joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c9fb0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
cmp esi, eax
jb 0x100c9fc0
mov esi, eax
test esi, esi
je 0x100ca052
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
sub ebp, ebx
mov dword [esp + 0x10], esi
lea ecx, [ecx]
mov eax, dword [edi + 8]
mov dl, byte [ebx + ebp]
or eax, 2
mov ecx, eax
mov byte [esp + 0x20], dl
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x20]
push 1
push eax
shr ecx, 8
xor cl, dl
mov byte [ebx], cl
mov eax, dword [edi]
not eax
push eax
call fcn.100c6a20
not eax
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 4], eax
mov al, byte [edi + 7]
mov byte [esp + 0x38], al
lea eax, [esp + 0x38]
push eax
mov eax, dword [edi + 8]
not eax
push eax
call fcn.100c6a20
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [edi + 8], eax
dec esi
jne 0x100c9fe0
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x100ca060
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
test edi, edi
je 0x100ca0e5
push ebx
mov ebx, dword [esp + 0x14]
jmp 0x100ca090
movzx eax, byte [ebx]
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 1
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.100c6a20
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
movzx eax, byte [esi + 7]
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.100c6a20
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x100ca090
pop ebx
pop edi
xor eax, eax
pop esi
ret

Function at 0x100cc910
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
cmp edi, eax
jb 0x100cc91f
mov edi, eax
test edi, edi
je 0x100cc99d
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
sub ebp, ebx
mov eax, dword [esi + 8]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x1c]
push 1
push eax
shr ecx, 8
xor cl, byte [ebx + ebp]
mov byte [ebx], cl
mov eax, dword [esi]
not eax
mov byte [esp + 0x24], cl
push eax
call fcn.100c6a20
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
mov al, byte [esi + 7]
mov byte [esp + 0x34], al
lea eax, [esp + 0x34]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.100c6a20
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x100cc934
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x100cc9c0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x24], 0xc
jae 0x100cc9d8
mov eax, dword [esp + 0x28]
mov byte [eax], 0xff
or eax, 0xffffffff
add esp, 0x10
ret
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x24]
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
test edi, edi
je 0x100cca55
push ebx
mov ebx, dword [esp + 0x24]
nop
movzx eax, byte [ebx]
mov byte [esp + 0x30], al
lea eax, [esp + 0x30]
push 1
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.100c6a20
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
movzx eax, byte [esi + 7]
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.100c6a20
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x100cca00
pop ebx
push 0xc
lea eax, [esp + 0x10]
push eax
push 0xc
push dword [esp + 0x34]
push esi
call fcn.100cc910
mov ecx, dword [esp + 0x44]
add esp, 0x14
mov al, byte [esp + 0x17]
pop edi
mov byte [ecx], al
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x100d1750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x14]
push edi
lea edi, [ebx + 0x94]
mov al, byte [edi + ecx]
cmp al, 0x20
je 0x100d1772
test al, al
je 0x100d1772
sub al, 0x30
cmp al, 7
ja 0x100d1796
inc ecx
cmp ecx, 8
jb 0x100d1761
mov dl, byte [edi]
push esi
test dl, dl
jns 0x100d1810
test dl, 0x40
je 0x100d179e
or bl, 0xff
or dl, 0x80
or esi, 0xffffffff
or ecx, 0xffffffff
jmp 0x100d17a7
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
xor bl, bl
and dl, 0x7f
xor esi, esi
xor ecx, ecx
mov al, bl
xor al, dl
jns 0x100d17d4
test bl, bl
je 0x100d17c2
mov ebx, dword [esp + 0x1c]
mov ecx, Ordinal_3
xor esi, esi
mov dword [esp + 0x10], ecx
jmp 0x100d1823
mov ebx, dword [esp + 0x1c]
mov ecx, Ordinal_3
or esi, 0xffffffff
mov dword [esp + 0x10], ecx
jmp 0x100d1823
mov ebx, 7
lea esp, [esp]
shld ecx, esi, 8
movzx eax, dl
lea edi, [edi + 1]
cdq
shl esi, 8
or ecx, edx
mov dl, byte [edi]
or esi, eax
dec ebx
jne 0x100d17e0
mov ebx, dword [esp + 0x1c]
shld ecx, esi, 8
movzx eax, dl
shl esi, 8
cdq
or esi, eax
or ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x100d1823
push 8
push 8
push edi
call fcn.100d46d0
add esp, 0xc
mov dword [esp + 0x10], edx
mov esi, eax
xor edx, edx
xor ecx, ecx
xor edi, edi
lea esp, [esp]
movzx eax, byte [ebx + ecx]
add edx, eax
movzx eax, byte [ebx + ecx + 1]
add ecx, 2
add edi, eax
cmp ecx, 0x94
jb 0x100d1830
push ebp
mov ebp, 0x9c
add edx, edi
cmp ecx, ebp
jae 0x100d185f
mov eax, ebp
sub eax, ecx
add ecx, eax
shl eax, 5
add edx, eax
xor edi, edi
xor ebx, ebx
cmp ecx, 0x200
jae 0x100d18b4
mov eax, 0x200
sub eax, ecx
cmp eax, 2
jb 0x100d189d
mov ebp, dword [esp + 0x20]
jmp 0x100d1880
movzx eax, byte [ecx + ebp]
add edi, eax
movzx eax, byte [ecx + ebp + 1]
add ecx, 2
add ebx, eax
cmp ecx, 0x1ff
jb 0x100d1880
mov ebp, 0x9c
cmp ecx, 0x200
jae 0x100d18af
mov eax, dword [esp + 0x20]
movzx eax, byte [ecx + eax]
add edx, eax
lea eax, [ebx + edi]
add edx, eax
cmp esi, edx
jne 0x100d18c5
pop ebp
pop esi
pop edi
mov eax, 1
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x20]
xor edx, edx
xor eax, eax
xor edi, edi
nop
movsx ecx, byte [ebx + eax]
add edx, ecx
movsx ecx, byte [ebx + eax + 1]
add eax, 2
add edi, ecx
cmp eax, 0x94
jb 0x100d18d0
add edx, edi
cmp eax, 0x9c
jae 0x100d18f9
sub ebp, eax
add eax, ebp
shl ebp, 5
add edx, ebp
xor edi, edi
xor ebx, ebx
cmp eax, 0x200
jae 0x100d193d
mov ebp, dword [esp + 0x20]
mov ecx, 0x200
sub ecx, eax
cmp ecx, 2
jb 0x100d192b
movsx ecx, byte [eax + ebp]
add edi, ecx
movsx ecx, byte [eax + ebp + 1]
add eax, 2
add ebx, ecx
cmp eax, 0x1ff
jb 0x100d1914
cmp eax, 0x200
jae 0x100d1938
movsx eax, byte [eax + ebp]
add edx, eax
lea eax, [ebx + edi]
add edx, eax
pop ebp
xor eax, eax
cmp esi, edx
pop esi
pop edi
sete al
pop ebx
add esp, 8
ret
Function at 0x100dd740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x18
cmp eax, 5
jae 0x100dd752
xor eax, eax
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov edx, dword [ecx + 0x4d00]
lea ebp, [eax - 4]
push esi
mov esi, dword [ecx + 0x4d04]
mov ecx, dword [ecx + 0x4d08]
push edi
xor edi, edi
mov dword [esp + 0x34], ecx
add ebp, ebx
mov dword [esp + 0x20], ebp
nop
lea eax, [edi + ebx]
mov dword [esp + 0x10], eax
cmp eax, ebp
jae 0x100dd7a3
jmp 0x100dd790
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x100dd79f
inc eax
cmp eax, ebp
jb 0x100dd790
mov dword [esp + 0x10], eax
mov edi, eax
sub edi, ebx
cmp eax, ebp
jae 0x100dd8c4
mov ecx, edi
sub ecx, edx
cmp ecx, 3
jbe 0x100dd7db
xor esi, esi
mov dword [esp + 0x14], esi
mov cl, byte [eax + 4]
mov edx, edi
mov dword [esp + 0x24], edx
test cl, cl
je 0x100dd817
cmp cl, 0xff
je 0x100dd817
and esi, 3
add esi, esi
or esi, 1
inc edi
jmp 0x100dd780
dec ecx
shl esi, cl
and esi, 7
mov dword [esp + 0x14], esi
je 0x100dd7be
movzx ecx, byte [esi + 0x101b8998]
mov edx, eax
sub edx, ecx
cmp byte [esi + 0x101b8990], 0
mov cl, byte [edx + 4]
je 0x100dd807
test cl, cl
je 0x100dd807
cmp cl, 0xff
jne 0x100dd7be
and esi, 3
mov edx, edi
add esi, esi
or esi, 1
inc edi
jmp 0x100dd780
movzx ebx, cl
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
sub ebx, dword [esp + 0x34]
sub ebx, edi
test esi, esi
je 0x100dd896
movzx ecx, byte [esi + 0x101b8998]
mov edx, 0x18
mov esi, dword [esp + 0x34]
shl ecx, 3
sub edx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov eax, edx
mov edx, ebx
mov ecx, eax
shr edx, cl
test dl, dl
je 0x100dd86f
cmp dl, 0xff
jne 0x100dd886
mov ecx, 0x20
mov edx, 1
sub ecx, ebp
shl edx, cl
dec edx
xor ebx, edx
sub ebx, esi
sub ebx, edi
jmp 0x100dd860
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [eax + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 3], cl
mov ecx, ebx
mov ebx, dword [esp + 0x30]
shr ecx, 8
add edi, 5
mov byte [eax + 2], cl
jmp 0x100dd780
mov eax, dword [esp + 0x2c]
add dword [eax + 0x4d08], edi
mov dword [eax + 0x4d04], esi
mov dword [eax + 0x4d00], edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x100e2710
Capabilities:
Terminate process

Disassembly:
mov edx, dword [str.Fatal_Internal_Error_in_libarchive:]
mov ecx, edx
push esi
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2720
sub ecx, esi
push ecx
push edx
push 2
call fcn.100e8740
mov edx, dword [esp + 0x18]
add esp, 0xc
mov ecx, edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2740
sub ecx, esi
push ecx
push edx
push 2
call fcn.100e8740
push 1
push 0x101b99a0
push 2
call fcn.100e8740
add esp, 0x18
push dword [esp + 8]
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
int3
Function at 0x100e3080
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0x30]
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 4], 0
mov edi, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
lea eax, [edi + 1]
push eax
push esi
call fcn.100e4010
mov ebp, dword [sym.imp.MSVCRT.dll_memmove]
add esp, 8
test eax, eax
je 0x100e30d7
mov eax, dword [esi + 4]
add eax, dword [esi]
push edi
push dword [esp + 0x1c]
push eax
call ebp
mov eax, dword [esi]
add esp, 0xc
add dword [esi + 4], edi
mov ecx, dword [esi + 4]
mov byte [ecx + eax], 0
jmp 0x100e30e6
push str.Out_of_memory
push 1
call fcn.100e2710
add esp, 8
mov dword [esi + 0x10], 0
lea edi, [esi + 0xc]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
inc eax
mov dword [esp + 0x18], ecx
add eax, ecx
push eax
push edi
call fcn.100e4010
add esp, 8
test eax, eax
je 0x100e3137
push dword [esp + 0x18]
mov eax, dword [edi]
push dword [esp + 0x18]
add eax, dword [edi + 4]
push eax
call ebp
mov eax, dword [esp + 0x24]
add esp, 0xc
add dword [edi + 4], eax
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov byte [ecx + eax], 0
jmp 0x100e3146
push str.Out_of_memory
push 1
call fcn.100e2710
add esp, 8
mov dword [esi + 0x1c], 0
add esi, 0x18
mov edi, dword [ebx + 0x1c]
mov ebx, dword [ebx + 0x18]
mov eax, dword [esi + 4]
inc eax
add eax, edi
add eax, eax
push eax
push esi
call fcn.100e4010
add esp, 8
test eax, eax
je 0x100e3192
mov ecx, dword [esi + 4]
lea eax, [edi + edi]
push eax
mov eax, dword [esi]
push ebx
lea eax, [eax + ecx*2]
push eax
call ebp
add dword [esi + 4], edi
add esp, 0xc
mov ecx, dword [esi + 4]
xor edx, edx
mov eax, dword [esi]
pop edi
pop esi
pop ebp
mov word [eax + ecx*2], dx
pop ebx
ret
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 8], str.Out_of_memory
mov dword [esp + 4], 1
jmp fcn.100e2710
Function at 0x100e81e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__errno]
test eax, 0xffff7fff
jne 0x100e82c4
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100e825d
call ebx
cmp eax, 3
jne 0x100e8243
push ebp
call fcn.100e8510
mov esi, eax
add esp, 4
test esi, esi
jne 0x100e8237
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100e825d
call ebx
push eax
call fcn.100e8110
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x100e82b8
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x100e827d
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x100e8284
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
cmp edi, 0xffffffff
jne 0x100e82a7
call ebx
push eax
call fcn.100e8110
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call dword [sym.imp.MSVCRT.dll__open_osfhandle]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x100e835b
mov eax, dword [esp + 0x18]
push dword [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x100e83e9
call edi
cmp dword [eax], 0xd
jne 0x100e8331
test dword [esp + 0x18], 0x100
je 0x100e8331
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100e830d
call ebx
push eax
call fcn.100e8110
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x100e8321
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call edi
cmp dword [eax], 2
jne 0x100e83e9
push ebp
call fcn.100e8510
mov esi, eax
add esp, 4
test esi, esi
jne 0x100e835b
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push dword [esp + 0x1c]
mov ebp, dword [esp + 0x1c]
push ebp
push esi
call dword [sym.imp.MSVCRT.dll__wopen]
add esp, 0xc
mov dword [esp + 0x18], eax
test eax, eax
jns 0x100e83d6
call edi
cmp dword [eax], 0xd
jne 0x100e83d6
test ebp, 0x100
je 0x100e83d6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100e83af
call ebx
push eax
call fcn.100e8110
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x100e83ce
call edi
push esi
mov dword [eax], 0x15
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call edi
mov dword [eax], 0xd
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x100e83f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x100e8408
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
jne 0x100e8412
xor eax, eax
ret
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100e847a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x100e8453
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x100e840f
cmp eax, 5
jne 0x100e846d
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.100e8110
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x100e8740
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x100e8758
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100e87a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100e8797
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.100e8110
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x100e8a90
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x100e8ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x100e8af7
push 8
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x100e8af7
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_CryptGenRandom]
push 0
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.DLL_CryptReleaseContext]
test esi, esi
je 0x100e8af7
xor eax, eax
pop esi
pop ecx
ret
mov eax, 0xffffffe7
pop esi
pop ecx
ret
Function at 0x100ef560
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push edi
mov dword [ebx], 0x4000400
test edx, edx
je 0x100ef5ca
lea eax, [ebx + 0x104]
mov ecx, edx
nop
mov dword [eax - 0x100], 0x4000400
lea eax, [eax + 0x10]
mov dword [eax - 0x10c], 0x4000400
mov dword [eax - 0x108], 0x4000400
mov dword [eax - 0x104], 0x4000400
mov dword [eax - 0x10], 0x4000400
mov dword [eax - 0xc], 0x4000400
mov dword [eax - 8], 0x4000400
mov dword [eax - 4], 0x4000400
dec ecx
jne 0x100ef580
cmp byte [esp + 0x28], 0
lea edi, [ebx + 0x204]
mov ecx, pe_nt_image_headers32
mov eax, 0x4000400
rep stosd dword es:[edi], eax
jne 0x100ef79c
push ebp
xor ebp, ebp
mov dword [esp + 0xc], ebp
test edx, edx
je 0x100ef79b
lea eax, [ebx + 0x404]
mov dword [esp + 0x2c], eax
lea eax, [ebx + 0x4808]
mov dword [esp + 0x10], eax
push esi
jmp 0x100ef610
mov edi, dword [ebx + 0x4804]
xor esi, esi
mov dword [eax], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [esp + 0x28], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x101c1200]
movzx edx, byte [ecx + 0x101c1200]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x18], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x101c1200]
add eax, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [ecx + 0x101c1200]
add eax, edx
mov dword [esp + 0x20], eax
test edi, edi
je 0x100ef778
cmp esi, 8
jae 0x100ef6c5
xor edi, edi
lea edx, [esi + 8]
nop
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp*8]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x101c1200]
add edi, eax
cmp edx, 1
jne 0x100ef680
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
add eax, edi
mov edi, dword [esp + 0x28]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, edi
jb 0x100ef675
jmp 0x100ef778
cmp esi, edi
jae 0x100ef778
lea ecx, [ecx]
cmp esi, 0x10
jae 0x100ef725
xor edi, edi
mov edx, esi
lea esp, [esp]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp*8]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x101c1200]
add edi, eax
cmp edx, 1
jne 0x100ef6e0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
add eax, edi
mov edi, dword [esp + 0x28]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, edi
jb 0x100ef6d0
jmp 0x100ef778
cmp esi, edi
jae 0x100ef778
mov ebp, dword [esp + 0x28]
lea ecx, [ecx]
xor edi, edi
lea eax, [esi + 0xf0]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x101c1200]
add edi, ecx
cmp eax, 1
jne 0x100ef738
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, ebp
jb 0x100ef730
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
inc ebp
add dword [esp + 0x30], 0x440
add eax, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
cmp ebp, dword [esp + 0x2c]
jb 0x100ef610
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x100ef7b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [esp + 0x24]
mov ebp, dword [ebx + 0x4804]
mov dword [esp + 0xc], ebp
mov dword [ebx + esi*4 + 0x4808], ebp
movzx ecx, word [ebx]
mov eax, ecx
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
movzx eax, byte [eax + 0x101c1200]
movzx edx, byte [ecx + 0x101c1200]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x101c1200]
add eax, edx
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + 0x101c1200]
add eax, edx
mov dword [esp + 0x18], eax
imul eax, esi, 0x440
xor esi, esi
add eax, 0x404
add eax, ebx
mov dword [esp + 0x20], eax
test ebp, ebp
je 0x100ef945
push edi
lea ebx, [ebx]
cmp esi, 8
jae 0x100ef898
mov ebp, dword [esp + 0x28]
lea edx, [esi + 8]
xor edi, edi
mov edi, edi
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp*8]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x101c1200]
add edi, eax
cmp edx, 1
jne 0x100ef850
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, ebp
jb 0x100ef840
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp esi, ebp
jae 0x100ef944
cmp esi, 0x10
jae 0x100ef8fb
mov ebp, dword [esp + 0x28]
xor edi, edi
mov edx, esi
lea ecx, [ecx]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp*8]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x101c1200]
add edi, eax
cmp edx, 1
jne 0x100ef8b0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, ebp
jb 0x100ef8a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp esi, ebp
jae 0x100ef944
nop
xor edi, edi
lea eax, [esi + 0xf0]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x101c1200]
add edi, ecx
cmp eax, 1
jne 0x100ef908
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, ebp
jb 0x100ef900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x100efa40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 0x100
add eax, edi
jmp 0x100efa60
mov ecx, dword [esi + 0x18]
mov edx, eax
shr edx, 7
add ebx, ebx
and edx, 1
mov dword [esi + ecx*4 + 0x20], edx
mov edx, edi
and edx, ebx
mov ecx, eax
shr ecx, 8
add edx, edi
add ecx, edx
add eax, eax
lea edx, [ecx*2]
mov ecx, dword [esi + 0x18]
add edx, ebp
mov dword [esi + ecx*4 + 0x108], edx
mov ecx, ebx
inc dword [esi + 0x18]
xor ecx, eax
not ecx
and edi, ecx
cmp eax, 0x10000
jb 0x100efa60
pop edi
pop esi
pop ebp
pop ebx
ret