joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c1b00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
push ebx
movzx ebx, word [eax + 2]
push ebp
push esi
movzx esi, word [eax]
shl ebx, 0x10
mov dword [esp + 0xc], esi
or ebx, esi
push edi
mov ecx, 0x1b434c83
mov edx, 0x3281ab71
mov dword [esp + 0x14], 0x21e1cde3
mov dword [esp + 0x18], 0xf4d50d87
mov dword [esp + 0x1c], 0x9cefa3f8
mov dword [esp + 0x20], 0xa4beea47
mov dword [esp + 0x24], 0xb5bfbc70
mov dword [esp + 0x28], 0x6aa127fa
mov dword [esp + 0x2c], 0x8a845dd1
mov dword [esp + 0x30], 0x1d3af235
mov eax, 1
mov esi, 0x4f111
nop
and ecx, 7
mov ecx, dword [esp + ecx*4 + 0x14]
xor ecx, edx
lea edi, [eax + 0x82a3]
lea edx, [edi - 1]
imul edi, eax
lea ebp, [eax - 1]
imul edx, ebp
add ecx, edx
lea edx, [esi - 0x980]
imul edx, ebp
mov ebp, ecx
shr ebx, 1
add edx, ebx
lea edx, [edx + ecx + 0xc9de]
and ebp, 7
mov ebp, dword [esp + ebp*4 + 0x14]
add ebp, ecx
xor edx, ebp
and edx, 7
mov edx, dword [esp + edx*4 + 0x14]
xor edx, ecx
add edx, edi
mov ecx, edx
and ecx, 7
mov ecx, dword [esp + ecx*4 + 0x14]
add ecx, edx
mov edi, esi
imul edi, eax
shr ebx, 1
add edi, ebx
lea edi, [edi + edx + 0xc9de]
xor ecx, edi
and ecx, 7
mov ecx, dword [esp + ecx*4 + 0x14]
xor ecx, edx
lea edi, [eax + 1]
lea edx, [eax + 0x82a4]
imul edx, edi
add ecx, edx
lea edx, [esi + 0x980]
imul edx, edi
mov edi, ecx
and edi, 7
mov edi, dword [esp + edi*4 + 0x14]
add edi, ecx
shr ebx, 1
add edx, ebx
lea edx, [edx + ecx + 0xc9de]
xor edx, edi
and edx, 7
mov edx, dword [esp + edx*4 + 0x14]
xor edx, ecx
lea edi, [eax + 2]
lea ecx, [eax + 0x82a5]
imul ecx, edi
add edx, ecx
lea ecx, [esi + 0x1300]
imul ecx, edi
mov edi, edx
and edi, 7
mov edi, dword [esp + edi*4 + 0x14]
shr ebx, 1
add ecx, ebx
add edi, edx
lea ecx, [ecx + edx + 0xc9de]
add eax, 4
xor ecx, edi
lea edi, [eax - 1]
add esi, 0x2600
cmp edi, 0x20
jb 0x100c1b70
mov eax, dword [esp + 0x38]
movzx eax, word [eax + 2]
mov esi, eax
imul esi, eax
mov eax, dword [esp + 0x10]
add esi, ecx
mov dword [esp + 0x14], esi
mov esi, eax
imul esi, eax
add edx, ecx
add esi, ecx
and edx, 0xffff41d3
lea ecx, [esp + 0x10]
or edx, 0x41d3
push ecx
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x3c], edx
call fcn.100c19b0
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret

Function at 0x100c3570
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1004
call fcn.10125a20
mov eax, dword [0x1018c630]
xor eax, esp
mov dword [esp + 0x1000], eax
push 0xfff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.10112c40
mov edx, dword [esp + 0x1014]
lea ecx, [esp + 0x1018]
push ecx
push edx
push 0x1000
lea eax, [esp + 0x18]
push 0x1000
push eax
call fcn.101090d3
add esp, 0x20
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.1010ccf3
add esp, 0x1004
ret
Function at 0x100c36b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
test edi, edi
je 0x100c3836
mov eax, 0x100c1d20
test eax, eax
je 0x100c3836
mov esi, dword [0x101ebf30]
call fcn.100c38a0
test eax, eax
jne 0x100c3838
xor ebx, ebx
xor esi, esi
lea esp, [esp]
mov ecx, edi
lea edx, [ebx + ecx]
push edx
call fcn.1008584d
add ebx, eax
cmp ebx, 6
jae 0x100c3711
inc esi
cmp esi, 0xf
jb 0x100c36f0
cmp ebx, 6
jb 0x100c3836
cmp ebx, 0xf
ja 0x100c3836
xor eax, eax
lea esp, [esp]
mov ecx, dword [eax*4 + 0x101ec070]
test ecx, ecx
je 0x100c372f
cmp dword [ecx], ebp
je 0x100c3739
inc eax
cmp eax, 0x80
jl 0x100c3720
jmp 0x100c3743
mov esi, ecx
test esi, esi
jne 0x100c37d1
cmp dword [0x101ebf3c], ebp
jne 0x100c3774
push 0x40
push 0x1000
push 0x1000
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x101ebf3c], eax
mov dword [0x101ec06c], ebp
test eax, eax
je 0x100c3836
mov eax, dword [0x101ec06c]
lea ecx, [eax + ebx + 6]
cmp ecx, 0x1000
ja 0x100c3836
push 0x20
call fcn.101087bd
mov ebp, eax
add esp, 4
xor eax, eax
test ebp, ebp
je 0x100c3838
mov edx, dword [0x101ebf3c]
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], eax
mov eax, dword [0x101ec06c]
lea edi, [eax + edx]
add eax, 0x20
mov esi, ebp
mov dword [0x101ec06c], eax
jmp 0x100c37d4
mov edi, dword [esi + 8]
mov eax, dword [esp + 0x1c]
mov dword [esi], eax
mov dword [esi + 4], 0x100c1d20
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 8]
push ebx
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0xc]
push eax
push edi
mov dword [esi + 0x1c], edx
call fcn.10112cc0
mov eax, dword [esp + 0x28]
add esp, 0xc
call fcn.100c35f0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
push 0x40
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100c3840
test ebp, ebp
je 0x100c3836
push ebp
call fcn.101086c9
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebp, dword [esp + 0x1c]
lea edx, [ebx + ebp]
push edx
add ebx, edi
push ebx
mov dword [0x101ebf30], edi
call fcn.100c3650
push 0x100c1d20
push ebp
call fcn.100c3650
add esp, 0x10
xor eax, eax
cmp dword [eax*4 + 0x101ec070], 0
je 0x100c3882
inc eax
cmp eax, 0x80
jl 0x100c3866
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
mov dword [eax*4 + 0x101ec070], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100c7c52
Capabilities:
Read file on windows

Disassembly:
xor eax, eax
ret
xchg dword [esp], eax
push 0x371bff74
mov dword [esp], eax
call edi
push ebx
mov ebx, eax
sub ebx, 0xffffffff
pop ebx
jne 0x10c3db58
jmp 0x10c43bc5
add eax, 0x3aeae5be
ret 0x2be5
cli
loopne 0x100c7c06
mov ebx, 0xf6136ea0
cmp al, dl
pop esi
jg 0x100c7be7
mov cl, 0x41
mov eax, dword [edx + 0x7206977c]
cmp byte [edi + edx*4 + 6], 0x72
ret 0xa83b
jecxz 0x100c7bd7
xor al, 0x56
mov ecx, 0xb3ce2cf
jecxz 0x100c7b97
adc eax, 0x4098ef9e
sahf
out dx, eax
cwde
inc eax
pop ebx
add edx, edx
or byte [eax], al
add byte [eax], al
add byte [eax], al
jmp 0x100c7c70
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10c45e8e
push eax
call fcn.100c7c52
jne 0x100c7cab
pop eax
pop eax
lea eax, [eax + 0xb79ed2]
call eax
jmp 0x100c7bfa
outsb dx, byte [esi]
sbb esi, dword [edx + 0x6b]
lea eax, [eax + 0x43f933b8]
xchg dword [esp], eax
push ebp
mov ebp, dword [esp + 4]
push eax
mov eax, 0x36616558
lea eax, [eax + 0x1a334f9a]
lea ebp, [eax + ebp]
pop eax
mov dword [esp + 4], ebp
pop ebp
push ecx
call 0x100c7ca5
jae 0x100c7cff
lea ecx, [ecx + 0xb73fcd]
call ecx
jp 0x100c7c3b
add bh, bh
sar dword [edx - 0x75], 1
xchg ecx, eax
xor al, 0xe
add byte [eax], al
xor eax, eax
test edx, edx
jle 0x10092bac
push edx
call 0x100c7cc6
ja 0x100c7d21
lea edx, [edx - 0x65a7]
call edx
jmp 0xfb7f5bd
add byte [eax], al
push eax
call 0x100c7d08
jo 0x100c7d61
lea eax, [eax + 0xb7eec1]
jmp eax
in eax, 0x10
mov eax, esi
or ebp, edx
call fcn.100c9945
push eax
mov eax, 0x5b7d4aaf
lea eax, [eax - 0x5b7d49af]
xchg dword [esp], eax
mov dword [esp + 0x18], eax
push ecx
call 0x100c7d47
ljmp 0xb854
jne 0x10c4b4c1
jmp 0x100d1436
push edi
mov dword [esp], 1
cmp edi, dword [esp]
lea esp, [esp + 4]
jbe 0x10c4150b
push edx
call 0x100d1455
jnp 0x100d14b0
lea edx, [edx + 0xb6f44e]
jmp edx
and al, 4
pushfd
push ebp
push edi
jmp fcn.10c3e0a6
lea esp, [esp - 0x12]
mov edi, dword [esp + 0x1a]
lea esp, [esp + 0x1e]
not eax
and eax, dword [esp + 0x1c]
xor ecx, esp
push ebx
call 0x100d14d4
jb 0x100d1530
lea ebx, [ebx + 0xb68267]
call ebx
jg 0x100d146c
and al, 4
push esi
mov esi, 0xddab60f9
lea esi, [esi + 0x22549f0a]
xchg dword [esp], esi
push ecx
mov ecx, edi
mov eax, 0x7b622cf8
mov eax, ecx
pop ecx
mov edi, 0x360f5ede
lea edi, [edi - 0x25f92e22]
mov edi, dword [edi]
lea esp, [esp - 4]
xchg dword [esp], eax
mov eax, dword [esp]
mov eax, 0x5ea753ea
lea eax, [eax + 0x6158ac16]
jmp 0x100c2779
ret 0xf2fc
Function at 0x100c7ca5
Capabilities:
Read file on windows

Disassembly:
xor eax, eax
ret
xchg dword [esp], eax
push 0x371bff74
mov dword [esp], eax
call edi
push ebx
mov ebx, eax
sub ebx, 0xffffffff
pop ebx
jne 0x10c3db58
jmp 0x10c43bc5
add eax, 0x3aeae5be
ret 0x2be5
cli
loopne 0x100c7c06
mov ebx, 0xf6136ea0
cmp al, dl
pop esi
jg 0x100c7be7
mov cl, 0x41
mov eax, dword [edx + 0x7206977c]
cmp byte [edi + edx*4 + 6], 0x72
ret 0xa83b
jecxz 0x100c7bd7
xor al, 0x56
mov ecx, 0xb3ce2cf
jecxz 0x100c7b97
adc eax, 0x4098ef9e
sahf
out dx, eax
cwde
inc eax
pop ebx
add edx, edx
or byte [eax], al
add byte [eax], al
add byte [eax], al
jmp 0x100c7c70
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10c45e8e
push eax
call fcn.100c7c52
jne 0x100c7cab
pop eax
pop eax
lea eax, [eax + 0xb79ed2]
call eax
jmp 0x100c7bfa
outsb dx, byte [esi]
sbb esi, dword [edx + 0x6b]
lea eax, [eax + 0x43f933b8]
xchg dword [esp], eax
push ebp
mov ebp, dword [esp + 4]
push eax
mov eax, 0x36616558
lea eax, [eax + 0x1a334f9a]
lea ebp, [eax + ebp]
pop eax
mov dword [esp + 4], ebp
pop ebp
push ecx
call 0x100c7ca5
jae 0x100c7cff
lea ecx, [ecx + 0xb73fcd]
call ecx
jp 0x100c7c3b
add bh, bh
sar dword [edx - 0x75], 1
xchg ecx, eax
xor al, 0xe
add byte [eax], al
xor eax, eax
test edx, edx
jle 0x10092bac
push edx
call 0x100c7cc6
ja 0x100c7d21
lea edx, [edx - 0x65a7]
call edx
jmp 0xfb7f5bd
add byte [eax], al
push eax
call 0x100c7d08
jo 0x100c7d61
lea eax, [eax + 0xb7eec1]
jmp eax
in eax, 0x10
mov eax, esi
or ebp, edx
call fcn.100c9945
push eax
mov eax, 0x5b7d4aaf
lea eax, [eax - 0x5b7d49af]
xchg dword [esp], eax
mov dword [esp + 0x18], eax
push ecx
call 0x100c7d47
ljmp 0xb854
jne 0x10c4b4c1
jmp 0x100d1436
push edi
mov dword [esp], 1
cmp edi, dword [esp]
lea esp, [esp + 4]
jbe 0x10c4150b
push edx
call 0x100d1455
jnp 0x100d14b0
lea edx, [edx + 0xb6f44e]
jmp edx
and al, 4
pushfd
push ebp
push edi
jmp fcn.10c3e0a6
lea esp, [esp - 0x12]
mov edi, dword [esp + 0x1a]
lea esp, [esp + 0x1e]
not eax
and eax, dword [esp + 0x1c]
xor ecx, esp
push ebx
call 0x100d14d4
jb 0x100d1530
lea ebx, [ebx + 0xb68267]
call ebx
jg 0x100d146c
and al, 4
push esi
mov esi, 0xddab60f9
lea esi, [esi + 0x22549f0a]
xchg dword [esp], esi
push ecx
mov ecx, edi
mov eax, 0x7b622cf8
mov eax, ecx
pop ecx
mov edi, 0x360f5ede
lea edi, [edi - 0x25f92e22]
mov edi, dword [edi]
lea esp, [esp - 4]
xchg dword [esp], eax
mov eax, dword [esp]
mov eax, 0x5ea753ea
lea eax, [eax + 0x6158ac16]
jmp 0x100c2779
ret 0xf2fc
Function at 0x100cdfc0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push 0x1016d79c
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.1010ab19
mov eax, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x100ce012
