joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcd74ea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0xd2b0e0]
push ebx
push esi
push edi
xor ebx, ebx
inc ebx
push 0
test eax, eax
push edx
mov edi, ecx
cmove eax, ebx
push ebx
lea ecx, [ebp - 0x38]
mov dword [0xd2b0e0], eax
call fcn.00cd546b
mov edx, dword [0xd2b0e0]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
shl edx, 0x18
or edx, ebx
shr ecx, 0x18
mov dword [0xd2b0e0], edx
add ecx, dword [eax + 0x14]
or esi, 0xffffffff
sub ecx, dword [ebp - 0xc]
je 0xcd75b3
cmp dword [0xd2b0f0], 0
jne 0xcd7548
inc edx
mov dword [0xd2b0e0], edx
push 0
lea ecx, [ebp - 0x38]
call fcn.00cd5655
push 8
xor esi, eax
pop ecx
mov eax, esi
and eax, ebx
neg eax
and eax, 0xedb88320
shr esi, 1
xor esi, eax
dec ecx
jne 0xcd7557
mov ecx, dword [0xd2b0dc]
mov eax, ecx
not eax
test al, 0xfa
push 0
pop eax
setne al
add ecx, ecx
push 0
mov edx, 0x80000000
or ecx, eax
mov eax, ecx
not eax
test al, 0xfa
pop eax
cmove eax, edx
shr ecx, 1
or ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [0xd2b0dc], ecx
mov ecx, dword [ebp - 8]
shr ecx, 0x18
add ecx, dword [eax + 0x14]
sub ecx, dword [ebp - 0xc]
je 0xcd75b3
mov edx, dword [0xd2b0e0]
jmp 0xcd7538
not esi
mov dword [edi], esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0xcdf4ad
Capabilities:
Parse pe header

Disassembly:
push 0x10
push 0xd21608
call fcn.00cd4337
mov esi, ecx
mov eax, dword [0xd2a510]
xor eax, 0x359f520
or eax, 0x14e6c9d4
mov dword [0xd2a510], eax
and dword [ebp - 4], 0
lea edi, [esi + 0x28]
push dword [ebp + 0xc]
push 0x40
push 0
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0xcdf5fe
or dword [ebp - 4], 0xffffffff
mov eax, 0x5a4d
cmp word [edi], ax
jne 0xcdf5ed
cmp dword [esi + 0x64], 0
je 0xcdf5ed
mov dword [ebp - 4], 1
lea edi, [esi + 0x68]
push dword [ebp + 0xc]
push 0xf8
push dword [esi + 0x64]
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0xcdf5fe
or dword [ebp - 4], 0xffffffff
cmp dword [edi], 0x4550
jne 0xcdf5ed
mov eax, 0x10b
cmp word [esi + 0x80], ax
jne 0xcdf5ed
movzx eax, word [esi + 0x6e]
test ax, ax
je 0xcdf5ed
mov edi, eax
imul edi, edi, 0x28
movzx ecx, word [esi + 0x7c]
mov ebx, dword [esi + 0x64]
add ecx, 0x18
add ebx, ecx
push edi
call fcn.00cd4f68
pop ecx
mov dword [ebp - 0x20], eax
mov dword [esi + 0x160], eax
mov edx, dword [0xd2a4f8]
mov ecx, edx
not ecx
test cl, 0xfa
push 0
pop ecx
mov dword [ebp - 0x1c], 0x80000000
cmove ecx, dword [ebp - 0x1c]
shr edx, 1
or edx, ecx
mov dword [0xd2a4f8], edx
test eax, eax
jne 0xcdf5a9
push 8
jmp 0xcdf604
mov eax, edx
not eax
test al, 0xfa
push 0
pop eax
cmove eax, dword [ebp - 0x1c]
shr edx, 1
or edx, eax
mov dword [0xd2a4f8], edx
mov dword [ebp - 4], 2
push dword [ebp + 0xc]
push edi
push ebx
push dword [ebp - 0x20]
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0xcdf5fe
or dword [ebp - 4], 0xffffffff
lea eax, [ebx + edi]
mov dword [esi + 0x10], eax
xor eax, eax
jmp 0xcdf605
push 0xb
jmp 0xcdf604
or dword [ebp - 4], 0xffffffff
push 0x1e
pop eax
call fcn.00cd4326
ret 8
Function at 0xce2aa1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0xd539b0]
push ebx
push esi
push edi
mov edi, dword [0xd2a554]
or edi, dword [0xd2a550]
mov dword [ebp - 0x1c], 0x80000000
or edi, dword [0xd2a550]
or eax, dword [0xd539b4]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], 1
jne 0xce2bd9
mov eax, dword [0xd2a558]
mov edi, dword [0xd2a568]
mov ebx, dword [0xd2a578]
mov dword [ebp - 0x10], eax
mov eax, dword [0xd2a548]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
cmp ebx, 0x51529ef4
mov eax, 0x567454f8
cmove ebx, eax
mov eax, ecx
cdq
mov esi, eax
mov eax, dword [0xd2a540]
mov ecx, eax
not ecx
test cl, 0xfa
push 0
pop ecx
mov edi, 0x80000000
cmove ecx, edi
mov edi, dword [ebp - 0x10]
shr eax, 1
or eax, ecx
mov ecx, dword [ebp - 8]
push 1
mov dword [0xd2a540], eax
test ecx, ecx
pop eax
cmove ecx, eax
mov dword [ebp - 8], ecx
mov dword [0xd2a548], ecx
mov dword [ebp - 0xc], 8
mov eax, esi
shrd esi, edx, 1
and eax, 1
