joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a7880
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x10160c18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov cl, byte [0x1018ca3c]
mov al, 0x3f
sub al, cl
push esi
push eax
push 0x56
call fcn.100980c0
mov ecx, 0x90
mov eax, 0xaa
mov word [esp + 0x26], cx
mov word [esp + 0x28], cx
mov ecx, 0x87
mov edx, 0x96
mov word [esp + 0x22], ax
mov word [esp + 0x2c], ax
mov word [esp + 0x32], cx
mov word [esp + 0x34], cx
mov cl, byte [0x10196e84]
mov word [esp + 0x36], ax
mov word [esp + 0x3e], ax
mov word [esp + 0x1c], dx
mov word [esp + 0x2e], dx
mov al, 1
add esp, 8
mov edx, 0x80
test al, cl
mov word [esp + 0x16], 0x85
mov word [esp + 0x18], 0x83
mov word [esp + 0x1c], 0x93
mov word [esp + 0x22], 0x91
mov word [esp + 0x28], dx
mov word [esp + 0x30], 0x9b
mov word [esp + 0x32], dx
mov word [esp + 0x34], 0x98
jne 0x100a79a2
push edi
or cl, al
push 0x26
mov byte [0x10196e84], cl
call fcn.1013c2df
add esp, 4
mov dword [0x10196e88], eax
xor esi, esi
mov di, word [esp + esi + 0x18]
push 0xf5
mov ecx, edi
and ecx, 0xffff
push ecx
mov ecx, 0x10196e88
call fcn.100a8ee0
mov edx, dword [0x10196e88]
add eax, 0xf5
xor eax, edi
mov word [esi + edx], ax
add esi, 2
cmp esi, 0x24
jb 0x100a7953
mov eax, dword [0x10196e88]
push 0x100a82f0
mov word [eax + 0x24], 0
call fcn.1013c36b
add esp, 4
pop edi
mov ecx, dword [esp + 0x48]
mov edx, dword [0x10196e88]
push ecx
lea eax, [esp + 8]
push edx
push eax
call fcn.1000cdb0
add esp, 0xc
mov ecx, dword [0x10191a54]
push 0
push eax
mov dword [esp + 0x48], 0
call fcn.10058e60
mov ecx, eax
call fcn.10067e70
mov ecx, dword [esp + 8]
mov esi, eax
test ecx, ecx
mov dword [esp + 0x40], 0xffffffff
je 0x100a7a1a
mov al, byte [ecx - 1]
test al, al
je 0x100a7a0e
cmp al, 0xff
je 0x100a7a0e
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret 4
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x38]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x100a7a30
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x10160c38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, 0x2b
mov edx, 1
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], ax
mov al, byte [0x10196e7c]
mov ecx, 0x1d
test dl, al
push esi
mov byte [0x1018ca38], 0x59
mov word [esp + 0x14], 0x53
mov word [esp + 0x16], 0x13
mov word [esp + 0x18], 6
mov word [esp + 0x1a], 0x29
mov word [esp + 0x1c], 0x39
mov word [esp + 0x1e], 3
mov word [esp + 0x20], 0
mov word [esp + 0x22], dx
mov word [esp + 0x24], 0x3b
mov word [esp + 0x26], 0x31
mov word [esp + 0x28], 0xb
mov word [esp + 0x2a], cx
mov word [esp + 0x2c], 0xc
mov word [esp + 0x32], cx
mov word [esp + 0x34], 4
mov word [esp + 0x36], 8
mov word [esp + 0x38], 0x3a
jne 0x100a7b50
push ebp
push edi
or al, dl
push 0x28
mov byte [0x10196e7c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10196e80], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x1c]
push edi
mov eax, ebp
mov ecx, 0x10196e80
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x10196e80]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10196e80]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x26
jb 0x100a7b02
push 0x100a8300
mov word [eax + 0x26], 0
call fcn.1013c36b
add esp, 4
pop edi
pop ebp
mov edx, dword [esp + 0x4c]
mov eax, dword [0x10196e80]
push edx
lea ecx, [esp + 8]
push eax
push ecx
call fcn.1000cdb0
add esp, 0xc
mov ecx, dword [0x10191a54]
push 0
push eax
mov dword [esp + 0x4c], 0
call fcn.10058e60
mov ecx, eax
call fcn.10067e70
mov ecx, dword [esp + 8]
mov esi, eax
test ecx, ecx
mov dword [esp + 0x44], 0xffffffff
je 0x100a7bc7
mov al, byte [ecx - 1]
test al, al
je 0x100a7bbb
cmp al, 0xff
je 0x100a7bbb
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret 4
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x100a7f30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10160c88
push eax
mov al, byte [0x1018ca3d]
mov dword fs:[0], esp
sub esp, 0x34
mov byte [0x1018ca3a], al
push ebx
mov ebx, dword [esp + 0x4c]
push ebp
push esi
mov ebp, dword [ebx + 8]
mov esi, dword [ebx + 4]
push edi
cmp ebp, ebp
mov edi, ebp
je 0x100a7f81
mov ecx, dword [0x1016a210]
push ecx
push 0
push edi
mov ecx, esi
call fcn.1000ba60
add edi, 0x10
add esi, 0x10
cmp edi, ebp
jne 0x100a7f66
mov eax, dword [ebx + 8]
mov ecx, ebx
push eax
push esi
call fcn.100242a0
mov dword [ebx + 8], esi
mov al, byte [0x1018ca3a]
mov cl, 0x2a
mov dl, byte [0x1018ca37]
imul cl
push edx
mov dl, byte [0x1018ca38]
push eax
mov eax, 0x274
push edx
cdq
idiv dword [0x1018ca10]
mov eax, dword [0x1018ca0c]
mov cl, byte [edx + eax]
push ecx
push 0x4f
call fcn.100980c0
add esp, 8
push eax
push 0x4f
push 0x4e
call fcn.100980d0
mov esi, dword [0x1018ca10]
add esp, 0x14
mov edi, dword [0x1018ca0c]
push eax
mov eax, 0x303
cdq
idiv esi
push 0xffffffffffffffc2
push 0xfffffffffffffffd
mov al, byte [edx + edi]
mov dl, 0x2b
imul dl
mov cl, al
mov eax, 0xe6
cdq
idiv esi
mov al, byte [edx + edi]
mov dl, 0xfa
imul dl
sub al, cl
add al, 6
push eax
call fcn.100786d0
mov eax, 6
mov ecx, 1
mov word [esp + 0x38], ax
mov word [esp + 0x4c], ax
mov al, byte [0x10196e8c]
add esp, 0x14
xor esi, esi
mov word [esp + 0x20], 0x53
test cl, al
mov word [esp + 0x22], 0x13
mov word [esp + 0x26], 0x29
mov word [esp + 0x28], 0x39
mov word [esp + 0x2a], 3
mov word [esp + 0x2c], si
mov word [esp + 0x2e], cx
mov word [esp + 0x30], 0x3b
mov word [esp + 0x32], 0x3a
mov word [esp + 0x34], 0xb
mov word [esp + 0x36], 0x1a
mov word [esp + 0x3a], 0x1b
mov word [esp + 0x3c], 0xc
mov word [esp + 0x3e], 0x16
mov word [esp + 0x40], 0x2c
jne 0x100a80fd
or al, cl
push 0x24
mov byte [0x10196e8c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10196e90], eax
mov edi, 0x30
mov bp, word [esp + esi + 0x20]
push edi
mov eax, ebp
mov ecx, 0x10196e90
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x10196e90]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10196e90]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x22
jb 0x100a80b1
push 0x100a8310
mov word [eax + 0x22], 0
call fcn.1013c36b
add esp, 4
mov edx, dword [esp + 0x54]
mov eax, dword [0x10196e90]
add edx, 4
lea ecx, [esp + 0x10]
push edx
push eax
push ecx
call fcn.1000cdb0
add esp, 0xc
mov ecx, dword [0x10191a54]
push ebx
push eax
mov dword [esp + 0x54], 0
call fcn.10058e60
mov ecx, eax
call fcn.10068300
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
test ecx, ecx
mov dword [esp + 0x40], 0xffffffff
pop ebx
je 0x100a8166
mov al, byte [ecx - 1]
test al, al
je 0x100a815a
cmp al, 0xff
je 0x100a815a
dec al
mov byte [ecx - 1], al
jmp 0x100a8166
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x34]
mov byte [0x1018ca37], 0x4f
mov dword fs:[0], ecx
add esp, 0x40
ret 8
Function at 0x100a9d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10160d0a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], esi
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x14], ebx
je 0x100a9e05
push ebp
push edi
mov edi, dword [esp + 0x28]
mov al, byte [edi]
mov dword [esi + 4], ebx
mov byte [esi], al
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [0x1016a210]
push ecx
push ebx
push edi
mov ecx, esi
call fcn.1000ba60
mov dl, byte [edi + 0x10]
lea ebp, [edi + 0x10]
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], 1
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x1016a210]
push eax
push ebx
push ebp
call fcn.1000ba60
mov dl, byte [edi + 0x20]
lea ebp, [edi + 0x20]
lea ecx, [esi + 0x20]
mov byte [esp + 0x1c], 2
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x1016a210]
push eax
push ebx
push ebp
call fcn.1000ba60
mov ecx, dword [edi + 0x30]
mov byte [esp + 0x1c], 3
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0x38]
mov dword [esi + 0x38], edx
mov eax, dword [edi + 0x3c]
add edi, 0x40
mov dword [esi + 0x3c], eax
add esi, 0x40
push ebx
mov cl, byte [edi]
mov byte [esi], cl
mov ecx, esi
call fcn.1000bc70
mov edx, dword [0x1016a210]
mov ecx, esi
push edx
push ebx
push edi
call fcn.1000ba60
pop edi
pop ebp
mov byte [esp + 0x14], bl
pop esi
mov dword [esp + 0x10], 0xffffffff
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100ac2b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0xa
call fcn.1013c2df
mov ebp, dword [esp + 0x18]
add esp, 4
mov dword [ebx], eax
xor edi, edi
mov si, word [edi + ebp]
mov ecx, esi
and ecx, 0xffff
sub ecx, 0xcc
cmp ecx, 0xcc
jle 0x100ac2fe
lea edx, [ecx - 1]
mov eax, 0xa0a0a0a1
mul edx
shr edx, 7
mov eax, edx
neg eax
shl eax, 4
sub eax, edx
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
test ecx, ecx
je 0x100ac304
xor ecx, ecx
sub esi, ecx
mov ecx, dword [ebx]
add esi, 0xcc
mov word [edi + ecx], si
add edi, 2
cmp edi, 8
jb 0x100ac2c8
mov edx, dword [ebx]
pop edi
pop esi
mov eax, ebx
pop ebp
mov word [edx + 8], 0
pop ebx
ret 4
Function at 0x100ad1d0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x10161088
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, 0x17
push ebx
push esi
mov word [esp + 0x1e], ax
mov word [esp + 0x2e], ax
mov word [esp + 0x30], ax
mov al, byte [0x10196dcc]
push edi
mov edi, 0x16
mov esi, 5
mov edx, 7
mov ecx, 0x11
xor ebx, ebx
mov word [esp + 0x1c], 0x45
test al, 1
mov word [esp + 0x1e], 6
mov word [esp + 0x20], di
mov word [esp + 0x24], 0x2d
mov word [esp + 0x26], 0x3e
mov word [esp + 0x28], si
mov word [esp + 0x2a], 0xd
mov word [esp + 0x2c], dx
mov word [esp + 0x2e], 0x1a
mov word [esp + 0x30], cx
mov word [esp + 0x36], di
mov word [esp + 0x38], dx
mov word [esp + 0x3a], cx
mov word [esp + 0x3c], 1
mov word [esp + 0x3e], 0x3b
mov word [esp + 0x40], 0x33
mov word [esp + 0x42], si
mov word [esp + 0x44], 0x1f
mov word [esp + 0x46], 0x13
jne 0x100ad2fc
push ebp
or al, 1
push 0x2e
mov byte [0x10196dcc], al
call fcn.1013c2df
add esp, 4
mov dword [0x10196dd0], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x20]
push edi
mov eax, ebp
mov ecx, 0x10196dd0
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x10196dd0]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10196dd0]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x2c
jb 0x100ad2b1
push 0x100adc40
mov word [eax + 0x2c], bx
call fcn.1013c36b
add esp, 4
pop ebp
mov edi, dword [0x10196dd0]
mov dl, byte [esp + 0x58]
push edi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x100ad34c
mov eax, dword [esp + 0x10]
push esi
push edi
push eax
call fcn.100017d0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [ecx + esi*2], bx
mov edx, dword [esp + 0x58]
mov ecx, dword [0x10191a54]
lea eax, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x58], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10067f30
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x50], 0xffffffff
cmp ecx, ebx
je 0x100ad3aa
mov al, byte [ecx - 1]
cmp al, bl
je 0x100ad39e
cmp al, 0xff
je 0x100ad39e
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x100adc50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x101610e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov al, byte [0x1018caf0]
push ebx
inc al
push esi
lea ecx, [esp + 8]
mov byte [0x1018caf0], al
mov bl, al
call fcn.10115b40
mov al, byte [0x1018caf2]
mov dword [esp + 0x54], 0
sub bl, al
sub bl, 0x1a
mov byte [0x1018caf0], bl
call fcn.10115b10
test eax, eax
je 0x100adccd
call fcn.10115b10
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x54], 0xffffffff
call fcn.10116170
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret
mov eax, 0x7f
mov ecx, 0x75
mov word [esp + 0x1a], ax
mov word [esp + 0x1c], ax
mov word [esp + 0x26], ax
mov word [esp + 0x28], ax
mov word [esp + 0x34], ax
mov eax, 0x79
mov edx, 0x7c
mov word [esp + 0x22], cx
mov word [esp + 0x38], ax
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], cx
mov word [esp + 0x44], cx
mov word [esp + 0x48], cx
mov cl, byte [0x10196dbc]
mov word [esp + 0x20], dx
mov word [esp + 0x2a], dx
mov al, 1
mov edx, 0x62
test al, cl
mov word [esp + 0x18], 0x57
mov word [esp + 0x1e], 0x77
mov word [esp + 0x24], 0x44
mov word [esp + 0x2c], 0x72
mov word [esp + 0x2e], 0x71
mov word [esp + 0x30], dx
mov word [esp + 0x32], 0x5e
mov word [esp + 0x36], 0x64
mov word [esp + 0x3a], 0x76
mov word [esp + 0x40], dx
mov word [esp + 0x42], 0x3e
mov word [esp + 0x46], 0x68
jne 0x100addf5
mov bl, cl
push edi
or bl, al
push 0x34
mov byte [0x10196dbc], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10196dc0], eax
xor esi, esi
mov di, word [esp + esi + 0x1c]
mov ecx, edi
and ecx, 0xffff
lea eax, [ecx + 0x10]
and eax, ecx
je 0x100addc4
and eax, 0x10
je 0x100addc4
cdq
xor eax, edx
sub eax, edx
je 0x100addc4
sar eax, 2
jne 0x100addbf
mov ecx, dword [0x10196dc0]
add eax, 0x10
xor eax, edi
mov word [esi + ecx], ax
add esi, 2
cmp esi, 0x32
jb 0x100add9f
mov edx, dword [0x10196dc0]
push 0x100b7980
mov word [edx + 0x32], 0
call fcn.1013c36b
add esp, 4
pop edi
mov eax, dword [0x10196dc0]
lea ecx, [esp + 8]
push eax
call fcn.101161a0
test al, al
jne 0x100ade33
call fcn.10115b10
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x54], 0xffffffff
call fcn.10116170
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret
lea ecx, [esp + 8]
mov dword [esp + 0x54], 0xffffffff
call fcn.10116170
mov ecx, dword [esp + 0x4c]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret
Function at 0x100b1b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016156f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
lea eax, [esp + 8]
push edi
xor ebx, ebx
push eax
mov dword [esp + 0x34], ebx
call fcn.100b18e0
add esp, 4
mov eax, dword [esp + 0x14]
mov edi, 1
cmp eax, ebx
mov dword [esp + 0x3c], edi
jne 0x100b1c0b
mov esi, dword [esp + 0x44]
mov cl, byte [esp + 0xc]
push ebx
mov byte [esi], cl
mov ecx, esi
call fcn.1000bc70
mov edx, dword [0x1016a210]
lea eax, [esp + 0xc]
push edx
push ebx
push eax
mov ecx, esi
call fcn.1000ba60
mov dword [esp + 0x30], edi
push edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], bl
call fcn.1000bc70
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
mov eax, 9
mov word [esp + 0x1c], 0x6c
mov word [esp + 0x24], ax
mov word [esp + 0x2a], ax
mov al, byte [0x10196ce4]
mov word [esp + 0x1e], 0xc
test al, 1
mov word [esp + 0x20], 0x22
mov word [esp + 0x22], 0x1d
mov word [esp + 0x26], 0xf
mov word [esp + 0x28], 5
mov word [esp + 0x2c], 0x16
jne 0x100b1c77
lea ecx, [esp + 0x1c]
or al, 1
push ecx
mov ecx, 0x10196ce8
mov byte [0x10196ce4], al
call fcn.100440f0
push 0x100b83c0
call fcn.1013c36b
add esp, 4
push ebp
mov ebp, dword [0x10196ce8]
push ebp
call fcn.1013c2c2
mov edx, dword [0x1016a210]
mov ecx, dword [esp + 0x1c]
mov esi, eax
sub edx, ecx
add esp, 4
cmp edx, esi
ja 0x100b1c9e
call fcn.101307ab
cmp esi, ebx
jbe 0x100b1cdd
mov eax, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x14]
lea edi, [eax + esi]
push edi
call fcn.1000c010
test al, al
je 0x100b1cd8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push esi
push ebp
lea eax, [ecx + edx*2]
push eax
call fcn.100017d0
add esp, 0xc
lea ecx, [esp + 0x10]
push edi
call fcn.1000bff0
mov edi, 1
mov eax, dword [esp + 0x14]
pop ebp
cmp eax, ebx
jne 0x100b1ceb
mov eax, 0x1016a1d8
push eax
call fcn.100b83d0
mov esi, dword [esp + 0x48]
add esp, 4
test eax, eax
jne 0x100b1d47
mov al, byte [esp + 0x44]
push 0x101913e8
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.1013c2c2
add esp, 4
mov ecx, esi
push eax
push 0x101913e8
call fcn.1000bf40
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], edi
cmp ecx, ebx
mov byte [esp + 0x3c], bl
je 0x100b1d98
mov al, byte [ecx - 1]
cmp al, bl
je 0x100b1d8c
cmp al, 0xff
je 0x100b1d8c
dec al
mov byte [ecx - 1], al
jmp 0x100b1d98
mov cl, byte [esp + 0xc]
mov dword [esi + 4], ebx
mov byte [esi], cl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov edx, dword [0x1016a210]
push edx
lea eax, [esp + 0x10]
push ebx
push eax
mov ecx, esi
call fcn.1000ba60
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], edi
cmp ecx, ebx
mov byte [esp + 0x3c], bl
je 0x100b1d98
mov al, byte [ecx - 1]
cmp al, bl
je 0x100b1d8c
cmp al, 0xff
je 0x100b1d8c
dec al
mov byte [ecx - 1], al
jmp 0x100b1d98
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x100d0e10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
call fcn.100d1030
mov eax, 1
mov word [esp + 0x10], 0x5e
mov word [esp + 0x12], ax
mov word [esp + 0x14], ax
mov al, byte [0x10195908]
mov word [esp + 0x16], 0xb
test al, 1
jne 0x100d0eaf
mov bl, al
push 0xa
or bl, 1
mov byte [0x10195908], bl
call fcn.1013c2df
add esp, 4
mov dword [0x1019590c], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x10]
push edi
mov eax, ebp
mov ecx, 0x1019590c
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x1019590c]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x1019590c]
mov di, word [esi + eax]
add esi, 2
cmp esi, 8
jb 0x100d0e63
push 0x100d1040
mov word [eax + 8], 0
call fcn.1013c36b
add esp, 4
mov edi, dword [0x1019590c]
push edi
call fcn.1013c2c2
mov ebx, dword [esp + 0x28]
add esp, 4
mov ebp, dword [ebx + 8]
cmp ebp, eax
mov esi, ebp
jb 0x100d0ecd
mov esi, eax
mov ecx, dword [ebx + 4]
mov edx, edi
test esi, esi
jbe 0x100d0ef9
mov di, word [ecx]
cmp di, word [edx]
jne 0x100d0ee9
add ecx, 2
add edx, 2
dec esi
jne 0x100d0ed6
jmp 0x100d0ef9
mov cx, word [ecx]
cmp cx, word [edx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
test ecx, ecx
jne 0x100d0f12
cmp ebp, eax
jb 0x100d0f12
xor ecx, ecx
cmp ebp, eax
setne cl
test ecx, ecx
jne 0x100d0f12
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, 0x19
mov ecx, 0x18
mov word [esp + 0x10], ax
mov word [esp + 0x16], ax
mov word [esp + 0x1c], ax
mov al, byte [0x10195910]
test al, 1
mov word [esp + 0x12], 4
mov word [esp + 0x14], 8
mov word [esp + 0x18], 0x12
mov word [esp + 0x1a], cx
mov word [esp + 0x1e], cx
jne 0x100d0fbf
or al, 1
push 0x12
mov byte [0x10195910], al
call fcn.1013c2df
add esp, 4
mov dword [0x10195914], eax
xor esi, esi
mov di, word [esp + esi + 0x10]
mov ecx, edi
and ecx, 0xffff
lea eax, [ecx + 0x7c]
and eax, ecx
je 0x100d0f90
and eax, 0x7c
je 0x100d0f90
cdq
xor eax, edx
sub eax, edx
je 0x100d0f90
sar eax, 2
jne 0x100d0f8b
mov edx, dword [0x10195914]
add eax, 0x7c
xor eax, edi
mov word [esi + edx], ax
add esi, 2
cmp esi, 0x10
jb 0x100d0f6b
mov eax, dword [0x10195914]
push 0x100d1050
mov word [eax + 0x10], 0
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10195914]
push edi
call fcn.1013c2c2
mov ebp, dword [ebx + 8]
add esp, 4
cmp ebp, eax
mov esi, ebp
jb 0x100d0fd9
mov esi, eax
mov ecx, dword [ebx + 4]
mov edx, edi
test esi, esi
jbe 0x100d1005
mov di, word [ecx]
cmp di, word [edx]
jne 0x100d0ff5
add ecx, 2
add edx, 2
dec esi
jne 0x100d0fe2
jmp 0x100d1005
mov cx, word [ecx]
cmp cx, word [edx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
test ecx, ecx
jne 0x100d1019
cmp ebp, eax
jb 0x100d1019
xor ecx, ecx
cmp ebp, eax
setne cl
test ecx, ecx
mov eax, 2
je 0x100d101e
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100d13b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10162356
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dl, byte [esp + 3]
mov eax, ecx
xor ecx, ecx
mov dword [esp + 4], eax
mov dword [eax], ecx
mov byte [eax + 4], dl
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dl, byte [esp + 3]
mov dword [esp + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x24], ecx
mov byte [eax + 0x28], dl
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], 0xffffffff
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x100d1420
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10162376
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov cl, byte [esp + 0x30]
xor eax, eax
mov dword [esi], eax
mov dword [esp + 4], esi
mov byte [esi + 4], cl
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dl, byte [esp + 0x30]
mov dword [esp + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], dl
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
push edx
mov byte [esp + 0x28], 1
push eax
mov ecx, esi
mov byte [0x1018cb5c], 0x93
call fcn.100d14d0
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x100d6120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10162b78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x34]
push esi
mov esi, ecx
sub esp, 0x10
mov dl, byte [eax]
mov ecx, esp
mov dword [esp + 0x14], esp
mov byte [ecx], dl
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov edx, dword [0x1016a210]
push edx
push 0
push eax
call fcn.1000ba60
lea eax, [esp + 0x28]
mov dword [esp + 0x40], 0xffffffff
push eax
call fcn.10023160
lea ecx, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x4c], 1
call fcn.10048390
add esp, 0x1c
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 3
test eax, eax
je 0x100d61c4
mov cl, byte [eax - 1]
test cl, cl
je 0x100d61b8
cmp cl, 0xff
je 0x100d61b8
dec cl
mov byte [eax - 1], cl
jmp 0x100d61c4
add eax, 0xfffffffe
push eax
call fcn.101307a0
add esp, 4
mov eax, dword [esi + 0xc]
lea ecx, [esi + 4]
lea edx, [esp + 8]
push edx
push 1
push eax
call fcn.10024390
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
test ecx, ecx
je 0x100d6217
mov al, byte [ecx - 1]
test al, al
je 0x100d620b
cmp al, 0xff
je 0x100d620b
dec al
mov byte [ecx - 1], al
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop esi
add esp, 0x30
ret 4
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x28]
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x30
ret 4