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.1010ae0c
mov edx, dword [esp + 0x10]
push edx
call fcn.1010aea0
mov eax, dword [esp + 0x18]
add esp, 0x14
add esp, 8
ret
push 0
call fcn.1010d1b3
push eax
call fcn.101094cf
call fcn.101094e1
push 0x1016fc80
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push esi
push eax
call fcn.1010ab19
mov eax, dword [esp + 0x14]
add esp, 0x14
test eax, eax
je 0x100ce05f
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.1010d131
mov edx, dword [esp + 0x10]
push edx
call fcn.1010aea0
add esp, 0x14
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x100d1640
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x68
mov eax, dword [0x1018c630]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, ecx
push edi
mov byte [esp + 0x13], 0
test esi, esi
je 0x100d1776
test ebp, ebp
je 0x100d1776
push 0x40000
call fcn.101074bc
mov edi, eax
add esp, 4
test edi, edi
je 0x100d174e
push 0x1016e3e0
push esi
call fcn.1010b53b
mov ebx, eax
xor esi, esi
add esp, 8
cmp ebx, esi
je 0x100d1743
xor eax, eax
mov dword [ebp], eax
push 0x40000
mov dword [ebp + 4], eax
push esi
mov dword [ebp + 8], eax
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
mov dword [ebp + 0xc], eax
call fcn.10112c40
push ebx
push 0x40000
push 1
push edi
call fcn.1010ae0c
add esp, 0x1c
cmp eax, esi
jle 0x100d1733
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100d1700
push edi
lea ecx, [esp + 0x1c]
call fcn.100d3a70
add esp, 4
push 0x14
call esi
push 0x40000
push 0
push edi
call fcn.10112c40
push ebx
push 0x40000
push 1
push edi
call fcn.1010ae0c
add esp, 0x1c
test eax, eax
jg 0x100d1700
lea esi, [esp + 0x18]
mov ecx, ebp
call fcn.100d3b20
mov byte [esp + 0x13], 1
push edi
call fcn.101090f3
add esp, 4
jmp 0x100d1752
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x100d175f
push ebx
call fcn.1010aea0
add esp, 4
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1010ccf3
add esp, 0x68
ret
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.1010ccf3
add esp, 0x68
ret
Function at 0x100d1850
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10183740
push 0x10117670
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1018c630]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x100d18be
cmp dword [ebp + 0xc], ebx
je 0x100d18be
cmp dword [ebp + 0x10], ebx
je 0x100d18be
cmp dword [ebp + 0x14], ebx
je 0x100d18be
cmp dword [ebp + 0x18], ebx
je 0x100d18be
lea ecx, [ebp - 0x28]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jne 0x100d18ca
mov dword [ebp - 4], 0xfffffffe
jmp 0x100d1965
lea edx, [edi + 1]
push edx
call fcn.101074bc
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, ebx
jne 0x100d18e8
mov dword [ebp - 4], 0xfffffffe
jmp 0x100d1965
mov dword [esi], ebx
push esi
push edi
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100d1944
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x10169754
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100d1944
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov word [edx], cx
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
movzx ecx, word [eax + 0xe]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x18]
mov word [ecx], ax
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x100d1965
cmp esi, ebx
je 0x100d1972
push esi
call fcn.101090f3
add esp, 4
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100d42e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
test edx, edx
jbe 0x100d4311
mov eax, dword [edi]
push ebx
push ebp
lea ebx, [ebx]
movzx ebx, byte [ecx + esi]
mov ebp, eax
and ebp, 0xff
xor ebx, ebp
shr eax, 8
xor eax, dword [ebx*4 + 0x1019d0c0]
inc ecx
cmp ecx, edx
jb 0x100d42f0
pop ebp
mov dword [edi], eax
pop ebx
ret

Function at 0x100d82b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x5c
push esi
push edi
mov edi, dword [esp + 0x68]
mov eax, edi
mov dword [esp + 8], 0x1c792e83
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d82c6
sub eax, edx
mov esi, eax
mov edx, esi
shr edx, 2
xor eax, eax
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x21e1cde6
mov dword [esp + 0x48], 0xf4d50d87
mov dword [esp + 0x4c], 0xfcefa3f8
mov dword [esp + 0x50], 0xa4beea44
mov dword [esp + 0x54], 0xbebfbc70
mov dword [esp + 0x58], 0xeaa127fa
mov dword [esp + 0x5c], 0x85845dd1
mov dword [esp + 0x60], 0xbd3af235
mov dword [esp + 0x3c], edx
mov dword [esp + 0x2c], eax
test edx, edx
jbe 0x100d853f
push ebx
xor ecx, ecx
push ebp
mov dword [esp + 0x38], ecx
Function at 0x100d9610
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
mov eax, 0xa8b19c75
test edi, edi
jbe 0x100d9659
push ebx
push ebp
push esi
lea esi, [ecx + 1]
mov edx, 0x25
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp + ecx*4]
mov ebx, edx
imul ebx, ecx
lea ebx, [ebx + ebp + 0x536327]
mov ebp, esi
imul ebp, ecx
lea eax, [eax + ebp + 0x152d9]
inc ecx
xor eax, ebx
add edx, 0x3b
add esi, 0x14df
cmp ecx, edi
jb 0x100d9626
pop esi
pop ebp
pop ebx
ret 4

Function at 0x100d9740
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
call esi
xor edx, edx
mov ecx, 0x3e8
div ecx
cmp edx, 0x32
jbe 0x100d9768
cmp edx, 0x320
jb 0x100d976e
push 0x32
call edi
jmp 0x100d9750
call esi
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov ebx, edx
shr ebx, 6
mov esi, 0x1765a2d3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 0x10]
xor ecx, ecx
xor edi, edi
add ebx, eax
add edx, 0x134
lea esp, [esp]
lea eax, [ecx + esi]
lea esi, [ecx + 6]
imul esi, ecx
xor eax, edi
mov dword [edx], eax
inc ecx
add edx, 4
add edi, ebx
lea esi, [esi + eax + 0x4e331f]
cmp ecx, 0x40
jb 0x100d97a0
pop edi
pop esi
pop ebx
ret 4
Function at 0x100dfcd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x1018c630]
xor eax, esp
mov dword [esp + 0x14], eax
push 0
call fcn.1010d1b3
mov ecx, dword [esp + 0x20]
add esp, 4
lea edx, [esp]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov ecx, 0x10
lea edx, [esp + 0x13]
push esi
xor eax, 0x10
mov dword [esp + 0x10], 0x1016b560
mov dword [esp + 0x14], fcn.100e01a0
sub edx, ecx
push edi
movzx esi, byte [edx + ecx]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
dec ecx
xor eax, esi
cmp ecx, 1
jae 0x100dfd17
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.1010ccf3
add esp, 0x18
ret

Function at 0x100e4490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push esi
push edi
mov edi, eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
lea eax, [esp + 0x18]
push eax
mov eax, edi
call fcn.100e4070
add esp, 4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x10], eax
mov esi, eax
call fcn.100e40e0
add esi, eax
mov eax, dword [ebx + 4]
and eax, 0x7fffff00
add esp, 8
cmp eax, 0x7ff7a500
je 0x100e45ba
fld qword [ebx]
fstp qword [esp + 0x10]
fld qword [esp + 0x10]
fistp dword [esp + 0xc]
fild dword [esp + 0xc]
fcomp qword [esp + 0x10]
fnstsw ax
test ah, 0x44
jp 0x100e45ba
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x100e45ba
cmp eax, 0x40000000
jg 0x100e45ba
dec eax
xor ecx, ecx
cmp eax, 0x100
jb 0x100e45a2
shr eax, 8
add ecx, 8
cmp eax, 0x100
jae 0x100e4595
movzx eax, byte [eax + 0x1016b568]
add eax, ecx
inc dword [esp + eax*4 + 0x18]
lea eax, [esp + eax*4 + 0x18]
mov eax, 1
jmp 0x100e45bc
xor eax, eax
add dword [esp + 8], eax
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x1c]
call fcn.100e4010
mov edx, dword [esp + 0xa0]
sub esi, eax
mov eax, dword [esp + 0xc]
add esp, 4
inc esi
push esi
push edx
mov ecx, edi
call fcn.100e42e0
add esp, 8
pop edi
pop esi
add esp, 0x90
ret

Function at 0x100e4b70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
shr ecx, 5
mov eax, edx
xor eax, dword [esp + 4]
inc ecx
cmp edx, ecx
jb 0x100e4b9f
push ebx
push edi
movzx edi, byte [esi + edx - 1]
mov ebx, eax
shl ebx, 5
add edi, ebx
mov ebx, eax
shr ebx, 2
add edi, ebx
sub edx, ecx
xor eax, edi
cmp edx, ecx
jae 0x100e4b82
pop edi
pop ebx
ret
Function at 0x100e4d40
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [eax + 0xc]
mov ebx, dword [esi + 0x30]
mov eax, edi
shr eax, 5
inc eax
xor ebx, edi
mov dword [esp + 0xc], esi
mov ecx, edi
cmp edi, eax
jb 0x100e4d7f
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + ecx - 1]
mov ebp, ebx
shl ebp, 5
add edx, ebp
mov ebp, ebx
shr ebp, 2
add edx, ebp
sub ecx, eax
xor ebx, edx
cmp ecx, eax
jae 0x100e4d60
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x18]
dec eax
and eax, ebx
mov ebp, dword [ecx + eax*4]
test ebp, ebp
je 0x100e4dfb
nop
cmp ebx, dword [ebp + 8]
jne 0x100e4df4
cmp edi, dword [ebp + 0xc]
jne 0x100e4df4
mov esi, dword [esp + 0x18]
mov ecx, edi
lea edx, [ebp + 0x10]
cmp edi, 4
jb 0x100e4dbc
mov eax, dword [esi]
cmp eax, dword [edx]
jne 0x100e4df0
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x100e4da8
test ecx, ecx
je 0x100e4e98
mov al, byte [edx]
cmp al, byte [esi]
jne 0x100e4df0
cmp ecx, 1
jbe 0x100e4e98
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x100e4df0
cmp ecx, 2
jbe 0x100e4e98
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x100e4e98
mov esi, dword [esp + 0xc]
mov ebp, dword [ebp]
test ebp, ebp
jne 0x100e4d90
mov eax, dword [esi + 0x20]
cmp dword [esi + 0x1c], eax
jb 0x100e4e1b
cmp eax, 0x3ffffffe
jg 0x100e4e1b
lea edx, [eax + eax]
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.100e4ba0
add esp, 8
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x14]
dec ecx
and ecx, ebx
lea ebp, [edx + ecx*4]
mov ecx, dword [eax + 0xc]
lea edx, [edi + 0x11]
push edx
push 4
push 0
push eax
mov dword [esp + 0x24], ecx
call fcn.100f7710
add esp, 0x10
mov esi, eax
test ebp, ebp
jne 0x100e4e50
mov ebp, dword [esp + 0x14]
add ebp, 0x3c
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 0x34]
mov eax, dword [esp + 0x18]
and cl, 3
mov byte [esi + 5], cl
mov byte [esi + 4], 4
mov edx, dword [ebp]
push edi
push eax
lea ecx, [esi + 0x10]
mov dword [esi], edx
mov dword [ebp], esi
push ecx
mov dword [esi + 0xc], edi
mov dword [esi + 8], ebx
mov byte [esi + 6], 0
call fcn.10112cc0
mov eax, dword [esp + 0x18]
add esp, 0xc
mov byte [esi + edi + 0x10], 0
inc dword [eax + 0x1c]
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 0xc]
mov al, byte [ebp + 5]
mov cl, byte [edx + 0x34]
xor al, 3
xor cl, 3
test al, cl
jne 0x100e4eae
mov byte [ebp + 5], al
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret