [ebp + 0xc]
imul ecx, eax, 0x84
mov eax, dword [ebx + 0x14]
add eax, 0x58
add ecx, eax
mov edi, 2
cmp esi, dword [ebx + 4]
jle 0x101454a0
pop edi
cmp esi, 0x10
jge 0x10145611
mov eax, dword [ecx]
cmp eax, 0xffff0000
jb 0x1014560a
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10148a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], 0
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0xc]
lea eax, [esi + 0x38]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
cmp eax, 4
jg 0x10148ac9
cmp eax, 2
setle bl
add ebx, 2
jmp 0x10148acf
cmp eax, 0x10
setle bl
push ecx
mov ecx, ebx
mov eax, 1
shl eax, cl
dec eax
add eax, edx
shr eax, cl
push eax
push esi
call fcn.10147e30
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x20], edi
test edi, edi
jne 0x10148bf3
mov eax, dword [esi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
cdq
push 1
push edx
push eax
call fcn.10140ad0
add esp, 0xc
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x10148b1c
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
lea eax, [esi + 0x38]
push dword [ebp - 4]
push ebx
push eax
push dword [esi + 0x14]
mov eax, dword [ebp - 0x14]
push dword [eax + 0x38]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.101482a0
mov esi, dword [ebp + 8]
push 1
push 1
push esi
call fcn.10155680
push 3
push 2
push esi
call fcn.10155680
add esp, 0x40
lea eax, [ebx - 1]
push eax
push 8
push esi
call fcn.10155680
mov eax, dword [ebp + 0xc]
dec ebx
add esp, 0xc
cmp ebx, 1
jl 0x10148bd7
mov edi, dword [eax + ebx*4]
mov edx, edi
mov esi, dword [eax + ebx*4 - 4]
and edx, 0xff00
mov eax, esi
mov ecx, edi
and eax, 0xff00ff00
and ecx, 0xffff00ff
sub edx, eax
and edi, 0xff00ff00
mov eax, esi
sub edx, 0xff01
and eax, 0xff00ff
and esi, 0xff00ff00
sub ecx, eax
sub edi, esi
mov eax, dword [ebp + 0xc]
add ecx, 0xff00
xor edx, ecx
add edi, 0xff00ff
and edx, 0xff00ff
xor edx, edi
mov dword [eax + ebx*4], edx
dec ebx
cmp ebx, 1
jge 0x10148b72
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp - 8]
push eax
push esi
call fcn.10148940
add esp, 0x14
mov ecx, 4
test eax, eax
cmove edi, ecx
push dword [ebp - 0xc]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10149ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1029e9c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movzx eax, cx
shr ecx, 0x10
mov byte [ebp - 0x18], al
mov byte [ebp - 0x16], cl
sar eax, 8
sar ecx, 8
mov byte [ebp - 0x17], al
mov byte [ebp - 0x15], cl
mov ecx, dword [ebp + 0x10]
movzx eax, cx
mov byte [ebp - 0xc], al
sar eax, 8
push edx
mov byte [ebp - 0xb], al
lea eax, [ebp - 0x1c]
shr ecx, 0x10
mov byte [ebp - 0xa], cl
push 0x15
sar ecx, 8
push eax
mov eax, dword [edx + 0x48]
mov dword [ebp - 0x1c], 0x46464952
mov dword [ebp - 0x14], 0x50424557
mov dword [ebp - 0x10], 0x4c385056
mov byte [ebp - 8], 0x2f
mov byte [ebp - 9], cl
call eax
mov ecx, dword [ebp - 4]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, ebp
and eax, 0xfffffff8
add eax, 8
call fcn.1016159e
mov esp, ebp
pop ebp
ret

Function at 0x1014a160
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 1
mov eax, dword [esi + 0x28]
mov dword [esi + 0x38], 0
cmp eax, ebx
jge 0x1014a1ed
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x18]
push 0
push eax
call fcn.1014a310
add esp, 8
test eax, eax
je 0x1014a19a
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push esi
push 0x1014a230
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x24], eax
test eax, eax
jne 0x1014a1c3
mov eax, ebx
jmp 0x1014a1ce
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x1014a1e0
mov dword [esi + 0x28], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
jle 0x1014a202
push 1
push esi
call fcn.1014a050
xor ebx, ebx
add esp, 8
cmp dword [esi + 0x38], ebx
sete bl
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x1014ccc0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x102a3bf0], 0
jne 0x1014cd8a
xor ecx, ecx
nop
lea eax, [ecx - 0xff]
cdq
lea ecx, [ecx + 1]
xor eax, edx
sub eax, edx
mov byte [ecx + 0x102a3bf7], al
shr al, 1
mov byte [ecx + 0x102a3df7], al
lea eax, [ecx - 0xff]
cmp eax, 0xff
jle 0x1014ccd0
mov eax, 0xfffffc04
mov edx, 0x7f
cmp eax, 0xffffff80
jge 0x1014cd0f
mov ecx, 0xffffff80
jmp 0x1014cd17
cmp eax, 0x7f
mov ecx, eax
cmovg ecx, edx
mov byte [eax + 0x102a43f4], cl
inc eax
cmp eax, 0x3fc
jle 0x1014cd03
mov eax, 0xffffff90
lea edx, [eax + 0x7f]
lea ecx, [ecx]
cmp eax, 0xfffffff0
jge 0x1014cd3c
mov ecx, 0xfffffff0
jmp 0x1014cd44
cmp eax, 0xf
mov ecx, eax
cmovg ecx, edx
mov byte [eax + 0x102a4868], cl
inc eax
cmp eax, 0x70
jle 0x1014cd30
mov eax, 0xffffff01
mov edx, 0xff
lea ebx, [ebx]
test eax, eax
jns 0x1014cd68
xor ecx, ecx
jmp 0x1014cd72
cmp eax, 0xff
mov ecx, eax
cmovg ecx, edx
mov byte [eax + 0x102a49df], cl
inc eax
cmp eax, 0x1fe
jle 0x1014cd60
mov dword [0x102a3bf0], 1
ret
Function at 0x1014f6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
push ebx
imul ecx, dword [eax + 8]
mov eax, dword [ebp + 0x14]
push edi
xor edi, edi
lea ecx, [eax + ecx*4]
mov ebx, ecx
sub ebx, eax
add ebx, 3
shr ebx, 2
cmp eax, ecx
cmova ebx, edx
test ebx, ebx
je 0x1014f829
cmp ebx, 8
jb 0x1014f7f0
movdqa xmm4, xmmword [0x1018f2f0]
mov ecx, ebx
movdqa xmm6, xmmword [0x1022df90]
and ecx, 7
movdqa xmm7, xmmword [0x1022b7a0]
mov edx, ebx
sub edx, ecx
mov ecx, 8
movd xmm3, ecx
mov ecx, 0x10
movd xmm5, ecx
nop
movdqu xmm2, xmmword [eax]
add edi, 8
movdqa xmm0, xmm2
psrld xmm0, xmm3
pand xmm0, xmm4
movdqa xmm1, xmm0
pslld xmm1, xmm5
por xmm1, xmm0
movdqa xmm0, xmm6
pand xmm0, xmm2
paddd xmm1, xmm0
movdqa xmm0, xmmword [0x1018f350]
pand xmm0, xmm2
pand xmm1, xmm7
por xmm1, xmm0
movdqu xmmword [eax], xmm1
movdqu xmm2, xmmword [eax + 0x10]
movdqa xmm0, xmm2
psrld xmm0, xmm3
pand xmm0, xmm4
movdqa xmm1, xmm0
pslld xmm1, xmm5
por xmm1, xmm0
movdqa xmm0, xmm6
pand xmm0, xmm2
paddd xmm1, xmm0
movdqa xmm0, xmmword [0x1018f350]
pand xmm1, xmm7
pand xmm0, xmm2
por xmm1, xmm0
movdqu xmmword [eax + 0x10], xmm1
add eax, 0x20
cmp edi, edx
jb 0x1014f760
cmp edi, ebx
jae 0x1014f829
push esi
mov esi, dword [eax]
lea eax, [eax + 4]
mov ecx, esi
inc edi
shr ecx, 8
and ecx, 0xff
mov edx, ecx
shl edx, 0x10
or edx, ecx
mov ecx, esi
and ecx, 0xffff00ff
add edx, ecx
xor edx, esi
and edx, 0xff00ff
xor edx, esi
mov dword [eax - 4], edx
cmp edi, ebx
jb 0x1014f7f5
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1014fd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x1014fdf4
push esi
mov esi, dword [ebp + 0x10]
mov edi, edi
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x1014fdb0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1014fe60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x1014fecb
push esi
mov esi, dword [ebp + 0x10]
mov edi, edi
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x1014fe90
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10157c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1029e9c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
movdqa xmm0, xmmword [0x1018f2e0]
paddd xmm0, xmmword [0x1022e670]
push ebx
mov eax, dword [edx + 0x18]
mov ebx, 1
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], eax
push edi
mov edi, ebx
mov dword [ebp - 0x20], edi
movdqu xmmword [ebp - 0x14], xmm0
cmp eax, ebx
jle 0x10157da7
push esi
lea ecx, [edx + 0x3f8]
lea esi, [edx + 0x5e4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], esi
jmp 0x10157cb0
xor edx, edx
mov dword [ebp - 0x2c], 0
test ebx, ebx
jle 0x10157cef
mov eax, dword [ebp - 0x24]
mov ecx, dword [esi - 4]
add eax, 0x3d0
cmp ecx, dword [eax - 4]
jne 0x10157cd6
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x10157ce2
mov ecx, dword [esi - 4]
inc edx
add eax, 0x214
cmp edx, ebx
jl 0x10157cc8
jmp 0x10157ce9
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2c], 0
mov dword [ebp + edi*4 - 0x14], edx
jne 0x10157d20
cmp ebx, edi
je 0x10157d16
mov edi, dword [ebp - 0x1c]
add esi, 0xfffffe14
mov ecx, 0x85
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
inc ebx
add ecx, 0x214
mov dword [ebp - 0x1c], ecx
inc edi
add esi, 0x214
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], esi
cmp edi, eax
jl 0x10157cb0
cmp ebx, eax
jge 0x10157da6
mov edi, dword [ebp - 0x24]
mov esi, dword [edi + 0x2c]
imul esi, dword [edi + 0x28]
test esi, esi
jle 0x10157d79
jmp 0x10157d50
mov eax, dword [edi + 0x5288]
dec esi
mov ecx, dword [eax + esi*8]
lea edx, [eax + esi*8]
mov eax, ecx
shr eax, 5
and eax, 3
mov eax, dword [ebp + eax*4 - 0x14]
shl eax, 5
xor eax, ecx
and eax, 0x60
xor eax, ecx
mov dword [edx], eax
test esi, esi
jg 0x10157d50
imul eax, ebx, 0x214
mov dword [edi + 0x18], ebx
lea edx, [eax + edi]
add eax, 0x1e4
add eax, edi
sub dword [ebp - 0x18], ebx
nop
mov edi, eax
lea esi, [edx - 0x30]
mov ecx, 0x85
add eax, 0x214
dec dword [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
jne 0x10157d90
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1016159e
mov esp, ebp
pop ebp
ret
Function at 0x408a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x408b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x408b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x408b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408b71
test eax, eax
je 0x408b67
add ebx, 0x14
jmp 0x408b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x408b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x408ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x408ddd
mov eax, 1
test eax, eax
je 0x408ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x408ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x408dd3
mov ebx, eax
and eax, 0x80000000
jne 0x408d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x408ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x408ddd
mov eax, 1
test eax, eax
je 0x408ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x408ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x408ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x408ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x408b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x408ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x408ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc