joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035b37
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x10078060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x42c], eax
cmp esi, ebx
jne 0x10035b65
xor eax, eax
jmp 0x10035c4c
cmp eax, ebx
jne 0x10035b7a
mov dword [ebp - 0x42c], str.abcdefghijklmnopqrstuvwabcdefghi
mov dword [ebp + 0xc], 0x20
lea eax, [ebp - 0x428]
push eax
mov eax, esi
mov dword [ebp - 0x428], ebx
call fcn.10032d67
test eax, eax
jne 0x10035be8
lea eax, [ebp - 0x424]
push esi
push eax
call fcn.10035a20
pop ecx
pop ecx
cmp dword [ebp - 0x410], ebx
jne 0x10035bb9
push ebx
push 1
lea ecx, [ebp - 0x424]
call fcn.10002274
jmp 0x10035b5e
cmp dword [ebp - 0x40c], 0x10
mov eax, dword [ebp - 0x420]
jae 0x10035bce
lea eax, [ebp - 0x420]
lea ecx, [ebp - 0x428]
push ecx
call fcn.10032d67
push ebx
push 1
lea ecx, [ebp - 0x424]
call fcn.10002274
call sub.IPHLPAPI.DLL_IcmpCreateFile
mov edi, eax
cmp edi, 0xffffffff
je 0x10035b5e
push 0x3ff
lea eax, [ebp - 0x407]
push ebx
push eax
xor esi, esi
mov byte [ebp - 0x408], bl
call fcn.10043280
add esp, 0xc
push 0x7d0
push 0x400
lea eax, [ebp - 0x408]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x42c]
push dword [ebp - 0x428]
push ebx
push ebx
push ebx
push edi
call sub.IPHLPAPI.DLL_IcmpSendEcho2
test eax, eax
je 0x10035c44
inc esi
push edi
call sub.IPHLPAPI.DLL_IcmpCloseHandle
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040b84
leave
ret

Function at 0x1003743a
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1790]
mov eax, 0x1810
call fcn.1004fd10
mov eax, dword [0x10078060]
xor eax, ebp
mov dword [ebp + 0x178c], eax
push esi
push 4
pop esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.Softwareprojonepodlp_smpcache_
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x80], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1003748b
cmp dword [ebp - 0x7c], esi
jne 0x1003748b
mov eax, dword [ebp - 0x78]
jmp 0x1003748d
xor eax, eax
test eax, eax
je 0x10037516
push edi
push 0x7fe
lea eax, [ebp + 0xf8e]
push 0
push eax
call fcn.10043280
mov esi, dword [sym.imp.SHLWAPI.dll_StrNCatW]
add esp, 0xc
push 0x5b
pop eax
mov edi, 0x400
push edi
mov word [ebp + 0xf8c], ax
push ebx
lea eax, [ebp + 0xf8c]
push eax
call esi
push 0x1006a1b4
lea eax, [ebp + 0xf8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push dword [ebp + 0x1798]
lea eax, [ebp + 0xf8c]
push eax
call esi
lea eax, [ebp + 0x179c]
push eax
lea eax, [ebp + 0xf8c]
push eax
push 0x800
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
mov ecx, dword [ebp + 0x178c]
xor ecx, ebp
pop esi
call fcn.10040b84
add ebp, 0x1790
leave
ret
Function at 0x10037607
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.1004fd10
mov eax, dword [0x10078060]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
call fcn.100376ea
test al, al
je 0x100376dd
xor eax, eax
mov word [ebp - 0x80c], ax
mov word [ebp - 0x100c], ax
push str.__ls__ls
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1006a1e0
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x2028]
push eax
call fcn.1003752c
cmp dword [eax + 0x18], 8
pop ecx
jb 0x10037678
mov eax, dword [eax + 4]
jmp 0x1003767b
add eax, 4
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x100c]
push 0x400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0
push 1
lea esi, [ebp - 0x2028]
call fcn.10002370
xor eax, eax
mov word [ebp - 0x200c], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0x800
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.10040b84
leave
ret

Function at 0x10037b4d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10078060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
mov edi, str..gxdte_cd
push edi
call esi
cmp eax, 0xffffffff
jne 0x10037c34
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.10043280
add esp, 0xc
call fcn.10037ad5
mov ebx, eax
push 0x104
lea eax, [ebp - 0x210]
push eax
xor ecx, ecx
call fcn.10032583
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10037bfa
cmp word [0x10082d78], ax
je 0x10037bfa
push 0x10082d78
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10032756
mov ebx, str.gxdte64.sys
test eax, eax
jne 0x10037c0d
mov ebx, str.gxdte32.sys
call fcn.10034f93
push ebx
lea ecx, [ebp - 0x210]
call fcn.1003e6e3
call fcn.10034eb3
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040b84
leave
ret

Function at 0x10037ec4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x10037ed5
mov eax, dword [eax + 4]
jmp 0x10037ed8
add eax, 4
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push str.Softwareprojonepodlpkeyrule_secClass_
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x10037f0b
cmp dword [ebp - 8], 4
jne 0x10037f0b
mov eax, dword [ebp - 0xc]
leave
ret
xor eax, eax
leave
ret
Function at 0x100394c2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test edx, edx
je 0x100394e6
push esi
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x10079668]
dec edx
inc ecx
test edx, edx
jne 0x100394ca
pop esi
not eax
ret

Function at 0x10039875
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10078060]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x144], 0
push esi
push edi
push 0x3f
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x4b]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x4c], 0
call fcn.10043280
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsw word es:[edi], word [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0x4c]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [ebp + eax - 0x8c], dl
mov byte [ebp + eax - 0xcc], cl
inc eax
cmp eax, 0x40
jb 0x100398b8
lea eax, [ebp - 0x13c]
call fcn.100408d5
lea eax, [ebp - 0x8c]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.10040919
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10040919
lea edi, [ebp - 0x6c]
call fcn.10040957
lea eax, [ebp - 0x13c]
call fcn.100408d5
lea eax, [ebp - 0xcc]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.10040919
mov eax, edi
push 0x20
push eax
lea eax, [ebp - 0x13c]
call fcn.10040919
add esp, 0x20
lea edi, [ebp - 0x2c]
call fcn.10040957
mov esi, dword [ebp - 0x140]
push 0x20
mov eax, edi
push eax
call fcn.10008e2c
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10040b84
leave
ret
Function at 0x1003aa3a
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
xor esi, esi
push edi
cmp dword [0x10081c94], esi
je 0x1003aa5a
push esi
push esi
mov dword [0x10081c94], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0xc]
push eax
push 0x10062908
xor edi, edi
inc edi
push edi
push esi
push 0x100629d8
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x1003aa84
xor eax, eax
jmp 0x1003ab63
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x10064f68
mov dword [ebp - 4], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1003ab57
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jl 0x1003ab4e
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push esi
push 0x30
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov ecx, dword [eax]
push 0x1006a580
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x1003ab4e
mov dword [ebp - 0x10], edi
push ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
lea edx, [ebp - 0x3c]
push edx
push 0xa
push 0xffffffffffffffff
push eax
xor ebx, ebx
call dword [ecx + 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x1003ab44
xor edi, edi
cmp dword [ebp + 8], esi
jbe 0x1003ab24
push dword [ebp + 0x10]
push dword [ebp + edi*4 - 0x3c]
call dword [ebp + 0xc]
test eax, eax
je 0x1003ab21
inc edi
cmp edi, dword [ebp + 8]
jb 0x1003ab0b
jmp 0x1003ab24
xor ebx, ebx
inc ebx
xor edi, edi
cmp dword [ebp + 8], esi
jbe 0x1003ab3b
mov eax, dword [ebp + edi*4 - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc edi
cmp edi, dword [ebp + 8]
jb 0x1003ab2b
cmp ebx, esi
jne 0x1003ab44
cmp dword [ebp - 0x14], esi
je 0x1003aae5
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 0xc
Function at 0x1003c05b
Capabilities:
Delete registry value

Disassembly:
push 0x34
mov eax, 0x1005bf0a
call fcn.10042281
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
mov edi, 0x10082f80
push edi
xor ebx, ebx
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push str.Software
push bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [ebp - 0x40]
push eax
call fcn.10018913
push ebx
mov dword [ebp - 4], ebx
call esi
lea edi, [ebp - 0x40]
mov esi, eax
call fcn.1003b9db
test eax, eax
jne 0x1003c0ca
mov esi, edi
call fcn.10002450
push dword [ebp - 0x40]
call fcn.10041033
pop ecx
xor eax, eax
call fcn.10042359
ret
lea ecx, [ebp - 0x40]
call fcn.1003bfb0
cmp dword [0x100836a4], ebx
jne 0x1003c0ef
lea esi, [ebp - 0x40]
call fcn.10002450
push dword [ebp - 0x40]
call fcn.10041033
pop ecx
mov eax, ebx
jmp 0x1003c0c4
mov eax, dword [0x100836a0]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [0x10083688]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100836a0]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10083688]
lea edi, [ebp - 0x1c]
lea esi, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
call fcn.1002c705
test al, al
jne 0x1003c13d
call fcn.10011a28
add eax, 0x1c
push eax
push 0x10083650
lea ebx, [ebp - 0x28]
call fcn.1001014f
call fcn.1001f062
jmp 0x1003c101
xor ebx, ebx
inc ebx
jmp 0x1003c0da
Function at 0x1003d26a
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x100585fe
call fcn.100422ea
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003d289
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.100025a6
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x1003d38e
jmp 0x1003d2ba
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x10063e00]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x1003d2ce
cmp al, 0xff
je 0x1003d2ba
cmp al, 0xff
je 0x1003d38e
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x10063e00]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x1003d2ee
cmp cl, 0xff
je 0x1003d2d6
cmp cl, 0xff
je 0x1003d38e
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.10009c37
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1003d38e
movsx eax, al
mov al, byte [eax + 0x10063e00]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x1003d32e
cmp al, 0xff
je 0x1003d30e
cmp al, 0xff
je 0x1003d38e
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.10009c37
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1003d38e
movsx eax, al
mov cl, byte [eax + 0x10063e00]
cmp esi, dword [ebp - 0x30]
jae 0x1003d36c
cmp cl, 0xff
je 0x1003d34e
cmp cl, 0xff
je 0x1003d38e
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.10009c37
cmp esi, dword [ebp - 0x30]
jb 0x1003d2b7
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10001fc9
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10002274
mov eax, dword [ebp - 0x38]
call fcn.1004236d
ret

Function at 0x1003d3fe
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10078060]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push edi
xor eax, eax
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x5c
lea edi, [ebp - 0x11]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1003d43b
cmp eax, 3
jne 0x1003d453
push ebx
call fcn.10032ab4
pop ecx
cmp eax, 0xffffffff
je 0x1003d460
cmp eax, 7
jne 0x1003d453
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
setne al
mov byte [esi], al
mov al, 1
jmp 0x1003d462
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10040b84
leave
ret
Function at 0x1003d66f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x1003d689
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x1003d685
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003d7a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10078060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.1003d96a
mov bl, al
mov al, dl
call fcn.1003d96a
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.1003d96a
mov bl, al
mov al, byte [esi - 4]
call fcn.1003d96a
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.1003d96a
mov bl, al
mov al, byte [esi]
call fcn.1003d96a
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.1003d96a
mov bl, al
mov al, byte [esi - 0xc]
call fcn.1003d96a
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1003d7cc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040b84
leave
ret 4
Function at 0x1003d859
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10078060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.1003d9e6
push ebx
mov dl, al
call fcn.1003d9bf
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.1003d97a
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.1003d998
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.1003d97a
push ebx
mov byte [ebp - 0x15], al
call fcn.1003d998
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.1003d9bf
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.1003d9e6
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.1003d9bf
mov bl, al
mov al, byte [edi + 4]
call fcn.1003d9e6
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.1003d998
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1003d97a
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.1003d998
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.1003d97a
xor bl, al
mov al, dl
call fcn.1003d9e6
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1003d9bf
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x1003d885
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040b84
leave
ret 4
Function at 0x1003ded6
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10058536
call fcn.100422ea
mov eax, dword [ebp + 8]
and dword [ebp - 0x34], 0
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.10001fc9
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
push 0x10
pop ebx
and eax, 0xf
mov esi, ebx
sub esi, eax
jne 0x1003df16
mov esi, ebx
test esi, esi
jle 0x1003df31
mov dword [ebp - 0x30], esi
xor ebx, ebx
push esi
inc ebx
lea edi, [ebp - 0x2c]
call fcn.10009c37
dec dword [ebp - 0x30]
jne 0x1003df1d
push 0x10
pop ebx
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x38]
push 0
call fcn.1002bb14
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], ebx
jae 0x1003df49
lea eax, [ebp - 0x28]
mov edi, esi
mov dword [ebp - 0x30], eax
cmp dword [edi + 0x18], ebx
jb 0x1003df58
mov edi, dword [edi + 4]
jmp 0x1003df5b
add edi, 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x3c]
cmp eax, ebx
jb 0x1003dfb3
shr eax, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov esi, edi
sub ecx, eax
sub esi, eax
mov dword [ebp - 0x40], ebx
mov dl, byte [ecx + eax]
xor dl, byte [eax]
mov byte [esi + eax], dl
inc eax
dec dword [ebp - 0x40]
jne 0x1003df77
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x14]
cmp dword [eax + 0x18], ebx
jb 0x1003df97
add eax, 4
mov eax, dword [eax]
jmp 0x1003df9a
add eax, 4
push 1
push eax
push edi
push edi
call fcn.1003dbbb
add dword [ebp - 0x30], ebx
mov ecx, edi
add esp, 0x10
add edi, ebx
dec dword [ebp - 0x34]
jne 0x1003df6b
mov edi, dword [ebp - 0x3c]
mov esi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 1
lea ecx, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
call fcn.10002274
mov eax, dword [ebp - 0x38]
call fcn.1004236d
ret
Function at 0x1003dfd1
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x10057a74
call fcn.100422ea
mov ebx, ecx
mov eax, dword [ebp + 8]
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x14]
mov esi, edx
mov dword [ebp - 0x34], esi
test al, 0xf
je 0x1003e006
push 0x10062dcf
mov ecx, esi
call fcn.10001fa7
jmp 0x1003e126
push 0
mov edi, eax
lea esi, [ebp - 0x2c]
call fcn.1002bb14
and dword [ebp - 4], 0
cmp dword [ebx + 0x18], 0x10
mov eax, dword [ebx + 0x14]
jb 0x1003e024
mov ebx, dword [ebx + 4]
jmp 0x1003e027
add ebx, 4
cmp dword [ebp - 0x14], 0x10
mov esi, dword [ebp - 0x28]
jae 0x1003e033
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 0xc]
cmp eax, 0x10
jb 0x1003e07e
shr eax, 4
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x3c]
cmp dword [edx + 0x18], 0x10
mov ecx, dword [edx + 0x14]
lea eax, [edx + 4]
jb 0x1003e052
mov eax, dword [eax]
push 0
push eax
push esi
push ebx
call fcn.1003dbbb
add esp, 0x10
mov ecx, edi
push 0x10
mov eax, esi
sub ecx, esi
pop edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x1003e068
mov edi, ebx
add ebx, 0x10
add esi, 0x10
dec dword [ebp - 0x38]
jne 0x1003e041
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jae 0x1003e0a7
mov ecx, dword [ebp - 0x34]
push 0x10062dcf
call fcn.10001fa7
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002274
mov eax, dword [ebp - 0x34]
jmp 0x1003e128
lea esi, [eax - 1]
cmp eax, esi
ja 0x1003e0b6
call fcn.10040b41
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x1003e0c2
lea ecx, [ebp - 0x28]
mov bl, byte [ecx + esi]
cmp bl, 0x10
ja 0x1003e086
mov byte [ebp - 0x2d], 0
test bl, bl
jbe 0x1003e106
movzx edi, bl
movzx ecx, byte [ebp - 0x2d]
mov esi, eax
sub esi, ecx
dec esi
cmp eax, esi
ja 0x1003e0ea
call fcn.10040b41
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x1003e0f6
lea ecx, [ebp - 0x28]
movsx ecx, byte [ecx + esi]
cmp ecx, edi
jne 0x1003e086
inc byte [ebp - 0x2d]
cmp byte [ebp - 0x2d], bl
jb 0x1003e0d5
mov esi, dword [ebp - 0x34]
movzx ecx, bl
sub eax, ecx
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.10001fef
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002274
mov eax, esi
call fcn.1004236d
ret

Function at 0x1003e1bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.10031cf7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
lea edi, [ebp - 0x10]
lea esi, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.1002c705
test al, al
jne 0x1003e219
call fcn.10011a28
cmp dword [eax + 0x18], 8
jb 0x1003e205
mov eax, dword [eax + 4]
jmp 0x1003e208
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 8]
call fcn.1000d749
jmp 0x1003e1da
lea eax, [ebp - 0x30]
push eax
call fcn.1000f82f
pop edi
pop esi
leave
ret