joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca9c8
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
xor eax, eax
push ebp
push 0x4caa78
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x4caa5a
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004c9b34
push 0xf0002
mov eax, dword [ebp - 0xc]
call fcn.00404f14
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x4caa54
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4caa7f
lea eax, [ebp - 0xc]
call fcn.00404a54
lea eax, [ebp - 4]
call fcn.00404a54
ret

Function at 0x4cd234
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
xor eax, eax
push ebp
push 0x4cd2e1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 8]
mov eax, 0x4cd2f8
call fcn.004313e0
test eax, eax
jle 0x4cd275
or ebx, 1
mov edx, dword [ebp - 8]
mov eax, 0x4cd30c
call fcn.004313e0
test eax, eax
jle 0x4cd289
or ebx, 2
mov edx, dword [ebp - 8]
mov eax, 0x4cd31c
call fcn.004313e0
test eax, eax
jle 0x4cd29d
or ebx, 4
mov edx, dword [ebp - 8]
mov eax, 0x4cd32c
call fcn.004313e0
test eax, eax
jle 0x4cd2b1
or ebx, 0x20
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
test eax, ebx
setne al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd2e8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret

Function at 0x4cf868
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
xor eax, eax
push ebp
push 0x4cf8cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004cf648
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf8d6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret
Function at 0x4d6364
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d645b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.00409500
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00404aa8
mov edx, dword [ebx]
lea eax, [ebp - 4]
mov ecx, 0x4d6474
call fcn.00404d60
jmp 0x4d63b3
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404d1c
mov eax, dword [ebx]
call fcn.00404d14
cmp esi, eax
jg 0x4d63a9
test edi, edi
jne 0x4d63fc
mov byte [ebp - 5], 0
mov eax, dword [ebx]
call fcn.00404d14
test eax, eax
jle 0x4d63db
mov edx, dword [ebx]
mov dl, byte [edx]
add byte [ebp - 5], dl
dec eax
jne 0x4d63d1
mov eax, dword [ebx]
call fcn.00404d14
test eax, eax
jle 0x4d643d
mov edx, 1
mov ecx, dword [ebx]
lea esi, [ecx + edx - 1]
mov cl, byte [ebp - 5]
xor byte [esi], cl
inc edx
dec eax
jne 0x4d63eb
jmp 0x4d643d
mov eax, edi
mov byte [ebp - 5], al
mov eax, dword [ebx]
call fcn.00404d14
test eax, eax
jle 0x4d641e
mov edx, 1
mov ecx, dword [ebx]
mov cl, byte [ecx + edx - 1]
add byte [ebp - 5], cl
inc edx
dec eax
jne 0x4d6411
mov eax, dword [ebx]
call fcn.00404d14
test eax, eax
jle 0x4d643d
mov edx, 1
mov ecx, dword [ebx]
lea esi, [ecx + edx - 1]
mov cl, byte [ebp - 5]
xor byte [esi], cl
inc edx
dec eax
jne 0x4d642e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6462
lea eax, [ebp - 0xc]
call fcn.00404a54
lea eax, [ebp - 4]
call fcn.00404a54
ret
Function at 0x4dc9e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dcb86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4fde78]
cmp dword [eax], 0
je 0x4dca52
lea edx, [ebp - 0x18]
mov eax, dword [0x4fde78]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov esi, dword [ebp - 0x18]
lea edx, [ebp - 0x18]
mov eax, dword [0x4fde78]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edi, dword [ebp - 0x14]
mov eax, dword [0x4fde78]
mov eax, dword [eax]
call fcn.0046966c
mov dword [ebp - 8], eax
mov eax, dword [0x4fde78]
mov eax, dword [eax]
call fcn.004696b0
jmp 0x4dca89
mov eax, dword [0x4fdf28]
mov eax, dword [eax]
call fcn.00488d34
mov esi, eax
mov eax, dword [0x4fdf28]
mov eax, dword [eax]
call fcn.00488d5c
mov edi, eax
mov eax, dword [0x4fdf28]
mov eax, dword [eax]
call fcn.00488d74
mov dword [ebp - 8], eax
mov eax, dword [0x4fdf28]
mov eax, dword [eax]
call fcn.00488d18
sub eax, dword [ebx + 0x4c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebx + 0x48]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x4ec]
call fcn.004a31e4
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [0x43f5a4]
call fcn.0043f98c
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00409998
add esi, eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, dword [0x43f5a4]
call fcn.0043f98c
mov eax, dword [ebp - 0x20]
xor edx, edx
call fcn.00409998
add edi, eax
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x43f5a4]
call fcn.0043f98c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00404aec
cmp byte [ebx + 0x4d0], 0
jne 0x4dcb20
cmp byte [ebx + 0x4d1], 0
je 0x4dcb2d
lea eax, [ebp - 4]
mov edx, 0x4dcb9c
call fcn.00404aec
mov eax, dword [ebp - 4]
mov edx, 0x4dcb9c
call fcn.00404e60
jne 0x4dcb4e
push 0
mov eax, dword [0x4fdd78]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 0x10]
push eax
push esi
push edi
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004958bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcb8d
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404a78
lea eax, [ebp - 4]
call fcn.00404a54
ret
Function at 0x4ef36c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404f04
xor eax, eax
push ebp
push 0x4ef440
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10]
mov al, 1
call fcn.004337b4
lea eax, [ebp - 0x10]
mov edx, 0x4ef454
call fcn.00404d1c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dl, 1
call fcn.00439b64
push 0
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [0x43f5a4]
call fcn.0043f98c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov al, 1
call fcn.004337b4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
pop ecx
call fcn.00404d60
mov eax, dword [ebp - 0xc]
call fcn.00409d68
test al, al
je 0x4ef425
push dword [ebp - 4]
push 0x4ef464
push dword [ebp - 0xc]
push 0x4ef470
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404dd4
push 5
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef447
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404a78
ret
Function at 0x10047bf0
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xa6b06b97], cl
mov edx, 0x3ee5a261
xchg byte [esi - 0x399e93de], dl
je 0x10047b85
insb byte es:[edi], dx
popal
invalid
sub eax, esi
clc
sbb dl, byte [esi]
scasd eax, dword es:[edi]
xchg ebp, eax
mov al, 0x64
inc ebp
inc eax
xor bl, byte [eax]
cmpsd dword [esi], dword es:[edi]
ja 0x10047b59
out dx, eax
wait
out dx, al
shr esi, cl
aaa
invalid
adc al, 0xe3
mov eax, 0xa9d337a
ja 0x10047b8e
adc ebp, ebp
add dword [eax], ebx
fcmovnbe st(0), st(2)
cmpsd dword [esi], dword es:[edi]
invalid
scasb al, byte es:[edi]
jle 0x10047b4b
adc eax, esi
push 0xffffffffffffffa6
inc ebx
add byte [ecx - 0x54], dh
nop
push esi
add byte [edx], dh
int1
wait
invalid
stosb byte es:[edi], al
pop es
dec edx
xor eax, 0xa443fd8
js 0x10047bf4
fdivr dword [edi]
inc esp
or bh, byte [eax - 6]
jmp 0x10047b9a

Function at 0x10049fe0
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x1b
cmpsd dword [esi], dword es:[edi]
insd dword es:[edi], dx
jg 0x10049fac
fmul dword [ebx + 0x7c]
ret 0x1662
Function at 0x105b0058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105b01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105b007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105b006a
add dl, dl
jne 0x105b0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105b00dc
xor eax, eax
add dl, dl
jne 0x105b0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105b017d
add dl, dl
jne 0x105b00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105b00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105b00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105b00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105b00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105b0075
mov eax, 1
add dl, dl
jne 0x105b00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105b00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105b00e1
sub eax, ebx
mov ebx, 1
jne 0x105b0128
mov ecx, 1
add dl, dl
jne 0x105b010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105b0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105b0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105b0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105b013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105b014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105b0136
cmp eax, 0x7d00
jae 0x105b016d
cmp eax, 0x500
jb 0x105b0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105b0075
cmp eax, 0x7f
ja 0x105b0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105b0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105b019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105b0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10028e70
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d8fdb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100f2040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x10323fb4]
test al, 1
jne 0x10028fbb
or eax, 1
mov dword [0x10323fb4], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100e7bd0]
xorps xmm0, xmmword [0x100e76c0]
mov dword [ebp - 0x20], 0xc0dfc0df
mov dword [ebp - 0x1c], 0xa6c0a2d8
mov word [ebp - 0x18], 0xe0d1
movups xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x30], 0xe0
inc eax
cmp eax, 0x1a
jb 0x10028ef3
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10028f20
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.100304c0
mov byte [ebp - 4], 1
mov edx, dword [0x10351fec]
test edx, edx
je 0x10028f49
mov edx, dword [edx + 0x50]
jmp 0x10028f4b
xor edx, edx
mov eax, dword [0x10351fe4]
test eax, eax
je 0x10028f59
mov eax, dword [eax + 0x18]
jmp 0x10028f5b
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10028960
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [0x10323fbc], eax
cmp ecx, 0xf
jbe 0x10028fb2
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10028fa3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10028fa3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d7cba
mov eax, dword [0x10323fbc]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x10028fc0
mov eax, dword [0x10323fbc]
test eax, eax
je 0x10028fc8
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10029d20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10357a0c]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test al, 1
jne 0x10029da8
or eax, 1
mov dword [0x10357a0c], eax
mov eax, dword [0x10352024]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x10029d93
nop dword [eax]
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x10029d60
xor edx, edx
test ecx, ecx
je 0x10029d89
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10029d70
cmp esi, 0x2437fe
je 0x10029d9d
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10029d50
mov esi, dword [ebp - 4]
xor ebx, ebx
mov dword [0x10357a10], ebx
jmp 0x10029dae
mov esi, dword [ebp - 4]
mov dword [0x10357a10], ebx
jmp 0x10029dae
mov ebx, dword [0x10357a10]
cmp byte [esi + 0x2c5f0], 0
je 0x10029dda
mov eax, dword [0x1035214c]
push 0x5c2c
push 0x3419
call eax
mov ebx, dword [0x10357a10]
add esp, 8
movd xmm0, eax
cvtdq2ps xmm0, xmm0
jmp 0x10029de2
movss xmm0, dword [0x103160cc]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
movss dword [esp], xmm0
mov eax, dword [eax + 0x3c]
call eax
mov ecx, dword [0x10352240]
mov eax, dword [0x103124c8]
add ecx, 0xffffffcb
xor ecx, 0xd553844
mov dword [0x103124cc], 0
cmp dword [ecx + eax], 0
jne 0x10029f99
mov eax, dword [0x10352098]
cmp dword [eax + 0x4cb0], 1
jg 0x10029f99
cmp byte [esi + 0x2c5f0], 0
je 0x10029f99
cmp byte [0x10323fc0], 0
mov dword [0x10323fc8], 0
je 0x10029e55
mov dword [0x103124d0], 0
mov eax, dword [0x1035214c]
push 0x5c2c
push 0x3419
call eax
add esp, 8
mov dword [0x10323fb8], 0
mov dword [0x10323fc8], eax
test eax, eax
jle 0x10029f8b
mov esi, dword [0x10312850]
test esi, esi
je 0x10029f8b
mov eax, dword [0x103522fc]
add eax, 0xffffff9c
xor eax, 0xd553873
cmp dword [eax + esi], 0
je 0x10029f8b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x6f8]
call eax
mov ecx, dword [0x103522fc]
cmp dword [eax + 0xc8], 0
jne 0x10029ed2
lea eax, [ecx - 0x64]
xor eax, 0xd553873
cmp dword [eax + esi], 0x1f
jne 0x10029f8b
lea eax, [ecx - 0x64]
xor eax, 0xd553873
mov eax, dword [eax + esi]
sub eax, 0x2b
cmp eax, 5
jbe 0x10029f8b
mov eax, dword [0x103128a8]
test byte [eax + 0x30], 1
je 0x10029f0a
mov eax, dword [0x10323fc8]
mov dword [0x103124cc], eax
mov byte [0x10323fc0], 1
jmp 0x10029f8b
cmp byte [0x10323fc0], 0
je 0x10029f8b
mov ecx, dword [0x10352268]
mov eax, dword [0x103124c8]
add ecx, 0xffffffc1
mov edx, dword [0x1035236c]
xor ecx, 0xd55384e
add edx, 0xffffff80
xor edx, 0xd55388f
movd xmm1, dword [ecx + eax]
mov eax, dword [0x10352084]
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [eax + 0x20]
mov eax, dword [0x10312850]
movss xmm0, dword [edx + eax]
subss xmm0, xmm1
call fcn.100286e0
comiss xmm0, dword [0x100e6b78]
jbe 0x10029f8b
mov eax, dword [0x1035214c]
push 0x5c2c
push 0x3419
mov byte [0x103124d4], 0
call eax
add esp, 8
mov dword [0x103124d0], eax
mov byte [0x10323fc0], 0
cmp dword [0x10323fc8], 0
setne byte [0x10323fb0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ad50
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d91a6
mov eax, dword fs:[0]
push eax
sub esp, 0xa34
push esi
mov eax, dword [0x100f2040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x644], xmm0
mov dword [esi], eax
mov dword [ebp - 0xa34], 0
movups xmmword [ebp - 0xa20], xmm0
mov dword [ebp - 0x9d0], 0
movups xmmword [ebp - 0xa10], xmm0
mov dword [ebp - 0x68c], 0
movups xmmword [ebp - 0xa00], xmm0
mov dword [ebp - 0x688], 0
movups xmmword [ebp - 0x9f0], xmm0
mov dword [ebp - 0x684], 0
movups xmmword [ebp - 0x9e0], xmm0
mov byte [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0
mov byte [ebp - 0x678], 0
movups xmmword [ebp - 0x674], xmm0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0
mov word [ebp - 0x650], 0
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x630], 0xf
mov byte [ebp - 0x644], 0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x628], xmm0
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x618], 0
mov dword [ebp - 0x614], 0xf
mov byte [ebp - 0x628], 0
push fcn.1002fcc0
push fcn.1002fd50
push 0x40
push 0x18
lea eax, [ebp - 0x60c]
mov byte [ebp - 4], 1
push eax
call fcn.100d7cfd
lea eax, [ebp - 0xa40]
mov dword [ebp - 4], 2
push eax
lea ecx, [esi + 0x30]
call fcn.10029380
mov dword [ebp - 4], 3
mov ecx, dword [0x103520a4]
push dword [ebp - 0x67c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
push fcn.1002fcc0
push 0x40
push 0x18
lea eax, [ebp - 0x60c]
push eax
call fcn.100d7886
mov ecx, dword [ebp - 0x614]
cmp ecx, 0xf
jbe 0x1002af02
mov edx, dword [ebp - 0x628]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002aef8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002af49
push ecx
push edx
call fcn.100d7cba
add esp, 8
mov ecx, dword [ebp - 0x630]
mov dword [ebp - 0x618], 0
mov dword [ebp - 0x614], 0xf
mov byte [ebp - 0x628], 0
cmp ecx, 0xf
jbe 0x1002af59
mov edx, dword [ebp - 0x644]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002af4f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002af4f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d7cba
add esp, 8
lea ecx, [esi + 8]
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xa70], 0
mov dword [esi + 0xa74], 0
mov dword [esi + 0xa84], 0
mov dword [esi + 0xa90], 0
mov dword [esi + 0xa8c], 0
mov dword [esi + 0xa94], 0
mov dword [esi + 0xa98], 0
mov dword [esi + 0xaa8], 0
mov byte [esi + 0xacc], 0
mov byte [esi + 0xa69], 0
mov byte [esi + 0xa6b], 0
call fcn.1002fe00
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
je 0x1002afdf
mov dword [esi + 0x20], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100311e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d9489
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100f2040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
lea edi, [eax + 0xc]
mov dword [eax + 4], 1
mov dword [eax + 8], 1
xorps xmm0, xmm0
mov dword [eax], 0x100e468c
mov eax, dword [ebp + 8]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov esi, dword [eax]
mov dword [edi + 0xc], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov byte [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov word [edi + 0x3f0], 0
movups xmmword [edi + 0x3fc], xmm0
mov dword [edi + 0x40c], 0
mov dword [edi + 0x410], 0xf
mov dword [ebp - 0x14], edi
mov byte [edi + 0x3fc], 0
mov dword [ebp - 4], 0
mov word [edi + 0x415], 0
mov byte [edi + 0x417], 0
mov dword [edi + 0x414], 0
movups xmmword [edi + 0x418], xmm0
mov dword [edi + 0x428], 0
mov dword [edi + 0x42c], 0xf
mov byte [edi + 0x418], 0
push fcn.1002fcc0
push fcn.1002fd50
push 0x40
push 0x18
lea eax, [edi + 0x434]
mov byte [ebp - 4], 1
push eax
call fcn.100d7cfd
push esi
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100290f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10032380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x100323de
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.1002bf10
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x100323b0
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x100323f5
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x100323f5
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x10032440
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.1002bf10
test al, al
je 0x10032431
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x10032400
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret