joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005cbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.1005bc90
mov edx, dword [ebp + 0x18]
add esp, 4
mov ebx, dword [ebx + 0xec]
mov edi, edx
mov esi, dword [ebp + 0x14]
shr edi, 5
mov dword [ebp - 4], eax
cmp edi, ebx
jb 0x1005cbdf
xor edi, edi
jmp 0x1005cbec
mov edi, dword [esi + edi*4]
mov ecx, edx
and ecx, 0x1f
shr edi, cl
and edi, 1
lea ecx, [eax + edx]
mov eax, ecx
shr eax, 5
cmp eax, ebx
jb 0x1005cbfc
xor eax, eax
jmp 0x1005cc07
mov eax, dword [esi + eax*4]
and ecx, 0x1f
shr eax, cl
and eax, 1
add eax, eax
or edi, eax
mov eax, dword [ebp - 4]
lea ecx, [edx + eax*2]
mov eax, ecx
shr eax, 5
cmp eax, ebx
jb 0x1005cc1e
xor eax, eax
jmp 0x1005cc29
mov eax, dword [esi + eax*4]
and ecx, 0x1f
shr eax, cl
and eax, 1
shl eax, 2
or edi, eax
mov eax, dword [ebp - 4]
lea ecx, [edx + eax*2]
add ecx, eax
mov eax, ecx
shr eax, 5
cmp eax, ebx
jb 0x1005cc43
xor eax, eax
jmp 0x1005cc4e
mov eax, dword [esi + eax*4]
and ecx, 0x1f
shr eax, cl
and eax, 1
shl eax, 3
or edi, eax
mov eax, dword [ebp - 4]
lea ecx, [edx + eax*4]
mov eax, ecx
shr eax, 5
cmp eax, ebx
jb 0x1005cc66
xor eax, eax
jmp 0x1005cc71
mov eax, dword [esi + eax*4]
and ecx, 0x1f
shr eax, cl
and eax, 1
mov ebx, dword [ebp + 0xc]
push 0xcc
shl eax, 4
push 0
push ebx
or edi, eax
call fcn.100a7e90
add esp, 0xc
xor eax, eax
nop dword [eax + eax]
inc eax
mov dword [ebp + 0xc], eax
xor eax, edi
lea esi, [eax - 1]
not eax
shr eax, 0x1f
shr esi, 0x1f
and esi, eax
mov eax, dword [ebp + 8]
neg esi
push dword [eax + 0x11c]
push ebx
push dword [ebp + 0x10]
push esi
push ebx
call fcn.10059f40
mov eax, dword [ebp + 8]
lea ecx, [ebx + 0x44]
push dword [eax + 0x11c]
mov eax, dword [ebp + 0x10]
push ecx
add eax, 0x44
push eax
push esi
push ecx
call fcn.10059f40
add dword [ebp + 0x10], 0x88
add esp, 0x28
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
jb 0x1005cc90
mov eax, dword [ebp + 8]
lea ecx, [ebx + 0x88]
push dword [eax + 0x11c]
add eax, 0x90
push eax
lea eax, [edi - 1]
not edi
shr eax, 0x1f
shr edi, 0x1f
and eax, edi
push ecx
neg eax
push eax
push ecx
call fcn.10059f40
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100635b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x14]
push edi
push 0x60
push 0
push esi
call fcn.100a7e90
xor edi, edi
add esp, 0xc
cmp dword [ebp + 0xc], edi
jbe 0x10063613
mov edx, dword [ebp + 8]
mov eax, esi
dec edx
push ebx
mov ebx, dword [ebp + 0x10]
lea ecx, [eax + 0x20]
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
push eax
mov esi, edx
push ebx
xor esi, edi
push esi
push eax
call fcn.10061140
mov ecx, dword [ebp - 4]
lea eax, [ebx + 0x20]
push ecx
push eax
push esi
push ecx
call fcn.10061140
mov eax, dword [ebp + 0x14]
inc edi
mov edx, dword [ebp - 8]
add esp, 0x20
add ebx, 0x40
cmp edi, dword [ebp + 0xc]
jb 0x100635e2
mov esi, eax
pop ebx
lea eax, [esi + 0x40]
push 0x100c679c
push eax
push dword [ebp + 8]
push eax
call fcn.10061140
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006c260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
xor bl, bl
test edx, edx
je 0x1006c31c
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp edx, 0x20
jb 0x1006c2fa
mov eax, dword [ebp + 8]
mov edi, edx
mov ebx, esi
and edi, 0xffffffe0
add eax, 0x10
xorps xmm3, xmm3
sub ebx, dword [ebp + 8]
xorps xmm2, xmm2
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + esi]
add ecx, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [ebx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp ecx, edi
jb 0x1006c293
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd ebx, xmm2
cmp ecx, edx
jae 0x1006c314
mov edi, dword [ebp + 8]
sub esi, edi
sub edx, ecx
lea eax, [ecx + edi]
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or bl, cl
sub edx, 1
jne 0x1006c304
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x1006e370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x1006e38b
push esi
push 0
push edi
call fcn.100a7e90
add esp, 0xc
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x2b0]
mov eax, dword [edx + 0x2b4]
mov byte [edi + esi - 1], cl
shrd ecx, eax, 8
shr eax, 8
mov byte [edi + esi - 2], cl
shrd ecx, eax, 8
shr eax, 8
mov byte [edi + esi - 3], cl
shrd ecx, eax, 8
shr eax, 8
mov byte [edi + esi - 4], cl
shrd ecx, eax, 8
shr eax, 8
mov byte [edi + esi - 5], cl
shrd ecx, eax, 8
shr eax, 8
mov byte [edi + esi - 6], cl
shrd ecx, eax, 8
shr eax, 8
mov byte [edi + esi - 7], cl
shrd ecx, eax, 8
xor eax, eax
mov byte [edi + esi - 8], cl
test esi, esi
je 0x1006e3ff
nop
mov cl, byte [edx + eax + 0x258]
xor byte [eax + edi], cl
inc eax
cmp eax, esi
jb 0x1006e3f0
pop edi
pop esi
pop ebp
ret

Function at 0x1006e410
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push edi
mov edi, dword [ebp + 8]
push 0x20
push eax
call fcn.10051980
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.10053bb0
mov al, byte [ebp - 0x45]
and byte [ebp - 0x64], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x45], al
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.10075c90
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.10071950
movups xmm0, xmmword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [edi + 0x10]
pop edi
movups xmmword [esi + 0x30], xmm0
pop esi
call fcn.100a69cd
mov esp, ebp
pop ebp
ret
Function at 0x1006e4b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0x20
push esi
call fcn.10053bb0
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.10075c90
lea eax, [ebp - 0xe4]
push eax
push ebx
call fcn.10071950
movups xmm0, xmmword [esi]
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
movups xmmword [edi], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [ebx]
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [edi + 0x30], xmm0
pop edi
pop esi
pop ebx
call fcn.100a69cd
mov esp, ebp
pop ebp
ret

Function at 0x1006e540
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x44]
push eax
push 0x20
push edi
call fcn.10053bb0
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x19c]
push eax
call fcn.10053cf0
push 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.10053da0
push dword [ebp + 0x10]
lea eax, [ebp - 0x19c]
push ebx
push eax
call fcn.10053da0
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.10053cd0
lea eax, [ebp - 0x84]
push eax
call fcn.10076090
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.10075c90
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call fcn.10071950
add esp, 0x44
lea eax, [ebp - 0x19c]
push eax
call fcn.10053cf0
push 0x20
push dword [ebp - 0x240]
lea eax, [ebp - 0x19c]
push eax
call fcn.10053da0
push 0x20
lea eax, [edi + 0x20]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.10053da0
push dword [ebp + 0x10]
lea eax, [ebp - 0x19c]
push ebx
push eax
call fcn.10053da0
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10053cd0
lea eax, [ebp - 0xc4]
push eax
call fcn.10076090
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc4]
push eax
mov eax, dword [ebp - 0x240]
add eax, 0x20
push eax
call fcn.100719f0
mov ecx, dword [ebp - 4]
add esp, 0x44
xor ecx, ebp
mov eax, 1
pop edi
pop ebx
call fcn.100a69cd
mov esp, ebp
pop ebp
ret
Function at 0x1006e950
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x20
push esi
call fcn.10051980
mov al, byte [esi + 0x1f]
or byte [esi], 7
and al, 0x3f
or al, 0x80
mov byte [esi + 0x1f], al
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movd eax, xmm0
movups xmmword [ebp - 0x14], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x24], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [ebp - 5], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.10075c90
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.1006eb00
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.1006f3d0
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1006ed70
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1006f830
