joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007db0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x20]
lea ebx, [eax - 0x2676]
mov ecx, edi
mov dword [esp + 0x20], ebx
xor ecx, 0x3227
lea edx, [eax - 0x1c2]
xor ebp, 0x1fd9
mov dword [esp + 0xc], ecx
xor edi, 0x2ec
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edx
lea eax, [ecx + 0x2e8]
cmp ebp, eax
jg 0x10007fe9
mov eax, dword [esp + 0x1c]
add eax, 0xfffffb60
cmp ebx, eax
je 0x10007fb0
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
nop word [eax + eax]
mov eax, dword [0x100a3a98]
mov edx, dword [esi + 0xe8]
mov edi, dword [eax + ebp]
add ebp, 4
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x2c]
sub eax, 0x14697206
imul eax, dword [esi + 0x6c]
mov dword [esi + 0x6c], eax
mov eax, dword [0x1008a74c]
mov eax, dword [eax + 0x94]
dec eax
add eax, edx
or dword [esi + 0xf4], eax
mov ecx, dword [0x1008a74c]
mov eax, dword [esi + 0xcc]
xor eax, edx
dec eax
xor dword [ecx + 0xdc], eax
mov ecx, dword [0x1008a74c]
mov ebx, dword [esi + 0x38]
mov eax, dword [esi + 0x94]
xor eax, dword [0x100a3b30]
dec eax
imul ebx, edi
add dword [ecx + 0xc4], eax
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x54]
mov edx, ebx
shr edx, 0x18
mov byte [ecx + eax], dl
mov ecx, ebx
inc dword [esi + 0x3c]
mov edx, dword [esi + 0x3c]
mov eax, dword [esi + 0x54]
shr ecx, 0x10
mov byte [edx + eax], cl
mov ecx, ebx
inc dword [esi + 0x3c]
mov eax, dword [0x100a3ac8]
mov edx, dword [esi + 0x3c]
xor eax, 0x18533
sub dword [esi + 0xb0], eax
mov eax, dword [0x1008a74c]
shr ecx, 8
mov eax, dword [eax + 0x54]
mov byte [edx + eax], cl
mov eax, 0x18533
inc dword [esi + 0x3c]
sub eax, dword [esi + 0x80]
mov ecx, dword [0x1008a74c]
add dword [ecx + 0x24], eax
mov ecx, dword [0x1008a74c]
mov eax, dword [ecx + 0x40]
xor eax, dword [0x100a3abc]
xor eax, 0x4de88
mov dword [ecx + 0x40], eax
mov eax, dword [0x1008a74c]
mov eax, dword [eax + 0xdc]
xor eax, 0xd7a1f
sub dword [esi + 0x14], eax
mov ecx, dword [0x100a3a84]
mov eax, dword [0x100a3a9c]
mov byte [ecx + eax], bl
inc dword [0x100a3a84]
cmp ebp, 0x345c
jl 0x10007e20
mov ebp, dword [esp + 0x2c]
lea eax, [ebp + 0x1451]
push eax
mov eax, dword [esp + 0x28]
add eax, 0x1451
push eax
push esi
mov eax, ebp
xor eax, 0x1624
push eax
lea eax, [ebp + 0x16bd]
push eax
mov eax, dword [esp + 0x34]
add eax, 0xfffff5ab
push eax
call fcn.10009190
mov edi, eax
lea ecx, [ebp + 0x1624]
mov eax, dword [esp + 0x48]
push ecx
xor eax, 0x3331
push eax
lea ecx, [eax - 0x1c1]
push ecx
lea ecx, [edi - 0x6e5]
push ecx
mov ecx, dword [esp + 0x38]
mov eax, ecx
xor eax, 0x3227
push esi
push eax
lea eax, [ecx - 0x1052]
push eax
call fcn.10018480
add esp, 0x34
xor edi, 0x728
mov eax, edi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0xc0]
or eax, dword [ecx + 0x88]
cmp dword [ecx + 0xb8], eax
jne 0x10007fe9
imul eax, edx, 0x16bd
xor eax, dword [ecx + 0x80]
or dword [0x100a3b14], eax
mov eax, dword [0x100a3ad0]
sub eax, dword [ecx + 0x60]
imul eax, dword [ecx + 0xc]
mov dword [ecx + 0xc], eax
xor edi, 0x728
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10008510
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea edx, [eax + 0x368]
push edi
mov edi, dword [esp + 0x10]
add eax, 0xfffff1ea
add edi, 0xffffe9dc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov ebp, edi
xor ecx, 0x1a1
xor ebp, 0x1ca9
add eax, 0xfffff839
mov dword [esp + 0x10], ecx
cmp eax, ebp
je 0x100085ca
push ebx
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [esi + 0x24]
sub eax, dword [0x100a3b30]
sub eax, 0x14756573
xor dword [esi + 0x14], eax
mov eax, dword [esi + 0x4c]
xor eax, dword [esi + 0xb0]
xor eax, 0xbe7cf
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + ebx]
mov eax, dword [0x1008a74c]
xor ecx, dword [eax + 0x44]
mov eax, dword [eax + 0x68]
mov dword [ebx + eax], ecx
add ebx, 4
mov eax, dword [0x1008a74c]
mov eax, dword [eax + 0x8c]
add eax, dword [0x100a3a5c]
xor eax, 0xe29c7de8
sub dword [esi + 0x4c], eax
mov eax, dword [0x100a3acc]
add dword [0x100a3a8c], eax
cmp ebx, 0x2e7a0
jl 0x10008560
mov ecx, dword [esp + 0x14]
pop ebx
mov eax, dword [esp + 0x24]
add eax, 0x55d
cmp dword [esp + 0x14], eax
jge 0x10008641
mov eax, dword [0x1008a74c]
mov edi, ebp
mov ecx, dword [0x100a3ab0]
mov dword [eax + 0x48], ecx
cmp dword [esi + 0xc0], 0xca6f
mov eax, dword [0x1008a74c]
jae 0x10008614
mov eax, dword [eax + 0x6c]
sub eax, dword [esi + 0x4c]
xor eax, 0x2493a
xor edi, 0x728
mov dword [esi + 0x74], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, dword [eax + 0x54]
add eax, dword [esi + 0xe0]
push eax
push dword [esi + 0xbc]
mov eax, dword [esi + 0x48]
push dword [0x100a3b38]
call eax
xor edi, 0x728
mov dword [esi + 0x9c], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, edx
sub edx, dword [0x100a3a74]
xor eax, 0x1785
or edx, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor edi, 0x728
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x10008a50
Capabilities:
Create pipe

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x28]
lea edx, [eax + 0x566]
push esi
mov esi, dword [esp + 0x20]
lea ecx, [ebx - 0xe16]
xor ebx, 0x214c
mov dword [esp + 0xc], ecx
push edi
lea edi, [eax - 0x1f4e]
mov ecx, ebx
mov eax, dword [esp + 0x1c]
xor esi, 0xa1d
add eax, 0x139a
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], eax
lea eax, [ecx + 0x1b81]
mov dword [esp + 0x24], eax
cmp edi, eax
je 0x10008aec
lea eax, [ebx + 0x1624]
cmp edi, eax
jg 0x10008aec
mov eax, dword [esp + 0x10]
lea ecx, [eax + 0x387]
xor eax, 0x8b7
push eax
push dword [esp + 0x28]
push ebp
push ecx
push ecx
push edx
call fcn.10017c10
xor dword [esp + 0x30], 0x3a68
add esp, 0x18
mov ecx, dword [esp + 0x20]
xor esi, 0x84f
mov edx, eax
xor ebx, 0x1785
add ecx, 0x1f4e
cmp edi, ecx
jg 0x10008bf1
lea eax, [esi + 0xbd3]
cmp edi, eax
je 0x10008b3d
lea eax, [edi + 0x1ca9]
push eax
lea eax, [esi - 0xa55]
push eax
lea eax, [edx - 0x44f]
xor eax, 0x327a
push eax
mov eax, dword [esp + 0x2c]
add eax, 0x18eb
push eax
push ebp
call sym.snj235nk4.dll_KgOUPf10A
add esp, 0x14
lea eax, [esi - 0x7c7]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
imul eax, edx
cmp edx, eax
jle 0x10008bf1
test esi, esi
jne 0x10008bf1
imul eax, dword [ebp + 0x10], 0x1451
push eax
mov eax, dword [0x100a3b08]
and eax, dword [esp + 0x24]
xor eax, ebx
push eax
mov eax, dword [0x1008a74c]
mov eax, dword [eax + 0x40]
add eax, 0x16bd
push eax
mov eax, dword [ebp + 0xa8]
xor eax, 0x1b81
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov eax, dword [ebp + 0x88]
mov ecx, dword [0x100a3b20]
and eax, 0x1624
mov edx, dword [ebp + 0xdc]
push eax
mov eax, dword [0x100a3a64]
or edx, 0x1d8b
sub edx, dword [ebp + 0xac]
imul eax, edi
or eax, dword [ebp + 0x8c]
push eax
mov eax, dword [ebp + 0xc8]
and eax, ecx
and eax, dword [0x100a3b3c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push 0xffffd98a
add eax, 0x2676
push eax
lea eax, [ecx + 0x1b81]
push eax
imul eax, dword [esp + 0x34], 0x1f4e
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
pop edi
lea eax, [esi - 0x7c7]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10009190
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0xc]
add eax, 0x92a
xor eax, 0x3e02
lea ecx, [edi - 0x1336]
xor edi, 0x8b7
mov edx, ecx
xor edx, 0x1f4e
cmp edi, eax
mov eax, dword [esp + 0x20]
cmovg edx, ecx
mov ecx, dword [esp + 0x10]
xor ecx, 0x16bd
xor eax, 0x1451
add ecx, 0x1d8b
cmp eax, ecx
je 0x10009350
mov eax, dword [esp + 0x18]
cmp dword [eax + 0xdc], 0x12e21
jbe 0x100091ff
mov ecx, dword [0x100a3a88]
add ecx, 0x38e38e38
mov dword [eax + 0x38], ecx
jmp 0x10009209
or dword [eax + 0xf4], 0x2514d
cmp dword [eax + 0x58], 0xa4d7
ja 0x1000921e
mov dword [0x100a3a98], 0x10027770
jmp 0x1000922d
mov ecx, dword [eax + 0x74]
xor ecx, 0x771a
add dword [0x100a3a6c], ecx
push ebx
push ebp
xor ebp, ebp
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [eax + 0x24]
xor ecx, 0x14756572
imul ecx, dword [eax + 0xd4]
mov dword [eax + 0xd4], ecx
mov edx, dword [0x1008a74c]
mov ecx, dword [edx + 0x50]
mov esi, dword [ecx + ebp]
add ebp, 4
mov ecx, dword [edx + 0x74]
sub ecx, 0x4de87
imul ecx, dword [eax + 0x2c]
mov dword [eax + 0x2c], ecx
mov edx, dword [0x1008a74c]
mov ecx, dword [edx + 0x38]
mov edx, dword [edx + 0x54]
imul ecx, esi
mov dword [esp + 0x14], ecx
mov ebx, ecx
mov ecx, dword [eax + 0x3c]
shr ebx, 0x10
mov byte [edx + ecx], bl
inc dword [eax + 0x3c]
mov ecx, dword [0x1008a74c]
mov ebx, dword [esp + 0x14]
shr ebx, 8
mov edx, dword [ecx + 0x3c]
mov ecx, dword [eax + 0x54]
mov byte [edx + ecx], bl
mov ecx, dword [0x1008a74c]
mov ebx, dword [esp + 0x14]
inc dword [ecx + 0x3c]
mov ecx, dword [eax + 0x80]
sub ecx, 0x18533
or dword [0x100a3a6c], ecx
mov ecx, dword [eax + 0xdc]
mov edx, dword [eax + 0xf4]
xor ecx, 0xd7a1f
sub dword [eax + 0xc4], ecx
mov ecx, dword [eax + 0x58]
xor ecx, dword [0x100a3ac8]
sub ecx, 0x18533
add dword [eax + 0x40], ecx
mov ecx, dword [0x1008a74c]
sub edx, dword [ecx + 0x24]
add edx, 0x14756573
or dword [eax + 0x58], edx
mov ecx, dword [0x1008a74c]
mov edx, dword [ecx + 0x3c]
mov ecx, dword [eax + 0x54]
mov byte [edx + ecx], bl
mov ecx, dword [0x1008a74c]
inc dword [ecx + 0x3c]
mov ecx, dword [0x100a3a54]
add ecx, 0xffeac518
add ecx, dword [eax + 0xcc]
add dword [eax + 0x80], ecx
cmp ebp, 0x1bf0
jl 0x10009240
pop ebp
xor edi, 0x728
pop ebx
mov eax, edi
pop edi
pop esi
ret
mov esi, dword [esp + 0x18]
mov eax, dword [0x1008a74c]
mov ecx, dword [esi + 0xdc]
or ecx, 0x1624
sub ecx, edx
cmp dword [eax + 0x6c], ecx
jne 0x100093a0
push 0x1cc4
push 0x1d84
push 0x34f1
call fcn.10018940
mov ecx, dword [0x1008a74c]
add esp, 0xc
mov dword [0x100ad2b4], eax
mov ecx, dword [ecx + 0xf4]
xor ecx, 0x1451
or dword [esi + 0xc4], ecx
xor edi, 0x728
mov eax, edi
pop edi
pop esi
ret
Function at 0x10009520
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
add ecx, 0xfffffaa3
mov dword [esp + 0x24], ecx
lea ebx, [edi - 0x161]
xor edi, 0x3edb
mov eax, edi
mov ebp, edi
xor eax, 0x35f7
cmp ecx, eax
jge 0x100095f3
mov esi, dword [esp + 0x18]
add ebx, 0x133a
mov eax, dword [esi + 0x4c]
add eax, 0x3b832
mov dword [0x100a3b28], eax
mov eax, dword [esi + 0xf4]
cmp eax, dword [0x100a3ad4]
ja 0x1000958e
mov ecx, dword [0x1008a74c]
mov eax, dword [ecx + 0x58]
add eax, 0x38529
xor dword [ecx + 0xe0], eax
jmp 0x1000959c
mov eax, 0x43d6
sub eax, dword [esi + 0xe8]
add dword [esi + 0x4c], eax
lea eax, [edi - 0x985]
xor ebp, 0x3610
push eax
push ebp
lea eax, [ebx - 0x1628]
xor ebx, 0x3610
push eax
lea eax, [edi - 0x12a1]
mov edi, dword [esp + 0x28]
push eax
push esi
push edi
push ebx
call fcn.1001aae0
mov eax, dword [0x100a3a6c]
add esp, 0x1c
cmp eax, dword [esi + 0x8c]
je 0x100095e8
mov eax, dword [esi + 0xcc]
sub eax, 0x33333334
mov dword [esi + 0x38], eax
lea eax, [edi - 0x330]
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [0x1008a74c]
mov edx, dword [eax + 0x2c]
mov eax, dword [ecx + 0x74]
or eax, edi
mov dword [esp + 0x14], edx
add eax, 0x1451
cmp edx, eax
jb 0x100096ae
nop word [eax + eax]
mov ecx, dword [esp + 0x18]
sub ebp, dword [esp + 0x24]
mov eax, dword [ecx + 0xe8]
mov ecx, dword [ecx + 0x14]
imul eax, edi
sub eax, dword [0x100a3a5c]
xor ebx, eax
mov eax, dword [0x1008a74c]
mov esi, dword [eax + 0xf4]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x18]
or edx, ebx
imul esi, dword [0x100a3ad4]
add ecx, dword [eax + 0xc4]
or ecx, dword [eax + 0x10]
mov eax, dword [0x1008a74c]
mov eax, dword [eax + 0x8c]
add eax, 0x18eb
or eax, dword [0x100a3b1c]
push eax
push ecx
push 0x100a3a48
push ebp
push edx
push esi
call fcn.10017c10
mov ecx, dword [0x1008a74c]
mov ebp, eax
mov eax, dword [esp + 0x2c]
add esp, 0x18
add eax, 2
mov dword [esp + 0x14], eax
mov ecx, dword [ecx + 0x74]
or ecx, edi
add ecx, 0x1451
cmp eax, ecx
jae 0x10009620
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
add eax, 0xfffffcd0
pop ebx
ret
Function at 0x10017d50
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
add ecx, 0x22e
mov eax, dword [esp + 0xc]
xor ecx, 0xd2f
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea ebp, [edx - 0x15c4]
push edi
mov edi, dword [esp + 0x18]
add eax, 0x10b2
add edi, 0xd8b
cmp eax, ecx
jle 0x10017d97
mov eax, dword [0x1008a74c]
mov dword [eax + 0x50], 0x1008a750
jmp 0x10017df4
mov eax, dword [esi + 0xc4]
mov ebx, edi
or eax, ebp
cmp edi, eax
jb 0x10017df4
mov eax, ebp
and eax, edi
and eax, 0x2676
mov dword [esp + 0x18], eax
mov eax, dword [0x1008a74c]
mov edx, dword [esi + 0x88]
mov ecx, dword [esi + 0x6c]
sub edx, 0x1624
or edx, dword [esi + 0x8c]
sub ecx, edi
mov eax, dword [eax + 0x6c]
xor eax, edi
push eax
push esi
push dword [esp + 0x20]
push ecx
push edx
call fcn.10017d50
mov edx, eax
add ebx, 4
mov eax, dword [esi + 0xc4]
add esp, 0x14
or eax, ebp
cmp ebx, eax
jae 0x10017db2
lea eax, [edx + 0x10b2]
cmp edi, eax
jne 0x10017f28
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [esi + 0xd4]
inc eax
imul eax, dword [esi + 0x94]
mov dword [esi + 0x94], eax
mov edx, dword [0x1008a74c]
mov eax, dword [edx + 0x50]
mov ecx, dword [edi + eax]
add edi, 4
mov eax, dword [edx + 0xc4]
add eax, dword [esi + 0xe8]
xor eax, 0x1835dd
sub dword [0x100a3adc], eax
mov eax, 1
mov ebx, dword [edx + 0x38]
imul ebx, ecx
mov ecx, dword [edx + 0xd4]
xor ecx, dword [0x100a3b14]
sub eax, ecx
add dword [esi + 0xcc], eax
mov ecx, dword [0x1008a74c]
mov eax, dword [esi + 0x80]
add eax, dword [0x100a3a74]
xor eax, 0xd789f
add dword [ecx + 0xc0], eax
mov eax, dword [0x1008a74c]
mov ecx, dword [eax + 0x54]
mov eax, dword [esi + 0x3c]
mov byte [ecx + eax], bl
mov eax, 0xd7a1f
inc dword [esi + 0x3c]
sub eax, dword [0x100a3b24]
add dword [esi + 0x24], eax
mov eax, 0x11fd5c
mov ecx, dword [esi + 0x74]
xor ecx, dword [esi + 0x6c]
sub eax, ecx
add dword [esi + 0x4c], eax
mov eax, dword [esi + 0x2c]
sub eax, 0xbf36c
add dword [esi + 0x58], eax
mov eax, dword [0x100a3abc]
sub eax, dword [esi + 0x14]
add eax, 0x196411
imul eax, dword [0x100a3b3c]
mov dword [0x100a3b3c], eax
mov eax, dword [0x100a3ad4]
add eax, 0x1d6c89c9
add eax, dword [esi + 0xc]
add dword [esi + 0x8c], eax
mov eax, dword [esi + 0x6c]
xor eax, dword [esi + 0x24]
xor eax, 0x146046a6
imul eax, dword [esi + 0x8c]
mov dword [esi + 0x8c], eax
mov eax, dword [esi + 0x58]
xor eax, dword [esi + 0x40]
xor eax, 1
mov dword [esi + 0x58], eax
mov ecx, dword [0x100a3b1c]
add dword [esi + 0x80], ecx
cmp edi, 0x23a0
jl 0x10017e10
pop edi
xor ebp, 0x1ca9
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x10019ec0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov ecx, dword [0x100ad2e4]
dec ecx
mov dword [0x100ad2e4], ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [0x100ad2dc]
inc esi
mov ebx, dword [0x100ad2c0]
mov dword [0x100ad2dc], esi
push edi
mov edi, dword [0x100ad304]
lea eax, [edi + esi]
or esi, dword [0x100ad2f4]
mov dword [esp + 0x14], eax
inc edi
mov dword [0x100ad304], edi
lea eax, [ecx + ecx*2]
movzx eax, word [ebp + eax*2]
mov dword [esp + 0x18], eax
movzx eax, word [ebp]
movzx edx, word [ebp + eax*2]
movzx ebp, word [ebp + ecx*8]
mov eax, dword [0x100ad2f0]
mov ecx, dword [esp + 0x28]
sub ebp, dword [ecx + eax*4]
mov ecx, dword [ecx]
mov eax, dword [0x100ad2ec]
mov dword [esp + 0x28], ebp
mov ebp, dword [eax + ecx*4 + 0x64]
mov ecx, dword [esp + 0x24]
movzx eax, si
mov dword [esp + 0x10], eax
mov eax, dword [0x100ad308]
inc eax
mov dword [0x100ad308], eax
sub al, byte [edi + ecx]
add al, dl
mov byte [edi + ecx], al
movzx eax, byte [ecx]
mov edi, dword [esp + 0x14]
lea ecx, [edi + eax*4]
movzx eax, word [0x100ad2d0]
lea eax, [eax + eax*2]
movzx eax, word [ebx + eax*2 + 0x8ac]
cdq
idiv dword [ecx]
mov ebx, dword [esp + 0x20]
mov dword [ecx], eax
mov eax, 0x1a61
inc word [0x100ad2d0]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
lea eax, [eax + eax*2]
lea esi, [ebx + eax*2]
movzx eax, word [ebx]
movzx eax, byte [eax + ecx]
mov ecx, dword [esp + 0x28]
xor eax, dword [0x100ad304]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x24]
lea ecx, [ecx + edx*2]
movzx ecx, byte [edx + ecx]
xor edx, edx
sub eax, ecx
mov ecx, 0xf3
div ecx
mov eax, dword [esp + 0x28]
and word [esi], dx
mov esi, dword [esp + 0x18]
mov edx, dword [eax]
mov eax, dword [0x100ad2dc]
movzx ecx, word [ebx + edx*2 + 0x4a]
movzx eax, byte [eax + esi + 8]
sub ecx, eax
or ecx, 0x1939
mov dword [ebp + edx*4], ecx
mov eax, dword [edi]
mov edx, dword [eax*4 + 0x1a61]
cmp edx, 0x15a6
jg 0x1001a075
mov ebp, dword [esp + 0x24]
lea eax, [edx + edx*2]
mov ebx, dword [esp + 0x28]
add ebp, edx
shl eax, 2
add ebx, 0xc
lea ebx, [ebx + edx*4]
nop dword [eax]
movzx ecx, byte [ebp]
lea ebx, [ebx + 4]
mov edx, dword [0x100ad2dc]
lea ebp, [ebp + 1]
sub edx, ecx
mov ecx, dword [esp + 0x20]
imul edx, dword [ebx - 4]
add dword [esp + 0x20], 2
mov dword [ebx - 4], edx
inc dword [0x100ad2dc]
movzx edx, word [ecx]
mov ecx, dword [esp + 0x10]
movzx esi, word [0x100ad2d4]
mov edi, dword [0x100ad2ec]
add dword [esp + 0x10], 0xffff
movzx ecx, cx
xor esi, ecx
mov ecx, dword [esp + 0x28]
xor esi, dword [ecx + edx*4 + 0x7c]
xor esi, dword [0x100ad2cc]
and dword [edi + eax + 0xc], esi
add eax, 0xc
cmp eax, 0x103c8
jle 0x1001a010
mov ecx, dword [esp + 0x24]
mov eax, dword [0x100ad2dc]
pop edi
pop esi
pop ebp
movzx eax, byte [eax + ecx]
pop ebx
add esp, 0xc
ret
Function at 0x1001a090
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x14]
add ecx, 0xffffe47f
lea edx, [eax - 0x1f4e]
mov dword [esp + 4], ecx
push ebp
mov ebp, dword [esp + 0x1c]
add eax, 0xfffff837
add ebp, 0xfffff42d
mov dword [esp + 0x18], eax
lea eax, [ecx + 0x24b4]
mov dword [esp + 0x1c], ebp
add ebx, 0xffffee82
mov dword [esp + 0xc], edx
push esi
mov esi, dword [esp + 0x18]
cmp ebp, eax
je 0x1001a0f9
mov eax, dword [0x1008a74c]
mov ecx, dword [eax + 0x74]
sub ecx, dword [eax + 0x6c]
xor ecx, 0xea61c918
mov dword [esi], ecx
jmp 0x1001a1aa
mov eax, dword [esi + 0x5c]
mov ebp, dword [0x100a3adc]
or eax, edx
or eax, 0x15c4
mov dword [esp + 0x2c], ebp
cmp ebp, eax
jb 0x1001a1aa
mov eax, dword [0x100a3ad4]
imul eax, ebx
push edi
nop
mov edi, dword [esi + 0xc0]
cmp edi, eax
jbe 0x1001a18f
lea ebp, [edx - 0x1336]
mov edx, dword [esp + 0x20]
and edx, dword [esp + 0x24]
add edx, ebx
mov dword [esp + 0x28], edx
nop
mov ecx, dword [0x1008a74c]
imul eax, dword [ecx + 0xdc], 0x1f4e
push eax
mov eax, dword [ecx + 0x2c]
and eax, dword [esi + 0x8c]
push ebp
push eax
mov eax, dword [esi + 0xa4]
xor eax, dword [esp + 0x1c]
imul eax, eax, 0x214c
push eax
push edx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov eax, dword [0x100a3ad4]
add edi, 2
mov edx, dword [esp + 0x28]
imul eax, ebx
cmp edi, eax
ja 0x1001a140
mov ebp, dword [esp + 0x30]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x5c]
add ebp, 2
or ecx, edx
mov dword [esp + 0x30], ebp
or ecx, 0x15c4
cmp ebp, ecx
jae 0x1001a120
pop edi
lea eax, [ebx + 0x11b]
cmp edx, eax
jge 0x1001a1d8
cmp dword [esi + 0x6c], 0x8f9
jbe 0x1001a1d8
mov edx, dword [esi + 0xa4]
add edx, dword [0x100a3a54]
mov ecx, dword [0x1008a74c]
xor edx, 0x32f9eb5f
mov dword [ecx + 4], edx
pop esi
xor ebx, 0x767
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x1001a330
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, eax
push ebx
push ebp
mov ebp, dword [esp + 0x20]
xor edx, 0x1451
lea ebx, [eax - 0x1451]
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [ebp - 0x18eb]
xor eax, 0x18eb
xor edi, 0x3fe3
cmp ebx, eax
je 0x1001a48e
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [0x100a3a98], 0x10029610
nop word [eax + eax]
mov ecx, dword [0x1008a74c]
mov edx, dword [ecx + 0xc0]
mov ecx, dword [eax + 0x94]
add edx, 0xffe6de84
add ecx, edx
add dword [eax + 0x80], ecx
mov ecx, dword [0x100a3b08]
add ecx, 0xffeac519
add ecx, dword [eax + 0xc]
mov dword [0x100a3b08], ecx
mov ecx, dword [eax + 0x50]
mov edx, dword [esi + ecx]
add esi, 4
mov ecx, dword [eax + 0xa4]
sub ecx, dword [0x100a3a6c]
xor ecx, 0xeb8a9a8d
sub dword [eax + 0xd4], ecx
mov ecx, 0x1523d4
sub ecx, dword [eax + 0x6c]
mov ebx, dword [eax + 0x38]
imul ebx, edx
mov edx, dword [0x1008a74c]
add dword [edx + 0x94], ecx
mov ecx, dword [0x1008a74c]
mov edx, dword [ecx + 0xc4]
add edx, dword [ecx + 0x14]
xor edx, 0x367874
imul edx, dword [eax + 0x8c]
mov dword [eax + 0x8c], edx
mov edx, dword [eax + 0x3c]
mov ecx, dword [eax + 0x54]
mov byte [edx + ecx], bl
mov ecx, 0xe27e3b50
inc dword [eax + 0x3c]
sub ecx, dword [0x100a3ad4]
add dword [eax + 0xdc], ecx
mov ecx, dword [0x100a3b24]
add ecx, 0xfff285e1
xor dword [eax + 0xb0], ecx
mov ecx, dword [eax + 0x24]
xor ecx, 0x14756572
imul ecx, dword [eax + 0x80]
mov dword [eax + 0x80], ecx
mov ecx, dword [0x1008a74c]
mov edx, dword [ecx + 0x80]
mov ecx, dword [eax + 0x8c]
add ecx, 0x1d803f7d
add ecx, edx
add dword [eax + 0xa4], ecx
cmp esi, 0x3bd60
jl 0x1001a380
pop edi
pop esi
lea eax, [ebp + 0x3be]
pop ebp
pop ebx
ret
mov ecx, dword [0x100a3a54]
mov eax, dword [esp + 0x20]
sub ecx, edx
add eax, 0xffffe47f
add eax, ecx
mov ecx, dword [0x1008a74c]
cmp dword [ecx + 0x94], eax
ja 0x1001a4ea
mov eax, dword [ecx + 0xe8]
mov ecx, dword [esp + 0x18]
xor eax, ebx
cmp dword [ecx + 0xd4], eax
jb 0x1001a4ea
mov eax, dword [ecx + 0x14]
or eax, edi
add eax, 0x1624
push eax
mov eax, dword [0x100a3b2c]
xor eax, 0x1785
push eax
mov eax, dword [0x100a3b08]
add eax, 0xffffe715
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
pop edi
pop esi
lea eax, [ebp - 0x152d]
pop ebp
pop ebx
ret