joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042d03
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e85f6
call fcn.100d5e28
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10042cb8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10042d10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e85f6
call fcn.100d5e28
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10042cb8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10045250
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e8781
call fcn.100d5e28
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10002124
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10002124
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10002124
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10002124
or dword [esi + 0x7c], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x64], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004525c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e8781
call fcn.100d5e28
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10002124
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10002124
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10002124
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10002124
or dword [esi + 0x7c], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x64], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004de7f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e8d84
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], 1
mov word [esi + 0x20], 0x100
mov dword [esi + 0x28], 0x40000000
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], ax
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004de8a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e8d84
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], 1
mov word [esi + 0x20], 0x100
mov dword [esi + 0x28], 0x40000000
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], ax
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1006814e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e9ba2
call fcn.100d5e28
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov dword [esi], 1
mov word [esi + 4], bx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.10002124
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1006889e
Capabilities:
Parse credit card information

Disassembly:
cmp dword [ecx + 0x3c], 2
mov eax, dword [esp + 4]
jge 0x100688bc
cmp byte [ecx + 0x42], 0
je 0x10068919
cmp eax, 0x3f
jb 0x10068919
jne 0x100688b9
push 0x46
jmp 0x10068918
dec eax
jmp 0x10068919
cmp eax, 0x2c
jb 0x10068919
cmp dword [ecx + 0x3c], 3
jl 0x100688d1
cmp eax, 0x2c
jne 0x100688d0
push 0x48
jmp 0x10068918
dec eax
cmp dword [ecx + 0x3c], 4
jl 0x100688e1
cmp eax, 0x2c
jne 0x100688e0
push 0x49
jmp 0x10068918
dec eax
cmp eax, 0x3a
jb 0x10068919
cmp byte [ecx + 0x14], 0
je 0x10068901
cmp eax, 0x3a
jne 0x100688f5
push 0x44
jmp 0x10068918
cmp eax, 0x3b
jne 0x100688fe
push 0x45
jmp 0x10068918
sub eax, 2
cmp eax, 0x3f
jb 0x10068911
cmp byte [ecx + 0x42], 0
je 0x10068911
cmp eax, 0x3f
jmp 0x100688b3
cmp eax, 0x44
jne 0x10068919
push 0x47
pop eax
ret 4
Function at 0x1006a08a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9c50
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10002124
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.10002327
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
call fcn.1006a018
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.10002124
