joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc3e950
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x2f], 0xfe
xor edx, edx
mov byte [ebp - 0x2e], 0xc1
mov byte [ebp - 0x2d], 0xe9
mov byte [ebp - 0x2c], 0xb7
mov byte [ebp - 0x2b], 0xa4
mov byte [ebp - 0x2a], 0xb9
mov byte [ebp - 0x29], 0xb6
mov byte [ebp - 0x28], 0x98
mov byte [ebp - 0x27], 0xbe
mov byte [ebp - 0x26], 0xb7
mov byte [ebp - 0x25], 0xba
mov byte [ebp - 0x24], 0xa5
mov byte [ebp - 0x23], 0xaf
mov byte [ebp - 0x22], 0x8f
mov byte [ebp - 0x21], 0xa7
mov byte [ebp - 0x20], 0xa0
mov byte [ebp - 0x1f], 0xaf
mov byte [ebp - 0x1e], 0xb7
mov byte [ebp - 0x1d], 0xa5
mov byte [ebp - 0x1c], 0xb3
mov byte [ebp - 0x1b], 0xa5
mov byte [ebp - 0x1a], 0xb2
mov byte [ebp - 0x19], 0xb0
mov byte [ebp - 0x18], 0xb5
mov esi, 0xf
mov byte [ebp - 0x17], 0xd7
mov al, byte [ebp - 0x2f]
mov dword [ebp - 4], edx
nop dword [eax]
mov bl, byte [ebp + edx - 0x2f]
mov ecx, edx
and ecx, esi
mov eax, 0xfc9027bd
cmp ecx, esi
mov edx, 0xa2cb8922
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 4]
and al, 0xf
lea ecx, [edx - 0x43]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0x2f], al
inc edx
mov dword [ebp - 4], edx
cmp edx, 0x19
jb 0xc3e9d0
mov byte [ebp - 0x16], 0x6e
xor edx, edx
mov byte [ebp - 0x15], 0x7c
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x67
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0x11], 0x23
mov byte [ebp - 0x10], 0x67
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x1d
mov al, byte [ebp - 0x16]
mov dword [ebp - 4], edx
mov bl, byte [ebp + edx - 0x16]
mov ecx, edx
and ecx, esi
mov eax, 0x1e1d1407
cmp ecx, esi
mov edx, 0x43f150da
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 4]
and al, 0xf
lea ecx, [edx + 7]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0x16], al
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xa
jb 0xc3ea38
lea eax, [ebp - 0x16]
push eax
call dword [0x9e7058]
lea ecx, [ebp - 0x2f]
push ecx
push eax
call dword [0x9e70cc]
mov ebx, eax
xor edi, edi
mov dword [ebp - 8], ebx
call dword [0x9e70e8]
mov dword [ebp - 4], eax
test eax, eax
je 0xc3eb17
mov esi, dword [0xa1e4fc]
push esi
push edi
push eax
call dword [0x9e70c0]
push 0
push esi
mov edi, eax
push edi
push 0x40
call ebx
mov ebx, eax
mov eax, dword [0x9e71dc]
cmp ebx, 0xc0000004
jne 0xc3eaf8
mov ebx, dword [ebp - 4]
push edi
push 0
push ebx
call eax
add esi, esi
cmp esi, 0x10000000
ja 0xc3eb0d
push esi
push 0
push ebx
call dword [0x9e70c0]
push 0
push esi
mov edi, eax
push edi
push 0x40
call dword [ebp - 8]
mov ebx, eax
mov eax, dword [0x9e71dc]
cmp ebx, 0xc0000004
je 0xc3eac1
test ebx, ebx
jns 0xc3eb1d
push edi
push 0
push dword [ebp - 4]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov eax, dword [0xa1e4fc]
cmp esi, 0x200000
cmovbe eax, esi
mov dword [0xa1e4fc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc40180
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9d3b66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor edx, edx
mov byte [ebp - 0x10], 0x12
mov edi, 0xf
mov byte [ebp - 0xf], 6
mov byte [ebp - 0xe], 0x60
mov al, byte [ebp - 0x10]
mov dword [ebp - 0x14], edx
nop dword [eax]
mov al, byte [ebp + edx - 0x10]
mov ecx, edx
and ecx, edi
mov byte [ebp - 0xd], al
cmp ecx, edi
mov eax, 0x2f5a3361
mov edx, 0x41ef8f97
cmovae ecx, edi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 0x14]
and al, 0xf
lea ecx, [edx + 0x61]
xor al, cl
xor al, byte [ebp - 0xd]
mov byte [ebp + edx - 0x10], al
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 3
jb 0xc40200
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.00d2d770
mov edi, eax
add esp, 8
test edi, edi
je 0xc402c3
push 2
push 0
push edi
call fcn.00d3154c
push edi
call fcn.00d2d2fb
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.00d3154c
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0xc40297
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0xc4028e
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0xc402a6
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00cb8110
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0xc402b0
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.00d35fef
push edi
call fcn.00d30ffe
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00c36c70
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0xc402f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9d3a5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov dword [ebp - 4], 0
xor edi, edi
mov byte [ebp - 0xf], 0x12
xor edx, edx
mov byte [ebp - 0xe], 6
mov esi, 0xf
mov byte [ebp - 0xd], 0x60
mov al, byte [ebp - 0xf]
mov dword [ebp - 0x14], edx
push ebx
mov bl, byte [ebp + edx - 0xf]
mov ecx, edx
and ecx, esi
mov eax, 0x2f5a3361
cmp ecx, esi
mov edx, 0x41ef8f97
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 0x14]
mov cl, al
and cl, 0xf
lea eax, [edx + 0x61]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 0xf], cl
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 3
jb 0xc40330
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xf]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.00d2d770
add esp, 8
mov esi, eax
pop ebx
test esi, esi
je 0xc403a5
push 2
push 0
push esi
call fcn.00d3154c
push esi
call fcn.00d2d2fb
push esi
mov edi, eax
call fcn.00d30ffe
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00c36c70
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0xc40410
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 0x1c], 0x92
xor edx, edx
mov byte [ebp - 0x1b], 0xa8
mov byte [ebp - 0x1a], 0xbb
mov byte [ebp - 0x19], 0x9c
mov byte [ebp - 0x18], 0xba
mov byte [ebp - 0x17], 0xab
mov byte [ebp - 0x16], 0x83
mov byte [ebp - 0x15], 0xb6
mov byte [ebp - 0x14], 0xa6
mov byte [ebp - 0x13], 0xaf
mov byte [ebp - 0x12], 0xbf
push esi
mov byte [ebp - 0x11], 0xb2
mov esi, ecx
push edi
mov byte [ebp - 0x10], 0xbf
mov edi, 0xf
mov byte [ebp - 0xf], 0xd5
mov al, byte [ebp - 0x1c]
mov dword [ebp - 4], edx
push ebx
mov bl, byte [ebp + edx - 0x1c]
mov ecx, edx
and ecx, edi
mov eax, 0x50bc96cf
cmp ecx, edi
mov edx, 0xdc9a7f43
cmovae ecx, edi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 4]
and al, 0xf
lea ecx, [edx - 0x31]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0x1c], al
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xe
jb 0xc40460
mov byte [ebp - 0xe], 0x4e
xor edx, edx
mov byte [ebp - 0xd], 0x7c
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x67
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 9], 0x23
mov byte [ebp - 8], 0x67
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x69
mov byte [ebp - 5], 0x1d
mov al, byte [ebp - 0xe]
mov dword [ebp - 4], edx
mov bl, byte [ebp + edx - 0xe]
mov ecx, edx
and ecx, edi
mov eax, 0x1e1d1407
cmp ecx, edi
mov edx, 0x43f150da
cmovae ecx, edi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 4]
and al, 0xf
lea ecx, [edx + 7]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0xe], al
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xa
jb 0xc404c8
lea eax, [ebp - 0xe]
push eax
call dword [0x9e7058]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [0x9e70cc]
pop ebx
push esi
test eax, eax
je 0xc40523
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [0x9e70a0]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xc40640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9d3a5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 4], 0
xor edx, edx
mov byte [ebp - 0xf], 0x12
mov esi, 0xf
mov byte [ebp - 0xe], 6
mov byte [ebp - 0xd], 0x60
mov al, byte [ebp - 0xf]
mov dword [ebp - 0x14], edx
nop dword [eax]
mov bl, byte [ebp + edx - 0xf]
mov ecx, edx
and ecx, esi
mov eax, 0x2f5a3361
cmp ecx, esi
mov edx, 0x41ef8f97
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 0x14]
and al, 0xf
lea ecx, [edx + 0x61]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0xf], al
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 3
jb 0xc40680
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xf]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.00d2d770
add esp, 8
test eax, eax
je 0xc406e1
push eax
call fcn.00d30ffe
add esp, 4
mov bl, 1
jmp 0xc406e3
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00c36c70
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0xc4dc00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9d577e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
xor ebx, ebx
mov byte [ebp - 0xe], cl
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 1
xor edx, edx
mov edi, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov edx, edi
sub edx, esi
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0xc4ddbb
xor eax, eax
mov dword [ebp - 0x20], eax
test cl, cl
je 0xc4dd63
add esi, eax
mov dword [ebp - 0x24], esi
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0xc4dc6f
mov eax, dword [esi]
push dword [esi + 0x10]
cmp dword [ebp + 0x28], 0x10
lea ecx, [ebp + 0x14]
mov edx, dword [ebp + 0x24]
cmovae ecx, dword [ebp + 0x14]
push eax
push 0
call fcn.00cbb8a0
add esp, 0xc
test eax, eax
je 0xc4dd33
mov byte [ebp - 0x12], 0x4a
xor ebx, ebx
mov byte [ebp - 0x11], 0xa8
mov esi, 0xf
mov byte [ebp - 0x10], 0xab
mov byte [ebp - 0xf], 0x83
mov al, byte [ebp - 0x12]
nop dword [eax]
mov al, byte [ebp + ebx - 0x12]
mov ecx, ebx
and ecx, esi
mov byte [ebp - 0xd], al
cmp ecx, esi
mov eax, 0x44fe157f
mov edx, 0xb74671c3
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
and al, 0xf
lea ecx, [ebx + 0x7f]
xor al, cl
xor al, byte [ebp - 0xd]
mov byte [ebp + ebx - 0x12], al
inc ebx
cmp ebx, 4
jb 0xc4dcb0
mov esi, dword [ebp - 0x24]
lea edx, [ebp - 0x12]
push esi
lea ecx, [ebp - 0x3c]
call fcn.00cba050
add esp, 4
mov byte [ebp - 4], 2
mov ebx, dword [ebp - 0x18]
or ebx, 1
mov dword [ebp - 0x18], ebx
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0xc4dd10
mov eax, dword [eax]
cmp dword [ebp + 0x28], 0x10
lea ecx, [ebp + 0x14]
push edx
cmovae ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x24]
push eax
push 0
call fcn.00cbb8a0
add esp, 0xc
mov byte [ebp - 0xd], 0
cmp eax, 0xffffffff
je 0xc4dd37
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 1
test bl, 1
je 0xc4dd51
and ebx, 0xfffffffe
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], ebx
call fcn.00c36c70
cmp byte [ebp - 0xd], 0
jne 0xc4ddeb
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
jmp 0xc4dd90
mov edx, dword [eax + esi + 0x10]
add eax, esi
cmp dword [eax + 0x14], 0x10
jb 0xc4dd71
mov eax, dword [eax]
cmp dword [ebp + 0x28], 0x10
lea ecx, [ebp + 0x14]
push edx
cmovae ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x24]
push eax
push 0
call fcn.00cbb8a0
add esp, 0xc
cmp eax, 0xffffffff
jne 0xc4ddeb
inc dword [ebp - 0x1c]
mov ecx, edi
add dword [ebp - 0x20], 0x18
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov cl, byte [ebp - 0xe]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
jb 0xc4dc58
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00cb7ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00c36c70
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0xc4ddbd
Function at 0xc4e540
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [0x9e711c]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xc4e580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push 0x100
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x18], 0x100
push 0
push eax
mov dword [ebp - 0x1c], 0x100
call fcn.00d29900
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [0x9e7028]
push 0x100
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00d29900
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [0x9e7120]
mov byte [ebp - 0x14], 0x9a
xor edx, edx
mov byte [ebp - 0x13], 0xba
mov esi, 0xf
mov byte [ebp - 0x12], 0xb0
mov byte [ebp - 0x11], 0xb2
mov byte [ebp - 0x10], 0x9e
mov byte [ebp - 0xf], 0xbb
mov byte [ebp - 0xe], 0xbd
mov byte [ebp - 0xd], 0xd2
mov al, byte [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov bl, byte [ebp + edx - 0x14]
mov ecx, edx
and ecx, esi
mov eax, 0xc58161d7
cmp ecx, esi
mov edx, 0x27f75b5d
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 0xc]
and al, 0xf
lea ecx, [edx - 0x29]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0x14], al
inc edx
mov dword [ebp - 0xc], edx
cmp edx, 8
jb 0xc4e614
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00d28db0
add esp, 8
test eax, eax
jne 0xc4e6de
mov byte [ebp - 7], 0x38
xor edx, edx
mov byte [ebp - 6], 0x3c
mov byte [ebp - 5], 0x3f
mov byte [ebp - 4], 0x4b
mov byte [ebp - 3], 0x28
mov byte [ebp - 2], 0x3d
mov byte [ebp - 1], 0x74
mov al, byte [ebp - 7]
mov dword [ebp - 0xc], edx
mov bl, byte [ebp + edx - 7]
mov ecx, edx
and ecx, esi
mov eax, 0xabb1e879
cmp ecx, esi
mov edx, 0xf353896d
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 0xc]
and al, 0xf
lea ecx, [edx + 0x79]
xor al, cl
xor al, bl
mov byte [ebp + edx - 7], al
inc edx
mov dword [ebp - 0xc], edx
cmp edx, 7
jb 0xc4e687
lea eax, [ebp - 7]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00d28db0
add esp, 8
test eax, eax
jne 0xc4e6de
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [0x9e71d8]
push eax
call dword [0x9e71d0]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc4e740
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x28]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x28], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov esi, 0xf
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x55
mov byte [ebp - 0x12], 0x51
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xf], 9
mov byte [ebp - 0xe], 0xa
mov byte [ebp - 0xd], 0x1f
shr eax, 0x1f
mov byte [ebp - 0xc], 0x52
and eax, 0xffffff01
mov byte [ebp - 0xb], 0x57
xor edx, edx
mov byte [ebp - 0xa], 0x50
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0x35
mov al, byte [ebp - 0x15]
mov dword [ebp - 4], edx
nop word [eax + eax]
mov bl, byte [ebp + edx - 0x15]
mov ecx, edx
and ecx, esi
mov eax, 0xc9c2f82d
cmp ecx, esi
mov edx, 0x8f8c4c04
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 4]
and al, 0xf
lea ecx, [edx + 0x2d]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0x15], al
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xd
jb 0xc4e7c0
lea eax, [ebp - 0x15]
push eax
call dword [0x9e7058]
mov edx, dword [ebp - 8]
test eax, eax
mov eax, 1
movzx ecx, dl
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc5b350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9d738d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov dword [ebp - 4], 0
push 0xa20024
call fcn.00d109c2
add esp, 4
test eax, eax
jne 0xc5b4c5
mov byte [ebp - 0x1a], 0xfd
xor edx, edx
mov byte [ebp - 0x19], 0x8a
mov esi, 0xf
mov byte [ebp - 0x18], 0x9e
mov byte [ebp - 0x17], 0xb0
mov byte [ebp - 0x16], 0x96
mov byte [ebp - 0x15], 0xc1
mov al, byte [ebp - 0x1a]
mov dword [ebp - 0x14], edx
nop dword [eax]
mov al, byte [ebp + edx - 0x1a]
mov ecx, edx
and ecx, esi
mov byte [ebp - 0xd], al
cmp ecx, esi
mov eax, 0x6e59efbf
mov edx, 0xa07123be
cmovae ecx, esi
shl ecx, 2
call fcn.00d4cd00
mov edx, dword [ebp - 0x14]
and al, 0xf
lea ecx, [edx - 0x41]
xor al, cl
xor al, byte [ebp - 0xd]
mov byte [ebp + edx - 0x1a], al
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 6
jb 0xc5b3b0
lea eax, [ebp + 8]
push eax
lea edx, [ebp - 0x1a]
lea ecx, [ebp - 0x34]
call fcn.00cba050
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [0xa20134]
cmp ecx, dword [0xa20138]
je 0xc5b44e
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
add dword [0xa20134], 0x18
jmp 0xc5b45a
push eax
push ecx
mov ecx, 0xa20130
call fcn.00cc3520
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00c36c70
push 0xa20024
call fcn.00d109d3
mov esi, dword [0xa1db3c]
lea eax, [ebp + 8]
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00cb5a60
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
mov edx, 0x2714
mov ecx, esi
call fcn.00c5a430
add esp, 0x18
test eax, eax
setg byte [ebp - 0xd]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00c36c70
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
push eax
call fcn.00d1066b
int3
Function at 0xcb6d40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9e3610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov byte [ecx + 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0xcb79f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9e370d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x10], eax
call fcn.00cb8fc0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea esi, [eax + 8]
mov dword [eax + 0x2c], edx
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea edi, [eax + 0x14]
mov dword [eax], 0x9e7d94
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [0xa20520]
mov ecx, dword [0xa20524]
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0xcb7b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9e373e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
push ebx
mov ebx, ecx
push esi
push edi
push 0
mov eax, dword [ebx]
push 0
mov dword [ebp - 0x14], ebx
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0xa02aac
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00c38690
push 8
call fcn.00d11440
push 1
mov esi, eax
call fcn.00d1024e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov dword [ebp - 4], 2
mov eax, dword [edi + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 2
push eax
call fcn.00cb9320
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov edx, 2
mov byte [ebp + 0xb], al
mov dword [ebp - 0x10], edx
and edx, 0xfffffffd
mov dword [ebp - 0x10], edx
mov byte [ebp - 4], 1
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 8]
test eax, eax
je 0xcb7c9d
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0xcb7cb9
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.00c38690
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc