joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000edeb
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x14], 0
je 0x1000ee09
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x27]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x1000edf6
pop ebx
mov byte [edx + 0x14], 0
mov eax, edx
ret

Function at 0x1000ee69
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x13], 0
je 0x1000ee87
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x27]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x1000ee74
pop ebx
mov byte [edx + 0x13], 0
mov eax, edx
ret

Function at 0x1000ee8a
Capabilities:
Get disk information

Disassembly:
push 0x40
mov eax, 0x1005160c
call fcn.100505ae
mov ebx, ecx
mov dword [ebp - 0x44], ebx
and dword [ebp - 4], 0
mov dword [ebp - 0x4c], ebx
and dword [ebp - 0x48], 0
push 0x10053593
call fcn.10007a7e
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
mov dword [ebp - 4], ecx
push 0x1005494c
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x13]
xor edx, edx
dec ecx
push 0xa
pop esi
div esi
add dl, 0x30
mov byte [ecx], dl
test eax, eax
jne 0x1000eeda
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
push 0xf
pop esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x13]
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
cmp ecx, eax
jne 0x1000ef0f
mov edx, esi
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x2c], edx
jmp 0x1000ef21
lea eax, [ebp - 0x13]
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.10007eac
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
cmp ebx, eax
je 0x1000ef53
mov edx, dword [ebx + 0x14]
cmp edx, esi
jbe 0x1000ef37
mov ecx, dword [ebx]
inc edx
call fcn.1000806a
push 6
xor eax, eax
mov dword [ebx + 0x14], esi
pop ecx
lea esi, [ebp - 0x40]
mov dword [ebx + 0x10], eax
mov edi, ebx
mov byte [ebx], al
rep movsd dword es:[edi], dword [esi]
push 0xf
pop esi
mov edx, esi
mov byte [ebp - 0x40], al
cmp edx, esi
jbe 0x1000ef60
mov ecx, dword [ebp - 0x40]
inc edx
call fcn.1000806a
mov eax, ebx
call fcn.1005056c
ret
Function at 0x1000fca5
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x1000fcc3
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x27]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x1000fcb0
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret
Function at 0x10014596
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x100145b4
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x27]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x100145a1
pop ebx
mov byte [edx + 0x11], 0
mov eax, edx
ret

Function at 0x100145b7
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x100145d5
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x27]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x100145c2
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x100145d8
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1b], 0
je 0x100145f6
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x27]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1a
jb 0x100145e3
pop ebx
mov byte [edx + 0x1b], 0
mov eax, edx
ret

Function at 0x100145f9
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x18], 0
je 0x10014617
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x27]
xor byte [ecx], al
inc ebx
cmp ebx, 0x17
jb 0x10014604
pop ebx
mov byte [edx + 0x18], 0
mov eax, edx
ret
Function at 0x1001ad33
Capabilities:
Encode data using xor

Disassembly:
push 0x34
mov eax, 0x10051e84
call fcn.100505ae
cmp byte [0x100604a0], 0
je 0x1001aef7
movaps xmm0, xmmword [0x1005a480]
lea ecx, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x1001953
xor ebx, ebx
call fcn.1000ee69
push eax
call fcn.1002d493
pop ecx
mov ecx, 0x98
mov edx, ebx
mov al, byte [edx + 0x10054e60]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ad93
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001ad76
mov byte [ebp - 0x11], bl
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x100604a4
lea ecx, [ebp - 0x1c]
call fcn.10033e5e
movaps xmm0, xmmword [0x1005a060]
add esp, 0xc
movups xmmword [ebp - 0x40], xmm0
mov ecx, ebx
mov byte [ebp - 0x20], 1
movaps xmm0, xmmword [str.l_r_n_nsl__dvyr_v]
movups xmmword [ebp - 0x30], xmm0
lea eax, [ecx + 0x27]
xor byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 0x1f
jb 0x1001adce
push 5
mov byte [ebp - 0x20], bl
mov edx, ebx
pop ecx
mov al, byte [edx + str._OX_Bjof]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ae00
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001ade3
mov byte [ebp - 0x13], bl
push ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
mov edx, 0x100604a8
lea ecx, [ebp - 0x1c]
call fcn.1003451c
pop ecx
pop ecx
mov ecx, 0xfb
mov edx, ebx
mov al, byte [edx + 0x10054e78]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ae48
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x1001ae2b
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x100604b0
lea ecx, [ebp - 0x1c]
call fcn.10033e5e
add esp, 0xc
mov ecx, 0xde
mov edx, ebx
mov al, byte [edx + 0x10054e84]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ae8f
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x1001ae72
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x100604b8
lea ecx, [ebp - 0x1c]
call fcn.10033e5e
add esp, 0xc
mov edx, ebx
push 0x50
pop ecx
mov al, byte [edx + 0x10054e90]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001aed4
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xa
jl 0x1001aeb7
mov byte [ebp - 0x12], bl
sub esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x100604ac
lea ecx, [ebp - 0x1c]
call fcn.10033e5e
add esp, 0xc
call fcn.1005056c
ret
Function at 0x1001b4c3
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10051fb0
call fcn.100505ae
cmp byte [0x100d5960], 0
je 0x1001b676
movaps xmm0, xmmword [0x1005a260]
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x4e584e5e
xor ebx, ebx
mov dword [ebp - 0x28], 0x1c585e
mov byte [ebp - 0x24], 1
call fcn.100145f9
push eax
call fcn.1002d493
lea ecx, [ebp - 0x20]
mov dword [esp], 0x3ba887ba
call fcn.1001eecd
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x100d5964
mov ecx, eax
call fcn.10033e5e
movaps xmm0, xmmword [0x1005a060]
add esp, 0xc
movups xmmword [ebp - 0x44], xmm0
mov ecx, ebx
mov byte [ebp - 0x24], 1
movaps xmm0, xmmword [str.l_r_n_nsl__dvyr_v]
movups xmmword [ebp - 0x34], xmm0
lea eax, [ecx + 0x27]
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0x1f
jb 0x1001b549
mov byte [ebp - 0x24], bl
mov ecx, 0x8f
mov edx, ebx
mov al, byte [edx + 0x10054f90]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b57d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xa
jl 0x1001b560
mov byte [ebp - 0x16], bl
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 1
push eax
mov edx, 0x100d5968
lea ecx, [ebp - 0x20]
call fcn.1003451c
pop ecx
pop ecx
mov ecx, 0xe8
mov edx, ebx
mov al, byte [edx + 0x10054f9c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b5c5
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001b5a8
mov byte [ebp - 0x17], bl
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x100d5970
lea ecx, [ebp - 0x20]
call fcn.10033e5e
add esp, 0xc
mov ecx, 0x81
mov edx, ebx
mov al, byte [edx + 0x10054fa8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b60c
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001b5ef
mov byte [ebp - 0x17], bl
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x100d5974
lea ecx, [ebp - 0x20]
call fcn.10033e5e
add esp, 0xc
mov ecx, 0xec
mov edx, ebx
mov al, byte [edx + 0x10054fb4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b653
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001b636
mov byte [ebp - 0x15], bl
sub esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x100d596c
lea ecx, [ebp - 0x20]
call fcn.10033e5e
add esp, 0xc
call fcn.1005056c
ret
Function at 0x1001bbc1
Capabilities:
Execute command

Disassembly:
push 0x2c
mov eax, 0x10052087
call fcn.100505ae
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
xor ebx, ebx
push 0x51
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10055028]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001bbf9
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1001bbdc
mov byte [ebp - 0x15], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
call fcn.1002dcb1
pop ecx
test al, al
je 0x1001bc4c
push 0x11
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10055038]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x30], al
and ecx, 0x800000ff
jns 0x1001bc38
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1d
jl 0x1001bc1b
lea eax, [ebp - 0x30]
mov byte [ebp - 0x13], bl
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [ebp - 0x38], 0
mov ecx, 0xbb
and dword [ebp - 0x34], 0
mov edx, ebx
mov al, byte [edx + 0x10055058]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001bc78
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1001bc5b
mov byte [ebp - 0x13], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.1002dcb1
or dword [ebp - 4], 0xffffffff
pop ecx
test al, al
je 0x1001bca2
call fcn.1000fcc9
and dword [ebp - 0x38], 0
mov ecx, 0xf2
and dword [ebp - 0x34], 0
mov edx, ebx
mov al, byte [edx + 0x10055068]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001bcce
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1001bcb1
mov byte [ebp - 0x13], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.1002dcb1
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x20]
pop ecx
mov cl, al
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
test cl, cl
je 0x1001bd04
call fcn.1001461a
call fcn.1005056c
ret
Function at 0x1001e70d
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x50
mov eax, 0x1005218f
call fcn.100505ae
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x1001e7cd
lea ecx, [ebp - 0x40]
call fcn.1000ee8a
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.10008234
call fcn.1000ef68
add esp, 0x18
test al, al
je 0x1001e7d8
mov ecx, esi
call fcn.10008b0c
mov ecx, esi
call fcn.10008ab0
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x1001e708
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x10008a5e
push ebx
push ebx
call esi
push 6
pop ecx
movaps xmm0, xmmword [0x10059b90]
lea edi, [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0xf0001
rep stosd dword es:[edi], eax
push ecx
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x14], 1
movups xmmword [ebp - 0x28], xmm0
call fcn.1000edeb
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.100023b8
pop ecx
pop ecx
call fcn.1000ee0c
lea ecx, [ebp - 0x40]
call fcn.10007a5b
xor eax, eax
inc eax
call fcn.1005056c
ret 0xc
movaps xmm0, xmmword [0x1005a970]
lea ecx, [ebp - 0x28]
push 0x10
push 0x10053593
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x100
call fcn.10014596
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1001e813
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x1001e830
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x1001e81e
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x1001e832
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x33], 0
je 0x1001e84f
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x32
jb 0x1001e83d
mov byte [esi + 0x33], 0
pop esi
ret

Function at 0x1001e851
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf1], 0
je 0x1001e877
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0xf0
jb 0x1001e85f
mov byte [esi + 0xf1], 0
pop esi
ret

Function at 0x1001e879
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x90], 0
je 0x1001e89f
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x8f
jb 0x1001e887
mov byte [esi + 0x90], 0
pop esi
ret

Function at 0x1001e8a1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4b], 0
je 0x1001e8be
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x4a
jb 0x1001e8ac
mov byte [esi + 0x4b], 0
pop esi
ret

Function at 0x1001e8c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x1001e8dd
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x1001e8cb
mov byte [esi + 0x24], 0
pop esi
ret
Function at 0x1001e8df
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x1001e8fc
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x1001e8ea
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x1001e8fe
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x1001e91b
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x1001e909
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x1001e91d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x74], 0
je 0x1001e93a
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x73
jb 0x1001e928
mov byte [esi + 0x74], 0
pop esi
ret

Function at 0x1001e93c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2d0], 0
je 0x1001e962
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x2cf
jb 0x1001e94a
mov byte [esi + 0x2d0], 0
pop esi
ret

Function at 0x1001e964
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xbe], 0
je 0x1001e98a
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0xbd
jb 0x1001e972
mov byte [esi + 0xbe], 0
pop esi
ret

Function at 0x1001e9d2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x46], 0
je 0x1001e9ef
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x45
jb 0x1001e9dd
mov byte [esi + 0x46], 0
pop esi
ret

Function at 0x1001eb08
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x1001eb25
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x1001eb13
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x1001eb27
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x1001eb44
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x1001eb32
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x1001eb46
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1001eb63
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x1001eb51
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x1001eb65
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x1001eb82
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x1001eb70
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x1001eb84
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x1001eba1
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x1001eb8f
mov byte [esi + 0x15], 0
pop esi
ret
Function at 0x1001eba3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x1001ebc0
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x1001ebae
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x1001ebc2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x1001ebdf
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x1001ebcd
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x1001ebe1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x1001ebfe
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x1001ebec
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x1001ec00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x1001ec1d
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x1001ec0b
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x1001ecbf
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x1001ecdc
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x1001ecca
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x1001ecde
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x1001ecfb
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x27]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x1001ece9
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x1001eecd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x70
pop edx
mov al, byte [esi + edi - 0x2ba33912]
xor al, dl
inc edx
mov byte [ecx + esi], al
and edx, 0x800000ff
jns 0x1001eef7
dec edx
or edx, 0xffffff00
inc edx
inc esi
cmp esi, 0xc
jl 0x1001eeda
pop edi
pop esi
mov byte [ecx + 0xc], 0
mov eax, ecx
pop ebp
ret 4
Function at 0x1001ff8e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1005f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100d5a2c]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x1010c640]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x1010c648]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x1010c64c]
call fcn.10050c10
mov edx, dword [0x1010c654]
mov ecx, dword [0x1010c650]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10050c10
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x1010c64c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1010c648], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.1001fee7
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x10020088
or eax, 0xffffffff
jmp 0x10020093
mov eax, dword [0x100d5a2c]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x1005fc6c], eax
je 0x100200a5
mov dword [0x1005fc6c], eax
call fcn.1001fe4b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004caf7
leave
ret

Function at 0x100215b1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1010c69c], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x100215f0
xor esi, esi
push 8
mov ecx, esi
pop edx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub edx, 1
jne 0x100215cb
mov dword [esi*4 + 0x1010c698], ecx
inc esi
cmp esi, 0x100
jb 0x100215c6
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x10021635
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1010c698]
inc edi
sub ebx, 1
jne 0x100215fb
jmp 0x1002163c
cmp al, 0x23
jne 0x10021623
cmp byte [edi], al
jne 0x10021623
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1010c698]
mov al, byte [edi]
inc edi
test al, al
jne 0x10021615
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x10021e36
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10021e45
and dword [edi], 0
mov edx, 0x10058f98
call fcn.10021da4
mov esi, eax
test esi, esi
je 0x10021ee3
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10021ed8
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x10021ed8
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10021ed8
mov ecx, ebx
call fcn.10023561
mov dword [ebp + 8], eax
test eax, eax
je 0x10021ed8
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10021ec6
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x1010c644]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x10021edf
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x10021ed3
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x10021ee2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x100265d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100d5a2c]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x10026625
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.10026628
mov edx, 0x10058f9c
mov ecx, esi
mov edi, eax
call fcn.10021da4
mov esi, eax
test esi, esi
je 0x10026624
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x1002d44a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100d5a2c]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x1002d490
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.10021583
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.1002d4d0
pop edi
pop esi
ret