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.10002124
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1006e13d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e9eff
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
xor edi, edi
mov dword [esi + 4], 0x100eef50
mov dword [esi + 8], 0x100ec3a0
mov dword [esi + 0xc], edi
mov dword [esi], 0x100f51e0
mov dword [esi + 4], 0x100f5214
mov dword [esi + 8], 0x100f5230
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100791dc
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0x10
push ebx
push edi
mov edi, ecx
jae 0x100791ec
xor eax, eax
inc eax
jmp 0x1007926b
mov ecx, dword [esp + 0xc]
xor edx, edx
push esi
mov al, dl
mov esi, edx
add al, byte [esi + ecx]
inc esi
cmp esi, 4
jl 0x100791f7
push 5
pop esi
add al, byte [esi + ecx]
inc esi
cmp esi, 0x10
jl 0x10079203
cmp al, byte [ecx + 4]
jne 0x10079267
cmp byte [ecx + 5], dl
jne 0x10079267
mov ax, word [ecx]
mov word [edi], ax
mov ax, word [ecx + 2]
mov word [edi + 2], ax
movzx esi, word [ecx + 0xa]
movzx ebx, word [ecx + 8]
lea eax, [esi + 0x10]
cmp dword [esp + 0x14], eax
jb 0x10079267
lea edi, [ecx + 0x10]
test esi, esi
je 0x1007925f
movzx eax, byte [edi]
mov ecx, edx
shr ecx, 8
xor ecx, eax
shl edx, 8
movzx eax, cl
movzx edx, dx
movzx ecx, word [eax*2 + 0x10113538]
xor edx, ecx
inc edi
sub esi, 1
jne 0x1007923c
cmp ebx, edx
jne 0x10079267
xor eax, eax
jmp 0x1007926a
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
ret 8
Function at 0x10082eaa
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ea915
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100981e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, ecx
push esi
push edi
cmp dword [eax + 0x34], 0xa
jae 0x10098243
nop word [eax + eax]
mov esi, dword [eax]
cmp esi, 8
jae 0x1009821d
mov edi, dword [eax + 8]
cmp edi, dword [eax + 0xc]
je 0x1009830b
movzx edx, byte [edi]
mov ecx, 0x18
sub ecx, esi
shl edx, cl
lea ecx, [edi + 1]
or dword [eax + 4], edx
add esi, 8
mov dword [eax], esi
mov dword [eax + 8], ecx
mov edx, dword [eax + 4]
mov ecx, edx
shl ecx, 8
mov dword [eax + 4], ecx
lea ecx, [esi - 8]
mov dword [eax], ecx
mov ecx, dword [eax + 0x34]
shr edx, 0x18
mov byte [eax + ecx + 0x70d6], dl
inc dword [eax + 0x34]
cmp dword [eax + 0x34], 0xa
jb 0x100981f0
mov dword [eax + 0x70e0], 0
movzx ecx, byte [eax + 0x70dc]
shl ecx, 8
mov dword [eax + 0x70e0], ecx
movzx edx, byte [eax + 0x70dd]
or edx, ecx
shl edx, 8
mov dword [eax + 0x70e0], edx
movzx ecx, byte [eax + 0x70de]
or ecx, edx
shl ecx, 8
mov dword [eax + 0x70e0], ecx
movzx edx, byte [eax + 0x70df]
or edx, ecx
mov dword [eax + 0x70e0], edx
mov cl, byte [eax + 0x70d6]
cmp cl, 0x31
jne 0x10098310
cmp byte [eax + 0x70d7], 0x41
jne 0x10098310
cmp byte [eax + 0x70d8], 0x59
jne 0x10098310
cmp byte [eax + 0x70d9], 0x26
jne 0x10098310
cmp byte [eax + 0x70da], 0x53
jne 0x10098310
cmp byte [eax + 0x70db], 0x59
jne 0x10098310
cmp byte [eax + 0x70e8], 0
jne 0x100982df
add dword [eax + 0x70f0], 1
adc dword [eax + 0x70f4], 0
add dword [eax + 0x70f8], 1
mov byte [eax + 0x70e8], 1
adc dword [eax + 0x70fc], 0
mov ecx, dword [eax + 0x70e4]
rol ecx, 1
xor ecx, edx
mov dword [eax + 0x70e4], ecx
mov dword [eax + 0x30], 2
pop edi
xor eax, eax
pop esi
ret
cmp cl, 0x17
jne 0x100983a6
cmp byte [eax + 0x70d7], 0x72
jne 0x100983a6
cmp byte [eax + 0x70d8], 0x45
jne 0x100983a6
cmp byte [eax + 0x70d9], 0x38
jne 0x100983a6
cmp byte [eax + 0x70da], 0x50
jne 0x100983a6
cmp byte [eax + 0x70db], 0x90
jne 0x100983a6
cmp byte [eax + 0x70e8], 0
jne 0x10098361
add dword [eax + 0x70f0], 1
adc dword [eax + 0x70f4], 0
mov esi, dword [eax + 4]
mov byte [eax + 0x70e8], 1
test esi, esi
je 0x10098376
mov byte [eax + 0x70ea], 1
mov edx, dword [eax]
mov ecx, edx
and ecx, 7
mov dword [eax + 0x30], 0xb
sub edx, ecx
shl esi, cl
mov ecx, dword [eax + 0x70e0]
mov dword [eax], edx
mov dword [eax + 4], esi
cmp ecx, dword [eax + 0x70e4]
je 0x1009830b
mov byte [eax + 0x70e9], 1
pop edi
mov eax, 1
pop esi
ret
Function at 0x10099630
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, ecx
mov dword [esp + 0x20], 0
push ebp
push esi
push edi
mov eax, dword [ebx + 8]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x2c]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x8ce0]
mov dword [esp + 0x30], 8
mov byte [esp + 0x34], 0
mov dword [ebx + 0x8cd4], 0
push dword [eax + 0x174]
mov dword [esp + 0x24], ebx
push dword [esp + 0x44]
push dword [ebx]
call fcn.10099360
mov ebp, dword [ebx + 0x8ce0]
cmp byte [ebp + 0x1a8], 0
je 0x100996b2
imul eax, dword [ebx + 0x8cd8], 0x8e00
mov ecx, dword [ebp + 0x184]
mov ecx, dword [eax + ecx + 0x8cf0]
call fcn.100cdb30
mov ebp, dword [ebx + 0x8ce0]
xor esi, esi
cmp dword [ebx + 0x8cd4], esi
jbe 0x100996eb
lea edx, [ebx + 0x7cd4]
mov ecx, dword [ebx + 0x8ce0]
lea edx, [edx + 4]
inc esi
mov eax, dword [ecx + 0x180]
rol eax, 1
xor eax, dword [edx - 4]
mov dword [ecx + 0x180], eax
cmp esi, dword [ebx + 0x8cd4]
jb 0x100996c2
mov ebp, dword [ebx + 0x8ce0]
mov al, byte [esp + 0x34]
mov esi, dword [ebx + 8]
mov byte [esp + 0x40], al
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], esi
lea edx, [eax*8 + 8]
xor eax, eax
sub edx, dword [esp + 0x30]
mov ecx, edx
mov dword [esp + 0x24], edx
shr ecx, 3
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x100997cc
mov ecx, dword [ebp + 0x140]
nop word [eax + eax]
movzx edx, byte [eax + esi]
mov edi, 8
nop dword [eax]
cmp edi, ecx
jb 0x1009979d
mov esi, dword [ebp + 0x14c]
sub edi, ecx
mov ebx, edx
mov ecx, edi
shr ebx, cl
mov eax, ebx
shl eax, cl
lea ecx, [ebp + 0x148]
sub edx, eax
mov eax, dword [ecx]
mov dword [esp + 0x14], edx
mov dl, byte [ebp + 0x144]
or dl, bl
mov byte [esi + eax], dl
inc esi
mov dword [ecx + 4], esi
cmp esi, dword [ecx + 8]
jne 0x1009977d
call fcn.100099bd
mov edx, dword [esp + 0x14]
mov ecx, 8
mov dword [ebp + 0x140], 8
mov byte [ebp + 0x144], 0
test edi, edi
jne 0x10099740
jmp 0x100997ad
sub ecx, edi
shl dl, cl
or byte [ebp + 0x144], dl
mov dword [ebp + 0x140], ecx
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x18]
jb 0x10099730
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx eax, byte [esp + 0x40]
lea ecx, [ebp + 0x140]
and edx, 7
push edx
push eax
call fcn.1009a9b0
mov esi, dword [ebx + 0x8ce0]
xor ebp, ebp
cmp byte [esi + 0x1a8], 0
je 0x10099876
mov eax, dword [ebx + 0x8cd8]
xor edi, edi
inc eax
cmp eax, dword [esi + 0x1a4]
cmovne edi, eax
cmp dword [esi + 0x1bc], ebp
je 0x1009985d
lea ecx, [esi + 0x148]
call fcn.100099f5
mov ecx, eax
mov eax, 0xf
sub eax, dword [esi + 0x140]
shr eax, 3
add ecx, eax
mov eax, dword [ebx + 0x8ce0]
mov dword [esp + 0x24], ecx
adc edx, ebp
mov dword [esp + 0x28], edx
mov ecx, dword [eax + 0x1bc]
lea eax, [esp + 0x24]
push eax
lea eax, [ebx + 0x8cf8]
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0xc]
mov esi, dword [ebx + 0x8ce0]
mov ebp, eax
mov ecx, dword [esi + 0x184]
imul edx, edi, 0x8e00
add edx, 0x8cf0
add ecx, edx
call fcn.100cdac0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x100afc00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
xor bl, bl
push edi
mov edi, ecx
xor dl, dl
mov ecx, dword [esp + 0x10]
xor eax, eax
mov byte [edi + 4], 0
mov dword [edi], 0xffffffff
test esi, esi
je 0x100afce5
cmp esi, 0x20
jb 0x100afc90
mov edx, esi
xorps xmm2, xmm2
and edx, 0xffffffe0
xorps xmm1, xmm1
nop word [eax + eax]
movups xmm0, xmmword [ecx + eax]
pxor xmm2, xmm0
movups xmm0, xmmword [ecx + eax + 0x10]
add eax, 0x20
pxor xmm1, xmm0
cmp eax, edx
jb 0x100afc40
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd edx, xmm1
cmp eax, esi
jae 0x100afc9c
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x100afc94
test dl, dl
jne 0x100afce5
test esi, esi
je 0x100afce5
mov edx, esi
mov byte [edi + 4], 1
mov bl, 1
call fcn.100d4380
mov edx, eax
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x100f714c], edx
jne 0x100afcc7
cmp dword [eax + 0x100f7148], esi
je 0x100afcd3
add eax, 0xc
inc ecx
cmp eax, 0x48
jb 0x100afcb7
or ecx, 0xffffffff
mov dword [edi], ecx
test ecx, ecx
js 0x100afce1
pop edi
pop esi
mov al, 1
pop ebx
ret 8
mov byte [edi + 4], 0
pop edi
pop esi
mov al, bl
pop ebx
ret 8
Function at 0x100b4510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, ecx
push ebx
push esi
push edi
xor bl, bl
mov dword [eax], 0
xor bh, bh
mov esi, 0x100f39a8
mov edi, 0xc
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100b45da
add edx, 4
add esi, 4
sub edi, 4
jae 0x100b4532
mov eax, dword [esp + 0x14]
push ebp
cmp dword [eax], 0x23170f69
jne 0x100b466c
mov ecx, 0x40c1
cmp word [eax + 4], cx
jne 0x100b466c
movzx ecx, word [eax + 6]
mov esi, 0x2790
mov ebp, ecx
cmp cx, si
je 0x100b4585
mov edx, 0x2791
cmp cx, dx
jne 0x100b466c
mov ecx, dword [eax + 8]
cmp bp, si
mov edi, dword [0x10112c68]
mov eax, dword [eax + 0xc]
setne byte [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
test edi, edi
je 0x100b466c
nop dword [eax + eax]
mov edx, dword [esi*4 + 0x10112c70]
cmp ecx, dword [edx + 8]
jne 0x100b4663
cmp eax, dword [edx + 0xc]
jne 0x100b4663
mov eax, 0x2790
cmp bp, ax
je 0x100b463b
xor eax, eax
cmp dword [edx + 4], eax
jmp 0x100b463f
mov edx, ecx
mov esi, 0x100f3ad8
mov edi, 0xc
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100b45fb
add edx, 4
add esi, 4
sub edi, 4
jae 0x100b45e6
mov bl, 1
jmp 0x100b45fd
xor bl, bl
test bl, bl
jne 0x100b4547
mov edx, 0x100f39b8
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100b4625
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100b4610
mov bh, 1
jmp 0x100b4627
xor bh, bh
test bh, bh
jne 0x100b4547
pop edi
pop esi
mov eax, 0x80004002
pop ebx
pop ecx
ret 0xc
xor eax, eax
cmp dword [edx], eax
sete al
test eax, eax
jne 0x100b465f
mov cl, byte [edx + 0x18]
test bl, bl
je 0x100b4654
test cl, cl
sete al
jmp 0x100b4657
movzx eax, cl
test eax, eax
je 0x100b4679
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
inc esi
cmp esi, edi
jb 0x100b45b0
pop ebp
pop edi
pop esi
mov eax, 0x80040111
pop ebx
pop ecx
ret 0xc
mov al, bh
movzx ecx, bh
xor al, 1
cmp dword [edx + 0x14], 1
movzx eax, al
cmovne ecx, eax
test cl, cl
je 0x100b469b
pop ebp
pop edi
pop esi
mov eax, 0x80004002
pop ebx
pop ecx
ret 0xc
test esi, esi
js 0x100b466c
push dword [esp + 0x20]
mov dl, byte [esp + 0x20]
mov ecx, esi
call fcn.100b41a0
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x100b5a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
push esi
push edi
mov esi, ecx
lea edx, [esp + 0x20]
push 0x14
mov dword [esp + 0x1c], esi
call fcn.100d5490
lea eax, [esi + 0x80]
push 0x14
lea edx, [esp + 0x64]
mov dword [esp + 0x20], eax
mov ecx, eax
call fcn.100d5490
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov edi, dword [esi]
mov dword [esp + 8], eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x2c], edx
jbe 0x100b5b38
mov esi, eax
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x60]
push eax
lea edx, [esp + 0x24]
call fcn.100d53a0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x64]
call fcn.100d53a0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
xor ecx, dword [esp + 0x28]
xor edx, dword [esp + 0x2c]
xor eax, dword [esp + 0x30]
xor edi, dword [esp + 0x20]
xor esi, dword [esp + 0x24]
sub dword [ebp + 0xc], 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
jne 0x100b5ad7
mov dword [esp + 8], esi
mov esi, dword [ebp + 8]
mov eax, dword [esp + 8]
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
pop edi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100b62a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eb7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0xc8
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x24], 0x10115000
push 0x10115000
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi + 0x20], 0
mov dword [ebp - 4], 0
je 0x100b6413
lea ecx, [ebp - 0xb0]
call fcn.100d5c40
mov eax, 0x3e8
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xb0]
call fcn.100d5530
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xb0]
call fcn.100d5530
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100b6392
push str.SystemFunction036
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100b638b
push 0x20
lea ecx, [ebp - 0xd0]
push ecx
call eax
test al, al
je 0x100b638b
push 0x20
lea edx, [ebp - 0xd0]
mov dword [ebp - 0x18], 0x64
lea ecx, [ebp - 0xb0]
call fcn.100d5530
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x100b63b0
push 8
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xb0]
call fcn.100d5530
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 4
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xb0]
call fcn.100d5530
mov edi, 0x64
nop
mov edx, esi
lea ecx, [ebp - 0xb0]
call fcn.100d5b40
lea ecx, [ebp - 0xb0]
call fcn.100d5c40
push 0x20
mov edx, esi
lea ecx, [ebp - 0xb0]
call fcn.100d5530
sub edi, 1
jne 0x100b63d0
sub dword [ebp - 0x18], 1
jne 0x100b6392
mov edx, esi
lea ecx, [ebp - 0xb0]
call fcn.100d5b40
mov byte [esi + 0x20], 0
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x100b64ad
mov edi, dword [ebx + 8]
lea ecx, [ebp - 0xb0]
call fcn.100d5c40
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb0]
push 0x20
call fcn.100d5530
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb0]
call fcn.100d5b40
lea ecx, [ebp - 0xb0]
call fcn.100d5c40
push 4
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xf672abd1
lea ecx, [ebp - 0xb0]
call fcn.100d5530
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb0]
push 0x20
call fcn.100d5530
lea edx, [ebp - 0xd0]
lea ecx, [ebp - 0xb0]
call fcn.100d5b40
xor eax, eax
nop
test esi, esi
je 0x100b64ad
mov cl, byte [ebp + eax - 0xd0]
dec esi
mov byte [edi], cl
inc eax
inc edi
cmp eax, 0x20
jb 0x100b6490
test esi, esi
jne 0x100b6421
push 0x10115000
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8