joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov ebx, eax
mov esi, dword [ebp + 8]
lea edi, [0x10002ac8]
mov bl, ah
mov dl, byte [ebx + edi]
and dx, 0xff
shl ax, 8
lodsb al, byte [esi]
xor ax, dx
shl dx, 2
xor ax, dx
shl dx, 0xd
xor ax, dx
loop 0x10025c77
mov word [ebp - 4], ax
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10027bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dx, word [ebp + 0x18]
xor ecx, ecx
mov cx, word [ebp + 0x14]
xor dx, word [ebp + 0xc]
inc ecx
xor eax, eax
mov al, byte [edi]
add al, cl
jb 0x10027c09
mov byte [edi], al
add edi, eax
sub ecx, 2
std
je 0x10027bf5
mov al, byte [esi]
inc esi
xor al, dh
stosb byte es:[edi], al
loop 0x10027bed
mov al, byte [esi]
xor al, dl
stosb byte es:[edi], al
cld
mov ax, word [ebp + 0xc]
xor al, 0x7f
stosb byte es:[edi], al
pop ebx
pop edi
pop esi
leave
ret 0x14
mov byte [edi], 0
inc ax
sub cx, ax
mov al, 0xff
cmp cl, 1
ja 0x10027be5
jb 0x10027c02
add edi, eax
jmp 0x10027bfb

Function at 0x10029cd9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [ebp + 0xc]
mov dh, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
xor ebx, ebx
inc dh
mov bl, dh
mov ah, byte [ebx + esi]
add dl, ah
mov bl, dl
mov al, byte [ebx + esi]
mov byte [ebx + esi], ah
mov bl, dh
mov byte [ebx + esi], al
add al, ah
mov bl, al
mov al, byte [ebx + esi]
xor byte [edi], al
inc edi
loop 0x10029cf9
mov byte [esi + 0x100], dh
mov byte [esi + 0x101], dl
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x1002be50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [ebx + 0x10]
cmp word [ebp + 0x54], 0
jne 0x1002be71
push ebp
call fcn.1002bb30
test eax, eax
js 0x1002c03f
movzx eax, byte [ebp + 0x56]
push esi
push edi
movzx edi, byte [ebp + 0x57]
add edi, eax
lea eax, [edi + 2]
lea ecx, [edi*8 + 0x14]
lea eax, [edi + eax*2]
lea eax, [ecx + eax*4]
push eax
mov dword [esp + 0x4c], eax
call fcn.1003b030
mov esi, eax
test esi, esi
jne 0x1002beac
pop edi
pop esi
pop ebp
mov eax, 0xfffffc0d
pop ebx
add esp, 0x34
ret 4
push 0x30
lea eax, [esp + 0x18]
push 0
push eax
call fcn.1003dd70
push dword [esp + 0x54]
push 0
push esi
call fcn.1003dd70
mov eax, dword [0x1006c724]
add esp, 0x18
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [0x1006c2a4]
push 0x100026b0
push dword [ebx + 0xc]
mov eax, dword [eax + 8]
call eax
mov dword [esp + 0x1c], eax
mov eax, dword [0x1006c2a4]
push 0x10002718
push ebx
mov eax, dword [eax]
call eax
mov dword [esp + 0x20], eax
lea eax, [edi*8 + 0x14]
add eax, esi
mov dword [esp + 0x30], eax
mov dword [eax], edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x1006c2a4]
mov eax, dword [eax + 0x64]
call eax
mov edi, eax
test edi, edi
js 0x1002c01c
mov ecx, dword [esp + 0x30]
test byte [ecx + 4], 1
jne 0x1002bf39
cmp dword [ecx + 0xc], 0
je 0x1002c01c
xor eax, eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [esp + 0x30]
test byte [eax + 4], 1
je 0x1002bf66
or word [esi + 4], 1
mov eax, dword [esp + 0x30]
mov dword [esp + 0x48], 1
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], 0
cmp dword [eax + 0xc], 0
lea edx, [eax + 0x10]
jbe 0x1002bffb
nop
mov cl, byte [ebp + 0x56]
movzx edi, byte [edx + 0xa]
mov ebx, dword [edx]
movzx eax, cl
cmp di, ax
jae 0x1002bf95
mov ecx, edi
jmp 0x1002bfa0
movzx ecx, cl
sub ecx, edi
add ecx, 0xff
test bl, 1
je 0x1002bfc4
or word [esi + 4], 2
or word [esi + ecx*8 + 0x14], 1
mov word [esi + ecx*8 + 0x16], di
mov eax, dword [edx + 4]
mov dword [esp + 0x48], 1
mov dword [esi + ecx*8 + 0x18], eax
test bl, 2
je 0x1002bfe6
or word [esi + ecx*8 + 0x14], 2
mov eax, dword [edx + 4]
mov dword [esi + ecx*8 + 0x18], eax
or word [esi + 4], 4
test bl, 4
jne 0x1002bfe6
or word [esi + ecx*8 + 0x14], 4
mov ecx, dword [esp + 0x10]
add edx, 0xc
mov eax, dword [esp + 0x30]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [eax + 0xc]
jb 0x1002bf80
mov eax, dword [esp + 0x48]
shl eax, 0xa
xor eax, dword [ebp + 0x2c]
pop edi
and eax, 0x400
mov dword [ebp + 0x58], esi
xor dword [ebp + 0x2c], eax
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
push esi
call fcn.1003afb0
mov eax, dword [0x1006c2a4]
push dword [esp + 0x14]
mov eax, dword [eax + 0x68]
call eax
test edi, edi
js 0x1002c03b
or dword [ebp + 0x2c], 0x200
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x1003a7c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push 0
push 0
shl eax, 0xb
push eax
push dword [esp + 0x14]
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1003a801
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x1c]
movzx eax, ax
push eax
push dword [esp + 0x1c]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, word [esp]
pop ecx
ret 0x10

Function at 0x1003a840
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x10049200]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1003a883
push esi
push 0
push 0x10003228
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.1003de00
add esp, 0x108
ret 4

Function at 0x1003aa90
Capabilities:
Get hostname

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0x20
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x1003aab3
call fcn.1003a970
pop ecx
ret 4
xor eax, eax
pop ecx
ret 4

Function at 0x1003ac10
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0xd
call fcn.10030be0
cmp eax, 0xffffff9c
jne 0x1003ac21
pop ecx
ret 0xc
mov eax, dword [esp + 0xc]
push 0
push 0
shl eax, 0xb
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1003ac45
call fcn.1003a970
pop ecx
ret 0xc
push 0
lea eax, [esp + 4]
push eax
push 0x800
push dword [esp + 0x1c]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003ac3c
xor eax, eax
mov ecx, 0xfffffc06
cmp dword [esp], 0x800
cmovne eax, ecx
pop ecx
ret 0xc

Function at 0x1003ac80
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0xd
call fcn.10030be0
cmp eax, 0xffffff9c
jne 0x1003ac91
pop ecx
ret 0xc
mov eax, dword [esp + 0xc]
push 0
shl eax, 6
push 0
sub eax, 0x40
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1003acb8
call fcn.1003a970
pop ecx
ret 0xc
push 0
lea eax, [esp + 4]
push eax
push 0x40
push dword [esp + 0x1c]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003acaf
xor eax, eax
mov ecx, 0xfffffc06
cmp dword [esp], 0x40
cmovne eax, ecx
pop ecx
ret 0xc

Function at 0x1003adf0
Capabilities:
Write file on windows

Disassembly:
push ecx
push 0xe
call fcn.10030be0
cmp eax, 0xffffff9c
jne 0x1003ae01
pop ecx
ret 0xc
mov eax, dword [esp + 0xc]
push 0
shl eax, 6
push 0
sub eax, 0x40
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1003ae28
call fcn.1003a970
pop ecx
ret 0xc
push 0
lea eax, [esp + 4]
push eax
push 0x40
push dword [esp + 0x1c]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003ae1f
xor eax, eax
mov ecx, 0xfffff8f0
cmp dword [esp], 0x40
cmovne eax, ecx
pop ecx
ret 0xc
Function at 0x1003b3a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
push edi
xor edi, edi
mov eax, dword [ebx]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1003b3d7
lea ecx, [esp + 0x20]
push ecx
push 1
push edi
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003b424
lea edi, [eax + 1]
mov eax, dword [esp + 0x20]
jmp 0x1003b3df
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
push ebp
mov ebp, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push esi
push ebx
push ebp
push ecx
push 0
push dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebx]
cmp eax, dword [esp + 0x10]
jge 0x1003b412
cmp dword [esp + 0x18], 1
jne 0x1003b412
test esi, esi
jne 0x1003b412
mov byte [eax + ebp], 0
test edi, edi
je 0x1003b420
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret 0x14
Function at 0x10044aae
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10049200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10040247
mov dword [ebp - 0x14], eax
cmp dword [0x1004b19c], esi
jne 0x10044ba1
push 0x800
push esi
push 0x1000762c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10044b2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10044c81
push esi
push esi
push 0x1000762c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10044c81
push 0x10007644
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10044c81
push eax
call ebx
push 0x10007650
push edi
mov dword [0x1004b19c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007660
push edi
mov dword [0x1004b1a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007674
push edi
mov dword [0x1004b1a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1004b1ac], eax
test eax, eax
je 0x10044b9e
push 0x10007690
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1004b1a8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10044bc6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10044bb9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10044bdb
push 4
pop eax
jmp 0x10044c83
cmp dword [ebp - 0x14], esi
je 0x10044bdb
push dword [0x1004b19c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10044bc0
mov eax, dword [0x1004b1a8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10044c39
cmp dword [0x1004b1ac], edi
je 0x10044c39
push eax
call ebx
push dword [0x1004b1ac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10044c39
test eax, eax
je 0x10044c39
call ecx
test eax, eax
je 0x10044c2e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10044c2e
test byte [ebp - 8], 1
jne 0x10044c39
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10044c69
mov eax, dword [0x1004b1a0]
cmp eax, edi
je 0x10044c66
push eax
call ebx
test eax, eax
je 0x10044c66
call eax
mov esi, eax
test esi, esi
je 0x10044c66
mov eax, dword [0x1004b1a4]
cmp eax, edi
je 0x10044c66
push eax
call ebx
test eax, eax
je 0x10044c66
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1004b19c]
call ebx
test eax, eax
je 0x10044c81
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10044c83
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003de00
mov esp, ebp
pop ebp
ret
Function at 0x1007320e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x5b
xor dword [esp + 0x57], ebp
xor ebp, dword [esp + 0x57]
xor dword [esp + 0x57], ebp
mov ebp, dword [esp + 0x57]
add esp, 0x57
mov ebp, esp
push 0
add dword [esp], edx
sub esp, 4
mov dword [esp], 0x8744bbc7
and dword [esp], ecx
or dword [esp], ecx
sub esp, 4
xor dword [esp], ebx
xor ebx, dword [esp]
xor dword [esp], ebx
mov ebx, dword [esp]
lea esp, [esp - 4]
mov dword [esp], edi
sub esp, 4
xor dword [esp], esi
xor esi, dword [esp]
xor dword [esp], esi
mov esi, dword [esp]
mov esi, dword [ebp + 8]
shl ecx, 0xd
shl ecx, 0x13
add ecx, dword [ebp + 0xc]
xor edx, edx
xor eax, eax
cmp ecx, 0
je 0x100732c9
mov ebx, dword [ebp + 0x10]
push 0
or dword [esp], ebp
not edi
xor edi, edi
add edi, dword [esp]
add esp, 4
push eax
or eax, 0xffffffff
inc eax
sub eax, 0x29a58556
neg eax
xchg dword [esp], eax
xor dword [esp], 0x29a58542
add edi, dword [esp]
lea esp, [esp + 4]
mov edi, dword [edi]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x100732ae
shl eax, 0xf
shl eax, 0x11
add eax, ebx
pop esi
pop edi
pop ebx
sub ecx, ecx
add ecx, esp
sub ecx, 0x5f
mov ecx, dword [ecx + 0x4c]
and ecx, dword [esp]
or ecx, dword [esp]
add esp, 4
mov edx, dword [esp]
lea esp, [esp + 4]
leave
ret 0x10

Function at 0x100732ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf
mov dword [esp + 0xb], esi
add esp, 0xb
push edi
sub esp, 0x3e
mov dword [esp + 0x3a], ecx
add esp, 0x3a
shl edi, 0xb
shl edi, 0x15
not edi
and edi, 0x4e12ec40
xor edi, 0x4e12ec4c
add edi, ebp
mov edi, dword [edi]
mov esi, dword [ebp + 8]
xchg ecx, ebp
mov ebp, ecx
push ebx
xor ebx, edx
lea esp, [esp - 0x11]
mov dword [esp + 0xd], 0x69a8452d
lea esp, [esp + 0xd]
lea ebx, [eax + ecx*4 + 0x52d83bd7]
sub ebx, ebx
or ebx, dword [esp]
add esp, 4
xor ebx, 0x69a8453d
add ecx, ebx
lea esp, [esp - 0x53]
mov ebx, dword [esp + 0x53]
lea esp, [esp + 0x57]
mov ecx, dword [ecx]
cmp ecx, 0
je 0x1007337a
push 0
xor dword [esp], esi
call fcn.10073406
mov byte [edi], al
inc edi
inc esi
dec ecx
jne 0x10073365
sub eax, eax
add eax, edi
lea esp, [esp - 0x39]
mov ecx, dword [esp + 0x39]
lea esp, [esp + 0x3d]
shl edi, 1
shl edi, 0x1f
not edi
and edi, 0xffffffff
and edi, dword [esp]
add esp, 4
mov esi, dword [esp]
lea esp, [esp + 4]
leave
ret 0xc
Function at 0x10073cf4
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
lea esp, [esp - 4]
mov dword [esp], ecx
sub esp, 0x2b
mov dword [esp + 0x27], 0xf6a47d7
add esp, 0x27
mov dword [esp], edx
sub esp, 0x65
xor dword [esp + 0x61], ebx
xor dword gs:[esp + 0x61], ebx
xor ebx, dword [esp + 0x61]
xor dword [esp + 0x61], ebx
mov ebx, dword [esp + 0x61]
add esp, 0x61
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0x10]
movzx ecx, word [esi + 0x38]
mov esi, dword [esi + 0x3c]
push 0xffffffffffffffff
call fcn.1007485c
cmp ecx, 0
je 0x10073d5d
xor eax, eax
xor edx, edx
cld
rol edx, 7
xor dl, al
mov al, byte [esi]
inc esi
dec ecx
jne 0x10073d4a
xor eax, eax
add eax, edx
or ebx, ebx
and ebx, dword [esp]
or ebx, dword [esp]
add esp, 4
call fcn.10073d79
enter 0xffffffffffff8661, 0x47
je 0x10073d10
adc ah, bl
loopne 0x10073d10
pop esi
aas

Function at 0x10073e7d
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 4]
mov dword [esp], 0x93c2f523
and dword [esp], ebp
or dword [esp], ebp
mov ebp, esp
push 0xac82907f
xor dword [esp], 0xbd35560a
and dword [esp], edi
or dword [esp], edi
push esi
push ecx
sub esp, 4
xor dword [esp], edx
xor edx, dword [esp]
xor dword [esp], edx
mov edx, dword [esp]
sub esp, 4
xchg dword [esp], ebx
lea esp, [esp - 0x6c]
xchg dword [esp + 0x6c], ebx
mov dword [esp + 0x6c], ebx
lea esp, [esp + 0x70]
sub esp, 4
shr esi, 7
shr esi, 0x19
xor esi, dword [ebp + 0xc]
dec esi
lea edi, [esi]
add edi, dword [ebp + 0x14]
mov ecx, esi
sub ecx, dword [ebp + 0x10]
inc ecx
je 0x10073ef9
add esi, dword [ebp + 8]
add edi, dword [ebp + 8]
movsb byte es:[edi], byte [esi]
dec esi
dec esi
dec edi
dec edi
dec ecx
jne 0x10073eed
mov edi, dword [ebp + 0x10]
add edi, dword [ebp + 8]
lea ecx, [ebp + 0x14]
mov ecx, dword [ecx]
cld
push 0xffffffffffffffff
call fcn.1007485c
push 0
pop edx
sub edx, eax
dec edx
not edx
push 0xffffffffffffffff
call fcn.1007485c
add edx, ecx
add eax, edx
xor al, ah
add edx, eax
rcl edx, 4
rcr eax, 6
mov byte [edi], al
lea edi, [edi + 1]
dec ecx
jne 0x10073f1b
sub ebx, 0x16dbc99e
and ebx, dword [esp]
or ebx, dword [esp]
add esp, 4
pop edx
pop ecx
lea esi, [edx]
and esi, dword [esp]
or esi, dword [esp]
add esp, 4
xchg dword [esp], edi
mov dword [esp], edi
add esp, 4
leave
ret 0x10

Function at 0x10074979
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x16
mov dword [esp + 0x12], ebp
add esp, 0x12
mov ebp, esp
push 0
xor dword [esp], esi
sub esp, 4
xchg dword [esp], ecx
mov ecx, dword [esp]
push edx
mov esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
xor ecx, ecx
rol edx, 7
xor dl, al
mov al, byte [esi]
inc esi
cmp al, 0x5a
adc ecx, 0
cmp al, 0x41
sbb ecx, 0
shl ecx, 5
add eax, ecx
jne 0x1007499c
mov eax, edx
pop edx
pop ecx
lea esp, [esp - 0x6a]
xchg dword [esp + 0x6a], esi
mov dword [esp + 0x6a], esi
lea esp, [esp + 0x6e]
leave
ret 4
Function at 0x100749de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
lea esp, [esp - 4]
xchg dword [esp], edx
mov edx, dword [esp]
mov esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
xor ecx, ecx
rol edx, 7
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x100749f5
mov eax, edx
pop edx
pop ecx
or esi, 0xffffffff
inc esi
sub esi, 0xffffffff
neg esi
sub esp, 0x3e
and esi, dword [esp + 0x3e]
add esp, 0x42
leave
ret 4

Function at 0x10075a25
Capabilities:
Encode data using xor

Disassembly:
push 0
or dword [esp], ebp
mov ebp, esp
sub esp, 8
push eax
push 0
xor dword [esp], ebx
push 0xffffffffffffffff
and dword [esp], edx
push ecx
push edi
sub esp, 0x44
xor dword [esp + 0x40], esi
xor esi, dword [esp + 0x40]
xor dword [esp + 0x40], esi
mov esi, dword [esp + 0x40]
add esp, 0x40
sub ebx, ebx
or ebx, 0x7fe3134b
sub ebx, dword [0x7fe45c4b]
push eax
lea eax, [ebp - 8]
mov dword [eax], ebx
pop eax
xchg esi, eax
push 0x7fe45c3b
call fcn.1007390f
xchg esi, eax
add esi, ebx
shr edx, 3
shr edx, 0x1d
add edx, dword [ebp + 8]
sub edx, ebx
call fcn.100731da
or edi, 0xffffffff
not edi
sub edi, eax
dec edi
not edi
push 0
mov eax, dword [esp]
lea esp, [esp + 4]
sub eax, dword [esi + 8]
dec eax
not eax
xor eax, edi
cmp edx, eax
jb 0x10075ba8
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x10075ba8
mov ecx, dword [esi + 0x10]
xor ecx, edi
xor edx, edx
or edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x10075b51
mov eax, 1
lock xchg dword [0x7fe45c47], eax
cmp eax, 0
jne 0x10075ad7
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x10075aef
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
cmp eax, 0
je 0x10075b39
sub esp, 0x4b
mov dword [esp + 0x47], 0x93428cfb
add esp, 0x47
and dword [esp], eax
or dword [esp], eax
pop dword [ebp - 4]
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x10075b23
xor eax, eax
sub eax, 1
neg eax
xor eax, edi
mov dword [esi], eax
mov dword [0x7fe45c47], 0
add edx, esi
mov dword [ebp + 4], edx
xor esi, ecx
or esi, 0xffffffff
not esi
xor esi, dword [esp]
add esp, 4
lea esp, [esp - 0x6a]
xchg dword [esp + 0x6a], edi
mov dword [esp + 0x6a], edi
lea esp, [esp + 0x6e]
mov ecx, dword [esp]
add esp, 4
xchg dword [esp], edx
mov dword [esp], edx
add esp, 4
mov ebx, dword [esp]
add esp, 4
xor dword [esp], eax
xor eax, dword [esp]
xor dword [esp], eax
mov dword [esp], eax
add esp, 4
leave
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x10075a92
Function at 0x100797ad
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
sub esp, 4
xor dword [esp], ecx
xor ecx, dword [esp]
xor dword [esp], ecx
mov ecx, dword [esp]
sub esp, 4
xor dword [esp], edx
xor edx, dword [esp]
xor dword [esp], edx
mov edx, dword [esp]
push edi
push 0xffffffffffffffff
and dword [esp], esi
mov edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
shl ecx, 0xf
shl ecx, 0x11
sub ecx, dword [eax + 0xc]
dec ecx
not ecx
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x100798ab
push 0
add dword [esp], ebp
push 0xffffffffffffffff
lea esp, [esp - 0xd]
mov dword [esp + 9], 0x7fe379fe
lea esp, [esp + 9]
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], 0x7fe32e77
lea esp, [esp + 0x5c]
push 0xffffffffffffffff
call fcn.10074c7e
mov edx, dword [ecx + 0x18]
cmp edx, 0
je 0x10079863
mov ebx, edx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
cmp ebx, 0
je 0x10079863
lea ebx, [ebx + edx]
mov esi, dword [ebx + 0xc]
lea esi, [esi + edx]
push esi
call fcn.10074979
call fcn.10074d3a
cmp eax, edi
jne 0x100797fc
add esp, 4
or eax, 0xffffffff
inc eax
add eax, ecx
pop esi
lea esp, [esp - 0xd]
xchg dword [esp + 0xd], edi
mov dword [esp + 0xd], edi
lea esp, [esp + 0x11]
pop edx
add ecx, 0x441c6b93
shr ecx, 0xd
shr ecx, 0x13
or ecx, dword [esp]
add esp, 4
mov ebx, dword [esp]
lea esp, [esp + 4]
leave
ret 4
xor ecx, ecx
jmp 0x10079873
Function at 0x100798bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 0xfffffffc
mov dword [esp], ebp
mov ebp, esp
sub esp, 0x108
push ebx
add esp, 0xfffffffc
mov dword [esp], edx
push ecx
push 0
or dword [esp], edi
push esi
push ebp
push 0xffffffffffffffff
sub esp, 0x11
mov dword [esp + 0xd], 0x7fe37b13
add esp, 0xd
add esp, 0xfffffffc
mov dword [esp], esi
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], 0x7fe32e77
lea esp, [esp + 0x5f]
xor dword [esp], esi
xor esi, dword [esp]
xor dword [esp], esi
mov dword [esp], esi
add esp, 4
xchg dword [esp], esi
push 0xffffffffffffffff
call fcn.10074c7e
push 0
mov ebx, dword [esp]
add esp, 4
add ebx, 0x6fed9913
xor ebx, 0x6fed991b
add ebx, ebp
mov ebx, dword [ebx]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
mov edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
sub esp, 4
xor dword [esp], eax
xor eax, dword [esp]
xor dword [esp], eax
mov eax, dword [esp]
push esi
call fcn.100749de
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1007998d
add edi, 4
add eax, 2
dec ecx
jne 0x10079948
call fcn.10074d3a
xor eax, eax
jmp 0x10079a4f
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10079a94
cmp eax, ecx
ja 0x10079a94
sub esi, esi
sub esi, eax
dec esi
not esi
lea edi, [ebp - 0x104]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
cmp al, 0x2e
jne 0x100799c8
mov dword [edi], 0x6c6c64
lea eax, [ebp - 0x104]
push 0
add dword [esp], eax
call fcn.10074979
lea ebx, [ebp - 0x104]
lea edx, [ebp - 0x108]
lea esp, [esp - 4]
xchg dword [esp], edx
mov edx, dword [esp]
lea esp, [esp - 4]
xchg dword [esp], ebx
pop ebx
lea esp, [esp - 4]
sub esp, 4
xor dword [esp], eax
xor eax, dword [esp]
xor dword [esp], eax
mov eax, dword [esp]
call fcn.10079aa2
mov ebx, eax
sub esp, 0x4c
xor dword [esp + 0x48], esi
xor esi, dword [esp + 0x48]
xor dword [esp + 0x48], esi
mov esi, dword [esp + 0x48]
add esp, 0x48
call fcn.100749de
call fcn.10074d3a
push eax
push 0
xor dword [esp], ebx
call fcn.100798bc
sub esi, ecx
shl esi, 0x13
shl esi, 0xd
add esi, dword [esp]
add esp, 4
pop edi
shr ecx, 0xb
shr ecx, 0x15
sub ecx, 0xffffffff
neg ecx
and ecx, dword [esp]
add esp, 4
and edx, edi
xor edx, edx
or edx, dword [esp]
add esp, 4
and ebx, ecx
and ebx, dword [esp]
or ebx, dword [esp]
add esp, 4
leave
ret 8
call fcn.10074d3a
jmp 0x10079a4f