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.1006f4a0
mov ecx, dword [ebp - 4]
add esp, 0x44
xor ecx, ebp
pop edi
pop esi
call fcn.100a69cd
mov esp, ebp
pop ebp
ret

Function at 0x1006ea30
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movups xmmword [ebp - 0x14], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x24], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [ebp - 5], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.10075c90
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.1006eb00
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.1006f3d0
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1006ed70
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1006f830
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.1006f4a0
mov ecx, dword [ebp - 4]
add esp, 0x3c
xor ecx, ebp
pop esi
call fcn.100a69cd
mov esp, ebp
pop ebp
ret
Function at 0x10078240
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 3
jne 0x100782fa
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10078510
push eax
push 0x100784f0
push 0x100f6f24
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1007830a
cmp dword [0x100f6f2c], 0
jne 0x100782fa
push edi
push dword [0x100f6f28]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x100782f9
push ebx
push esi
push 0x100f6f0c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movups xmm0, xmmword [0x100f6f10]
mov ecx, dword [0x100f6f20]
push 0x100f6f0c
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea ebx, [ebp - 0x18]
mov esi, edi
sub ebx, edi
mov edi, 5
mov eax, dword [ebx + esi]
test eax, eax
je 0x100782e4
push dword [esi]
call eax
add esp, 4
add esi, 4
sub edi, 1
jne 0x100782d6
push dword [ebp - 0x1c]
call fcn.100a93ee
add esp, 4
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a69cd
mov esp, ebp
pop ebp
ret 0xc
call fcn.100a8e30
int3

Function at 0x10078400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10078510
push eax
push 0x100784f0
push 0x100f6f24
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x100784e9
cmp dword [0x100f6f2c], 0
push esi
push edi
jne 0x100784d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x100f6f28]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1007849e
push 0x14
call fcn.100a9409
mov edi, eax
add esp, 4
test edi, edi
je 0x100784d8
push edi
push dword [0x100f6f28]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1007849e
push edi
call fcn.100a93ee
push dword [ebp + 0xc]
call dword [ebp + 0x10]
add esp, 8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x100f6f0c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 8]
push 0x100f6f0c
lea esi, [eax*4]
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x100f6f10], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [esi + edi], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
call dword [ebp + 0x10]
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100a8e30
int3
Function at 0x1008b270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0xa8], eax
xor ebx, ebx
push esi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x98], eax
lea esi, [ebp - 0x84]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edx
sub eax, edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0xa4], eax
lea eax, [edi + 0x100]
cmp ecx, eax
jbe 0x1008b2d9
mov ebx, ecx
sub ebx, edi
sub ebx, 0x100
mov dword [ebp - 0x8c], ebx
xor ecx, ecx
xor al, al
mov dword [ebp - 0x94], ecx
mov byte [ebp - 0x85], al
test edi, edi
je 0x1008b300
push edi
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.100a7e90
mov edx, dword [ebp + 0x14]
add esp, 0xc
xor ecx, ecx
xor eax, eax
cmp ebx, dword [ebp + 0x18]
jae 0x1008b3b6
shr edx, 0x1f
mov dword [ebp - 0xa0], edx
mov edx, ebx
sub edx, dword [ebp + 0x14]
mov dword [ebp - 0x90], edx
nop
mov ecx, dword [ebp - 0x8c]
mov esi, eax
sub esi, edi
cmp eax, edi
cmovb esi, eax
mov eax, ebx
xor eax, dword [ebp - 0xa4]
shr ecx, 0x1f
shr edx, 0x1f
xor dl, cl
lea ebx, [eax - 1]
not eax
shr eax, 0x1f
shr ebx, 0x1f
and ebx, eax
mov al, cl
xor al, byte [ebp - 0xa0]
neg ebx
or byte [ebp - 0x85], bl
or dl, al
mov eax, dword [ebp - 0x8c]
xor dl, cl
mov ecx, dword [ebp + 0x10]
neg dl
and dl, byte [eax + ecx]
mov eax, esi
and dl, byte [ebp - 0x85]
and eax, ebx
or byte [ebp + esi - 0x44], dl
mov ebx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
inc ebx
mov edx, dword [ebp - 0x90]
or ecx, eax
inc edx
mov dword [ebp - 0x94], ecx
lea eax, [esi + 1]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x90], edx
cmp ebx, dword [ebp + 0x18]
jb 0x1008b320
lea esi, [ebp - 0x84]
mov eax, 1
lea edx, [ebp - 0x44]
mov dword [ebp - 0x8c], eax
cmp edi, eax
jbe 0x1008b463
nop dword [eax]
mov bl, cl
mov dword [ebp - 0x90], edi
and bl, 1
mov ecx, eax
mov eax, esi
dec bl
mov esi, edx
mov bh, bl
sub esi, dword [ebp - 0x9c]
not bh
mov dword [ebp - 0xa0], esi
mov esi, ecx
lea eax, [eax + 1]
sub esi, edi
cmp ecx, edi
cmovb esi, ecx
mov ecx, dword [ebp - 0xa0]
mov dl, byte [esi + edx]
mov cl, byte [ecx + eax - 1]
and dl, bh
and cl, bl
or dl, cl
sub dword [ebp - 0x90], 1
mov byte [eax - 1], dl
lea ecx, [esi + 1]
mov edx, dword [ebp - 0x98]
jne 0x1008b3f3
mov ecx, dword [ebp - 0x94]
mov eax, edx
mov edx, dword [ebp - 0x9c]
mov esi, eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x8c]
add eax, eax
shr ecx, 1
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], ecx
cmp eax, edi
jb 0x1008b3d0
jmp 0x1008b467
test edi, edi
je 0x1008b477
push edi
push edx
push dword [ebp - 0xa8]
call fcn.100a7910
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a69cd
mov esp, ebp
pop ebp
ret
Function at 0x1008b840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0xc
push esi
mov esi, dword [ebp + 0x1c]
inc esi
cmp esi, edx
jbe 0x1008b859
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea edi, [edx - 1]
mov ebx, edx
add edi, dword [ebp + 0x10]
mov al, byte [edi]
movzx ecx, al
mov byte [ebp + 0x1f], al
mov dword [ebp - 4], ecx
lea eax, [ecx + esi]
mov esi, 0x100
sub ebx, eax
xor eax, edx
xor ebx, edx
or ebx, eax
mov eax, edx
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, esi
cmovae eax, esi
xor esi, esi
mov dword [ebp - 8], eax
test eax, eax
je 0x1008b8d9
mov edx, ecx
shr edx, 0x1f
mov dword [ebp - 0xc], edx
nop dword [eax]
sub ecx, esi
lea edi, [edi - 1]
shr ecx, 0x1f
mov eax, esi
xor cl, dl
shr eax, 0x1f
xor al, dl
inc esi
or cl, al
movzx eax, byte [edi + 1]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 0x1f]
xor ecx, eax
and edx, ecx
mov ecx, dword [ebp - 4]
not edx
and ebx, edx
mov edx, dword [ebp - 0xc]
cmp esi, dword [ebp - 8]
jb 0x1008b8a0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub edx, eax
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
pop esi
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10093c83
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
sub esp, 0xc
cmp eax, 3
ja case.default.0x10093c45
push ebx
push esi
push edi
jmp dword [eax*4 + 0x10093df8]
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x1b], 6
mov dword [eax], 0x20
jmp 0x10093c90
mov eax, dword [ebp + 0xc]
mov esi, 0x48
mov byte [ebp + 0x1b], 6
mov dword [eax], 0x40
jmp 0x10093c95
mov eax, dword [ebp + 0xc]
mov esi, 0xa8
mov byte [ebp + 0x1b], 0x1f
mov dword [eax], 0
jmp 0x10093c95
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x1b], 0x1f
mov dword [eax], 0
mov esi, 0x88
mov edi, dword [ebp + 8]
push 0xd0
push 0
push edi
call fcn.100a7e90
mov ebx, dword [ebp + 0x14]
mov ecx, esi
mov edx, dword [ebp + 0x10]
add esp, 0xc
shr ecx, 3
mov dword [edi + 0xc8], esi
mov dword [ebp - 8], ecx
cmp ebx, esi
jb 0x10093d0b
mov dword [ebp - 4], edx
mov esi, edx
mov eax, edi
sub esi, edi
mov ebx, ecx
nop dword [eax + eax]
mov ecx, dword [esi + eax]
lea eax, [eax + 8]
mov edx, dword [esi + eax - 4]
xor dword [eax - 8], ecx
xor dword [eax - 4], edx
sub ebx, 1
jne 0x10093cd0
push edi
call fcn.10093950
mov eax, dword [edi + 0xc8]
add esp, 4
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
sub ebx, eax
mov ecx, dword [ebp - 8]
add edx, eax
mov dword [ebp - 4], edx
mov dword [ebp + 0x14], ebx
cmp ebx, eax
jae 0x10093cc3
xor ecx, ecx
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x10093dce
cmp ebx, 0x40
jb 0x10093db1
lea eax, [edx - 1]
mov dword [ebp - 4], ecx
lea esi, [edi - 1]
add eax, ebx
add esi, ebx
cmp edi, eax
ja 0x10093d3a
cmp esi, edx
jae 0x10093db1
mov eax, ebx
lea esi, [edx + 0x30]
and eax, 0xffffffc0
mov ecx, edx
sub ecx, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
lea eax, [edi + 0x10]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
movups xmm0, xmmword [eax - 0x10]
add ecx, 0x40
lea esi, [esi + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [esi - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [esi - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [esi - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, dword [ebp - 0xc]
jb 0x10093d55
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
cmp ecx, ebx
jae 0x10093dce
mov esi, ebx
add ecx, edi
sub edx, edi
sub esi, dword [ebp - 4]
nop word [eax + eax]
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x10093dc0
mov cl, byte [ebp + 0x1b]
lea eax, [edi + ebx]
xor byte [eax], cl
mov eax, dword [edi + 0xc8]
push edi
xor byte [eax + edi - 1], 0x80
call fcn.10093950
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100a8e30
nop
dec esp
cmp al, 9
adc byte [ebx + 0x3c], bl
or dword [eax], edx
outsd dx, dword [esi]
cmp al, 9
adc byte [ebx - 0x33eff6c4], al
int3
Function at 0x100a6880
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax]
lea edx, [eax + 8]
mov edi, dword [eax + 4]
mov dword [ebp - 4], edx
jbe 0x100a68e0
push ebx
mov ebx, dword [ebp + 0x14]
sub dword [ebp + 0x10], ebx
mov eax, dword [ebp - 4]
lea ecx, [esi + 1]
movzx esi, cl
lea ebx, [ebx + 1]
mov edx, dword [edx + esi*4]
lea ecx, [edx + edi]
movzx edi, cl
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + edi*4]
mov dword [eax + esi*4], ecx
add ecx, edx
mov dword [eax + edi*4], edx
mov edx, eax
mov eax, dword [ebp + 0x10]
movzx ecx, cl
mov cl, byte [edx + ecx*4]
xor cl, byte [eax + ebx - 1]
sub dword [ebp + 0xc], 1
mov byte [ebx - 1], cl
jne 0x100a68a1
mov eax, dword [ebp + 8]
pop ebx
mov dword [eax + 4], edi
pop edi
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100b88d4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b874a

Function at 0x100bb62f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100bb182
Function at 0x401160
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push esi
push edi
lea edi, [eax + 4]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00404000
cmp dword [eax], 0
je 0x401192
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00404000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00404000
cmp dword [eax + 4], 0
je 0x4011ca
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00404000
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00404000
mov dword [eax + 4], 0
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 8
jb 0x4011d5
mov ebx, dword [ebx]
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00404000
push ebx
push 0x20000
push 0
push 4
push 0
push 0xffffffffffffffff
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi], eax
mov ecx, edi
lea eax, [ebp + 0xc]
push eax
call fcn.00404000
cmp dword [eax], 0
je 0x401236
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00404000
push 0x20000
push 0
push 0
push 6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov ecx, edi
lea eax, [ebp + 0xc]
push eax
call fcn.00404000
mov dword [eax + 4], esi
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00404000
mov ecx, dword [ebp - 4]
pop edi
pop esi
cmp dword [eax + 4], 0
pop ebx
setne al
mov byte [ecx + 0x10], al
mov esp, ebp
pop ebp
ret 8