joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004dd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 0x14]
cdq
and edx, 0xf
push esi
add eax, edx
push edi
sar eax, 4
mov edi, ecx
cmp dword [ebp + 0x14], 0x10
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
je 0x1004ddaf
pop edi
mov eax, 0xfffffffa
pop esi
mov esp, ebp
pop ebp
ret 0x14
test eax, eax
jle 0x1004dedf
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
inc eax
mov dword [ebp - 0x14], eax
mov edx, ecx
mov eax, dword [ebp + 0x18]
sub edx, eax
push ebx
mov dword [ebp - 0x10], edx
lea ebx, [eax + 8]
mov dword [ebp - 8], ebx
push ecx
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.1004d3d0
mov ecx, edi
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, ebx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.1004d3d0
mov dword [ebp + 0x18], 0x10
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x19]
xor esi, edx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0x14]
xor edx, dword [eax + 0x1d]
mov dword [ebp + 0x14], edx
mov edx, dword [eax + 0x11]
sub ebx, edx
sub ecx, dword [eax + 0x15]
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 0x1d]
mov eax, dword [eax + 0x15]
mov dword [ebp + 0xc], esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], eax
push dword [esi + 4]
lea eax, [ebp - 0x40]
push dword [esi]
push ecx
push ebx
push eax
mov ecx, edi
call fcn.1004d260
push dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov edi, eax
push dword [esi + 8]
lea eax, [ebp - 0x48]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.1004df30
push dword [esi + 0x14]
push dword [esi + 0x10]
mov ebx, dword [eax]
push dword [edi + 4]
mov eax, dword [eax + 4]
push dword [edi]
mov edi, dword [ebp - 4]
mov ecx, edi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x50]
push eax
call fcn.1004d260
xor ebx, dword [ebp - 0x18]
lea esi, [esi + 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
xor ebx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
xor ebx, dword [ebp + 0xc]
xor ecx, dword [ebp + 0x14]
dec dword [ebp + 0x18]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x14], eax
jne 0x1004de34
push ecx
push ebx
mov ebx, dword [ebp - 8]
mov ecx, edi
lea eax, [ebx - 8]
push eax
call fcn.1004d210
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0xc]
push ebx
call fcn.1004d210
mov ecx, dword [ebp + 0x10]
add ebx, 0x10
add ecx, 0x10
mov dword [ebp - 8], ebx
dec dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
jne 0x1004ddd2
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1004f010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [edx + 1]
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
mov eax, dword [eax + ecx*8 + 0xc]
sub dword [esi + 8], eax
movzx ecx, byte [edx]
mov eax, dword [edx + 1]
mov eax, dword [eax + ecx*8 + 8]
sub dword [esi], eax
mov al, byte [edx]
mov byte [ebp - 1], al
test al, al
je 0x1004f0f8
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
movzx eax, al
push ebx
shl eax, 3
push edi
mov edi, dword [esi + 4]
mov dword [ebp - 8], eax
mov ebx, dword [esi]
mov eax, edx
mov edx, ecx
mov dword [esi + 0xc], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], eax
mov dword [esi + 8], edi
lea ecx, [edx*2 + 1]
mov dword [ebp - 0x18], ebx
imul ecx, edx
mov dl, 5
mov dword [esi + 4], ebx
mov dword [esi], eax
call fcn.1004f420
lea ecx, [ebx*2 + 1]
mov dword [ebp - 0x10], eax
imul ecx, ebx
mov dl, 5
call fcn.1004f420
mov ecx, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dl, bl
mov eax, dword [eax + 1]
sub edi, dword [ecx + eax + 4]
mov ecx, edi
call fcn.1004f430
mov edx, dword [ebp - 0xc]
mov ecx, eax
mov eax, dword [ebp - 0x10]
xor ecx, eax
mov edi, dword [ebp - 8]
mov dword [esi + 8], ecx
mov edx, dword [edx + 1]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
sub ecx, dword [edi + edx]
mov dl, al
call fcn.1004f430
mov ecx, dword [ebp - 0x10]
xor eax, ebx
mov edx, dword [ebp - 0x1c]
sub edi, 8
mov dword [esi], eax
mov al, byte [ebp - 1]
dec al
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0x18]
mov byte [ebp - 1], al
test al, al
jne 0x1004f056
mov edx, dword [ebp - 0xc]
pop edi
pop ebx
mov eax, dword [edx + 1]
mov eax, dword [eax + 4]
sub dword [esi + 0xc], eax
mov eax, dword [edx + 1]
mov eax, dword [eax]
sub dword [esi + 4], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004f110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, edx
mov byte [ebp - 1], 1
push esi
mov esi, ecx
mov dword [ebp - 0x10], ebx
push edi
mov eax, dword [ebx + 1]
mov eax, dword [eax]
add dword [esi + 4], eax
mov eax, dword [ebx + 1]
mov eax, dword [eax + 4]
add dword [esi + 0xc], eax
cmp byte [ebx], 1
mov edi, dword [esi + 0xc]
mov dword [ebp - 8], edi
jb 0x1004f1e0
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
lea ecx, [edx*2 + 1]
imul ecx, edx
mov dl, 5
call fcn.1004f420
lea ecx, [edi*2 + 1]
mov dword [ebp - 0xc], eax
imul ecx, edi
mov dl, 5
call fcn.1004f420
movzx edi, byte [ebp - 1]
mov ebx, eax
mov ecx, dword [esi]
mov dl, bl
xor ecx, dword [ebp - 0xc]
shl edi, 3
mov dword [ebp - 0x1c], edi
call fcn.1004f420
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 1]
mov ecx, dword [ebp - 0x18]
xor ecx, ebx
mov edi, dword [edi + edx]
mov dl, byte [ebp - 0xc]
add edi, eax
mov dword [esi], edi
call fcn.1004f420
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 1]
add eax, dword [edx + ecx + 4]
mov ecx, dword [ebp - 0x14]
mov edx, eax
mov dword [esi + 4], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
mov dword [ebp - 0x18], eax
mov al, byte [ebp - 1]
inc al
mov dword [esi], ecx
mov dword [esi + 0xc], edi
mov dword [ebp - 8], edi
mov byte [ebp - 1], al
cmp al, byte [ebx]
jbe 0x1004f150
movzx ecx, byte [ebx]
mov eax, dword [ebx + 1]
pop edi
mov eax, dword [eax + ecx*8 + 8]
add dword [esi], eax
movzx ecx, byte [ebx]
mov eax, dword [ebx + 1]
mov eax, dword [eax + ecx*8 + 0xc]
add dword [esi + 8], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004f220
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100df0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov ax, dx
push edi
xor edi, edi
mov word [ebp - 0x2a], ax
cmp byte [ebp + 8], 0x7d
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], edi
jbe 0x1004f261
pop edi
mov al, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009bea4
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x100
mov dword [ebx + 1], 0x101f3698
cmp ax, cx
ja 0x1004f401
push esi
movzx esi, ax
lea eax, [esi + 0x1f]
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
movzx eax, ax
shl eax, 2
push eax
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.1009c990
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
push dword [ebp - 0x34]
lea eax, [ebp - 0x24]
push eax
call fcn.1009b860
mov al, byte [ebp + 8]
add esp, 0x18
mov byte [ebx], al
mov ax, word [ebp - 0x2a]
shr ax, 5
movzx ecx, ax
mov eax, esi
mov dword [ebp - 0x2c], ecx
and eax, 0x8000001f
jns 0x1004f2d5
dec eax
or eax, 0xffffffe0
inc eax
je 0x1004f316
cdq
inc ecx
and edx, 7
mov dword [ebp - 0x2c], ecx
add edx, eax
sar edx, 3
and esi, reloc.OLEAUT32.dll_VariantInit
jns 0x1004f2f1
dec esi
or esi, 0xfffffff8
inc esi
je 0x1004f2f5
inc dl
test dl, dl
je 0x1004f31d
movzx eax, cx
lea ecx, [ebp + eax*4 - 0x28]
movzx eax, dl
push eax
push ecx
lea eax, [ebp - 0x30]
push eax
call fcn.1009b860
mov edi, dword [ebp - 0x30]
add esp, 0xc
jmp 0x1004f31d
movzx eax, cx
mov edi, dword [ebp + eax*4 - 0x28]
movzx eax, byte [ebp + 8]
mov dl, 1
mov dword [0x101f3698], 0xb7e15163
lea esi, [eax*2 + 4]
mov dword [ebp - 0x40], esi
cmp esi, 1
jle 0x1004f35a
mov ecx, 1
mov eax, dword [ebx + 1]
inc dl
lea ecx, [eax + ecx*4]
mov eax, dword [ecx - 4]
sub eax, 0x61c88647
mov dword [ecx], eax
movzx ecx, dl
cmp ecx, esi
jl 0x1004f341
mov eax, dword [ebp - 0x2c]
xor dl, dl
movzx eax, ax
xor ebx, ebx
mov dword [ebp - 0x30], eax
xor ecx, ecx
cmp dword [ebp - 0x30], esi
mov eax, esi
mov esi, dword [ebp - 0x30]
cmovg eax, esi
mov dword [ebp - 0x34], 1
mov byte [ebp - 0x25], dl
lea eax, [eax + eax*2]
movzx eax, ax
cmp word [ebp - 0x34], ax
ja 0x1004f400
dec esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x38]
add ecx, ebx
movzx edx, dl
mov dword [ebp - 0x2c], edx
mov eax, dword [eax + 1]
add ecx, dword [eax + edx*4]
lea esi, [eax + edx*4]
mov dl, 3
call fcn.1004f420
mov dword [esi], eax
movzx esi, byte [ebp - 0x25]
mov dword [ebp - 0x3c], eax
lea edx, [ebx + eax]
cmp esi, dword [ebp - 0x44]
jne 0x1004f3cd
lea ecx, [ebx + eax]
add ecx, edi
call fcn.1004f420
mov edi, eax
mov ebx, edi
jmp 0x1004f3e0
mov ecx, dword [ebp + esi*4 - 0x24]
add ecx, ebx
add ecx, eax
call fcn.1004f420
mov ebx, eax
mov dword [ebp + esi*4 - 0x24], ebx
mov eax, dword [ebp - 0x2c]
inc eax
mov ecx, dword [ebp - 0x3c]
cdq
idiv dword [ebp - 0x40]
lea eax, [esi + 1]
mov byte [ebp - 0x29], dl
cdq
idiv dword [ebp - 0x30]
dec dword [ebp - 0x34]
mov byte [ebp - 0x25], dl
mov dl, byte [ebp - 0x29]
jne 0x1004f391
pop esi
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.1009bea4
mov esp, ebp
pop ebp
ret 8
Function at 0x1004f5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movdqu xmm0, xmmword [edx]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push esi
lea ecx, [edi + 0x28]
movdqu xmmword [edi + 8], xmm0
call fcn.1004f700
lea eax, [esi + 1]
mov esi, 4
lea edx, [edi + 0x19]
jmp 0x1004f5f0
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
dec esi
jne 0x1004f5f0
movdqu xmm0, xmmword [edi + 8]
movdqu xmmword [edi + 0x18], xmm0
pop edi
pop esi
pop ebp
ret 4

Function at 0x1004f630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
lea edi, [ebx + 2]
add esi, 0x19
sub ebx, ecx
mov edx, 4
mov edi, edi
movzx ecx, byte [ebx + eax]
lea eax, [eax + 4]
xor cl, byte [esi - 1]
lea esi, [esi + 4]
mov byte [eax - 4], cl
lea edi, [edi + 4]
movzx ecx, byte [edi - 5]
xor cl, byte [esi - 4]
mov byte [eax - 3], cl
movzx ecx, byte [esi - 3]
xor cl, byte [edi - 4]
mov byte [eax - 2], cl
movzx ecx, byte [esi - 2]
xor cl, byte [edi - 3]
mov byte [eax - 1], cl
dec edx
jne 0x1004f650
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov edx, esi
push esi
lea ecx, [ebx + 0x28]
call fcn.1004f700
movdqu xmm0, xmmword [esi]
pop edi
pop esi
movdqu xmmword [ebx + 0x18], xmm0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x100df0c0]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [edx + 1]
push esi
movzx esi, byte [edx]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 2]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 3]
push edi
mov edi, ecx
shl esi, 8
movzx ecx, byte [edx + 4]
or esi, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xa4], esi
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
mov dword [ebp - 0xa0], ecx
movzx ecx, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
mov dword [ebp - 0x9c], ecx
movzx ecx, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl ecx, 8
or ecx, eax
mov eax, 0x100b4e98
mov dword [ebp - 0x98], ecx
xor esi, esi
movdqu xmm0, xmmword [ebp - 0xa4]
movdqu xmm1, xmmword [eax]
pxor xmm1, xmm0
movdqu xmmword [ebp - 0x94], xmm1
lea esp, [esp]
mov ecx, dword [esi + 0x100b4ea8]
xor ecx, dword [ebp + esi - 0x90]
xor ecx, dword [ebp + esi - 0x8c]
xor ecx, dword [ebp + esi - 0x88]
call fcn.1004f4a0
xor eax, dword [ebp + esi - 0x94]
mov dword [ebp + esi - 0x84], eax
mov dword [esi + edi], eax
add esi, 4
cmp esi, 0x80
jb 0x1004f970
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1009bea4
mov esp, ebp
pop ebp
ret
Function at 0x1004fbf0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
movzx esi, cx
shr ecx, 0x10
test edi, edi
jne 0x1004fc0a
pop edi
lea eax, [edx + 1]
pop esi
pop ebp
ret 4
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x1004fd07
mov edx, 0x15b0
cmp ebx, edx
cmovl edx, ebx
sub ebx, edx
mov dword [ebp + 8], ebx
cmp edx, 0x10
jl 0x1004fccc
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
lea esp, [esp]
movzx eax, byte [edi]
add esi, eax
movzx eax, byte [edi + 1]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 2]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 3]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 4]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 5]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 6]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 7]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 8]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 9]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 0xa]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 0xb]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 0xc]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 0xd]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 0xe]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 0xf]
add ecx, esi
add edi, 0x10
add esi, eax
add ecx, esi
dec ebx
jne 0x1004fc40
mov ebx, dword [ebp + 8]
test edx, edx
je 0x1004fcdb
movzx eax, byte [edi]
inc edi
add esi, eax
add ecx, esi
dec edx
jne 0x1004fcd0
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
test ebx, ebx
jg 0x1004fc16
pop ebx
shl ecx, 0x10
or ecx, esi
pop edi
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x10052540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x10052551
mov dword [esi], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100525b5
mov eax, 0x8000
cmp ecx, eax
push 0
cmovb eax, ecx
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], 0
test esi, esi
je 0x1005258e
add dword [esi], edx
test eax, eax
jne 0x100525b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100525a6
mov eax, 0x80004005
pop esi
pop ebp
ret 0x10
jle 0x100525b7
movzx eax, ax
or eax, 0x80070000
pop esi
pop ebp
ret 0x10
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x1005fc70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0xaaaaaaab
lea ecx, [ebx + 2]
mul ecx
mov eax, dword [ebp + 0x14]
shr edx, 1
lea edx, [edx*4 + 1]
cmp dword [eax], edx
jae 0x1005fc9c
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
mov eax, 0xaaaaaaab
mul ebx
push esi
shr edx, 1
push edi
mov edi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
lea esi, [edx + edx*2]
xor edx, edx
test esi, esi
je 0x1005fd2d
lea edx, [esi - 1]
mov eax, 0xaaaaaaab
mov esi, dword [ebp + 8]
mul edx
mov ebx, edx
shr ebx, 1
inc ebx
lea eax, [ebx + ebx*2]
mov dword [ebp - 4], eax
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + edi]
mov byte [ecx], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi]
shl eax, 4
shr edx, 4
add edx, eax
and edx, 0x3f
movzx eax, byte [edx + edi]
mov byte [ecx + 1], al
movzx edx, byte [esi + 2]
movzx eax, byte [esi + 1]
shr edx, 6
lea eax, [edx + eax*4]
and eax, 0x3f
movzx eax, byte [eax + edi]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + edi]
mov byte [ecx + 3], al
add ecx, 4
dec ebx
jne 0x1005fcd1
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
jmp 0x1005fd30
mov esi, dword [ebp + 8]
cmp edx, ebx
jae 0x1005fd8a
movzx eax, byte [esi]
mov dword [ebp + 0xc], eax
lea eax, [edx + 1]
mov dword [ebp + 8], eax
cmp eax, ebx
jae 0x1005fd4a
movzx edx, byte [esi + 1]
jmp 0x1005fd4c
xor edx, edx
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
and eax, 0x3f
shl esi, 4
movzx eax, byte [eax + edi]
mov byte [ecx], al
mov eax, edx
shr eax, 4
add eax, esi
and eax, 0x3f
movzx eax, byte [eax + edi]
mov byte [ecx + 1], al
cmp dword [ebp + 8], ebx
jae 0x1005fd7e
and edx, 0xf
mov al, byte [edi + edx*4]
jmp 0x1005fd80
mov al, 0x3d
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
mov eax, dword [ebp + 0x14]
mov byte [ecx], 0
sub ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10060760
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x100df0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0xc0]
call fcn.100129a0
mov eax, 0x3e8
mov dword [ebp - 0xc8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [ebp - 0xc4]
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0xc0]
call fcn.10012a40
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [ebp - 0xc4]
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0xc0]
call fcn.10012a40
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10060830
push str.SystemFunction036
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10060825
push 0x20
lea ecx, [ebp - 0x30]
push ecx
call eax
test al, al
je 0x10060825
push 0x20
lea edx, [ebp - 0x30]
mov dword [ebp - 0xc8], 0x64
lea ecx, [ebp - 0xc0]
call fcn.10012a40
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [esp]
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10060854
push 8
lea edx, [ebp - 0xd0]
lea ecx, [ebp - 0xc0]
call fcn.10012a40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 4
lea edx, [ebp - 0xc4]
mov dword [ebp - 0xc4], eax
lea ecx, [ebp - 0xc0]
call fcn.10012a40
mov esi, 0x64
jmp 0x10060880
mov edx, edi
lea ecx, [ebp - 0xc0]
call fcn.100128e0
lea ecx, [ebp - 0xc0]
call fcn.100129a0
push 0x20
mov edx, edi
lea ecx, [ebp - 0xc0]
call fcn.10012a40
dec esi
jne 0x10060880
dec dword [ebp - 0xc8]
jne 0x10060830
mov edx, edi
lea ecx, [ebp - 0xc0]
call fcn.100128e0
mov ecx, dword [ebp - 4]
mov byte [edi + 0x20], 0
xor ecx, ebp
pop edi
pop esi
call fcn.1009bea4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x10060950
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100adf2f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100df0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.10019d80
lea eax, [esi + 0xc]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0xc]
call fcn.10019d80
lea eax, [esi + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x18]
call fcn.10019d80
lea eax, [esi + 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x24]
call fcn.10019d80
lea eax, [esi + 0x30]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x30]
call fcn.10019d80
mov al, byte [esi + 0x3c]
lea ecx, [edi + 0x40]
mov byte [edi + 0x3c], al
lea eax, [esi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.10019d80
lea eax, [esi + 0x4c]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 0x4c]
call fcn.10019d80
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10060a10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100adf8f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100df0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10019ec0
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.10019ec0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.10019ec0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.10019ec0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.10019ec0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
mov byte [esi + 0x3c], 0
call fcn.10019ec0
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.10019ec0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006f8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ecx + 4]
xor esi, esi
mov ecx, dword [ecx]
mov edx, 0x159a55e5
mov dword [ebp - 4], ecx
mov eax, 0x1f123bb5
test edi, edi
je 0x1006f901
push ebx
mov ebx, dword [ebp + 8]
movzx ecx, dx
imul ecx, ecx, 0x9069
shr edx, 0x10
add edx, ecx
movzx ecx, ax
imul ecx, ecx, 0x4650
shr eax, 0x10
add eax, ecx
mov cl, al
xor cl, bl
mov ebx, dword [ebp - 4]
mov byte [esi + ebx], cl
inc esi
mov ebx, dword [ebp + 8]
cmp esi, edi
jb 0x1006f8d2
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10072170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
je 0x10072287
mov eax, dword [ebp + 8]
mov edi, edi
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
add ecx, eax
xor ecx, eax
dec edx
jne 0x10072180
mov eax, ecx
pop ebp
ret 4