shr edx, 1
or eax, 0
je 0xce2b6f
xor esi, 0xd7870f42
xor edx, 0xc96c5795
inc edi
test ecx, ecx
mov eax, 0x1cdb1558
cmove edi, eax
inc ebx
test ecx, ecx
mov eax, 0x3e1b03f0
cmove ebx, eax
dec dword [ebp - 0xc]
mov dword [0xd2a558], edi
jne 0xce2b53
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 4]
xor eax, eax
shl edi, 0x14
inc eax
or edi, eax
mov dword [ecx*8 + 0xd531b8], esi
mov dword [ecx*8 + 0xd531bc], edx
inc ecx
mov dword [0xd2a578], ebx
mov dword [ebp - 4], edi
mov dword [0xd2a568], edi
mov dword [ebp - 0x14], ecx
cmp ecx, 0x100
jl 0xce2b02
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
jmp 0xce2be5
mov esi, dword [0xd2a568]
mov ebx, dword [0xd2a548]
or edi, dword [0xd2a550]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
not ecx
not edx
mov dword [0xd2a554], edi
test eax, eax
je 0xce2c81
cmp dword [ebp + 0xc], 0
je 0xce2c81
mov edi, dword [0xd2a540]
movzx eax, byte [eax]
xor eax, ecx
and eax, 0xff
shrd ecx, edx, 8
xor ecx, dword [eax*8 + 0xd531b8]
shr edx, 8
xor edx, dword [eax*8 + 0xd531bc]
inc esi
test ebx, ebx
mov eax, 0x53543a4
cmove esi, eax
mov eax, edi
not eax
test al, 0xfa
push 0
pop eax
setne al
add edi, edi
push 0
mov dword [0xd2a568], esi
or edi, eax
dec dword [ebp + 0xc]
mov eax, edi
not eax
test al, 0xfa
pop eax
cmove eax, dword [ebp - 0x1c]
shr edi, 1
or edi, eax
mov eax, dword [ebp + 8]
inc eax
test ebx, ebx
cmove ebx, dword [ebp - 0x20]
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [0xd2a548], ebx
jne 0xce2c0e
mov dword [0xd2a540], edi
pop edi
not ecx
pop esi
not edx
mov eax, ecx
pop ebx
leave
ret
Function at 0xce4f12
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0xd17f06
call fcn.00cd4307
sub esp, 0xf8
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
xor eax, eax
push 0xee
push eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push eax
call fcn.00cd1c8d
mov esi, dword [0xd2a5e0]
mov ecx, dword [0xd2a610]
xor esi, 0x4ea78be4
or esi, 0x18ffef24
add esp, 0xc
inc esi
mov eax, 0x46b9cfc
cmove esi, eax
movzx eax, byte [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov al, byte [ebp + 0xc]
lea ebx, [ebp - 0x104]
xor edi, edi
mov dword [ebp + 0x10], ecx
movzx eax, al
cdq
idiv dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
cmp dl, 9
jbe 0xce4f9b
movzx ecx, dl
add cx, 0x57
mov word [ebx], cx
mov ecx, dword [ebp + 0x10]
jmp 0xce4faa
movzx eax, dl
push 0x30
pop edx
add ax, dx
mov word [ebx], ax
mov eax, dword [ebp + 0xc]
add ebx, 2
test esi, esi
push 1
pop edx
cmove esi, edx
xor ecx, 0x44150754
or ecx, 0x216d6200
inc edi
mov dword [ebp + 0x10], ecx
mov dword [0xd2a610], ecx
test al, al
jne 0xce4f7d
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], edi
cmp edi, eax
mov dword [0xd2a5e0], esi
lea edi, [ebp - 0x104]
jge 0xce5022
sub eax, dword [ebp + 0x10]
push 0x30
mov ecx, eax
mov dword [ebp + 0x14], eax
pop eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp + 0x14]
xor ecx, ecx
lea ebx, [ebx + eax*2]
inc ecx
test esi, esi
cmove esi, ecx
dec eax
jne 0xce500e
mov dword [0xd2a5e0], esi
lea edi, [ebp - 0x104]
mov esi, dword [0xd2a5e8]
mov edx, dword [0xd2a5ec]
xor eax, eax
mov word [ebx], ax
sub ebx, 2
movzx ecx, word [ebx]
mov ax, word [edi]
mov word [ebx], ax
or edx, esi
mov word [edi], cx
sub ebx, 2
add edi, 2
or edx, esi
cmp edi, ebx
jb 0xce5036
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
lea eax, [ebp - 0x104]
push eax
mov dword [0xd2a5ec], edx
call fcn.00ce5800
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
xor eax, eax
inc eax
pop edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xce5a66
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd159a8
call fcn.00cd4307
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00ce58b5
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 3
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 5
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 7
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 9
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x54]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x60]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x70]
mov byte [esi + 0x6c], bl
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x7c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x15
lea ecx, [esi + 0x88]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x17
lea ecx, [esi + 0x94]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x19
mov byte [esi + 0xa0], 0
mov eax, dword [0xd2a5e0]
cmp eax, 0x1a128a10
mov ecx, 0x18846220
cmove eax, ecx
push ebx
test eax, eax
push ebx
cmove eax, ebx
push 0
mov dword [0xd2a5e0], eax
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
mov eax, dword [0xd2a610]
xor eax, 0x230d0cfc
or eax, 0x10fd0700
add esp, 0xc
mov dword [0xd2a610], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xce5a73
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd159a8
call fcn.00cd4307
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00ce58b5
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 3
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 5
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 7
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 9
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x54]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x60]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x70]
mov byte [esi + 0x6c], bl
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x7c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x15
lea ecx, [esi + 0x88]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x17
lea ecx, [esi + 0x94]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x19
mov byte [esi + 0xa0], 0
mov eax, dword [0xd2a5e0]
cmp eax, 0x1a128a10
mov ecx, 0x18846220
cmove eax, ecx
push ebx
test eax, eax
push ebx
cmove eax, ebx
push 0
mov dword [0xd2a5e0], eax
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
mov eax, dword [0xd2a610]
xor eax, 0x230d0cfc
or eax, 0x10fd0700
add esp, 0xc
mov dword [0xd2a610], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0xce5ba2
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd159f1
call fcn.00cd4307
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.00ce56db
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.00ce56db
mov byte [ebp - 4], 1
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00ce56db
mov byte [ebp - 4], 2
lea eax, [esi + 0x24]
push eax
lea ecx, [edi + 0x24]
call fcn.00ce56db
mov byte [ebp - 4], 3
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00ce56db
mov byte [ebp - 4], 4
lea eax, [esi + 0x3c]
push eax
lea ecx, [edi + 0x3c]
call fcn.00ce56db
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0xce5c2f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd15a6a
call fcn.00cd4307
push ecx
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00ce58b5
mov dword [ebp - 4], 1
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 3
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 5
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 7
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 9
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0xce5f77
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0xd15ca3
call fcn.00cd4307
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xc
xor ebx, ebx
push ebx
push 1
push ebx
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
mov edx, dword [0xd2a5d8]
add esp, 0xc
mov eax, edx
not eax
test al, 0xfa
push ebx
pop ecx
setne cl
lea eax, [edx + edx]
or eax, ecx
mov dword [0xd2a5d8], eax
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x94]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xb
call fcn.00ce5d79
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x88]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xa
call fcn.00ce5d79
mov byte [ebp - 4], 9
lea ecx, [esi + 0x7c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
call fcn.00ce5d79
mov byte [ebp - 4], 8
lea ecx, [esi + 0x70]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
