joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10055d38
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1006b3c8
push 0x1006b3c0
push str.FlsGetValue
push 0x21
call fcn.10055b25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10055d6f
push dword [ebp + 8]
mov ecx, esi
call dword [0x100661e0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10055d77
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1006b3d0
push 0x1006b3c8
push str.FlsSetValue
push 0x22
call fcn.10055b25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10055db1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100661e0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10059e94
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10059f31
push ebx
push esi
call fcn.10059e5d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100585d1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10059ede
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10059f30
push edi
push eax
call fcn.10050eb0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10059efe
call fcn.1005090c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10059f2f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100585d1
add esp, 0x20
test eax, eax
jne 0x10059f1d
push edi
call fcn.1005090c
jmp 0x10059f25
push ebx
call fcn.1005090c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10059f34
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10059f45
pop esi
ret
push ebx
push edi
push esi
call fcn.10059e5d
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10050eb0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10059f6d
push ebx
push esi
push edi
call fcn.1003dad0
add esp, 0xc
push 0
call fcn.1005090c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1005a33d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10059f82

Function at 0x1005c5c3
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1004ef5c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005c632
cmp esi, dword [ebp - 4]
je 0x1005c62d
cmp dword [ebp + 0xc], 0
je 0x1005c62d
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005c60a
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1005c115
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1005c634
xor eax, eax
inc eax
jmp 0x1005c634
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1005c699
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007f098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1004ef5c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1004ef5c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1005c710
cmp word [ecx], dx
je 0x1005c710
mov eax, dword [0x1006b9ec]
push edi
dec eax
push eax
push 0x1006b8d8
call fcn.1005c638
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1005c783
cmp word [eax], dx
je 0x1005c783
mov eax, dword [edi]
test eax, eax
je 0x1005c734
cmp word [eax], dx
je 0x1005c734
lea eax, [ebp - 0x10]
push eax
call fcn.1005c01b
jmp 0x1005c73d
lea eax, [ebp - 0x10]
push eax
call fcn.1005c0b6
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1005c7ad
mov eax, dword [0x1006b8d4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1006b5c8
call fcn.1005c638
add esp, 0xc
test al, al
je 0x1005c7ad
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1005c778
cmp word [eax], di
je 0x1005c778
lea eax, [ebp - 0x10]
push eax
call fcn.1005c01b
pop ecx
jmp 0x1005c7af
lea eax, [ebp - 0x10]
push eax
call fcn.1005c0b6
jmp 0x1005c775
mov eax, dword [edi]
test eax, eax
je 0x1005c79a
cmp word [eax], dx
je 0x1005c79a
lea eax, [ebp - 0x10]
push eax
call fcn.1005bfd0
pop ecx
jmp 0x1005c7ad
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1005c878
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1005c4bd
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1005c878
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1005c878
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1005c878
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1005c805
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10055f53
test ebx, ebx
je 0x1005c873
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10055f53
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005c878
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005c878
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10060b91
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1005c87a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c0aa
leave
ret
Function at 0x10061301
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1006127d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10061470
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10061470
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10061425
jg 0x1006135d
test eax, eax
je 0x1006141b
push 1
push 0x1000
call fcn.10052b25
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10061380
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10061412
push 0x8000
push ebx
call fcn.100611ae
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100613a9
jg 0x100613a4
cmp ecx, 0x1000
jb 0x100613a9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10054b14
add esp, 0x10
cmp eax, 0xffffffff
je 0x100613ee
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100613a4
jl 0x100613d5
test ecx, ecx
jne 0x10061396
push dword [ebp - 0xc]
push ebx
call fcn.100611ae
push esi
call fcn.1005090c
add esp, 0xc
xor ebx, ebx
jmp 0x1006147e
cmp byte [edi + 0x24], 0
je 0x10061405
cmp dword [edi + 0x20], 5
jne 0x10061405
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10061410
mov ebx, dword [edi + 0x18]
jmp 0x10061412
xor ebx, ebx
push esi
call fcn.1005090c
pop ecx
jmp 0x1006147e
test ecx, ecx
jg 0x100613e7
jl 0x10061425
test eax, eax
jae 0x100613e7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10054f36
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10061445
cmp byte [edi + 0x1c], 0
je 0x100613e7
jmp 0x10061476
push ebx
call fcn.1005eca3
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100613e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1006147e
cmp byte [edi + 0x1c], 0
je 0x1006147b
mov ebx, dword [edi + 0x18]
jmp 0x1006147e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10054f36
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x15da618
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x15e2bb3
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret
Function at 0x1a698a6
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x1a6d942
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x1a8d764
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x1aa7b7a
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x1ab856d
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x1ac1725
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp ebp
dec eax
neg eax
stc
cmc
ror eax, 2
neg eax
test edi, 0x126f6bdc
cmp esi, esp
xor ebx, eax
cmp ecx, 0x3d133651
add ebp, eax
jmp 0x15c2b9b
xor eax, ebx
jmp 0x19c9a78
push eax
push ebp
not ax
push edx
cmovl edx, edx
cwde
push ecx
nop
push edi
rdtsc
bswap bx
cwd
pushfd
rdtsc
push esi
mov edx, 0
movzx edi, sp
cbw
push edx
mov ax, 0x475d
mov edi, dword [esp + 0x28]
movzx eax, bp
dec edi
bswap eax
bts eax, esp
cmc
ror edi, 1
shld esi, ebx, 0xb2
rol bh, 0x46
add edi, 0x45975e4a
mov bp, 0x5a11
bswap edi
mov ebx, esp
inc ah
mov ax, 0x1c7a
inc edi
add edi, edx
sbb ebx, 0x1dd0644c
test ecx, ecx
test sp, 0x44f0
mov esi, esp
sub esp, 0xc0
xor ebp, esp
shl bx, 0xa0
mov ebx, edi
xor bp, 0x2824
xchg bp, ax
mov eax, 0
btc ebp, 0x2f
sub ebx, eax
sar ah, 0x58
sal ax, cl
rcl bp, 0xf0
lea ebp, [0x1a82437]
sub eax, ebp
mov al, 0xcc
btr eax, edi
mov eax, dword [edi]
add edi, 4
jmp 0x19cb4a3
push ebx
jmp 0x1a823a9

Function at 0x1e31c95
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x1e54e86
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0x1e5b89b
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret
Function at 0x5d22d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13d000]
mov dword [edi + 0x1afb00], 0xfaafd2aa
push edi
or ebp, 0xffffffff
jmp 0x5d22fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5d2301
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5d22f0
mov eax, 1
add ebx, ebx
jne 0x5d2313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5d2324
jne 0x5d2343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5d2343
dec eax
add ebx, ebx
jne 0x5d2330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5d2308
add ebx, ebx
jne 0x5d233f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5d2395
xor ecx, ecx
sub eax, 3
jb 0x5d235b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5d23ca
sar eax, 1
mov ebp, eax
jmp 0x5d2366
add ebx, ebx
jne 0x5d2366
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5d2334
inc ecx
add ebx, ebx
jne 0x5d2374
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5d2334
add ebx, ebx
jne 0x5d2381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5d2376
jne 0x5d2392
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5d2376
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5d23b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5d23a6
jmp 0x5d22f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5d23b4
add edi, ecx
jmp 0x5d22f6
pop esi
mov edi, esi
mov ecx, 0x90b1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5d23d2
cmp byte [edi], 0x11
jne 0x5d23d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5d23d7
lea edi, [esi + 0x1c6000]
mov eax, dword [edi]
or eax, eax
je 0x5d244f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d2278]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d232c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5d2404
mov ecx, edi
jns 0x5d2433
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d2330]
or eax, eax
je 0x5d2449
mov dword [ebx], eax
add ebx, 4
jmp 0x5d2421
call dword [esi + 0x1d2340]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5d2480
cmp al, 0xef
ja 0x5d2473
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5d2455
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5d2462
mov ebp, dword [esi + 0x1d2334]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5d24b4
sub esp, 0xffffff80
jmp 0x4da46d
Function at 0x1001aee9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d0db4
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100dbeac
mov dword [esi + 8], 0x100d97c0
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push fcn.1000b96d
push 0x1001b0f6
push 6
lea eax, [esi + 0x160]
push 8
push eax
mov byte [ebp - 4], 7
call fcn.1002af95
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dbe78
mov dword [esi + 4], 0x100dbe5c
mov dword [esi + 8], 0x100dbe4c
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100248ea
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x10024919
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
shr eax, 8
movzx ecx, word [ecx*2 + 0x100f75d0]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x100248f9
pop edi
pop esi
ret 4

Function at 0x10029218
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d1c35
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100d9c7c
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dd620
mov dword [esi + 4], 0x100dd610
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1002af95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1002afa4
pop dword [ebp - 0x20]
mov eax, 0x768bfe40
add eax, 0x9976b164
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x44472
push 0
mov eax, 0xb778e769
sub eax, 0xa76b5741
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xea3a273
sub ecx, 0xea358dc
mov edi, eax
mov ebx, 0x19cc00c5
add ebx, 0xf6461d3b
add ebx, dword [ebp - 0x20]
mov edx, 0x818e0314
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0x981af708
xor esi, edx
mov dword [edi], esi
sub dword [ebp - 0x1c], ecx
add edi, 0xf754d3d0
sub edi, 0xf754d3cc
add ebx, 0xd88328aa
sub ebx, 0xd88328a6
loop 0x1002affd
add eax, 0xd1e97e42
sub eax, 0xd1e86513
xor ebx, ebx
add ebx, eax
add eax, 0x57a12000
sub eax, 0x57a11ffb
mov ecx, 0xead16153
sub ecx, 0xdad16153
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1007f713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100d7204
call fcn.100cece0
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.1007f8eb
xor edi, edi
cmp eax, edi
jne 0x1007f8da
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x1007f76b
push 1
pop eax
jmp 0x1007f76d
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.100786d5
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x1007f8bf
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x1007f892
cmp word [eax + 0x20], 1
jne 0x1007f892
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.10080f40
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.1002af95
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.1007e9a8
test eax, eax
jne 0x1007f8aa
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1007f826
cmp byte [ebx + 0x2c], 0
je 0x1007f8c5
xor eax, eax
cmp byte [edi + eax], 0
jne 0x1007f8c5
inc eax
cmp eax, 0x14
jb 0x1007f816
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x1007f83e
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.10080ecb
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.1002af95
test eax, eax
jne 0x1007f8aa
cmp byte [ebp + 0x17], al
je 0x1007f892
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x1007f8a6
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x1007f8a6
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x1007f892
cmp dword [eax + 0x24], 1
jne 0x1007f892
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x1007f88a
test al, al
je 0x1007f8c5
test al, al
je 0x1007f892
test cl, cl
je 0x1007f8ae
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x1007f8bf
jmp 0x1007f792
xor cl, cl
jmp 0x1007f86a
mov esi, eax
jmp 0x1007f8cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
push 1
pop eax
jmp 0x1007f8da
cmp byte [ebp + 0x17], 0
je 0x1007f8ca
push 1
pop esi
jmp 0x1007f8cc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1008095a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100d729c
call fcn.100cece0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10080ade
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10080ade
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
call fcn.1002af95
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.1002af95
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [esi + 2], al
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.1002af95
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.1002af95
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.1002af95
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.1002af95
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.1002af95
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.1002af95
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.100034b3
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10080f88
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d731b
call fcn.100cece0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100851fe
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100d78af
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001da4
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10085281
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4