joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfc1382
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xb3f03
jmp 0xfc121f
push edx
int 0xe8
xor al, 0xfa
invalid
add esp, 1
and al, bh
mov eax, 0xdcdae8fd
lea esp, [esp + 2]
jmp 0xfc1102
sub byte [ecx], cl
test al, 0xcb
bound ebx, qword [ebp + 0x24648dec]
lea esp, [esp + 0x18]
xor cl, 0x13
sub esp, 3
jbe 0xfc10ca
lea esp, [esp + 0x18]
xor cl, 0x13
sub esp, 3
jbe 0xfc10ca
ja 0xfc10f6
loop 0xfc1073
adc esi, dword [esi - 0x7b]
inc edi
invalid
add esp, 1
and al, bh
mov eax, 0xdcdae8fd
jmp 0xfc1172
xor cl, 0x8d
push ax
lea eax, [ebp*4]
not eax
jmp 0xfc113d
jmp 0xfc1155
not ax
lea esp, [esp + 2]
mov eax, ecx
rcr bx, cl
ja 0xfc1127
sub esp, 0xd
call fcn.00fc1178
insd dword es:[edi], dx
jl 0xfc10d9
sub esp, 0xd
btr bx, di
in al, dx
or eax, 0xfbb30f66
lea esp, [esp + 1]
jmp 0xfc11e1
lea esp, [esp + 2]
jmp 0xfc1102
shl eax, 2
bt bx, bx
je 0xfc120c
mov bl, 0xfe
sub esp, 0x14
xor ebx, ebp
jmp 0xfbb658
mov bl, 0xfe
jmp 0xfc1215
sub esp, 0x14
xor ebx, ebp
jmp 0xfbb658
mov ebx, eax
lea ebx, [edx + esi]
jmp 0xfc1255
mov bx, 0xba95
jmp 0xfc136d
push 0xf0fac78c
jmp 0xfc13bb
mov eax, dword [eax + reloc.PSAPI.DLL_GetMappedFileNameW]
mov ebx, dword [esp]
mov ebx, 0x8743c6fc
mov bl, dh
call 0xfc1316
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 4], edi
jmp 0xfc1484
bts edx, edi
mov si, word [esp + 1]
xchg cx, ax
lea esp, [esp + 1]
jmp 0xfc13c2
sub esp, 9
ja 0xfc13a5
jbe 0xfc13f1
mov esi, dword [esp + 0x34]
stc
jge 0xfc1414
lea ebx, [edx - 0xb]
neg ebx
cpuid
jmp 0xfc142f
lea esp, [esp + 1]
jmp 0xfc13c2
bts edx, edi
mov si, word [esp + 1]
xchg cx, ax
jmp 0xfc13d8
neg ebx
cpuid
jmp 0xfc142f
lea ebx, [edx - 0xb]
jmp 0xfc13fe
mov bx, word [esp]
mov cl, byte [esp]
call fcn.00fc1467
mov esp, 0x26eb8c1e
mov eax, dword [reloc.PSAPI.DLL_GetMappedFileNameW]
lea ebp, [esp + 8]
mov ebx, ecx
bsf eax, esp
ja 0xfc1419
jbe 0xfc145a
sub esp, 0xb8
mov edi, esp
jmp 0xfc14d8
mov bx, word [esp]
mov cl, byte [esp]
jmp 0xfc143c
lea esp, [esp + 4]
pushfd
jmp 0xfc1275
mov edx, dword [esp]
btr ax, ax
ja fcn.00fc152b
jbe fcn.00fc152b
mov eax, 0x46cbac3e
test dword [edx + reloc.PSAPI.DLL_GetMappedFileNameW], 0x408116a3
add ecx, dword [ecx - reloc.PSAPI.DLL_GetMappedFileNameW]
push dword [esp + 1]
mov dword [esp + 8], esi
call 0xfc1382

Function at 0xfc1797
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
mov dword [esp + 8], esi
jmp 0xfc1500
je 0xfc14f3
mov dword [esp + 4], ebp
pushfd
jmp 0xfc1398
mov dword [esp + 4], ebp
pushfd
lea esp, [esp + 1]
lea esp, [esp + 3]
push esp
push cx
push ecx
push word [esp + 2]
jmp 0xfc14c0
jmp 0xfc1575
Function at 0xfc8c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0xfc9caf
jmp 0xfacd5d
jmp 0xfacdd2
jmp 0xfc8c3a
jmp 0xfddcc2
neg ch
jmp 0xfddce7
push dx
lea esp, [esp + 2]
push ebp
mov bp, 0x2c89
neg cl
jmp 0xfddcac
sub esp, 0x14
xchg ch, cl
jmp 0xfddd09
mov ebp, esp
mov ch, bh
rol cx, 0xe
inc cx
jmp 0xfddcd1
push esi
jmp 0xfddd38
push ebx
mov bx, 0x6fe
neg cx
xchg cx, bx
xchg ebx, ecx
jmp 0xfddcf3
mov esi, ebp
add esi, 0xc
mov ebx, dword [esi]
pop esi
jmp 0xfdde3d
mov ecx, 0x7b8fb10a
stc
push edi
mov cl, 0x34
inc di
call fcn.00fddd77
mov ecx, 0x74718f51
xchg cl, ch
mov cx, si
mov ecx, 0xa36efe5f
push esi
jmp 0xfddda5

Function at 0xfddd77
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp + 2], dl
jmp 0xfddd79
jmp 0xfddd61
mov edi, dword [eax]
mov cl, bl
pushfd
call fcn.00fddd84
sub cl, byte [edi + 0x42eb2404]
pop dword [esp]
jmp 0xfdddcb

Function at 0xfddd84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx esi, word [ebp + 0xc]
movzx eax, ax
jmp 0xfacd08
push ecx
lea esp, [esp + 4]
movzx ebx, bx
mov cl, 0xdd
mov cx, sp
jmp 0xfddf0f
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0xfdde68
pop dword [esp]
jmp 0xfdddcb
sub esp, 0x1f
push word [esp + 1]
lea esp, [esp + 1]
jmp 0xfdddb5
mov ecx, 0xffff
jmp 0xfdddfb
mov eax, dword [eax + 4]
setge cl
push di
lea esp, [esp + 2]
shr ebx, 0x10
jmp 0xfddd89
lea esp, [esp + 0x28]
jne 0xfacd1f
je 0xfdde1c
xor al, 0xbe
sub al, 0x4b
mov byte [edx], 6
xchg ebx, eax
add esp, dword [esi - 0x6b]
daa
pushfd
adc al, 0x8a
in eax, dx
sbb al, 0xa8
add dword [ecx + reloc.PSAPI.DLL_GetMappedFileNameW], ecx
invalid
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
cmp bx, cx
jmp 0xfddddc
shr eax, 0x10
call fcn.00fdde06
lea esp, [esp + 4]
jmp 0xfaccfb
inc ecx
bsr dx, dx
xchg dh, dl
jmp 0xfdde8a
movzx ecx, bx
mov dl, byte [esp]
mov dl, ch
mov edx, ebp
jmp 0xfdde52
mov dword [ebp - 4], eax
jmp 0xfaccfb
xor edx, edx
div ecx
movzx eax, ax
jmp 0xfdde74
lea esp, [esp + 0x10]
imul ecx, eax
sub esp, 1
lea esp, [esp + 1]
imul eax, ebx
call fcn.00fdde93
lea esp, [esp + 4]
or edx, reloc.PSAPI.DLL_GetMappedFileNameW
sub esp, 0xa
add esp, 2
jmp 0xfddeec
sub edi, eax
push dx
lea esp, [esp + 2]
sub edx, eax
jmp 0xfddf38
mov ecx, esi
stc
sub esp, 0x12
lea esp, [esp + 2]
jmp 0xfddeb6
sub esp, 0x1a
call fcn.00fddef8
Function at 0x10a5c6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
or dl, ch
mov dword [esp + 0xe], edi
pop word [esp + 0xd]
neg dx
not edx
jmp 0x10a5c8e
setl ch
not ebp
bswap ecx
mov edi, dword [esp + 3]
mov word [esp + 0xa], ax
jmp 0x10a5cba
lea ebx, [esp + eax]
cpuid
pop dword [esp + 3]
bts di, bp
rdtsc
xchg ebx, edx
jmp 0x10a5dc9
bsr cx, di
xchg dword [esp], eax
inc esi
xchg word [esp + 1], di
jmp 0x10a5d28
push dword [esp + 0xb]
dec edi
lea esp, [esp + 0xe]
bswap edi
mov byte [esp + 2], cl
bsr edi, ebx
jmp 0x10a5ce8
setb bl
lea edi, [edx*4]
mov dword [esp + 0xd], edx
rcl edx, cl
jmp 0x10a5d6f
lea esp, [esp + 2]
cpuid
sub esp, 0x10
push cx
lea ebx, reloc.PSAPI.DLL_GetMappedFileNameW
jmp 0x10a5d12
pop word [esp + 6]
mov al, bh
push word [esp + 6]
xchg edi, ebx
xchg word [esp + 8], di
lea esp, [esp]
jmp 0x10a5cfe
mov edi, ebp
mov ecx, 0x21a93eeb
xchg word [esp + 0xb], bp
lea edi, [edx + ebx]
jmp 0x10a5d99
cpuid
mov al, dh
lea edi, [eax + ebx]
mov word [esp + 6], dx
xchg byte [esp + 0xa], dh
rdtsc
jmp 0x10a5d59
pop cx
mov dword [esp + 1], edi
dec ebp
mov ax, 0xbc88
mov edx, dword [esp + 0xa]
jmp 0x10a5dad
xchg word [esp + 6], bp
lea edi, [ebx + esi]
bsf cx, cx
pop bp
xchg ecx, edx
push bx
jmp 0x10a5d83
add esp, 3
cmc
lea esp, [esp + 3]
mov dl, al
add esp, 8
mov dh, byte [esp]
jmp 0x10a5e79
pop dword [esp + 2]
btc bp, dx
mov dx, 0x4cea
mov al, byte [esp + 2]
push dword [esp + 5]
mov esi, edx
jmp 0x10a5d41
pop ebp
pop word [esp + 7]
xchg dh, ch
pop word [esp + 4]
jmp 0x10a5e0d
mov ebx, dword [esp + 5]
pop word [esp + 0xc]
mov word [esp + 0xd], dx
pop esi
pop eax
push ecx
jmp 0x10a5de4
xchg word [esp + 1], ax
xchg edi, eax
xchg word [esp + 4], si
mov ecx, dword [esp + 3]
mov si, 0xaf84
xchg bh, dl
jmp 0x10a5e5c
mov dl, byte [esp]
mov eax, 0xafc4be3d
lea ebp, [eax*4]
mov ax, 0x8cc8
push dword [esp + 6]
cpuid
jmp 0x10a5dfa
lea ebp, [eax + edi]
sub esp, 0x17
mov dx, sp
std
mov si, word [esp + 0x17]
jmp 0x10a5ea7
xchg dx, di
xchg edx, eax
mov eax, ebx
setno ah
mov esi, dword [esp + 8]
mov bx, sp
jmp 0x10a5e46
ret
mov dword [esp], eax
sub esp, 0xf
mov ah, 0x57
xchg edi, ebp
stc
lea ebx, [ecx + ebp]
jmp 0x10a5e2b
mov ebp, 0xdb560736
neg bx
mov ah, dl
call 0x10a5ed1
push 0xf61b7cee
pop ds
jp 0x10a5ea3
xchg ebx, eax
test byte [0xf0f146e3], 0x89
je 0x10a5ece
jecxz 0x10a5eeb
int1
invalid
mov dword [esp + 7], esi
pop es
cpuid
cld
push dword [esp + 7]
stc
sub edx, 0xb7a80483
jmp 0x10a5e89
jno 0x10a5e61
ljmp 0xf586:0x224448f
inc esp
and al, 0x25
mov cl, byte [esp + 9]
dec bx
jmp 0x10a5f31
not dx
mov cl, byte [esp + 0xa]
and edi, 0x90131fcb
neg dh
jmp 0x10a5f84
pop dword [esp + 0x23]
lea eax, [eax*4]
pop word [esp + 0x1b]
cpuid
xchg esi, eax
jmp 0x10a5f1b
mov si, dx
call fcn.010a5f67
Function at 0x10a5f67
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [esp + edi]
popal
mov dx, 0x786f
push ecx
bswap eax
jmp 0x10a5fcc
xchg dword [esp + 3], eax
xchg cl, bh
mov dx, sp
clc
mov ah, al
xchg dword [esp + 3], ecx
jmp 0x10a5fae
shr dl, cl
bswap eax
cmc
mov edx, esp
pop edi
cpuid
jmp 0x10a5f8c
xchg word [esp + 4], di
push dword [esp + 2]
sub esp, 0x1b
cmc
mov eax, dword [esp + 0xa]
inc dl
jmp 0x10a5fe3
neg bx
pop dword [esp + 4]
bswap ebx
pop word [esp + 5]
bswap edx
push word [esp + 6]
jmp 0x10a5fa2
pop dx
mov dl, byte [esp + 0x1b]
mov ecx, edi
bsf bx, bp
neg cx
lea edx, [ebx + 0x4f]
jmp 0x10a6652
pop dword [esp + 3]
mov ecx, eax
bswap eax
xchg ah, bh
pop dword [esp]
cld
jmp 0x10a60aa
neg ebx
xchg cl, ah
pop word [esp + 0xb]
mov bl, 5
setbe cl
bsf di, bp
jmp 0x10a5ffb
pop bx
seto cl
sub esp, 5
xchg byte [esp + 3], ch
xchg dh, cl
jmp 0x10a607e
mov dword [esp], edx
mov byte [esp], cl
lea edi, [ebx + edi]
bswap ecx
dec bl
std
jmp 0x10a6034
mov esi, 0xafb0e329
mov cl, byte [esp]
dec si
mov esi, ebp
pushfd
xchg cx, ax
jmp 0x10a604a
xchg dword [esp + 2], ebx
setg ah
mov ax, 0xfc66
pushal
pop word [esp + 0x10]
mov bp, cx
jmp 0x10a6266
bt ax, ax
lea esp, [esp + 6]
mov word [esp], bp
pop dx
lea esi, reloc.PSAPI.DLL_GetMappedFileNameW
mov dl, byte [esp]
jmp 0x10a606d
mov eax, ebp
shl esi, cl
std
bsr dx, ax
lea edi, reloc.PSAPI.DLL_GetMappedFileNameW
inc ebx
jmp 0x10a60f7
rdtsc
bsf ecx, esp
mov di, bx
rdtsc
push dword [esp + 0x14]
rdtsc
jmp 0x10a60c3
pop dword [esp]
mov dx, di
inc ax
bswap edx
mov dl, bh
add esp, 6
jmp 0x10a6151
pop dword [esp + 4]
pop word [esp + 0x1a]
mov bl, byte [esp + 0x21]
mov esi, 0x424b07e4
lea ecx, [ebx*4]
lea esi, [esi + esi]
jmp 0x10a60e5
bts si, ax
cpuid
pushal
mov dword [esp + 0x29], esp
push dword [esp + 0x1b]
jmp 0x10a6184
lea esp, [esp + 0xc]
not ah
xchg word [esp + 0xd], ax
push word [esp + 1]
xchg dword [esp + 0xf], ebp
lea ecx, [edi*4]
jmp 0x10a613b
rol ebx, cl
setle ch
mov dl, dh
mov al, byte [esp]
call fcn.010a61ef
cmp eax, 0xaa5f38aa
add ecx, dword [ebx - 0x7d]
in al, dx
or al, 0x8d
and al, 0x44
sub esp, 0xc
lea esp, [esp + 0x44]
setp dh
bsr di, bx
bts ebp, ebp
xchg di, ax
jmp 0x10a616e
mov al, byte [esp + 1]
mov dl, dh
xchg dx, ax
rdtsc
bsf edi, ebp
sub esp, 4
jmp 0x10a611d
mov ax, bx
add esp, 0x16
xchg word [esp + 0xa], di
shl ch, cl
mov dx, sp
bsf ecx, esp
jmp 0x10a6020
cpuid
setg dh
mov word [esp + 0xa], sp
rol cx, cl
xchg byte [esp + 7], bh
push dword [esp + 0x15]
jmp 0x10a6482
Function at 0x10a64b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec si
not cx
rdtsc
xchg byte [esp + 2], ah
rdtsc
jmp 0x10a65f5
mov word [esp + 3], cx
add esp, 3
jmp 0x10a649a
mov word [esp + 1], cx
xchg word [esp], di
push dword [esp + 2]
cmc
jmp 0x10a64e2
cld
mov bp, si
rcl ebp, cl
lea ebx, [edx + 0xb7]
dec ebp
mov bp, ax
jmp 0x10a64ba
mov word [esp + 5], dx
mov cx, sp
xchg dh, bl
pushal
pop word [esp + 0x1e]
mov cx, word [esp]
jmp 0x10a6527
pop word [esp]
mov ebp, dword [esp + 5]
cmc
pop dword [esp]
push word [esp + 1]
pop dx
jmp 0x10a64d0
mov eax, 0xd6e71cb2
std
setg ah
btc eax, esp
jmp 0x10a6538
mov dword [esp + 0xc], eax
xchg al, dl
not di
pushfd
pop edx
mov byte [esp + 0x22], dh
jmp 0x10a6511
pop word [esp + 0x13]
mov byte [esp + 0xe], dl
setge bh
bsf eax, ecx
pop si
neg eax
jmp 0x10a6587
bsr eax, edx
add esp, 2
push word [esp + 1]
push word [esp + 4]
bswap edi
mov ecx, 0xe282ef32
jmp 0x10a64fc
mov word [esp + 0x18], sp
mov dword [esp + 9], edx
lea edi, [eax + ebp]
push dword [esp + 0xd]
call fcn.010a6571
mov bx, word [esp + 1]
mov ebx, eax
mov dword [esp + 3], esp
mov bp, word [esp + 6]
bswap edi
mov cl, 6
jmp 0x10a65da
mov esi, 0x1318c1b1
mov dword [esp + 3], ebx
lea edi, reloc.PSAPI.DLL_GetMappedFileNameW
setns al
bswap esi
jmp 0x10a662c
lea edi, reloc.PSAPI.DLL_GetMappedFileNameW
lea edx, reloc.PSAPI.DLL_GetMappedFileNameW
xchg esi, eax
lea ebx, [esi*4]
lea ecx, [edx + esi]
mov cl, byte [esp + 6]
jmp 0x10a6558
push word [esp + 0xe]
mov edi, dword [esp + 0x18]
ror cx, 8
xchg dx, cx
jmp 0x10a6cac
xchg byte [esp + 2], ah
neg ebx
bsr di, cx
lea esp, [esp + 1]
mov bh, cl
sub esp, 0x16
jmp 0x10a6616
mov eax, dword [esp + 0x10]
lea ebp, [esi + esi]
inc ah
mov byte [esp + 0x13], cl
jmp 0x10a6779
setno dh
add esp, 1
bt eax, esi
mov bh, byte [esp + 0x10]
xchg bh, al
mov dword [esp + 0x13], ebx
jmp 0x10a666c
mov esi, dword [esp]
shr ax, cl
shl al, 2
mov bp, word [esp]
add esp, 0
mov dh, byte [esp]
jmp 0x10a66d1
mov di, 0x36ea
neg di
cmp ebx, edx
lea esp, [esp]
mov byte [esp], bh
neg ebp
jmp 0x10a6697
bswap edi
mov dh, byte [esp]
mov edx, dword [esp]
lea edx, [eax*4]
neg bx
lea esp, [esp]
call fcn.010a670f
push 0x60b6cfe
mov bl, 0x5a
rol dword [ebx + 0x26], cl
aad 0x7a
salc
add esp, 0x1d
mov ebx, dword [esp]
xchg cx, di
lea esi, [edi*4]
mov byte [esp], dl
inc dx
jmp 0x10a66be
bsf si, cx
mov word [esp + 0xd], dx
std
mov bx, word [esp + 0x11]
rdtsc
push dword [esp + 0x11]
jmp 0x10a66f8
mov byte [esp + 0x19], bh
neg si
mov edi, 0xf1c80aa7
xchg byte [esp + 3], al
mov dword [esp + 4], ebx
pop edi
jmp 0x10a6730
xchg ecx, edi
mov word [esp + 0x17], sp
mov dword [esp + 8], eax
mov cx, bx
inc al
bsr bp, si
jmp 0x10a6682
mov ax, 0xaf8c
rdtsc
mov word [esp + 1], dx
shr ebx, cl
rdtsc
shr al, 6
jmp 0x10a6836
std
mov dword [esp + 8], ebp
bsr di, bp
neg si
mov dh, ch
stc
jmp 0x10a68dd

Function at 0x10a6571
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x17]
pop word [esp + 0x19]
jmp 0x10a65c2
popal
pop dword [esp + 1]
or eax, 0x74aa38b8
mov dword [esp], edi
mov ebx, ecx
lea edx, [ebx*4]
jmp 0x10a659c
Function at 0x10a6910
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x10a6963
lea esp, [esp + 2]
mov dword [esp + 0x14], esi
push di
mov word [esp], si
mov word [esp], si
mov byte [esp], al
call fcn.010a6912

Function at 0x10a6936
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
call fcn.010a6013
lea esp, [esp + 0x14]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x10a6993
mov word [esp + 1], bx
mov dword [esp], eax
lea esp, [esp + 3]
mov dword [esp + 0x14], ebp
push di
call fcn.010a6910
push dword [esp + 4]
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x14], edi
jmp 0x10a6914
push eax
jmp 0x10a600e
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x10a697d
Function at 0x6d539c2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x6d539c3c
pop dword [ebp - 0x10]
mov eax, 0x6d539c3c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xca08cc19
add dword [ebp - 0x20], 0x84497932
mov dword [ebp - 0x1c], 0x3e6eec4d
sub dword [ebp - 0x1c], 0xc3ba008
mov dword [ebp - 0x18], 0x7b66071c
add dword [ebp - 0x18], 0xd0e63d12
mov dword [ebp - 0x14], 0x5ef95c19
sub dword [ebp - 0x14], 0x5ef95c19
lea eax, [ebp - 0x20]
push eax
mov eax, 0x430f0f88
sub eax, 0xd5bb5f2c
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xfc744778
sub dword [ebp - 0x20], 0x8801de22
mov dword [ebp - 0x1c], 0xdf2d6907
add dword [ebp - 0x1c], 0x623ef86e
mov dword [ebp - 0x18], 0xcff2505f
add dword [ebp - 0x18], 0x937d1c0d
mov dword [ebp - 0x14], 0x9b937eee
add dword [ebp - 0x14], 0x646c8112
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3d58f
push 0
call eax
mov ecx, 0x6090
xor edi, edi
add edi, eax
mov edx, 0x6d556600
add edx, dword [ebp - 0x10]
mov esi, 0xbbc36221
sub esi, 0x4ee7f19a
sub dword [ebp - 4], edi
mov ebx, dword [edx]
xor dword [ebp - 8], 0x515c6035
sub ebx, esi
add dword [ebp - 8], edx
mov dword [edi], ebx
sub dword [ebp - 8], ecx
add edi, 0x78394f0e
sub edi, 0x78394f0a
add edx, 0xf83c4f4c
add edx, 0x7c3b0b8
loop 0x6d539d4a
add eax, 0x23d600bd
add eax, 0xdc2b7456
xor ebx, ebx
add ebx, eax
add eax, 0x657a6e0c
add eax, 0x9a8591f9
mov ecx, 0x7faa3eae
add ecx, 0xeda8c152
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100313d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4901
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100e4040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edx]
xorps xmm0, xmm0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
movups xmmword [ecx + 0x90], xmm0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0xa4], 0xf
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x90], 0
mov dword [ebp - 4], 0
movups xmmword [ecx + 0xa8], xmm0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0xf
mov byte [ecx + 0xa8], 0
mov byte [ebp - 4], 1
mov word [ecx + 0xc1], 0
mov byte [ecx + 0xc3], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0x400], 0
mov dword [ecx + 0x404], 0
mov dword [ecx + 0x408], 0
mov dword [ecx + 0x40c], 0
mov dword [ecx + 0x410], 0
mov dword [ecx + 0x414], 0
mov dword [ecx + 0x418], 0
mov dword [ecx + 0x41c], 0
mov byte [ecx + 0x424], 0
push eax
mov byte [ecx + 0x3428], 0
mov dword [ecx + 0x342c], 0
mov dword [ecx + 0x3430], 0
mov dword [ecx + 0x3434], 0
mov dword [ecx + 0x3438], 0
mov dword [ecx + 0x343c], 0
mov dword [ecx + 0x3440], 0
mov dword [ecx + 0x3444], 0
mov dword [ecx + 0x3448], 0
mov dword [ecx + 0x344c], 0
mov byte [ecx + 0x345d], 0
mov byte [ecx + 0x3468], 0
mov byte [ecx + 0x3754], 0
mov dword [ecx + 0x3758], 0
mov dword [ecx + 0x375c], 0
mov dword [ecx + 0x3760], 0
mov dword [ecx + 0x3764], 0
mov dword [ecx + 0x3768], 0
mov dword [ecx + 0x376c], 0
mov byte [ecx + 0x3774], 0
