joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40140b
Capabilities:
Encode data using xor

Disassembly:
imul ebx, eax
imul ebx, eax
not dl
bswap ecx
cmp ebx, 0x7ceb
mov ch, dh
imul esi, ebx
push ebx
push 0xf7f42c
bswap ebp
call 0x40142d
mov dl, 0x25
cmp ebx, edi
pop ebp
test edx, esi
cmp ebp, 0x5684
jb 0x401444
xchg cl, ch
test cl, ch
dec dl
neg ch
mov edi, 0x6f61e659
push 0x28b7e
pop esi
mov ch, 0x7b
imul edi, edi
sub eax, esi
or edx, edx
add eax, 0x22fe7
movd mm2, ebp
movd ebx, mm2
bswap edi
and al, 0x16
imul edx, ebx
add ebx, 0x2d567
cmp esi, ebp
ja 0x40147b
mov dh, ah
movzx ecx, cl
add ebx, 0x6ad
bswap esi
bswap ecx
dec dh
test edi, ebp
mov edi, eax
cmp ebp, 0x836d
sub eax, 0x9ebffc2e
mov dh, ch
sub dh, 0x20
adc eax, ebx
push ebx
imul eax, ecx, 0xd9fbae42
imul edx, edx, 0x84b949db
push 0
dec esi
pop esi
not dl
inc esi
xor edi, ecx
imul eax, ecx
add ebp, 0x571af5b0
cmp esi, 0xaf8
jb 0x4014b3
sbb cl, bl
ret

Function at 0x1d91058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01d911a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1d9107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d9106a
add dl, dl
jne 0x1d91089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d910dc
xor eax, eax
add dl, dl
jne 0x1d91096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d9117d
add dl, dl
jne 0x1d910a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d910b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d910bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d910c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1d910d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1d91075
mov eax, 1
add dl, dl
jne 0x1d910ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d910f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d910e1
sub eax, ebx
mov ebx, 1
jne 0x1d91128
mov ecx, 1
add dl, dl
jne 0x1d9110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1d91119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d91105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d91075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1d9113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1d9114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d91136
cmp eax, 0x7d00
jae 0x1d9116d
cmp eax, 0x500
jb 0x1d91168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d91075
cmp eax, 0x7f
ja 0x1d91170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d91075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1d9119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1d91075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406952
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406991
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406991
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406991
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406991
cmp dword [ecx + 0x74], 0xe
jbe 0x406991
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40c3b3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c450
push ebx
push esi
call fcn.0040c37c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040c310
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c3fd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c44f
push edi
push eax
call fcn.0040cfd2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c41d
call fcn.0040ae71
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c44e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040c310
add esp, 0x20
test eax, eax
jne 0x40c43c
push edi
call fcn.0040ae71
jmp 0x40c444
push ebx
call fcn.0040ae71
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d74f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x472f30
push 0x472f28
push str.FlsAlloc
push 0x1f
call fcn.0040d60e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d783
push dword [ebp + 8]
mov ecx, esi
call dword [0x42114c]
call esi
jmp 0x40d789
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d7cd
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x472f40
push 0x472f38
push str.FlsGetValue
push 0x21
call fcn.0040d60e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d804
push dword [ebp + 8]
mov ecx, esi
call dword [0x42114c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d80c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x472f48
push 0x472f40
push str.FlsSetValue
push 0x22
call fcn.0040d60e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d846
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42114c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412ca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412ccd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412ccd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000efca
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1000ec8a
Function at 0x10020920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
cmp esi, 0x80
jge 0x10020948
lea eax, [esi - 0x41]
cmp eax, 0x19
ja 0x100209f2
lea eax, [esi + 0x20]
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x10000
jge 0x100209e4
push ebx
push edi
mov edi, 0xa2
mov dword [ebp - 4], 0xffffffff
xor ebx, ebx
lea eax, [ebx + edi]
cdq
sub eax, edx
mov edx, esi
sar eax, 1
movzx ecx, word [eax*4 + 0x10134150]
sub edx, ecx
js 0x10020984
mov edx, eax
lea ebx, [eax + 1]
mov dword [ebp - 4], edx
jmp 0x1002098a
mov edx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, ebx
jge 0x10020964
movzx ecx, word [edx*4 + 0x10134150]
movzx eax, byte [edx*4 + 0x10134153]
add eax, ecx
pop edi
pop ebx
cmp esi, eax
jge 0x100209c9
movzx eax, byte [edx*4 + 0x10134152]
xor ecx, esi
and ecx, eax
test ecx, 1
jne 0x100209c9
shr eax, 1
movzx eax, word [eax*2 + 0x10135628]
add eax, esi
movzx esi, ax
mov eax, dword [ebp - 8]
test eax, eax
je 0x100209f2
xor edx, edx
mov ecx, esi
cmp eax, 2
sete dl
call fcn.10020a40
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x10400]
cmp eax, 0x27
lea eax, [esi + 0x28]
jbe 0x100209f4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10023300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 0x10], ebx
xor ecx, ecx
mov dword [ebp - 0xc], edi
test esi, esi
jle 0x10023416
cmp esi, 0x20
jb 0x100233f6
lea eax, [esi - 1]
lea edx, [esi - 1]
add eax, edi
add edx, ebx
cmp ebx, eax
ja 0x1002333f
cmp edx, edi
jae 0x100233f6
mov eax, esi
and eax, 0x8000001f
jns 0x1002334d
dec eax
or eax, 0xffffffe0
inc eax
movaps xmm3, xmmword [0x1013cf40]
mov edx, esi
movaps xmm4, xmmword [0x1013cf80]
mov esi, edi
movaps xmm5, xmmword [0x1013cf60]
sub edx, eax
movaps xmm6, xmmword [0x1013cf20]
sub esi, ebx
mov dword [ebp - 4], esi
mov eax, ebx
lea esi, [edi + 0x10]
mov edi, dword [ebp - 4]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 8]
movups xmm2, xmmword [edi + eax]
movaps xmm0, xmm3
pcmpgtb xmm0, xmm2
movaps xmm1, xmm2
pxor xmm0, xmm4
pcmpgtb xmm1, xmm5
pandn xmm1, xmm0
movaps xmm0, xmm2
paddb xmm0, xmm6
pand xmm0, xmm1
pandn xmm1, xmm2
por xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm2, xmmword [ebx + ecx]
add ecx, 0x20
movaps xmm0, xmm3
pcmpgtb xmm0, xmm2
movaps xmm1, xmm2
pxor xmm0, xmm4
pcmpgtb xmm1, xmm5
pandn xmm1, xmm0
movaps xmm0, xmm2
paddb xmm0, xmm6
pand xmm0, xmm1
pandn xmm1, xmm2
por xmm0, xmm1
movups xmmword [eax + 0x10], xmm0
add eax, 0x20
cmp ecx, edx
jl 0x10023385
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
cmp ecx, esi
jge 0x10023416
sub edi, ebx
lea edx, [ecx + ebx]
sub esi, ecx
mov al, byte [edx + edi]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x1002340e
add al, 0x20
mov byte [edx], al
inc edx
sub esi, 1
jne 0x10023401
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100337c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0xd
push esi
push edi
mov dword [esp + 0x10], ecx
lea esi, [ebx - 1]
test esi, esi
js 0x100337fa
mov edi, dword [ebp + 8]
movzx edx, byte [esi + edi]
lea ecx, [eax*8]
xor edx, ecx
xor eax, edx
sub esi, 1
jns 0x100337e2
mov ecx, dword [esp + 0x10]
xor edx, edx
div dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
mov edi, dword [eax + edx*4]
test edi, edi
je 0x1003386e
nop dword [eax]
mov eax, dword [edi + 0x14]
inc eax
cmp ebx, eax
jne 0x10033868
mov eax, dword [ebp + 8]
lea edx, [edi + 0x28]
mov esi, ebx
sub esi, 4
jb 0x10033836
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x1003383b
add edx, 4
add eax, 4
sub esi, 4
jae 0x10033825
cmp esi, 0xfffffffc
je 0x10033889
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x10033868
cmp esi, 0xfffffffd
je 0x10033889
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x10033868
cmp esi, 0xfffffffe
je 0x10033889
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x10033868
cmp esi, 0xffffffff
je 0x10033889
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x10033889
mov edi, dword [edi]
test edi, edi
jne 0x10033810
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x10]
lea ecx, [ebx + 0x29]
sub eax, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
add eax, 0x16
cdq
mov esi, eax
mov ebx, edx
call fcn.100791f0
test eax, eax
je 0x100338c8
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
or eax, ebx
je 0x100338dc
push ebx
push esi
call fcn.10111bb0
add esp, 8
mov esi, eax
jmp 0x100338de
xor esi, esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
test esi, esi
je 0x100338b3
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
add eax, edi
push ebx
push eax
lea eax, [esi + 0xc]
push eax
call fcn.10015590
sub esi, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [esp + 0x10]
add esi, 0xc
mov edx, edi
push esi
call fcn.10034040
mov ecx, dword [ebp + 0x14]
add esp, 4
add eax, ebx
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, ecx
push ebx
push esi
mov dword [esp + 0x10], eax
mov ebx, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
add ebx, ebx
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], eax
lea esi, [ebx*4]
call fcn.100791f0
test eax, eax
jne 0x100342b1
mov eax, esi
or eax, 0
je 0x100342b1
push 0
push esi
call fcn.10111bb0
mov edi, eax
add esp, 8
mov dword [esp + 0x24], edi
test edi, edi
je 0x100342b1
push esi
push 0
push edi
call fcn.10002790
mov esi, dword [esp + 0x20]
xor eax, eax
add esp, 0xc
mov dword [esp + 0x18], eax
cmp dword [esi + 0xc], eax
jle 0x1003422f
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
cmp dword [ecx], 0
je 0x1003421a
mov ebx, dword [ecx]
mov eax, dword [ebx]
mov dword [ecx], eax
lea eax, [ebx + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100341c2
sub eax, edx
mov esi, 0xd
add eax, 0xffffffff
js 0x100341f5
nop word [eax + eax]
movzx edx, byte [ebx + eax + 0x28]
lea ecx, [esi*8]
xor edx, ecx
xor esi, edx
sub eax, 1
jns 0x100341e0
xor edx, edx
mov edi, dword [esp + 0x24]
mov eax, esi
mov ecx, dword [esp + 0x1c]
div dword [esp + 0x20]
mov eax, dword [edi + edx*4]
mov dword [ebx], eax
mov dword [edi + edx*4], ebx
cmp dword [ecx], 0
jne 0x100341b6
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
inc eax
add ecx, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
cmp eax, dword [esi + 0xc]
jl 0x100341b1
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100342a2
cmp dword [0x101422c8], 0
je 0x10034298
mov eax, dword [0x101441e8]
test eax, eax
je 0x10034253
push eax
call dword [0x10142318]
add esp, 4
push dword [esp + 0x10]
call dword [0x101422f4]
push dword [esp + 0x14]
sub dword [0x10144240], eax
dec dword [0x10144264]
call dword [0x101422ec]
mov eax, dword [0x101441e8]
add esp, 8
test eax, eax
je 0x100342a2
push eax
call dword [0x10142320]
add esp, 4
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [0x101422ec]
add esp, 4
mov dword [esi + 0xc], ebx
xor eax, eax
mov dword [esi + 0x14], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edx
mov dword [eax], 0
test edi, edi
je 0x1003a737
mov ebx, dword [ebp + 0xc]
mov esi, 0xd
lea edx, [ebx - 1]
test edx, edx
js 0x1003a697
mov ebx, dword [ebp + 8]
nop word [eax + eax]
movsx ecx, byte [edx + ebx]
lea eax, [esi*8]
xor ecx, eax
xor esi, ecx
sub edx, 1
jns 0x1003a680
mov ebx, dword [ebp + 0xc]
mov ecx, dword [esp + 0xc]
lea eax, [esi*8]
xor eax, esi
xor eax, ecx
and eax, 0x1ff
lea eax, [edi + eax*4]
mov edi, dword [eax]
mov dword [esp + 0x14], eax
test edi, edi
je 0x1003a71e
cmp dword [edi + 8], ecx
jne 0x1003a717
cmp dword [edi + 4], ebx
jne 0x1003a717
mov edx, dword [edi]
mov ecx, ebx
mov esi, dword [ebp + 8]
sub ecx, 4
jb 0x1003a6e1
nop
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1003a6e6
add edx, 4
add esi, 4
sub ecx, 4
jae 0x1003a6d0
cmp ecx, 0xfffffffc
je 0x1003a72e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x1003a713
cmp ecx, 0xfffffffd
je 0x1003a72e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x1003a713
cmp ecx, 0xfffffffe
je 0x1003a72e
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x1003a713
cmp ecx, 0xffffffff
je 0x1003a72e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x1003a72e
mov ecx, dword [esp + 0xc]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x1003a6b8
lea edi, [ebx + 0x10]
xor esi, esi
call fcn.100791f0
test eax, eax
je 0x1003a740
jmp 0x1003a7a7
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
or eax, esi
je 0x1003a7a1
test esi, esi
ja 0x1003a7a1
jb 0x1003a754
cmp edi, 0x7fffff00
jae 0x1003a7a1
cmp dword [0x101422c8], esi
je 0x1003a793
mov eax, dword [0x101441e8]
test eax, eax
je 0x1003a76f
push eax
call dword [0x10142318]
add esp, 4
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.10111c20
mov eax, dword [0x101441e8]
test eax, eax
je 0x1003a78d
push eax
call dword [0x10142320]
add esp, 4
mov esi, dword [esp + 0x10]
jmp 0x1003a7a3
push edi
call dword [0x101422e8]
add esp, 4
mov esi, eax
jmp 0x1003a7a3
xor esi, esi
test esi, esi
jne 0x1003a7b8
xor eax, eax
jl 0x1003a7c4
jg 0x1003a7b1
test edi, edi
je 0x1003a7c4
mov edi, 7
jmp 0x1003a7c6
push edi
push 0
push esi
call fcn.10002790
add esp, 0xc
xor edi, edi
test esi, esi
je 0x1003a7f1
mov edx, dword [esp + 0xc]
lea eax, [esi + 0x10]
push ebx
push dword [ebp + 8]
mov dword [esi], eax
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
call fcn.10015590
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov dword [ecx], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10044170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, edx
push edi
mov edi, ecx
and eax, 0x80000003
jns 0x10044185
dec eax
or eax, 0xfffffffc
inc eax
mov esi, dword [ebp + 8]
jne 0x100441c8
mov eax, esi
and eax, 0x80000003
jns 0x10044198
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, dword [ebp + 0xc]
jne 0x100441cb
cmp ecx, 4
jle 0x100441cb
push ebx
lea ebx, [ecx - 5]
shr ebx, 2
inc ebx
mov eax, ebx
neg eax
lea ecx, [ecx + eax*4]
mov eax, dword [esi]
add esi, 4
xor eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ebx, 1
jne 0x100441b1
pop ebx
jmp 0x100441cb
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x100441e5
sub esi, edx
sub edi, edx
mov al, byte [esi + edx]
lea edx, [edx + 1]
xor al, byte [edx - 1]
dec ecx
mov byte [edi + edx - 1], al
test ecx, ecx
jg 0x100441d3
pop edi
pop esi
pop ebp
ret
Function at 0x10044c30
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ecx + 4]
mov dword [ebp - 4], ecx
push ebx
mov ebx, dword [edx + 0xc]
push esi
mov esi, dword [edx + 4]
push edi
mov edi, dword [edx]
bswap edi
mov dword [ecx], edi
mov ecx, dword [edx + 8]
bswap ecx
bswap esi
mov dword [eax], esi
mov esi, dword [ebp - 4]
bswap ebx
mov dword [esi + 8], ecx
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
mov dword [esi + 0xc], ebx
mov edx, dword [ecx*4 + str.ccccwwww]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
movzx ecx, cl
and edx, 0xff000000
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + str.ccccwwww]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, edi
mov edi, 0x101366a4
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
movzx ecx, cl
mov esi, dword [ecx*4 + str.ccccwwww]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
movzx ecx, cl
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + str.ccccwwww]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x101366c8
jne 0x10044cd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045ba0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
mov eax, dword [edx + 4]
bswap eax
push esi
push edi
mov edi, ecx
mov esi, dword [edx]
mov ecx, dword [edx + 0x1c]
bswap ecx
bswap esi
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
bswap eax
mov dword [edi + 8], eax
mov eax, dword [edx + 0xc]
bswap eax
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x10]
bswap eax
mov dword [edi + 0x10], eax
mov eax, dword [edx + 0x14]
bswap eax
mov dword [edi + 0x14], eax
mov eax, dword [edx + 0x18]
bswap eax
mov dword [edi + 0x18], eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
mov dword [edi + 0x1c], ecx
mov dword [edi], esi
mov edx, dword [eax*4 + str.ccccwwww]
mov eax, ecx
shr eax, 8
xor edx, 0x1000000
movzx eax, al
and edx, 0xff000000
mov eax, dword [eax*4 + str.ccccwwww]
and eax, 0xff0000
xor edx, eax
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax*4 + str.ccccwwww]
xor edx, eax
movzx eax, cl
mov ecx, dword [edi + 8]
mov eax, dword [eax*4 + str.ccccwwww]
and eax, 0xff00
xor edx, eax
mov eax, dword [edi + 4]
xor edx, esi
xor eax, edx
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], eax
xor ecx, eax
mov eax, dword [edi + 0xc]
xor eax, ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x30]
mov edi, 0x101366a4
mov edx, dword [eax - 4]
lea eax, [eax + 0x20]
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
mov esi, dword [ecx*4 + str.ccccwwww]
mov ecx, edx
shr ecx, 8
and esi, 0xff0000
movzx ecx, cl
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff00
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff000000
xor esi, ecx
movzx ecx, dl
mov edx, dword [eax - 0x38]
movzx ecx, byte [ecx*4 + str.ccccwwww]
xor esi, ecx
mov ecx, dword [eax - 0x3c]
xor esi, dword [eax - 0x40]
xor ecx, esi
mov dword [eax - 0x20], esi
mov dword [eax - 0x1c], ecx
xor edx, ecx
mov ecx, dword [eax - 0x34]
xor ecx, edx
mov dword [eax - 0x18], edx
mov dword [eax - 0x14], ecx
mov edx, dword [eax - 0x14]
mov ecx, edx
shr ecx, 8
movzx ecx, cl
mov esi, dword [ecx*4 + str.ccccwwww]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
movzx ecx, cl
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + str.ccccwwww]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 0x30]
xor esi, dword [edi]
add edi, 4
mov dword [eax - 0x10], esi
mov ecx, dword [eax - 0x2c]
xor ecx, esi
mov dword [eax - 0xc], ecx
mov edx, dword [eax - 0x28]
xor edx, ecx
mov dword [eax - 8], edx
mov ecx, dword [eax - 0x24]
xor ecx, edx
mov dword [eax - 4], ecx
cmp edi, 0x101366bc
jne 0x10045c58
pop edi
pop esi
ret
Function at 0x10045d50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10141004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10045d7f
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.invalid_ICLRRuntimeHost_pointer._n
call esi
mov edi, 0x80004003
jmp 0x10045d97
mov eax, dword [esi]
test eax, eax
jne 0x10045de4
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.invalid_ICLRRuntimeHost._n
call esi
mov edi, 0x80070057
push 0x115
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.10002790
push edi
push str.VerifyClrCleanup
push str._s_HRESULT:_0x_016X
lea eax, [ebp - 0x11c]
push 0x115
push eax
call fcn.10001010
add esp, 0x20
lea eax, [ebp - 0x11c]
push eax
call esi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100011bc
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax]
push eax
mov ecx, dword [ecx + 8]
call ecx
push str.done_with_cleanup._n
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100011bc
mov esp, ebp
pop ebp
ret