joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4220e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x422249
mov dword [ebp - 8], 0x200
jg 0x422112
nop
xchg edx, edx
js 0x422117
xchg edi, edi
jns 0x422117
ja 0x422114
jg 0x422109
and cl, byte [ebp + 0x6a51f04d]
add byte [edx], ch
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x14], eax
add byte [edx], 0x89
inc ebp
in al, dx
jl 0x422144
nop
nop
nop
jmp 0x422151
ja 0x42214c
xchg ebp, ebp
je 0x42214c
xchg esi, esi
jl 0x42213f
ja 0x422163
xor dword [ebx + 0xf00ec7d], eax
test edx, ecx
add byte [eax], al
add bh, al
test eax, ebp
std
invalid
cmp dword [ebp - 0x14], 0
jne 0x422225
mov dword [ebp - 0x218], 0x104
add byte [eax], al
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00422330
add esp, 0x10
mov dword [ebp - 0x14], eax
jmp 0x422192
mov ebx, ebx
jo 0x422195
nop
jno 0x422195
jmp 0x42218b
jae 0x4221a2
je 0x4221a0
xchg ecx, ecx
ja 0x4221a0
xchg esi, esi
nop
jmp 0x4221a5
jae 0x422197
xor eax, dword [ebx + 0x7500ec7d]
js 0x422137
cmp dword [ebp - 0x14], 0
jne 0x422223
mov ecx, dword [ebp - 0x218]
mov byte [ebp + ecx - 0x31c], 0
jo 0x4221c6
invalid
ja 0x4221c4
xchg ebp, ebp
je 0x4221c4
xchg ebx, ebx
nop
jmp 0x4221c9
jo 0x4221bb
mov cl, byte [ebp - 0x31b6b]
call dword [edx - 0x18]
mov eax, dword [eax]
add byte [eax], al
lea edx, [ebp - 0x31c]
push edx
call 0x422260
add esp, 4
and eax, 0xffff
test eax, eax
je 0x422223
jnp 0x4221e9
mov eax, eax
nop
nop
jmp 0x4221f5
ja 0x4221f0
xchg ebx, ebx
je 0x4221f0
nop
jnp 0x4221e3
xchg esi, esi
mov dword [ebx - 0x3899f3bb], ecx
add byte [ecx], al
add byte [ebx + 0xb], dh
mov eax, dword [ebp + 0xc]
mov word [eax], 1
jae 0x42220a
je 0x422208
xchg eax, eax
ja 0x422208
xchg ebp, ebp
nop
jmp 0x42220d
jae 0x4221ff
sal dword [ebp + 7], 1
jne 0x422216
mov ebx, ebx
nop
nop
nop
jmp 0x422221
je 0x42221c
xchg ebx, ebx
ja 0x42221c
jne 0x42220f
xchg esi, esi
mov gs, ebx
jmp 0x422227
jmp 0x422249
jmp 0x422227
jmp 0x422249
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jne 0x422238
mov edx, edx
nop
nop
jmp 0x422244
je 0x42223f
xchg eax, eax
ja 0x42223f
nop
jne 0x422232
xchg eax, eax
sbb ch, cl
stosb byte es:[edi], al
invalid
jmp 0x4220f3
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422490
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov edx, eax
dec eax
test edx, edx
jbe 0x4224fd
push edi
mov edi, dword [esp + 0x14]
sub edi, ecx
push esi
mov esi, dword [esp + 0xc]
inc eax
push ebp
push ebx
mov dword [esp + 0x1c], eax
mov eax, ecx
xor edx, edx
mov ebx, 0x7b
mov ebp, 0x7f
div ebx
xor eax, eax
mov al, byte [edx + esi]
xor edx, edx
mov ebx, eax
mov eax, ecx
div ebp
xor eax, eax
mov al, byte [edx + esi]
mov edx, ecx
xor ebx, eax
and edx, ebp
mov al, byte [ebx + 0x42a790]
mov bl, byte [edx + esi]
xor al, bl
mov bl, byte [ecx + edi]
xor bl, al
mov eax, dword [esp + 0x1c]
mov byte [ecx + edi], bl
inc ecx
dec eax
mov dword [esp + 0x1c], eax
jne 0x4224b2
pop ebx
pop ebp
pop esi
pop edi
mov eax, 0x3e9
ret

Function at 0x401910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401923
push esp
mov dword [ebp - 0x24], 0x401640
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.zeenty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.upsent
push str.zeenty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019c2
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019a3
pop ebp
ret 0x10
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x405a12
pop dword [ebp - 0x38]
mov eax, 0xb5ddc0f2
add eax, 0x4a629920
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x6fe31ad8
sub dword [ebp - 0x48], 0x2190d58d
mov dword [ebp - 0x44], 0x638bf77c
sub dword [ebp - 0x44], 0x3158ab37
mov dword [ebp - 0x40], 0xee9bb9b
add dword [ebp - 0x40], 0x3d628893
mov dword [ebp - 0x3c], 0x6feef5f0
sub dword [ebp - 0x3c], 0x6feef5f0
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x88fab2ba
add dword [ebp - 0x48], 0xeb77b69c
mov dword [ebp - 0x44], 0xe0ac7960
sub dword [ebp - 0x44], 0x9f4017eb
mov dword [ebp - 0x40], 0x942d727c
sub dword [ebp - 0x40], 0x30be0610
mov dword [ebp - 0x3c], 0x628349c4
add dword [ebp - 0x3c], 0x9d7cb63c
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x8f07659a
add eax, 0x71391b66
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x37004
push 0
call eax
mov ecx, 0xb7c007b2
add ecx, 0x48404063
mov edx, eax
mov esi, 0x23a44d43
sub esi, 0x235d6943
add esi, dword [ebp - 0x38]
mov ebx, 0x2e8cbcbe
sub ebx, 0x88d3d887
mov dword [ebp - 0x1c], 0x6229b095
mov edi, dword [esi]
xor edi, ebx
sub dword [ebp - 0x34], 0xa7c42a2f
mov dword [edx], edi
sub dword [ebp - 8], edi
add edx, 0x4b8c628a
sub edx, 0x4b8c6286
add esi, 0x96ad5eeb
sub esi, 0x96ad5ee7
loop 0x405b2f
add eax, 0x80ea3b9e
sub eax, 0x80e92877
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x403e57
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp byte [edi], 0x25
jne 0x403ed4
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call fcn.00403093
lea eax, [ebp + eax - 0x105]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x25
jne 0x403ebc
and byte [eax], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x104]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push eax
push 0x4016ec
call esi
pop edi
pop esi
leave
ret 0x18

Function at 0x4041d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40422c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404223
cmp dword [ebp + 8], esi
jne 0x404223
cmp dword [ebp - 4], esi
jne 0x404223
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x402da0
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
mov eax, dword [0x766a2c6f]
or eax, 0xd16ddcd1
and dword [0xcd8d0ccd], edx
ljmp 0x99f1
cmp ebx, dword [edi + 0x6d9ed051]
cmp dh, ah
mov edi, 0xe5b13966
invalid
mov al, byte [0x14bf1e94]
or byte [edx + edx*2], dh
pop edx
mov ebx, 0xfa29b142
loopne 0x402d3c
xor dl, byte [ebx]
test al, 0xd1
daa
jbe 0x402dce
in eax, dx
salc
adc esi, 0xc666b5b8
in eax, 0xca
imul edx, dword [esi], 0x1c321c2d
les esi, [edx]
mov dl, 0x86
test eax, 0x1db27d0c
push ss
sub eax, 0xc41c321c
xor dh, byte [edx + 0x7d0ca986]
mov dl, 0x1d
pop ebp
dec edx
fild dword es:[ebx + 0x422f8fab]
clc
rcr byte [ecx + edi*4 - 0x6aa8715], 0xfe
je 0x402dc2
sbb eax, 0x1d2d3bd0
je 0x402d7d
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0041b631
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0041b631
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0041b631
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x41b631
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x41b640
pop dword [ebp - 0x1c]
mov eax, 0x27188b9c
sub eax, 0x26d6d55c
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x79049a77
add dword [ebp - 0x2c], 0xd54daad4
mov dword [ebp - 0x28], 0x47938910
add dword [ebp - 0x28], 0xea9fc335
mov dword [ebp - 0x24], 0xbe82c6ce
add dword [ebp - 0x24], 0x8dc97d60
mov dword [ebp - 0x20], 0x9a568776
sub dword [ebp - 0x20], 0x9a568776
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x62752ba9
sub eax, 0x62336b59
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x7dd3baf1
add dword [ebp - 0x2c], 0xf69eae65
mov dword [ebp - 0x28], 0xfd2fa849
add dword [ebp - 0x28], 0x443cb92c
mov dword [ebp - 0x24], 0x8fdcccd9
add dword [ebp - 0x24], 0xd3929f93
mov dword [ebp - 0x20], 0x954f98f8
add dword [ebp - 0x20], 0x6ab06708
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a78f
push 0
call eax
mov ecx, 0x5fa0f11e
add ecx, 0xa05f5298
mov edi, eax
mov ebx, 0x26d0b0c
add ebx, 0xfdd61ef4
add ebx, dword [ebp - 0x1c]
mov esi, 0xcb2333ae
mov edx, dword [ebx]
add dword [ebp - 0x14], 0xd6964ff8
xor edx, esi
mov dword [ebp - 0x18], 0x36587c15
mov dword [edi], edx
mov dword [ebp - 0x14], 0x75e2e4d3
add edi, 0x46a88ee6
sub edi, 0x46a88ee2
add ebx, 4
loop 0x41b757
add eax, 0x4d7737b9
add eax, 0xb289c9f2
xor ebx, ebx
add ebx, eax
add eax, 0xa9ee34da
sub eax, 0xa9ee34d5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x8bd0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008bd200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8bd0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bd0c2
add dl, dl
jne 0x8bd0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bd134
xor eax, eax
add dl, dl
jne 0x8bd0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8bd1d5
add dl, dl
jne 0x8bd0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bd108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bd113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bd11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8bd12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8bd0cd
mov eax, 1
add dl, dl
jne 0x8bd142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8bd14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bd139
sub eax, ebx
mov ebx, 1
jne 0x8bd180
mov ecx, 1
add dl, dl
jne 0x8bd166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8bd171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bd15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bd0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8bd197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8bd1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8bd18e
cmp eax, 0x7d00
jae 0x8bd1c5
cmp eax, 0x500
jb 0x8bd1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bd0cd
cmp eax, 0x7f
ja 0x8bd1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8bd0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8bd1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8bd0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1002d150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1002d15f
pop dword [ebp - 0x34]
mov eax, 0x49348ab7
add eax, 0xc6ce46a8
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x7bfb54e
add dword [ebp - 0x44], 0x46928ffd
mov dword [ebp - 0x40], 0x61365e23
add dword [ebp - 0x40], 0xd0fcee22
mov dword [ebp - 0x3c], 0xc11142db
sub dword [ebp - 0x3c], 0x74c4fead
mov dword [ebp - 0x38], 0xafd21b10
sub dword [ebp - 0x38], 0xafd21b10
lea eax, [ebp - 0x44]
push eax
mov eax, 0xad389ccc
add eax, 0x62cb8368
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xf9be3bee
sub dword [ebp - 0x44], 0x854bd298
mov dword [ebp - 0x40], 0x339cd8d7
add dword [ebp - 0x40], 0xdcf889e
mov dword [ebp - 0x3c], 0xd87046a2
sub dword [ebp - 0x3c], 0x7500da36
mov dword [ebp - 0x38], 0xc2d6cfbb
add dword [ebp - 0x38], 0x3d293045
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x20daff99
add eax, 0xef2920b3
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x462ab
push 0
call eax
mov ecx, 0xc6b5821c
add ecx, 0x394ac0a6
mov esi, eax
mov edi, 0x2d9cfb4e
add edi, 0xe26882b2
add edi, dword [ebp - 0x34]
mov ebx, 0x980ebdca
sub ebx, 0xcba72f96
mov dword [ebp - 8], 0x5db0ac19
mov edx, dword [edi]
mov dword [ebp - 0x1c], 0x1f2e67e5
add edx, ebx
mov dword [esi], edx
xor dword [ebp - 0x24], edi
add esi, 0x3dadec
sub esi, 0x3dade8
add edi, 0xc286da5
add edi, 0xf3d7925f
loop 0x1002d281
add eax, 0xfddb
xor ebx, ebx
add ebx, eax
add eax, 0xa9e9035d
sub eax, 0xa9e90358
mov ecx, 0xd0afdcd0
sub ecx, 0xc0afdcd0
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1002dfa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100406a0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 1
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], esi
push eax
call fcn.1002d150
add esp, 0xc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jg 0x1002e07b
push 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x10042d3f
mov byte [esi], 0
call fcn.1002d150
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1002e05e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002e054
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002e1af
push edx
push ecx
call fcn.1002d150
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002d150
add esp, 4
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
mov edi, dword [ebp - 0x5c]
push edi
push eax
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov ecx, edi
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e0c7
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x40]
call fcn.1002d150
push edi
mov byte [ebp - 4], 1
call fcn.1003aa37
push 1
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1002d150
movups xmm0, xmmword [ebp - 0x58]
mov edx, dword [ebp - 0x2c]
add esp, 0x10
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [ebp - 0x58], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x48]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
cmp edx, 8
jb 0x1002e163
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002e159
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002e1af
push edx
push ecx
call fcn.1002d150
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x1002e05e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002e054
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002e054
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3