joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10062150
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
mov ebp, dword [esp + 0x22c]
push esi
mov esi, ecx
lea ecx, [esp + 0x118]
push 0x6b39dac7
call fcn.100625a0
mov esi, dword [esi + 4]
mov eax, 0x100
cmp word [esi], ax
jne 0x10062340
cmp word [esi + 2], 0
jne 0x10062340
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100621ac
cmp eax, 1
jne 0x10062340
push ebx
lea edx, [esi + 4]
mov ebx, 0xc
push edi
mov ecx, edx
mov edi, 0x10008a48
lea ecx, [ecx]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x100621d8
add ecx, 4
add edi, 4
sub ebx, 4
jae 0x100621c0
mov ebx, 2
jmp 0x100621fc
mov ecx, 0x10008a38
mov edi, 0xc
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x10062337
add edx, 4
add ecx, 4
sub edi, 4
jae 0x100621e2
mov ebx, 4
cmp dword [esi + 0x14], 0
jne 0x1006221e
push 1
push 0
push 0
push 0xffffdd9f
push 0xfffffc05
mov ecx, ebp
call fcn.100628d0
jmp 0x1006231a
lea eax, [esi + 0x18]
push 0x80
push eax
lea ecx, [esp + 0x128]
mov dword [esp + 0x18], eax
call fcn.10062610
cmp dword [esi + 0x6a], 0x38e
jbe 0x10062261
movsd xmm0, qword [esi + 0x72]
ucomisd xmm0, qword [0x10008c80]
lahf
test ah, 0x44
jp 0x10062261
push 1
push 0xfffffbfc
mov ecx, ebp
call fcn.10062940
test byte [ebp], 8
jne 0x10062283
cvttsd2si edi, qword [esi + 0x72]
lea ecx, [esi + 0x42]
mov edx, 4
sub edx, ecx
xor dword [ecx], edi
lea ecx, [ecx + 4]
lea eax, [edx + ecx]
cmp eax, 0x28
jle 0x10062276
mov eax, dword [ebp]
and eax, 8
mov dword [esp + 0x14], eax
jne 0x100622c8
cmp word [esi + 0x42], 0
lea ecx, [esi + 0x42]
je 0x100622c8
cmp dword [esp + 0x234], 2
je 0x100622c8
mov edx, dword [esp + 0x230]
test edx, edx
je 0x100622ec
mov edi, 0x24
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100622ec
add ecx, 4
add edx, 4
sub edi, 4
jae 0x100622b3
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x100622e8
cmp dword [esi + 0x3e], eax
je 0x100622e8
cmp ebx, 4
mov eax, 3
push 0x4b8
mov ecx, ebp
cmovne ebx, eax
call fcn.100629a0
mov eax, ebx
jmp 0x1006231c
push 0x6b39dac7
lea ecx, [esp + 0x1c]
call fcn.100625a0
push 0x80
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.10062610
push 1
push 0xfffff88f
mov ecx, ebp
call fcn.10062940
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x220]
pop esi
pop ebp
xor ecx, esp
call fcn.1011705d
add esp, 0x21c
ret 0xc
push 1
push 0xfffffbfc
jmp 0x10062313
cmp word [esi + 0x40e], 0
je 0x10062367
push 0x39c76bda
lea ecx, [esp + 0x14]
call fcn.100625a0
push 0x800
push esi
lea ecx, [esp + 0x18]
call fcn.10062610
cmp word [esi], 1
jne 0x10062394
cmp dword [esi + 0x406], 0x68636952
jne 0x10062394
push 1
push 0
push 0
push 0xffffdda0
push 0xfffffc05
mov ecx, ebp
call fcn.100628d0
xor eax, eax
jmp 0x1006231e
push 1
push 0xfffffbfc
mov ecx, ebp
call fcn.10062940
xor eax, eax
jmp 0x1006231e
Function at 0x10062610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x10062663
lea esi, [ecx + 6]
mov edi, dword [ebp + 8]
xor ebx, ebx
xor edx, edx
mov bl, byte [ecx + 4]
mov dl, byte [ecx + 5]
inc bl
push ebp
xor eax, eax
mov ebp, dword [ebp + 0xc]
mov cl, byte [esi + ebx]
add dl, cl
mov ch, byte [edi]
inc edi
mov al, byte [esi + edx]
mov byte [esi + edx], cl
mov byte [esi + ebx], al
add al, cl
inc bl
xor ch, byte [esi + eax]
dec ebp
mov byte [edi - 1], ch
mov cl, byte [esi + ebx]
jne 0x1006263b
pop ebp
mov ecx, dword [ebp - 4]
mov byte [ecx + 4], dh
mov byte [ecx + 5], dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006a8b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, ecx
test byte [edi + 0x14], 0x80
jne 0x1006a96f
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x30], 0
push eax
push ebx
push dword [esp + 0x48]
mov dword [esp + 0x40], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006a955
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
mov ecx, 0x10137ca8
call fcn.100827f0
mov eax, dword [esp + 0xc]
test al, 1
jne 0x1006a92f
cmp dword [esp + 0x10], 0xfffffc15
jne 0x1006a92f
or dword [edi + 0x14], 0x80
jmp 0x1006a943
test al, 8
je 0x1006a943
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.100626f0
mov eax, dword [esp + 0xc]
test eax, 0xfffffffe
je 0x1006a969
lea ecx, [esp + 0xc]
call fcn.100627c0
jmp 0x1006a969
cmp dword [esp + 0x44], ebx
je 0x1006a969
push 1
push 0xfffffc06
mov ecx, esi
call fcn.10062940
test byte [edi + 0x14], 0x80
je 0x1006a9dd
push ebp
lea ebp, [edi + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push dword [esp + 0x44]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1006a99c
push esi
mov ecx, 0x10137ca8
call fcn.100827f0
jmp 0x1006a9d5
push 0
lea eax, [esp + 0x4c]
push eax
push ebx
push dword [esp + 0x4c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006a9c1
push esi
mov ecx, 0x10137ca8
call fcn.100827f0
jmp 0x1006a9d5
cmp dword [esp + 0x48], ebx
je 0x1006a9d5
push 1
push 0xfffffc06
mov ecx, esi
call fcn.10062940
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
inc dword [0x10137d18]
test byte [esi], 8
je 0x1006a9f2
push 0
push esi
mov ecx, edi
call fcn.1006ab90
pop edi
pop esi
pop ebx
add esp, 0x28
ret 0x10
Function at 0x1006aca0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, ecx
test byte [edi + 0x14], 0x80
jne 0x1006ad5f
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x30], 0
push eax
push ebx
push dword [esp + 0x48]
mov dword [esp + 0x40], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1006ad45
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
mov ecx, 0x10137ca8
call fcn.100827f0
mov eax, dword [esp + 0xc]
test al, 1
jne 0x1006ad1f
cmp dword [esp + 0x10], 0xfffffc15
jne 0x1006ad1f
or dword [edi + 0x14], 0x80
jmp 0x1006ad33
test al, 8
je 0x1006ad33
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.100626f0
mov eax, dword [esp + 0xc]
test eax, 0xfffffffe
je 0x1006ad59
lea ecx, [esp + 0xc]
call fcn.100627c0
jmp 0x1006ad59
cmp dword [esp + 0x44], ebx
je 0x1006ad59
push 1
push 0xfffff8f0
mov ecx, esi
call fcn.10062940
test byte [edi + 0x14], 0x80
je 0x1006adcd
push ebp
lea ebp, [edi + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push dword [esp + 0x44]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1006ad8c
push esi
mov ecx, 0x10137ca8
call fcn.100827f0
jmp 0x1006adc5
push 0
lea eax, [esp + 0x4c]
push eax
push ebx
push dword [esp + 0x4c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1006adb1
push esi
mov ecx, 0x10137ca8
call fcn.100827f0
jmp 0x1006adc5
cmp dword [esp + 0x48], ebx
je 0x1006adc5
push 1
push 0xfffff8f0
mov ecx, esi
call fcn.10062940
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
inc dword [0x10137d1c]
test byte [esi], 8
je 0x1006ade2
push 0
push esi
mov ecx, edi
call fcn.1006ab90
pop edi
pop esi
pop ebx
add esp, 0x28
ret 0x10
Function at 0x10072130
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, ecx
lea eax, [edx + 7]
mov dword [esp + 8], ebp
shr eax, 3
push esi
mov ecx, dword [ebp]
push edi
mov edi, dword [esp + 0x28]
lea ebx, [eax*8 + 1]
add ebx, eax
mov dword [esp + 0x14], ebx
lea eax, [ecx + ebx]
cmp eax, dword [ebp + 0xc]
ja 0x1007216a
mov esi, dword [ebp + 4]
add esi, ecx
jmp 0x10072179
push edi
push ebx
mov ecx, ebp
call fcn.10072f10
mov edx, dword [esp + 0x24]
mov esi, eax
test byte [edi], 8
jne 0x100722b9
cmp dword [esp + 0x1c], 0
jne 0x10072191
mov byte [esi], 0x7f
inc esi
xor bl, bl
jmp 0x10072198
mov byte [esi], 0x80
inc esi
or bl, 0xff
mov ecx, dword [esp + 0x20]
movsx eax, bl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
cmp edx, 8
jbe 0x1007221a
lea edi, [edx - 9]
shr edi, 3
inc edi
lea esp, [esp]
movzx eax, byte [ecx]
sub edx, 8
xor al, bl
mov byte [esi], al
movzx eax, byte [ecx + 1]
xor al, bl
mov byte [esi + 1], al
movzx eax, byte [ecx + 2]
xor al, bl
mov byte [esi + 2], al
movzx eax, byte [ecx + 3]
xor al, bl
mov byte [esi + 3], al
movzx eax, byte [ecx + 4]
xor al, bl
mov byte [esi + 4], al
movzx eax, byte [ecx + 5]
xor al, bl
mov byte [esi + 5], al
movzx eax, byte [ecx + 6]
xor al, bl
mov byte [esi + 6], al
movzx eax, byte [ecx + 7]
add ecx, 8
xor al, bl
mov byte [esi + 7], al
mov byte [esi + 8], 9
add esi, 9
dec edi
jne 0x100721c0
mov dword [esp + 0x24], edx
test edx, edx
je 0x100722b2
xor ebp, ebp
test edx, edx
je 0x1007228c
cmp edx, 0x20
jb 0x10072277
lea eax, [ecx - 1]
lea edi, [esi - 1]
add eax, edx
add edi, edx
cmp esi, eax
ja 0x1007223f
cmp edi, ecx
jae 0x10072277
mov eax, edx
mov edi, edx
and eax, 0x1f
sub edi, eax
jmp 0x10072250
movdqu xmm0, xmmword [ecx]
add ebp, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi + 0x10], xmm0
add esi, 0x20
cmp ebp, edi
jb 0x10072250
cmp ebp, edx
jae 0x1007228c
mov edi, edx
sub ecx, esi
sub edi, ebp
mov al, byte [ecx + esi]
xor al, bl
mov byte [esi], al
inc esi
dec edi
jne 0x10072281
mov eax, 8
sub eax, edx
push eax
movzx eax, bl
push eax
push esi
call fcn.101172b0
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov ebp, dword [esp + 0x10]
mov al, cl
xor al, bl
sub esi, ecx
mov byte [esi + 8], al
mov eax, dword [esp + 0x14]
add dword [ebp], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x10072870
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, ecx
push edi
lea eax, [ebp + 8]
xor edi, edi
cmp eax, dword [esi]
jae 0x100728a1
mov eax, dword [esi + 4]
movzx eax, byte [eax + ebp]
sub eax, ebx
je 0x100728a1
sub eax, 0x80
je 0x10072992
sub eax, 0x7f
jne 0x100728af
mov ecx, dword [esp + 0x24]
push 0x3ec
call fcn.100629a0
mov eax, dword [esp + 0x24]
test byte [eax], 4
jne 0x100729ac
lea ecx, [ebp + 1]
mov ebp, 8
add ecx, dword [esi + 4]
neg ebx
mov esi, dword [esp + 0x1c]
sbb bl, bl
movsx eax, bl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movzx eax, bl
pshufd xmm1, xmm0, 0
mov dword [esp + 0x10], eax
lea ebx, [ebx]
movzx edx, byte [ecx + 8]
xor edx, eax
cmp edx, 8
cmova edx, ebp
lea ebp, [edx + edi]
mov dword [esp + 0x18], ebp
cmp ebp, dword [esp + 0x20]
ja 0x1007299c
xor edi, edi
test edx, edx
je 0x1007296f
cmp edx, 0x20
jb 0x1007295e
lea eax, [ecx - 1]
lea ebp, [esi - 1]
add eax, edx
add ebp, edx
cmp esi, eax
ja 0x1007292a
cmp ebp, ecx
jae 0x1007295a
mov eax, edx
mov ebp, edx
and eax, 0x1f
sub ebp, eax
movdqu xmm0, xmmword [ecx]
add edi, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi + 0x10], xmm0
add esi, 0x20
cmp edi, ebp
jb 0x10072933
mov ebp, dword [esp + 0x18]
cmp edi, edx
jae 0x1007296f
sub edx, edi
mov al, byte [ecx]
inc ecx
xor al, bl
mov byte [esi], al
inc esi
dec edx
jne 0x10072964
mov dl, byte [ecx]
mov edi, ebp
mov eax, dword [esp + 0x10]
xor dl, bl
inc ecx
mov ebp, 8
cmp dl, 8
ja 0x100728f0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ebx, 1
jmp 0x100728af
mov ecx, dword [esp + 0x24]
push 1
push 0xfffffbf2
call fcn.10062940
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x10073060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
mov ecx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, 1
lea eax, [ecx + 9]
cmp eax, dword [ebp]
jae 0x10073094
mov eax, dword [ebp + 4]
movzx eax, byte [eax + ecx]
sub eax, ebx
je 0x10073094
sub eax, 0x80
je 0x100730cc
sub eax, 0x7f
jne 0x100730a4
push 0x3ec
mov ecx, edi
call fcn.100629a0
mov ecx, dword [esp + 0x14]
test byte [edi], 4
jne 0x100730c3
mov eax, dword [ebp + 4]
inc eax
add ecx, eax
neg ebx
sbb bl, bl
mov dl, byte [ecx + 8]
lea ecx, [ecx + 9]
xor dl, bl
add esi, 9
cmp dl, 8
ja 0x100730b3
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
mov ebx, esi
jmp 0x100730a4
Function at 0x10081080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x10]
mov ecx, edi
push 0
mov dword [esi], 0x10009684
lea eax, [esi + 0x30]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x88]
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0x40
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0x40
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x70], 0
mov eax, dword [edi]
call dword [eax + 0x3c]
mov ecx, eax
call fcn.10089180
push 0x63c
mov eax, dword [eax + 8]
movzx ebx, byte [eax + 5]
and ebx, 1
call fcn.10118972
add esp, 4
test eax, eax
je 0x1008111a
mov ecx, eax
call fcn.10080f20
jmp 0x1008111c
xor eax, eax
mov dword [esi + 0xc], eax
test eax, eax
jne 0x1008113b
mov ecx, dword [esp + 0x14]
push 1
push 0xfffffc0d
call fcn.10062940
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x38]
push dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
push 0x40000
push ebx
push dword [eax + 0xc]
call fcn.1007bfb0
mov eax, dword [esi + 0xc]
pop edi
inc dword [eax]
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x10], eax
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x10082c20
Capabilities:
Get hostname

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x10082c49
push dword [esp + 0x10]
mov ecx, esi
call fcn.100827f0
pop esi
ret 0xc

Function at 0x10082cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x1c]
mov ecx, reloc.mswstr10.dll_Ordinal_2
push esi
push edi
xor edi, edi
mov esi, 1
mov eax, dword [ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
test eax, eax
cmove eax, ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x10082d03
cmp byte [ecx], 0
je 0x10082d03
lea edx, [esp + 0x24]
push edx
push 0x20019
push edi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10082d4e
lea edi, [eax + 1]
mov eax, dword [esp + 0x24]
jmp 0x10082d07
mov dword [esp + 0x24], eax
test eax, eax
je 0x10082d43
push ebx
mov ebx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ebp
push ebx
push ecx
push 0
push dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp]
cmp eax, dword [esp + 0x10]
jae 0x10082d3e
cmp dword [esp + 0x18], 1
jne 0x10082d3e
test esi, esi
jne 0x10082d3e
mov byte [eax + ebx], 0
mov eax, dword [esp + 0x28]
pop ebx
test edi, edi
je 0x10082d4e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebp
pop ecx
ret 0x14
Function at 0x10082d60
Capabilities:
Resume thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x18]
cmp dword [esi + 0x18], 0
jne 0x10082e20
mov eax, dword [esi + 0x14]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10118972
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
jne 0x10082dac
push 1
push 0xfffffc0d
mov ecx, edi
call fcn.10062940
pop edi
pop esi
pop ebp
pop ebx
ret 8
xor ebx, ebx
cmp dword [esi + 0x14], ebx
jbe 0x10082e20
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esp, [esp]
push 4
call fcn.10118972
add esp, 4
test eax, eax
je 0x10082de0
push edi
push esi
push 0x10083080
mov ecx, eax
call fcn.1008dab0
mov ecx, eax
jmp 0x10082de2
xor ecx, ecx
mov eax, dword [esi + 0x18]
mov dword [eax + ebx*4], ecx
mov eax, dword [esi + 0x18]
cmp dword [eax + ebx*4], 0
jne 0x10082dff
push 1
push 0xfffffc0d
mov ecx, edi
call fcn.10062940
test byte [edi], 8
jne 0x10082e4d
lea eax, [esi + 0x68]
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [esi + 0x18]
mov eax, dword [eax + ebx*4]
push dword [eax]
call ebp
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x10082dc0
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 8]
test eax, eax
je 0x10082e8a
mov ecx, dword [esi + 0x54]
push eax
call fcn.100506c0
test eax, eax
jne 0x10082e8a
push 1
push 0xfffffc0e
mov ecx, edi
call fcn.10062940
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esi + 0x18]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10082e67
mov ecx, edi
call fcn.1008db80
push edi
call fcn.101189e8
add esp, 4
mov eax, dword [esi + 0x18]
mov dword [eax + ebx*4], 0
test ebx, ebx
jne 0x10082e94
push dword [esi + 0x18]
call fcn.101189e8
add esp, 4
mov dword [esi + 0x18], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, dword [esi + 0x1c]
push edi
push ebx
call fcn.1008dbb0
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x1008dab0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
push 4
push dword [esp + 0x18]
push dword [esp + 0x18]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x1008dae3
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, esi
pop esi
pop ecx
ret 0xc
push edi
mov edi, dword [esp + 0x18]
mov ecx, 0x10137ca8
push edi
call fcn.100827f0
test byte [edi], 1
jne 0x1008db18
cmp dword [edi + 4], 0xffffea84
jne 0x1008db18
push 1
push 0
push 0
push 0xffffdf30
push 0xffffea84
mov ecx, edi
call fcn.100628d0
pop edi
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x100a9905
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
mov edx, dword [esi + 0x8c]
mov ebx, edx
mov ecx, dword [esi + 0x60]
imul eax, edx, 0x24
shl ebx, 3
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], eax
mov eax, dword [ecx + eax + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0xe4]
add ecx, ebx
mov ebx, dword [eax + 0x104]
imul eax, dword [eax + 0x108], 0xc
mov dword [esp + 0x14], ecx
add eax, ebx
mov dword [esp + 0x10], eax
jmp 0x100a9a9e
mov ebp, dword [ebx]
mov edi, dword [ebp + 0xe4]
add edi, dword [esp + 0x2c]
and dword [esp + 0x20], 0
cmp dword [esp + 0x48], 0
je 0x100a999b
mov eax, dword [esp + 0x48]
push dword [eax + 0x28]
push ebx
push esi
call fcn.100ce51c
mov ecx, dword [esp + 0x14]
test eax, eax
mov eax, dword [esp + 0x10]
js 0x100a9a97
mov edx, dword [esp + 0x28]
cmp dword [esp + 0x4c], 0
je 0x100a99ac
cmp ebp, dword [esp + 0x4c]
je 0x100a9a97
test byte [edi + 4], 6
jne 0x100a9ae6
test byte [edi + 4], 1
je 0x100a99d2
push 3
push dword [ebp + edx*4 + 0x28]
push dword [esi + 0x28]
call fcn.1003c920
and dword [edi + 4], 0xfffffffe
mov ecx, dword [esp + 0x14]
cmp byte [ecx], 2
je 0x100a9ab2
test byte [ecx + 4], 1
jne 0x100a9ab2
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp dword [edx + eax + 0x64], 0xa
jne 0x100a99ff
cmp dword [esp + 0x50], 0
je 0x100a9a93
or dword [edi + 4], 8
mov dword [esp + 0x24], 1
mov byte [edi], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp dword [ecx + eax + 0x64], 0
jne 0x100a9a59
mov eax, dword [ebp + 0xf0]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 4]
and edx, 0x3f
shl edx, 4
add edx, ecx
mov dword [esp + 0x30], ecx
cmp ecx, edx
jae 0x100a9a59
mov esi, ecx
mov ecx, dword [esi]
add esi, 0x10
mov eax, dword [edi + 4]
shl eax, 3
not eax
xor eax, dword [ecx + 4]
and eax, 0x40
xor dword [ecx + 4], eax
cmp esi, edx
jb 0x100a9a3b
mov esi, dword [esp + 0x3c]
mov eax, dword [ebp + 0xe0]
xor edi, edi
push edi
push edi
push dword [esp + 0x28]
push dword [esp + 0x50]
push dword [eax + 0x28]
push dword [esp + 0x48]
push dword [esi + 0x28]
call fcn.1003cce0
push dword [esp + 0x24]
push edi
push edi
push dword [esp + 0x50]
push ebp
push esi
call fcn.100a9905
test eax, eax
js 0x100a9aa8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
add ebx, 0xc
cmp ebx, eax
jb 0x100a9961
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x48]
push ebx
push dword [esp + 0x4c]
push esi
call fcn.100a9cdc
test eax, eax
jne 0x100a99ff
and dword [esp + 0x24], eax
mov eax, dword [edi + 4]
and eax, 0xfffffff7
mov byte [edi], 2
or eax, 0x10
mov dword [edi + 4], eax
jmp 0x100a9a0e
lea eax, [esp + 0x44]
push eax
push ebp
push esi
call fcn.100ab4ae
xor eax, eax
push eax
push eax
push eax
push 0xffffe009
push eax
push eax
push dword [esp + 0x5c]
push dword [esi + 0x28]
call fcn.10037730
mov eax, 0xfffffbe8
jmp 0x100a9aa8
Function at 0x100b4ebe
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x198
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
mov ebx, dword [esp + 0x1a0]
lea eax, [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x1ac]
push edi
mov edi, dword [esp + 0x1b4]
push 0x1c
push 0x64
push eax
push dword [edi + 8]
push ebx
call fcn.1009187b
movsx ebp, ax
mov eax, dword [esi + 0x88]
add eax, ebp
cmp eax, dword [esi + 0x8c]
jle 0x100b4f27
mov dword [esi + 0x8c], eax
shl eax, 5
push eax
lea eax, [esi + 0x84]
push eax
push ebx
call fcn.100c9f7d
lea ebx, [esp + 0x14]
mov eax, ebx
mov ecx, ebx
mov dword [esp + 0x10], ecx
lea eax, [eax + ebp*4]
xor ebp, ebp
mov edx, eax
sub edx, ecx
xor ecx, ecx
add edx, 3
shr edx, 2
cmp ebx, eax
cmova edx, ecx
test edx, edx
je 0x100b4f96
mov eax, dword [esi + 0x88]
mov ecx, eax
shl ecx, 5
add ecx, dword [esi + 0x84]
inc eax
mov dword [esi + 0x88], eax
mov eax, dword [ebx]
lea ebx, [ebx + 4]
mov dword [ecx + 8], eax
mov eax, dword [edi]
xor eax, dword [ecx]
and eax, 1
xor dword [ecx], eax
mov al, byte [edi + 0x10]
mov byte [ecx + 0x10], al
mov al, byte [edi + 0x11]
mov byte [ecx + 0x11], al
mov eax, dword [edi]
xor eax, dword [ecx]
and eax, 0x10
xor dword [ecx], eax
inc ebp
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
cmp ebp, edx
jb 0x100b4f4d
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011705d
add esp, 0x198
ret 0xc
Function at 0x100d5836
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
cmp dword [ebp + 0x10], 0
je 0x100d5858
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001b690
jmp 0x100d5866
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10018410
mov esi, eax
cmp esi, 0xfffffbb2
je 0x100d5888
cmp esi, 0xfffffbad
je 0x100d5888
cmp esi, 0xfffffbaf
je 0x100d5888
cmp esi, 0xfffffbae
jne 0x100d5896
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
cmp eax, 0x2710
jb 0x100d5842
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10