joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.00401537
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x4019de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, esi
add ebx, 0xc8
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov eax, edi
shl eax, cl
cdq
idiv ebx
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x401a7c
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
jmp 0x401a17
add dword [ebp - 0xc], ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x10], eax
jl 0x401a11
mov ecx, dword [ebp - 8]
cmp eax, ecx
jne 0x401a30
mov eax, dword [ebp + 0xc]
add eax, esi
mov ebx, eax
sub ebx, dword [ebp - 0xc]
or ebx, ebx
je 0x401a8d
and dword [ebp - 0x14], 0
push ebx
push dword [ebp - 0xc]
push esi
call fcn.0040198a
mov dword [ebp - 0x18], eax
push ebx
push dword [ebp - 0xc]
push esi
call fcn.0040198a
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
or edx, esi
add edx, eax
push edx
mov edx, dword [ebp - 0x18]
xor edx, esi
add edx, eax
push edx
call fcn.00401970
add esp, 0x20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x7e8
jl 0x401a38
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
mov edx, esi
dec edx
and eax, edx
cmp dword [ebp - 4], eax
jle 0x401a07
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401031
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403220], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403224], eax
push 0xa
push dword [0x403224]
push 0
push dword [0x403220]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, dword [ebp + 0x10]
inc eax
mov dl, byte [eax]
cmp dl, 0x20
jne 0x401044
jmp 0x401046
jmp 0x40103a
inc eax
push eax
push 0x403123
call fcn.00401110
push 0xfa
push 0x403029
push 0xffffffffffffffff
push 0x403123
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov dword [0x403228], 0x44
mov dword [0x403254], 1
mov word [0x403258], 0
push 0x40326c
push 0x403228
push 0
push 0
push 0
push 0x403029
push 0
push 0
push 0x403025
push 0
push str.mima1
call sub.advapi32.dll_CreateProcessWithLogonW
push 0xffffffffffffffff
push dword [0x40326c]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x40326c]
call sub.kernel32.dll_CloseHandle
push dword [0x403270]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x4017f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe8
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dl, byte [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov al, byte [ebp + 0x14]
vmovsd xmm0, qword [ebp + 0xc]
mov edi, esp
mov dword [esi + 0xd4], edi
mov dword [esi + 0xe0], 0xffffffff
lea edi, [esi + 0xd8]
mov dword [esi + 0xdc], 0x4058f0
mov ebx, dword fs:[0]
mov dword [esi + 0xd8], ebx
mov dword fs:[0], edi
and dl, 1
mov byte [esi + 0xd3], dl
and al, 1
mov byte [esi + 0xd2], al
vmovsd qword [esi + 0xc8], xmm0
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xbc], 0x40f1e760
mov dword [esi + 0xb8], 0
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0xa0]
call fcn.004059b0
sub esp, 4
mov byte [esi + 0x9f], 0
mov dword [esi + 0xe0], 0
mov eax, esp
mov dword [eax], str.xtnhuvfqhkcdasrpxycwsgyxdzqrulaogpyenozwimv
lea ecx, [esi + 0x84]
call fcn.004059b0
sub esp, 4
jmp 0x4018c6
mov dword [esi + 0x7c], 0x40f231b0
mov dword [esi + 0x78], 0
mov byte [esi + 0x77], 0
mov dword [esi + 0x6c], 0x40c9b200
mov dword [esi + 0x68], 0
mov byte [esi + 0x67], 1
mov dword [esi + 0x5c], 0x40a74800
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0x200
mov dword [esi + 0xe0], 1
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0x3c]
call fcn.004059b0
sub esp, 4
jmp 0x401921
mov dword [esi + 0xe0], 2
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0x24]
call fcn.004059b0
sub esp, 4
jmp 0x401943
lea ecx, [esi + 0x24]
lea eax, [esi + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00405ad0
mov byte [esi + 0x13], al
lea ecx, [esi + 0x24]
call fcn.00405aa0
lea ecx, [esi + 0x3c]
call fcn.00405aa0
mov al, byte [esi + 0x13]
test al, 1
jne 0x401978
jmp 0x40199c
mov dword [esi + 0x20], 0x10
cmp dword [esi + 0x20], 0
jle 0x401997
mov eax, dword [esi + 0x20]
add eax, 0xffffffff
mov dword [esi + 0x20], eax
jmp 0x40197f
jmp 0x40199c
mov dword [esi + 0x1c], 0x30
cmp dword [esi + 0x1c], 0
jle 0x4019bb
mov eax, dword [esi + 0x1c]
add eax, 0xffffffff
mov dword [esi + 0x1c], eax
jmp 0x4019a3
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xe0], 1
mov eax, esp
mov dword [eax], str.aimyspgesqdavhnmxfs
call fcn.004059b0
sub esp, 4
jmp 0x4019dd
lea ecx, [esi + 0x84]
call fcn.00405aa0
lea ecx, [esi + 0xa0]
call fcn.00405aa0
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xd8]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x402ba0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
imul eax
rol eax, 0xfb
rol edx, 0xf
rol ebx, 0x37
inc esi
add ebx, 0xbc
rol ebx, 0x7d
rcl edi, 0x69
sbb edi, 0x3c
sub edx, 6
imul eax
neg edx
sub edx, 0x1f
rcr edx, 0x4d
dec eax
mov ebx, 0xe5
sbb ebx, 0x91
rcr ebx, 0xd5
bswap edi
or eax, 0xa4
not edi
rcr esi, 0x7b
sbb edx, 0xcf
and ebx, 0x1b
add eax, 0xd0
rcr ebx, 0x67
dec ebx
ror edi, 0x7d
rcl ebx, 0x39
sbb ebx, 0x83
dec esi
inc ebx
rcl eax, 0x27
and edx, 0x25
dec ebx
dec edi
mov ebx, 0xec
neg edx
rcl edi, 0x46
inc edx
rol edi, 0xa7
rcl ebx, 0x79
rcl ebx, 0x6f
or edi, 6
bswap eax
rcr edx, 0xd7
rol eax, 0x9c
dec eax
rcl edx, 0x1c
imul edx
xor ecx, ecx
xor edi, edi
inc eax
not edi
imul edx
inc esi
inc eax
neg eax
neg eax
dec ebx
ror ebx, 0xe5
sbb edx, 0xb0
mov ebx, 0xa6
not edi
and edi, 4
inc edx
not esi
or edx, 0xf6
or esi, 0x10
imul esi
and edi, 0x7c
add eax, 0xf
bswap eax
sbb edi, 0x47
sub edx, 0xa5
add esi, 0xa3
not ebx
inc edi
or esi, 0x86
mov ebx, 0xcc
inc eax
sbb eax, 0x17
bswap esi
dec edi
neg eax
sbb edx, 0x57
sub eax, 0x19
bswap ebx
add edx, 0x9a
mov edx, 0x21
dec esi
imul esi
or edx, 0x16
mov edi, 0x4e
and edi, 0x4e
or edx, 0x8a
imul edx
rcr edx, 0xf4
dec edi
sbb eax, 0x43
sbb edi, 0x83
neg eax
mov ecx, dword [ebp + 0xc]
rcr eax, 0x5e
mov esi, 0x2b
imul edi
inc esi
ror eax, 0xea
sbb eax, 0x11
neg edi
dec esi
imul eax
sub eax, 0xa9
bswap edi
dec ebx
rcr eax, 0x23
sbb ebx, 0x8c
imul edx
mov edi, 8
add edx, 0x6c
dec edx
inc esi
dec eax
neg eax
inc eax
sbb edi, 0x72
sub edi, 0x91
not ebx
ror ebx, 0x16
or eax, 0xec
imul esi
mov edi, 0xed
imul edi
rcr ebx, 0xe6
ror eax, 0x70
mov eax, 0
or ebx, 0x30
sub esi, 0x55
not edx
not eax
not esi
ror edx, 0x89
rcl edx, 0xcd
or ebx, 0xa8
add edi, 0x8a
neg eax
add eax, 0x50
bswap ebx
sub edx, 0xeb
sbb eax, 0x31
neg esi
sbb ebx, 0x31
sub ebx, 0xa5
mov edi, dword [ebp + 8]
mov ebx, esi
xor ebx, esi
mov eax, eax
xor esi, eax
mov ebx, esi
mov eax, eax
mov esi, eax
xor eax, ebx
mov esi, eax
xor ebx, esi
mov ebx, eax
xor ebx, eax
not byte [edi]
mov esi, ebx
xor esi, esi
mov esi, ebx
mov esi, esi
xor ebx, ebx
xor esi, eax
xor ebx, ebx
mov esi, ebx
mov esi, ebx
sub byte [edi], 0x89
xor esi, esi
xor esi, esi
mov ebx, ebx
xor esi, ebx
mov eax, eax
mov ebx, eax
mov eax, esi
xor eax, esi
mov eax, eax
add byte [edi], 0x57
mov esi, ebx
xor esi, esi
mov esi, esi
mov eax, ebx
xor esi, eax
mov ebx, eax
mov esi, eax
xor esi, ebx
mov eax, esi
imul byte [edi]
inc edi
loop 0x402d76
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40724d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40728c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40728c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40728c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40728c
cmp dword [ecx + 0x74], 0xe
jbe 0x40728c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40e688
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40e725
push ebx
push esi
call fcn.0040e651
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040e5e5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40e6d2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e724
push edi
push eax
call fcn.0040cfeb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40e6f2
call fcn.0040d039
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e723
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040e5e5
add esp, 0x20
test eax, eax
jne 0x40e711
push edi
call fcn.0040d039
jmp 0x40e719
push ebx
call fcn.0040d039
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40f934
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a70
push 0x418a68
push str.FlsAlloc
push 0x1f
call fcn.0040f7f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f968
push dword [ebp + 8]
mov ecx, esi
call dword [0x416130]
call esi
jmp 0x40f96e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40f9b2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a80
push 0x418a78
push str.FlsGetValue
push 0x21
call fcn.0040f7f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f9e9
push dword [ebp + 8]
mov ecx, esi
call dword [0x416130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40f9f1
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a88
push 0x418a80
push str.FlsSetValue
push 0x22
call fcn.0040f7f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40fa2b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x414df0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414e1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414e1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x74709b]
test eax, eax
je 0x401ac0
mov ch, 0xc3
nop
lea esp, [edx]
mov dword [0xea4070e3], 0x57000001
jmp sym.___do_global_ctors

Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a
Function at 0x10003780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1013a664]
and eax, dword [0x1013a668]
sub eax, 0x309dc485
add eax, 0xe28c9fdb
and eax, 0x653f12f8
xor eax, 0xd6fad23a
xor eax, 0x9736b2b4
xor eax, 0xeb2dbf4
mov ecx, 0xab4dabe2
xor edx, edx
div ecx
add eax, 0x1b69765
or eax, 0x6d1074b1
mov ecx, 0x598511df
xor edx, edx
div ecx
and eax, 0x8a33e99e
add eax, 0x8a75bacc
xor eax, 0xe99a84d5
add eax, 0xe2e08fc9
xor eax, 0x33e74d1f
or eax, 0x9fb52125
add eax, 0x99b626ed
xor eax, 0x2fe10014
and eax, 0xe591c050
add eax, 0xa4e4fa5a
cmp eax, 0x3d28faa6
jbe 0x1000396d
mov eax, dword [0x1013a66c]
xor eax, dword [0x1013a670]
sub eax, 0x7a4c971d
or eax, 0xad2b7d45
add eax, 0x33deb188
imul eax, eax, 0x8b284e55
imul eax, eax, 0x4ae44fc9
and eax, 0x21a4a7f8
and eax, 0x7e143580
or eax, 0x3bdc8e1a
add eax, 0x539efc76
add eax, 0x56ea6b0f
add eax, 0x18f0e6c
or eax, 0x4f210561
or eax, 0x5bf45b9d
and eax, 0x4ab05584
imul eax, eax, 0x34a8278
mov ecx, 0xc2e1d46d
xor edx, edx
div ecx
and eax, 0xf802e12e
add eax, 0x5c801d55
xor eax, 0x16d41333
add eax, 0x5075e421
cmp eax, 0x6312dd58
je 0x10003813
mov eax, dword [0x1013a674]
add eax, dword [0x1013a678]
sub eax, 0xf9ab6a4d
add eax, 0xcb3389f5
add eax, 0x89b6adeb
sub eax, 0xa4303e50
imul eax, eax, 0x6fb80028
mov ecx, 0x30817ef6
xor edx, edx
div ecx
xor eax, 0x726820ac
xor eax, 0x1f497136
sub eax, 0x397b8fbc
mov ecx, 0xd98a3baa
xor edx, edx
div ecx
add eax, 0x9c21531c
and eax, 0x66aa6f10
add eax, 0x7751cf29
mov ecx, 0x1d97c2d3
xor edx, edx
div ecx
sub eax, 0x349e7624
mov ecx, 0xe45b9299
xor edx, edx
div ecx
or eax, 0xb887d950
mov ecx, 0xf94273aa
xor edx, edx
div ecx
and eax, 0x38662f25
mov ecx, 0x238f555b
xor edx, edx
div ecx
cmp eax, 0x5f8f055e
jae 0x10003958
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
mov eax, 2
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [esi], edi
mov dword [ecx], edx
mov ecx, dword [ecx]
mov dword [ebp - 0x14], ecx
cmp eax, 0xe3a7846f
ja 0x10003958
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
push eax
mov edx, esp
push eax
mov eax, esp
mov dword [edx], esi
mov dword [eax], ecx
jmp 0x10003927
jmp 0x10003813
Function at 0x10006f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1013a984]
or eax, dword [0x1013a988]
and eax, 0x8d220396
mov ecx, 0x492ea33b
xor edx, edx
div ecx
or eax, 0x37d3a23
and eax, 0x5c5be70c
mov ecx, 0x83149d1e
xor edx, edx
div ecx
xor eax, 0x7a6b13c9
sub eax, 0x4529d5b4
sub eax, 0x842e4c2e
sub eax, 0xd25d18a8
or eax, 0xea88e384
xor eax, 0x479cb892
sub eax, 0x85218f5e
or eax, 0x44d220d3
add eax, 0x5ea0ca9b
mov ecx, 0x40b2c0e8
xor edx, edx
div ecx
or eax, 0xb61222fa
and eax, 0xe8fd33f6
or eax, 0xb0c1f738
sub eax, 0x25ba918
sub eax, 0xee2365b9
cmp eax, 0xfc2adc72
je 0x10007094
mov edi, dword [ebp - 0xc]
mov eax, dword [0x1013a98c]
mov ecx, dword [0x1013a990]
and eax, ecx
or eax, 0xc3051b86
imul eax, eax, 0xe2ba20f2
add eax, 0x6dbcc2c8
xor eax, 0xc083cd05
add eax, 0xaf1624ef
mov ecx, 0xaa89a7bd
mul ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
shr eax, 0x1d
imul eax, eax, 0x6f779391
add eax, 0xf6a00639
or eax, 0x40210000
and eax, 0x40a10248
or eax, 0x3587cb5
xor eax, 0x183f749
imul eax, eax, 0xa6a59930
add eax, 0x8c0e7e70
or eax, 0x10400301
and eax, 0x13dc9721
xor eax, 0x7615f00c
add eax, 0x154ff50b
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [esi], edi
mov dword [ecx], edx
mov ecx, dword [ecx]
mov dword [ebp - 0x14], ecx
cmp eax, 0xbb87c536
jae 0x10006ff7
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [0x1013a994]
or eax, dword [0x1013a998]
or eax, 0xa27cb8d1
imul eax, eax, 0xd479983f
mov ecx, 0x992f7b71
xor edx, edx
div ecx
sub eax, 0xb5c5fa90
imul eax, eax, 0x7d4e142f
or eax, 0x55385377
mov ecx, 0xc1a678e3
xor edx, edx
div ecx
imul eax, eax, 0xbfa4da6
and eax, 0xfebaed0f
xor eax, 0xabe47af8
or eax, 0x848aefd3
or eax, 0x3954ad5a
mov ecx, 0xc7d49a15
xor edx, edx
div ecx
or eax, 0x47e306cc
add eax, 0xf09c198b
add eax, 0xf958f13f
or eax, 0xfbcfa3ff
and eax, 0xbb9fdeb7
or eax, 0xd4e23ed2
or eax, 0x32248f74
cmp eax, 0x7f31cfe6
jbe 0x100071ae
mov edi, dword [ebp - 0xc]
mov eax, dword [0x1013a99c]
mov ecx, dword [0x1013a9a0]
imul eax, ecx
add eax, 0x2873d1db
xor eax, 0x4e38cde6
add eax, 0xe52f0638
mov ecx, 0x44278019
mul ecx
shr edx, 0x1b
imul eax, edx, 0xbb47429
add eax, 0x54c4b6af
and eax, 0x24ee7d44
add eax, 0x772645a0
mov ecx, 0x221e9467
mul ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
shr eax, 0x1c
imul eax, eax, 0x87c47d8b
add eax, 0xf9e2a2f1
and eax, 0x3898bfb
add eax, 0x1b5cc341
and eax, 0x2700c6b
xor eax, 0x3d5139f5
add eax, 0xb873a05
or eax, 0xd29f3b0e
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [esi], edi
mov dword [ecx], edx
cmp eax, 0x6f4ddd6b
jb 0x1000711d
jmp 0x10006ff7
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
push eax
mov edx, esp
push eax
mov eax, esp
mov dword [edx], esi
mov dword [eax], ecx
jmp 0x1000711d
Function at 0x10007560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1013a9d4]
sub eax, dword [0x1013a9d8]
or eax, 0xade7f19f
add eax, 0x91acb811
or eax, 0xb8bf8f05
add eax, 0xa932b72b
mov ecx, 0x88d7a082
xor edx, edx
div ecx
and eax, 0xb9db6937
sub eax, 0x6ab0b04b
and eax, 0x9cf76567
and eax, 0x8c326ed9
sub eax, 0xd8eea130
and eax, 0xf60ce48c
or eax, 0xda2547b9
imul eax, eax, 0x62089b20
or eax, 0xc16ea8f6
and eax, 0x1b838ff6
sub eax, 0x391a9e1
mov ecx, 0x234a2519
xor edx, edx
div ecx
or eax, 0x264e6612
sub eax, 0x16dcf71f
sub eax, 0xa3e0b2d7
cmp eax, 0xe9696391
jae 0x10007739
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
mov eax, 0xfe682ee8
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [esi], edi
mov dword [ecx], edx
mov ecx, dword [ecx]
mov dword [ebp - 0x14], ecx
cmp eax, 0x955981ff
jb 0x100075f4
mov eax, dword [0x1013a9e4]
or eax, dword [0x1013a9e8]
or eax, 0xc492697a
or eax, 0x5f192e11
and eax, 0x6caf5ea8
mov ecx, 0x55ab513d
xor edx, edx
div ecx
sub eax, 0x2cd801f2
sub eax, 0x1b0e0a13
xor eax, 0x1b291309
sub eax, 0x4090eeb5
or eax, 0xbcdeff74
imul eax, eax, 0x64f1986b
add eax, 0xe838d055
add eax, 0xfb1b2126
sub eax, 0x6a17e298
sub eax, 0x35a49069
add eax, 0x7a7ca5b5
sub eax, 0xd2bc6bd7
mov ecx, 0x8fa39de4
xor edx, edx
div ecx
or eax, 0x14ad751d
add eax, 0xdce43e3d
and eax, 0xa5f5310
cmp eax, 0x839dcd1b
ja 0x1000774e
mov eax, dword [0x1013a9ec]
xor eax, dword [0x1013a9f0]
sub eax, 0xe207796f
or eax, 0x5e7ceafc
sub eax, 0x7d2fae8f
imul eax, eax, 0x6b72f1f3
and eax, 0xa5e8fcd6
xor eax, 0x8941c837
or eax, 0x1e8262a7
mov ecx, 0x8ad338
xor edx, edx
div ecx
mov ecx, 0x1047ab6f
xor edx, edx
div ecx
sub eax, 0xe146605f
mov ecx, 0x589fdac8
xor edx, edx
div ecx
xor eax, 0x1ece4de8
sub eax, 0x8c02c05f
mov ecx, 0xce96f5bc
xor edx, edx
div ecx
imul eax, eax, 0x2d647c28
xor eax, 0x4476ccec
imul eax, eax, 0xad4891d1
or eax, 0x611e1c31
add eax, 0x11d28952
mov ecx, 0x7499d0cb
xor edx, edx
div ecx
cmp eax, 0x58c650e4
jae 0x1000769c
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
push eax
mov edx, esp
push eax
mov eax, esp
mov dword [edx], esi
mov dword [eax], ecx
jmp 0x100075f4
jmp 0x1000769c
Function at 0x10009770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x20], ecx
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100e32a0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x1013abc4]
add eax, dword [0x1013abc8]
or eax, 0x76259825
mov ecx, 0x611379d4
xor edx, edx
div ecx
xor eax, 0x223476e
or eax, 0x6c84f4d9
and eax, 0x780e1ca2
add eax, 0xee3f0ff6
or eax, 0x36ff66ee
and eax, 0xecb0a5ba
and eax, 0x71e5a23b
imul eax, eax, 0xd2bca45d
and eax, 0xe9fa70b
or eax, 0x937c30d1
mov ecx, 0x155f1cff
xor edx, edx
div ecx
add eax, 0x69606cc4
mov ecx, 0x2fc42401
xor edx, edx
div ecx
sub eax, 0x3ef7160b
mov ecx, 0x5b557630
xor edx, edx
div ecx
sub eax, 0x8b6ed6fe
or eax, 0xf1ff0b96
sub eax, 0x973d1eb6
cmp eax, 0x20d18d14
jbe 0x1000996b
mov ecx, dword [ebp - 0x20]
push eax
mov eax, esp
mov dword [eax], ecx
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x1013abdc]
xor eax, dword [0x1013abe0]
and eax, 0xf19f4782
or eax, 0x684b79aa
sub eax, 0xce70a87
or eax, 0xb9f62ece
add eax, 0xe7c9046f
add eax, 0xa00525b3
sub eax, 0x8e087a72
xor eax, 0xc2354305
or eax, 0xc032ed35
or eax, 0xe32595fe
add eax, 0x67bacce8
imul eax, eax, 0x989a6440
imul eax, eax, 0x9416599d
or eax, 0xd8a2abf6
sub eax, 0x63285b5f
add eax, 0x933c18b7
sub eax, 0xd3fcc603
add eax, 0xfcba7cda
xor eax, 0xe92558f1
sub eax, 0x51fe5fa
cmp eax, 0x7974a794
jb 0x1000982d
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x24]
call fcn.100c9880
jmp 0x100098ca
mov ecx, dword [ebp - 0x24]
call fcn.100caa90
mov eax, dword [0x1013ac0c]
add eax, dword [0x1013ac10]
add eax, 0x8eecc1d5
or eax, 0xebdf8e4a
imul eax, eax, 0xd2750d9d
mov ecx, 0x3b45c509
xor edx, edx
div ecx
xor eax, 0x43dda208
or eax, 0x37779b79
imul eax, eax, 0xa756a434
imul eax, eax, 0xc1e81db9
xor eax, 0x58f4cf62
sub eax, 0xdbe8d5a2
xor eax, 0xae8d8935
imul eax, eax, 0x9e78f2ba
sub eax, 0xcf90cfee
and eax, 0x9a5b2001
imul eax, eax, 0xab494196
imul eax, eax, 0x55d20039
and eax, 0x1aa9a49b
sub eax, 0x689e4477
mov ecx, 0x17bd9c2d
xor edx, edx
div ecx
add eax, 0x6340bf10
cmp eax, 0xe3b6a002
ja 0x100098ca
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x20]
push eax
mov eax, esp
mov dword [eax], ecx
jmp 0x1000982d
Function at 0x100a3160
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret