joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022617
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002ddaf
call fcn.1002b0d2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002275c
cmp dword [ebp - 0x18], 1
jne 0x1002275c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10023b9e
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x1002275c
push dword [ebp - 0x14]
push ebx
push esi
call fcn.10023b9e
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022751
cmp dword [ebp - 0x18], 1
jne 0x10022751
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10023b9e
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10022751
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.10023b9e
lea eax, [ebp - 0x20]
push eax
push 0x100333c8
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10022735
push ebx
call fcn.10023b9e
pop ecx
test al, al
je 0x10022735
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10022751
push dword [edi]
call fcn.1002b601
and dword [edi], 0
pop ecx
jmp 0x10022751
test esi, esi
je 0x1002275c
push esi
call fcn.1002b601
pop ecx
call fcn.1002b030
ret

Function at 0x10022f02
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10033124
xor esi, esi
call fcn.10023b9e
pop ecx
test eax, eax
jne 0x10022f23
push 0x1003313c
call fcn.10023b9e
pop ecx
test eax, eax
je 0x10022f26
xor esi, esi
inc esi
cmp byte [0x1003cdfb], 0
jne 0x10022f38
cmp byte [0x1003cdfa], 0
je 0x10022f6e
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d640
push edi
call fcn.10023b9e
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10022f5d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10022f6d
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x10023b9e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10023bad
pop dword [ebp - 0x38]
mov eax, 0x731d1884
add eax, 0x9ce52329
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xc1ff91d3
sub dword [ebp - 0x48], 0x73ad4c88
mov dword [ebp - 0x44], 0xc50643df
add dword [ebp - 0x44], 0x6d2d0866
mov dword [ebp - 0x40], 0x3485770d
add dword [ebp - 0x40], 0x17c6cd21
mov dword [ebp - 0x3c], 0x2fe17b56
add dword [ebp - 0x3c], 0xd01e84aa
lea eax, [ebp - 0x48]
push eax
mov eax, 0x50f261c4
sub eax, 0x40ef7038
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x6da35f42
add dword [ebp - 0x48], 0x6cf0a14
mov dword [ebp - 0x44], 0x1e689aa7
add dword [ebp - 0x44], 0x2303c6ce
mov dword [ebp - 0x40], 0x392a2ddf
add dword [ebp - 0x40], 0x2a453e8d
mov dword [ebp - 0x3c], 0x93b9b740
sub dword [ebp - 0x3c], 0x93b9b740
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x37014e29
sub eax, 0x26fe5d3d
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x46fde
push 0
call eax
mov ecx, 0xa2f4f73e
add ecx, 0x5d0b5aa2
xor esi, esi
add esi, eax
mov edi, 0x5fa0ec1e
sub edi, 0x4f9c881e
add edi, dword [ebp - 0x38]
mov edx, 0xe4f8468e
sub edx, 0x68407482
sub dword [ebp - 0x24], eax
mov ebx, dword [edi]
add dword [ebp - 0x30], 0x93ba1652
xor ebx, edx
add dword [ebp - 4], edi
mov dword [esi], ebx
add dword [ebp - 0x34], 0x9053d7c0
add esi, 0x8071f02b
add esi, 0x7f8e0fd9
add edi, 0x232037dd
sub edi, 0x232037d9
loop 0x10023cd1
add eax, 0x13a53
mov ebx, eax
add eax, 0xd0a19e8a
sub eax, 0xd0a19e85
mov ecx, 0x7c7f9b93
add ecx, 0x9380646d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x100252bb
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cdfb], 0
jne 0x100252fd
cmp byte [0x1003cdfa], 0
je 0x10025334
movzx eax, bl
mov esi, 0x1003e1a8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.10023b9e
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10025324
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10025334
push esi
call fcn.10005eb0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cdfb], 0
jne 0x1002534b
cmp byte [0x1003cdfa], 0
je 0x1002537d
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1a8
push esi
call fcn.10023b9e
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x1002536d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1002537d
push esi
call fcn.10005eb0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.10023b9e
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.10023b9e
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.10023b9e
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.10023b9e
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.10023b9e
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.10023b9e
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10023b9e
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.10023b9e
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.10023b9e
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10023b9e
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.10023b9e
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x10043080
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp ecx, edx
je 0x100430a8
push edi
mov edi, esi
mov eax, esi
shr eax, 2
shl edi, 6
add edi, eax
movzx eax, word [ecx]
add eax, 0x9e3779b9
add ecx, 2
add eax, edi
xor esi, eax
cmp ecx, edx
jne 0x10043088
pop edi
mov eax, 3
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
imul eax, eax, 0x7fffffff
sub esi, eax
or esi, 0x40000000
mov eax, esi
pop esi
ret
Function at 0x100858d9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100858ea
pop esi
ret
push ebx
push edi
push esi
call fcn.10088242
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10088242
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10085912
push ebx
push esi
push edi
call fcn.10067180
add esp, 0xc
push 0
call fcn.10088242
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10088242
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10088251
pop dword [ebp - 0x4c]
mov eax, 0x10088251
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x390ce1f0
sub dword [ebp - 0x5c], 0xeaba9ca5
mov dword [ebp - 0x58], 0xea5be597
sub dword [ebp - 0x58], 0xb8289952
mov dword [ebp - 0x54], 0xea1a4945
add dword [ebp - 0x54], 0x6231fae9
mov dword [ebp - 0x50], 0x83fdaaf1
sub dword [ebp - 0x50], 0x83fdaaf1
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x2268b7e2
add eax, 0xeda0a91e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xc33ce3f7
sub dword [ebp - 0x5c], 0x4eca7aa1
mov dword [ebp - 0x58], 0xc6c853bb
add dword [ebp - 0x58], 0x7aa40dba
mov dword [ebp - 0x54], 0xf833bddd
add dword [ebp - 0x54], 0x6b3bae8f
mov dword [ebp - 0x50], 0xe9fd716c
sub dword [ebp - 0x50], 0xe9fd716c
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xc863f356
add eax, 0x47a56dba
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x58ae7
push 0
call eax
mov ecx, 0x7f5f38e9
sub ecx, 0x7f5efc82
mov esi, eax
mov edx, 0x100ce000
add edx, dword [ebp - 0x4c]
mov ebx, 0x91b6b3f0
sub ebx, 0xe29773a
sub dword [ebp - 0x10], 0x6641976d
mov edi, dword [edx]
sub dword [ebp - 0xc], 0xd458b20f
xor edi, ebx
xor dword [ebp - 0x1c], 0xfadba48f
mov dword [esi], edi
mov dword [ebp - 0x18], 0x3eef9fe4
add esi, 0x1f09bc8e
sub esi, 0x1f09bc8a
add edx, 4
loop 0x10088368
add eax, 0xce95f0a2
add eax, 0x316af3cd
mov ebx, eax
add eax, 5
mov ecx, 0x3d5714f9
add ecx, 0xd2a8eb07
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10012be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159130
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101d5844]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10116ac6
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1011ac0e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045950
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9cc
mov eax, dword [0x101d5844]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x9cc], edx
push edi
mov dword [ebp - 0x9c8], ebx
push 0x1388
mov dword [ebp - 0x9c8], ebx
call fcn.10116ac6
mov esi, eax
add esp, 4
mov dword [ebp - 0x9c8], esi
mov ecx, 0x1571
mov edx, 1
mov dword [esi + 0x1384], 0xffffffff
lea edi, [esi + 8]
mov dword [esi + 4], 0x1571
nop dword [eax]
mov eax, ecx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [edi - 4], ecx
cmp edx, 0x270
jb 0x100459b0
mov ecx, dword [ebp - 0x9cc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x9c4]
mov dword [esi], 0x270
push eax
call fcn.1001da30
xor eax, eax
lea edx, [ebp - 0x9c4]
xor ecx, ecx
mov edi, dword [edx]
mov dword [esi + ecx*4 + 4], edi
test ecx, ecx
jne 0x10045a06
mov eax, dword [esi + 4]
shr eax, 0x1f
jmp 0x10045a08
or eax, edi
inc ecx
add edx, 4
cmp ecx, 0x270
jb 0x100459f4
test eax, eax
jne 0x10045a1f
mov dword [esi + 4], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, ebx
mov dword [esi], 0x270
xor ecx, ebp
pop edi
mov dword [ebx], esi
pop esi
pop ebx
call fcn.10116b04
mov esp, ebp
pop ebp
ret
Function at 0x10045a40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x10045a9e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x10045a60
mov eax, dword [edi]
jmp 0x10045b89
cmp eax, 0x4e0
jb 0x10045b89
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10045ac0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10045b10
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov ecx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [edi + 0x1384]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
pop edi
xor eax, ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10045bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x10045c0d
push esi
movzx esi, byte [edi]
inc edi
movzx eax, byte [ecx]
mov edx, dword [ecx + 4]
xor esi, eax
mov eax, dword [ecx]
shrd eax, edx, 8
xor eax, dword [esi*8 + 0x101bebb8]
shr edx, 8
xor edx, dword [esi*8 + 0x101bebbc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
cmp edi, ebx
jne 0x10045be0
pop esi
pop edi
mov eax, ecx
pop ebx
pop ebp
ret 8
Function at 0x1004fbb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx + 4]
movsd xmm1, qword [0x101c3b40]
push esi
mov esi, dword [ecx]
movsd xmm0, qword [eax - 8]
push edi
mov edi, edx
mov dword [ebp - 4], ecx
subsd xmm0, qword [esi]
xor esi, esi
divsd xmm1, xmm0
movsd qword [ebp - 0x18], xmm1
mov eax, dword [ecx]
sub esp, 8
mulsd xmm1, qword [eax + esi]
movsd qword [esp], xmm1
call fcn.10134f6c
movsd xmm1, qword [ebp - 0x18]
lea edi, [edi + 4]
mov ecx, dword [ebp - 4]
add esi, 8
fstp qword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x10]
add esp, 8
xorps xmm0, xmmword [0x101c3e20]
cvttsd2si eax, xmm0
mov dword [edi - 4], eax
cmp esi, 0x4000
jl 0x1004fbf1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10072c70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015c9f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101d5844]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
mov ecx, edi
push ebx
mov dword [ebp - 0x14], edi
call fcn.1002d750
lea eax, [ebx + 0xc]
mov dword [ebp - 4], 0
lea ecx, [edi + 0xc]
push eax
call fcn.1002d750
lea esi, [ebx + 0x18]
mov byte [ebp - 4], 1
push esi
lea ecx, [edi + 0x18]
call fcn.10046b80
mov eax, dword [esi + 0xc]
mov ecx, edi
mov dword [edi + 0x24], eax
movzx eax, word [ebx + 0x28]
mov word [ecx + 0x28], ax
movzx eax, word [ebx + 0x2a]
mov word [ecx + 0x2a], ax
movzx eax, word [ebx + 0x2c]
mov word [ecx + 0x2c], ax
movzx eax, byte [ebx + 0x2e]
mov byte [ecx + 0x2e], al
movzx eax, byte [ebx + 0x2f]
mov byte [ecx + 0x2f], al
movq xmm0, qword [ebx + 0x30]
movq qword [ecx + 0x30], xmm0
movzx eax, word [ebx + 0x38]
mov word [ecx + 0x38], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100928f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
neg eax
mov dword [ebp - 4], edx
mov cl, byte [esi + 0xc]
sbb al, al
movzx edx, byte [edx + edi*8 + 0x164]
and eax, 0xffffff02
mov dword [ebp - 8], eax
cmp edi, 2
setne al
dec al
mov byte [ebp + 0xf], al
mov al, cl
and al, 0xfe
or cl, 1
movzx eax, al
and dl, 1
mov edx, dword [ebp - 4]
movzx ebx, cl
cmove ebx, eax
mov byte [esi + 0xc], bl
mov al, bl
movzx ecx, byte [edx + edi*8 + 0x164]
and al, 0xfb
or bl, 4
movzx eax, al
and cl, 2
movzx ebx, bl
cmove ebx, eax
mov byte [esi + 0xc], bl
mov al, bl
movzx edx, byte [edx + edi*8 + 0x164]
and al, 0xfd
or bl, 2
movzx eax, al
and dl, 4
movzx ecx, bl
cmove ecx, eax
mov eax, dword [ebp - 4]
mov byte [esi + 0xc], cl
mov cl, byte [eax + edi*8 + 0x160]
cmp cl, 2
jae 0x10092990
mov al, 2
jmp 0x1009299d
mov edx, 0x10
movzx eax, cl
cmp cl, dl
cmova eax, edx
movzx eax, al
mov ecx, esi
push eax
call fcn.1004d7d0
mov ecx, dword [ebp - 4]
xor edx, edx
xor ebx, ebx
mov dword [ebp + 8], edx
movzx eax, byte [ecx + edi*8 + 0x162]
mov byte [esi + 0xd], al
movzx eax, byte [ecx + edi*8 + 0x163]
mov byte [esi + 0xe], al
mov al, byte [ecx + edi*8 + 0x161]
mov byte [esi + 0x10], al
mov byte [esi + 0xf], al
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
test eax, eax
je 0x10092a40
shl edi, 6
add edi, 0xa2
add edi, ecx
nop dword [eax]
movzx ecx, word [edi - 2]
lea edi, [edi + 4]
cmp word [ebp + 8], cx
mov eax, ecx
movzx edx, dx
cmovb edx, eax
mov eax, dword [esi]
movzx ecx, dx
mov word [eax + ebx*4], cx
lea eax, [ecx + 1]
mov cl, byte [ebp - 8]
movzx edx, ax
mov al, byte [edi - 4]
xor al, byte [ebp + 0xf]
shr al, cl
cmp al, 0x40
movzx ecx, al
mov eax, 0x40
mov dword [ebp + 8], edx
cmova ecx, eax
mov eax, dword [esi]
mov byte [eax + ebx*4 + 2], cl
inc ebx
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
cmp ebx, eax
jb 0x100929f0
push 0x20
push ecx
mov ecx, esi
call fcn.1004d110
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8