call fcn.00ce5d79
mov byte [ebp - 4], 7
lea ecx, [esi + 0x60]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
call fcn.00ce5d79
mov byte [ebp - 4], 6
lea ecx, [esi + 0x54]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
call fcn.00ce5d79
mov byte [ebp - 4], 5
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
call fcn.00ce5d79
mov byte [ebp - 4], 4
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.00ce5d79
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
call fcn.00ce5d79
mov byte [ebp - 4], 2
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.00ce5d79
mov byte [ebp - 4], 1
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.00ce5d79
mov byte [ebp - 4], bl
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], bl
call fcn.00ce5d79
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00ce5d79
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xce60bc
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd15d1c
call fcn.00cd4307
push ecx
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.00ce5d79
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
call fcn.00ce5d79
mov byte [ebp - 4], 2
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.00ce5d79
mov byte [ebp - 4], 1
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.00ce5d79
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0
call fcn.00ce5d79
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00ce5d79
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0xcf2ec1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0xd2a5e0]
xor eax, eax
inc eax
push ebx
mov ebx, dword [ebp + 8]
test edx, edx
cmove edx, eax
push edi
mov edi, ecx
mov dword [0xd2a5e0], edx
test ebx, ebx
jne 0xcf2f06
mov eax, dword [0xd2a600]
mov ecx, 0x13e09960
cmp eax, 0xaafb3b0
cmove eax, ecx
mov ecx, edi
mov dword [0xd2a600], eax
call fcn.00cf3403
jmp 0xcf2fac
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0xffffffff
jne 0xcf2f1e
push ebx
call fcn.00cf5b30
mov edx, dword [0xd2a5e0]
pop ecx
mov esi, eax
mov eax, dword [0xd2a5f0]
cmp eax, 0x40629250
mov ecx, 0x63785b0
cmove eax, ecx
mov dword [0xd2a5f0], eax
xor edx, 0x53d422a0
lea eax, [esi + 1]
or edx, 0x3f5a0540
push eax
mov ecx, edi
mov dword [0xd2a5e0], edx
call fcn.00cf5291
mov eax, dword [edi + 4]
cmp esi, eax
jb 0xcf2f5c
lea esi, [eax - 1]
xor edx, edx
test esi, esi
je 0xcf2f83
mov al, byte [edx + ebx]
mov ecx, dword [edi]
mov byte [edx + ecx], al
mov eax, dword [0xd2a5e0]
xor eax, 0x3b019120
or eax, 0x917a278
inc edx
mov dword [0xd2a5e0], eax
cmp edx, esi
jb 0xcf2f62
mov dword [edi + 8], esi
mov eax, dword [0xd2a610]
inc eax
cmp dword [0xd2a5e0], 0
mov ecx, 0x15d44c80
cmove eax, ecx
mov dword [0xd2a610], eax
mov eax, dword [edi]
mov ecx, dword [edi + 8]
pop esi
mov byte [ecx + eax], 0
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0xcf349b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0xd2a5e0]
mov eax, dword [0xd2a600]
inc eax
test edx, edx
push ebx
mov ebx, dword [ebp + 0x10]
mov ecx, 0x43a5aa78
cmove eax, ecx
mov ecx, dword [0xd2a5d8]
mov dword [ebp - 0x10], eax
mov dword [0xd2a600], eax
push esi
mov esi, dword [ebp + 0x14]
push edi
mov eax, ecx
not eax
test al, 0xfa
push 0
pop eax
setne al
xor ebx, dword [0xd2a6a8]
xor esi, dword [0xd2a6ac]
lea edi, [ecx + ecx]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
or edi, eax
xor eax, eax
inc eax
test edx, edx
cmove edx, eax
mov eax, dword [0xd539c8]
mov dword [ebp - 4], edi
mov dword [0xd2a5e0], edx
cmp eax, dword [0xd539d0]
jne 0xcf35b7
mov eax, dword [0xd539cc]
cmp eax, dword [0xd539d4]
jne 0xcf35b7
mov eax, dword [0xd2a5f0]
xor eax, 0x62620ad0
or eax, 0x44245670
cmp edx, 0x25b89208
mov ecx, 0x1a61bbf8
cmove edx, ecx
inc eax
test edx, edx
mov ecx, 0x71d7840
cmove eax, ecx
mov dword [0xd2a5f0], eax
xor eax, eax
xor esi, esi
mov dword [ebp + 0x14], eax
inc esi
mov edi, eax
xor ecx, ecx
inc edx
mov eax, 0x6f60898c
push 8
cmove edx, eax
pop ebx
mov eax, edi
shrd edi, ecx, 1
and eax, esi
shr ecx, 1
or eax, 0
je 0xcf3584
xor edi, dword [0xd2a6a0]
xor ecx, dword [0xd2a6a4]
dec ebx
jne 0xcf3569
mov eax, dword [ebp + 0x14]
test edx, edx
cmove edx, esi
mov dword [eax*8 + 0xd539c8], edi
mov dword [eax*8 + 0xd539cc], ecx
inc eax
mov dword [ebp + 0x14], eax
cmp eax, 0x100
jb 0xcf3559
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov dword [0xd2a5e0], edx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0xcf35fc
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, ebx
shrd ebx, esi, 8
and eax, 0xff
shr esi, 8
xor ebx, dword [eax*8 + 0xd539c8]
xor esi, dword [eax*8 + 0xd539cc]
xor edx, 0x522b4c18
or edx, 0x8d91564
inc edi
mov dword [0xd2a600], edx
dec ecx
jne 0xcf35c4
mov edi, dword [ebp - 4]
mov edx, dword [0xd2a6ac]
mov eax, edi
not eax
test al, 0xfa
push 0
pop ecx
mov eax, 0x80000000
cmove ecx, eax
mov eax, dword [0xd2a6a8]
shr edi, 1
or edi, ecx
mov dword [0xd2a5d8], edi
xor eax, ebx
pop edi
xor edx, esi
pop esi
pop ebx
leave
ret
Function at 0xcf7dbc
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd17c04
call fcn.00cd4307
push ecx
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00ce58b5
mov dword [ebp - 4], 1
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 3
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 5
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 7
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 9
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xb
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [esi + 0x48]
call fcn.00ce5800
mov byte [ebp - 4], 0xc
push 0xffffffffffffffff
push dword [ebp + 0xc]
lea ecx, [esi + 0x54]
call fcn.00ce5800
mov byte [ebp - 4], 0xd
push 1
push 2
push 0
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
mov eax, dword [0xd2a7e0]
add esp, 0xc
inc eax
cmp dword [0xd2a7b0], 0
mov ecx, 0x7cbbdb40
cmove eax, ecx
mov dword [0xd2a7e0], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0xcf7dc8
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd17c04
call fcn.00cd4307
push ecx
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00ce58b5
mov dword [ebp - 4], 1
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 3
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 5
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 7
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 9
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xb
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [esi + 0x48]
call fcn.00ce5800
mov byte [ebp - 4], 0xc
push 0xffffffffffffffff
push dword [ebp + 0xc]
lea ecx, [esi + 0x54]
call fcn.00ce5800
mov byte [ebp - 4], 0xd
push 1
push 2
push 0
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
mov eax, dword [0xd2a7e0]
add esp, 0xc
inc eax
cmp dword [0xd2a7b0], 0
mov ecx, 0x7cbbdb40
cmove eax, ecx
mov dword [0xd2a7e0], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0xcf8007
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd17daa
call fcn.00cd4307
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 7
mov eax, dword [0xd2a7b8]
or dword [0xd2a7bc], eax
xor ebx, ebx
push ebx
push 2
push ebx
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
mov eax, dword [0xd2a7e0]
add esp, 0xc
mov ecx, 0x1629ea0
cmp eax, 0x1c15cf4
cmove eax, ecx
mov dword [0xd2a7e0], eax
mov byte [ebp - 4], 6
lea ecx, [esi + 0x54]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
call fcn.00ce5d79
mov byte [ebp - 4], 5
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
call fcn.00ce5d79
mov byte [ebp - 4], 4
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.00ce5d79
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
call fcn.00ce5d79
mov byte [ebp - 4], 2
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.00ce5d79
mov byte [ebp - 4], 1
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.00ce5d79
mov byte [ebp - 4], bl
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], bl
call fcn.00ce5d79
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00ce5d79
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret