joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1dd2f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1dd2ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x1dd3035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.01dd2e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x1dd2fc5
mov edi, 0x1ded8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x1dd3035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.01dd2e00
add edi, 4
add esp, 0xc
cmp edi, 0x1ded8c0
jb 0x1dd3000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x1dd3070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.01dd9082
mov esi, eax
add esp, 8
test esi, esi
je 0x1dd3107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1dd3102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.01dd8946
add esp, 8
test eax, eax
je 0x1dd30e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x1dd30e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.01dd8946
add esp, 8
test eax, eax
jne 0x1dd30c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x1dd3102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x1dd3f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x1de89fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x1dd4002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.01dd7dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1dd4002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.01dcf6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.01dd820b
push 0x10
call fcn.01dd81d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x1dd3fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.01dc41c0
jmp 0x1dd3fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.01dd3b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x1dd3ff0
mov ecx, edi
call fcn.01dc42c0
push edi
call fcn.01dd81c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1dd4021
inc ebx
cmp ebx, 0x20
jb 0x1dd3f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x1dd5250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1de9808
push 0x1dd9288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1dd5329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1dd5329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.01dd81d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x1dd5329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x1dd5329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x1dd532c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.01dd5351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1dd5d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1dd5d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x1dd5d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1dd5d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1dd5d94
push eax
push esi
call fcn.01dd820b
add esp, 8
pop esi
ret 0x10

Function at 0x1dd5da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1dd5e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x1dd5e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x1dee320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01dd7dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x1dd5dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x1dd5e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1dd5ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x1dd5eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x1dee320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01dd7dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x1dd5eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x1dd5e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x1dd6000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1dd6131
push esi
call fcn.01dd9145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01dc8080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x1dd6131
push 0
push ebp
call fcn.01dc83a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01dc8260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1dd608b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.01dc82f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1dd6121
push 0x1dee918
push edi
call fcn.01dd73f0
push eax
push ebx
push esi
call fcn.01dd5f60
push 0x1dee8f8
push edi
call fcn.01dd73f0
push eax
push ebx
push esi
call fcn.01dd5f60
push 0x1dee8d8
push edi
call fcn.01dd73f0
push eax
push ebx
push esi
call fcn.01dd5f60
push 0x1dee8c0
push edi
call fcn.01dd73f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.01dd5f60
push 0x1dee8a0
push edi
call fcn.01dd73f0
push eax
push ebx
push esi
call fcn.01dd5f60
push 0x1dee888
push edi
call fcn.01dd73f0
push eax
push ebx
push esi
call fcn.01dd5f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1dd71b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01dd7140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01dd7140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01dd7140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01dd7140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1dd7bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1dd7c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1de987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1dd7c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1dd7c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x50b210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
jmp 0x50b22a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50b231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50b220
mov eax, 1
add ebx, ebx
jne 0x50b243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50b238
jne 0x50b254
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50b238
xor ecx, ecx
sub eax, 3
jb 0x50b268
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50b2da
mov ebp, eax
add ebx, ebx
jne 0x50b273
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50b280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50b2a4
inc ecx
add ebx, ebx
jne 0x50b290
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50b285
jne 0x50b2a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50b285
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50b2c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50b2b5
jmp 0x50b226
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50b2c4
add edi, ecx
jmp 0x50b226
pop esi
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x50b323
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd97c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd9d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50b2e1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd9dc]
or eax, eax
je 0x50b31d
mov dword [ebx], eax
add ebx, 4
jmp 0x50b2fe
call dword [esi + 0xd9d8]
mov ebp, dword [esi + 0xd9e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50b357
sub esp, 0xffffff80
jmp 0x501008
Function at 0x10001030
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [edx]
mov byte [ecx], al
movzx eax, byte [edx + 1]
mov byte [ecx + 1], al
movzx eax, byte [edx + 2]
mov byte [ecx + 2], al
movzx eax, byte [edx + 3]
mov byte [ecx + 3], al
movzx eax, byte [edx + 4]
mov byte [ecx + 4], al
movzx eax, byte [edx + 5]
mov byte [ecx + 5], al
movzx eax, byte [edx + 6]
mov byte [ecx + 6], al
movzx eax, byte [edx + 7]
mov byte [ecx + 7], al
movzx eax, byte [edx + 8]
mov byte [ecx + 8], al
movzx eax, byte [edx + 9]
mov byte [ecx + 9], al
movzx eax, byte [edx + 0xa]
mov byte [ecx + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [ecx + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [ecx + 0xc], al
movzx eax, byte [edx + 0xd]
mov byte [ecx + 0xd], al
movzx eax, byte [edx + 0xe]
mov byte [ecx + 0xe], al
movzx eax, byte [edx + 0xf]
mov edx, 4
mov byte [ecx + 0xf], al
lea eax, [ecx + 0xd]
mov dword [ebp - 8], edx
push ebx
mov cl, byte [eax + 1]
mov bl, byte [eax - 1]
mov bh, byte [eax]
mov byte [ebp - 1], cl
mov cl, byte [eax + 2]
mov byte [ebp - 2], cl
test dl, 3
jne 0x10001102
movzx ecx, bh
mov dl, bl
mov bl, byte [ecx + str.cw]
movzx ecx, byte [ebp - 1]
mov bh, byte [ecx + str.cw]
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 1], cl
movzx ecx, dl
mov edx, dword [ebp - 8]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 2], cl
mov ecx, edx
shr ecx, 2
xor bl, byte [ecx + 0x10018580]
mov cl, byte [eax - 0xd]
inc edx
xor cl, bl
mov dword [ebp - 8], edx
mov byte [eax + 3], cl
mov cl, byte [eax - 0xc]
xor cl, bh
mov byte [eax + 4], cl
mov cl, byte [eax - 0xb]
xor cl, byte [ebp - 1]
mov byte [eax + 5], cl
mov cl, byte [eax - 0xa]
xor cl, byte [ebp - 2]
mov byte [eax + 6], cl
add eax, 4
cmp edx, 0x2c
jb 0x100010b0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
add ecx, 2
mov esi, 4
mov edi, edi
mov dl, byte [ecx + 1]
lea ecx, [ecx + 4]
mov bh, byte [ecx - 4]
mov dh, dl
mov al, byte [ecx - 6]
xor dh, bh
mov bl, byte [ecx - 5]
mov ah, 0x1b
mov byte [ebp - 2], al
mov byte [ebp - 3], dl
mov dl, dh
xor dl, al
xor dl, bl
mov byte [ebp - 1], dl
mov dl, al
xor dl, bl
mov al, dl
add dl, dl
shr al, 7
imul ah
mov ah, 0x1b
xor al, dl
mov dl, bl
xor al, byte [ebp - 2]
xor dl, bh
xor al, byte [ebp - 1]
mov byte [ecx - 6], al
mov al, dl
shr al, 7
add dl, dl
imul ah
xor al, dl
mov dl, 0x1b
xor al, bl
mov bl, byte [ebp - 1]
xor al, bl
mov byte [ecx - 5], al
mov al, dh
shr al, 7
add dh, dh
imul dl
mov dl, byte [ebp - 3]
mov ah, 0x1b
xor dl, byte [ebp - 2]
xor al, dh
xor al, bh
xor al, bl
mov byte [ecx - 4], al
mov al, dl
shr al, 7
add dl, dl
imul ah
xor al, dl
xor al, byte [ebp - 3]
xor al, bl
mov byte [ecx - 3], al
dec esi
jne 0x10001150
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100011f0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, edx
mov edi, ecx
mov dword [ebp - 8], eax
sub edx, edi
mov esi, edi
mov ebx, 4
lea esp, [esp]
mov ecx, 4
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
dec ecx
jne 0x10001215
dec ebx
jne 0x10001210
mov byte [ebp - 1], 1
mov esi, edi
mov ebx, 4
lea esp, [esp]
mov ecx, esi
mov edx, 4
jmp 0x10001240
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + str.cw]
mov byte [ecx - 4], al
dec edx
jne 0x10001240
inc esi
dec ebx
jne 0x10001230
cmp byte [ebp - 1], 0xa
movzx eax, byte [edi + 5]
mov cl, byte [edi + 1]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 0xb], al
mov byte [edi + 7], cl
je 0x100012e6
mov ecx, edi
call fcn.10001140
mov ch, byte [ebp - 1]
mov eax, edi
movzx edx, ch
mov ebx, 4
shl edx, 4
add edx, dword [ebp - 8]
mov esi, 4
jmp 0x100012d0
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
dec esi
jne 0x100012d0
dec ebx
jne 0x100012c6
inc ch
mov byte [ebp - 1], ch
jmp 0x10001225
mov ecx, dword [ebp - 8]
mov esi, 4
add ecx, 0xa0
mov edx, 4
lea esp, [esp]
mov al, byte [ecx]
inc ecx
xor byte [edi], al
inc edi
dec edx
jne 0x10001300
dec esi
jne 0x100012f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov dword [ebp - 4], eax
add eax, 0xb0
mov dword [ebp - 8], eax
mov esi, eax
push edi
mov edi, edx
test ebx, ebx
je 0x10001371
dec ebx
shr ebx, 4
inc ebx
mov eax, edi
sub esi, edi
mov edx, 0x10
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edx
jne 0x10001350
mov edx, dword [ebp - 4]
mov ecx, edi
call fcn.100011f0
mov esi, edi
add edi, 0x10
dec ebx
jne 0x10001346
mov eax, dword [ebp - 8]
movdqu xmm0, xmmword [esi]
pop edi
pop esi
movdqu xmmword [eax], xmm0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x20], 0x78323025
mov edx, ecx
mov dword [ebp - 0x1c], 0x3230252d
mov eax, 0x78
mov dword [ebp - 0x18], 0x30252d78
mov word [ebp - 4], ax
mov dword [ebp - 0x14], 0x252d7832
movzx eax, byte [edx + 5]
movzx ecx, byte [edx + 1]
push eax
movzx eax, byte [edx + 4]
push eax
movzx eax, byte [edx + 3]
push eax
movzx eax, byte [edx + 2]
push eax
push ecx
movzx ecx, byte [edx]
lea eax, [ebp - 0x20]
push ecx
push eax
push 0x12
push esi
mov dword [ebp - 0x10], 0x2d783230
mov dword [ebp - 0xc], 0x78323025
mov dword [ebp - 8], 0x3230252d
call fcn.100049a2
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003d60
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push edi
test ecx, ecx
jle 0x10003d86
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x10003d8e
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x10003da7
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x10003daf
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x10003dc8
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10003dd0
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x10003de9
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x10003df1
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x10003e33
add dword [esp], 5
retf

Function at 0x10003ec0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
push esi
push edi
test ecx, ecx
je 0x10003f31
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x10003ee0
test eax, eax
je 0x10003f31
test edx, edx
je 0x10003f31
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
push 0x33
call fcn.10003ef1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003f40
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x17
push esi
push edi
test ecx, ecx
je 0x10003fc8
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x10003f64
test eax, eax
je 0x10003fc8
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
push 0x33
call fcn.10003f75
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003fd0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5dc
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x1c], ecx
push edi
movlpd qword [ebp - 0x10], xmm0
push 0x33
call 0x10003fee
add dword [esp], 5
retf

Function at 0x1000414e
Capabilities:
64-bit execution via heavens gate

Disassembly:
mov dword [esp + 4], 0x23
add dword [esp], 0xd
retf

Function at 0x1000427e
Capabilities:
64-bit execution via heavens gate

Disassembly:
mov dword [esp + 4], 0x23
add dword [esp], 0xd
retf