mov dword [ecx + 0x3784], 0
mov byte [ecx + 0x378a], 0
mov dword [ecx + 0x378c], 0
mov dword [ecx + 0x3790], 0
call fcn.10027110
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100319a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x100319fe
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.1002a890
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x100319d0
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x10031a15
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x10031a15
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x10031a60
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.1002a890
test al, al
je 0x10031a51
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x10031a20
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e4040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003831c
cmp byte [esi + 0x3d], 0
je 0x1003831c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003830a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100382d1
sub eax, 1
je 0x100382d5
sub eax, 2
jne 0x1003830a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c205e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100382f3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003830a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c205e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c205e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100c205e
mov esp, ebp
pop ebp
ret
Function at 0x1003b880
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100f7f4c], 0
push ebx
push esi
push edi
je 0x1003ba0e
mov ecx, dword [0x101c9374]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003ba0e
mov ecx, dword [0x101c9404]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003ba0e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x1003b8e0
xor edx, edx
test ecx, ecx
je 0x1003b909
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1003b8f0
cmp edi, 0x5ff56dc5
je 0x1003b918
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003ba0e
mov ecx, dword [ebp - 4]
jmp 0x1003b8c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003ba0e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1003ba0e
movss xmm1, dword [0x100d8204]
xor ebx, ebx
cmp edx, 4
jl 0x1003b9db
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b97c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b997
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b9b2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b9c5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1003b961
cmp ebx, edx
jl 0x1003b9df
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1003ba0e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003ba03
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1003b9f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret