joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, edx
mov esi, ecx
call fcn.10037660
cmp dword [0x1004cd00], 0
je 0x1000cecd
push 0
push esi
call fcn.1000c150
add esp, 8
test al, 1
jne 0x1000ced7
mov ecx, esi
call fcn.100370e0
cmp eax, 0xffffffff
je 0x1000d04e
mov esi, dword [0x1004dee0]
imul edi, eax, 0x2c
shl bl, 2
mov al, byte [esi + edi + 0x14]
mov byte [ebp - 0xd], al
push 0xff
push 4
call fcn.100077e0
add esp, 8
mov ecx, ebx
mov ebx, eax
not bl
and bl, cl
push 5
call fcn.10009090
add esp, 4
mov al, byte [ebp - 0xd]
mov bh, bl
not bh
and al, bl
mov byte [ebp - 0xe], al
push 0xee
call fcn.10009090
add esp, 4
and al, bh
mov bh, al
movzx eax, bl
push 0x10
push eax
call fcn.100073a0
add esp, 8
mov cl, byte [ebp - 0xd]
or al, bh
movzx eax, al
and cl, 0xfb
xor cl, 0xef
movzx ecx, cl
push eax
push ecx
call fcn.100077e0
add esp, 8
mov ebx, eax
mov al, byte [ebp - 0xe]
and al, 0xf8
movzx eax, al
push 0xff
push eax
call fcn.100073a0
add esp, 8
movzx eax, al
movzx ecx, bl
push eax
push ecx
call fcn.10002bd0
add esp, 8
mov byte [esi + edi + 0x14], al
jmp 0x1000d04a
mov esi, 2
jmp 0x1000d053
push 0
push dword [0x1004e5c4]
call fcn.1000a9a0
add esp, 8
xor esi, esi
test al, 1
jne 0x1000d053
mov eax, dword [0x1004dee0]
shl bl, 2
mov dword [ebp - 0x1c], eax
push 5
call fcn.10009090
add esp, 4
xor al, bl
movzx esi, bl
not al
movzx eax, al
push esi
push eax
call fcn.100073a0
add esp, 8
mov ebx, eax
push 4
push esi
call fcn.100073a0
add esp, 8
mov eax, dword [0x1004e5c4]
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 0xf], bl
not bl
xor edi, edi
mov byte [ebp - 0xe], bl
mov dword [ebp - 0x18], eax
nop
nop
nop
nop
imul eax, edi, 0x2c
mov dword [ebp - 0x20], eax
push 0xff
push dword [esi + eax + 0x14]
call fcn.100077e0
add esp, 8
mov bh, al
push 0xfa
call fcn.10009090
add esp, 4
mov byte [ebp - 0xd], al
push 0x51
call fcn.10009090
add esp, 4
mov bl, al
not bl
push 0x51
call fcn.10009090
add esp, 4
or al, bl
not bh
and bh, al
and bh, byte [ebp - 0xd]
push 0xfa
call fcn.10009090
add esp, 4
mov bl, bh
not bl
mov byte [ebp - 0x11], bl
push 0xff
push 0xb1
call fcn.100077e0
add esp, 8
and bl, 0xb1
mov byte [ebp - 0xd], al
and bh, al
mov byte [ebp - 0x10], bl
push 0xb0
call fcn.10009090
add esp, 4
mov bl, byte [ebp - 0xd]
and al, byte [ebp - 0xe]
movzx ecx, byte [ebp - 0x10]
and bl, byte [ebp - 0xf]
or bl, al
movzx eax, bh
push eax
push ecx
call fcn.10002bd0
add esp, 8
mov bh, al
movzx eax, byte [ebp - 0x11]
xor bh, bl
or al, byte [ebp - 0xe]
movzx eax, al
push 0xff
push eax
call fcn.100077e0
add esp, 8
movzx ecx, byte [ebp - 0xd]
or cl, 0xb1
and cl, al
movzx eax, cl
movzx ecx, bh
push eax
push ecx
call fcn.10002bd0
add esp, 8
mov ecx, dword [ebp - 0x20]
mov byte [esi + ecx + 0x14], al
push 0xba4096fa
call fcn.10008470
add esp, 4
lea eax, [edi + eax + 1]
push 0x2d9156fb
push eax
call fcn.100076e0
add esp, 8
cmp eax, dword [ebp - 0x18]
mov edi, eax
jb 0x1000cf40
xor esi, esi
jmp 0x1000d053
mov esi, 4
call fcn.10038130
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000f480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x1004cde8]
or eax, dword [0x1004cdec]
jne 0x1000f4d0
lea eax, [esp + 0x26]
push eax
push 0x10048ad0
call fcn.1000a030
add esp, 8
mov esi, eax
call fcn.10025910
push esi
push edx
push eax
call fcn.1001ef40
add esp, 0xc
mov dword [0x1004cde8], eax
or eax, edx
mov dword [0x1004cdec], edx
je 0x1000f648
mov ecx, dword [ebp + 0x1c]
xor eax, eax
test ecx, ecx
je 0x1000f4dd
mov ecx, dword [ecx]
jmp 0x1000f4df
xor ecx, ecx
cmp dword [0x1004f08c], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
jne 0x1000f5ba
mov ebx, 0x35fae3d7
xor edi, edi
push 0x800
push 0x100467ba
call fcn.10009650
add esp, 8
mov dword [esp + 4], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov esi, ebx
mov dword [esp + 0x10], edi
shl esi, 8
xor byte [eax + edi], bl
mov edi, esi
shr ebx, 0x18
not edi
push 0x314f1fb2
call fcn.10008470
add esp, 4
and eax, edi
mov edi, eax
push 0x5961204c
push esi
call fcn.100067d0
add esp, 8
mov esi, eax
or esi, edi
xor esi, ebx
xor esi, 0xa69edfb3
push 0xfa9e5aec
call fcn.10008470
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [ecx + eax + 1]
push 0x6d4f9aed
push eax
call fcn.100076e0
add esp, 8
mov edi, eax
cmp eax, 0x800
mov ebx, esi
jne 0x1000f520
push 0
mov esi, dword [esp + 8]
push esi
call fcn.10005f60
add esp, 8
mov dword [0x1004f08c], eax
push esi
call fcn.1002c820
add esp, 4
cmp dword [0x1004f08c], 0
je 0x1000f652
lea eax, [esp + 0x17]
push eax
push 0x10045fa8
call fcn.1000a030
add esp, 8
push eax
push dword [0x1004f08c]
call fcn.1003bc10
add esp, 8
mov ebx, dword [0x1004cde8]
mov edi, dword [0x1004cdec]
mov esi, eax
push 0x97d1c004
call fcn.10008470
add esp, 4
lea ecx, [esp + 8]
push 0
push ecx
push 0
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
push edi
push ebx
call esi
add esp, 0x34
push 0
push 0
push edx
push eax
call fcn.10009550
add esp, 0x10
mov ecx, eax
xor eax, eax
test cl, 1
sete al
jne 0x1000f64a
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x1000f64a
mov eax, dword [esp + 8]
mov dword [ecx], eax
mov eax, 1
jmp 0x1000f64a
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
jne 0x1000f63b
jmp 0x1000f641
Function at 0x1000fb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
push 0
push 0
push dword [0x1004e3b4]
push dword [0x1004e3b0]
call fcn.100097a0
add esp, 0x10
test al, 1
je 0x1000fb9f
lea eax, [esp + 0x1f]
push eax
push 0x1004a470
call fcn.1000a030
add esp, 8
mov esi, eax
call fcn.10025910
push esi
push edx
push eax
call fcn.1001ef40
add esp, 0xc
mov dword [0x1004e3b0], eax
or eax, edx
mov dword [0x1004e3b4], edx
je 0x1000fc91
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
cmp dword [0x1004f09c], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp], edx
jne 0x1000fc34
mov ebx, 0x35fae3d7
xor edi, edi
push 0x800
push 0x100467ba
call fcn.10009650
add esp, 8
mov esi, eax
nop
xor byte [esi + edi], bl
rol ebx, 8
push 1
push 0
call fcn.100076e0
add esp, 8
sub eax, edi
push eax
push 0
call fcn.100076e0
add esp, 8
mov edi, eax
push 0x97d1c801
call fcn.10008470
add esp, 4
cmp edi, eax
jne 0x1000fbe0
push 0
push esi
call fcn.10005f60
add esp, 8
mov dword [0x1004f09c], eax
push esi
call fcn.1002c820
add esp, 4
cmp dword [0x1004f09c], 0
je 0x1000fc95
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
push 0x10045fa8
call fcn.1000a030
add esp, 8
push eax
push dword [0x1004f09c]
call fcn.1003bc10
add esp, 8
mov ecx, esp
lea edx, [esp + 8]
push 0
push esi
push 0
push edi
push 0
push ecx
push 0
push edx
push 0
push ebx
push 5
push dword [0x1004e3b4]
push dword [0x1004e3b0]
call eax
add esp, 0x34
mov ecx, eax
xor eax, eax
or edx, ecx
sete al
jmp 0x1000fc9a
xor eax, eax
jmp 0x1000fc9a
mov eax, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100109e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, ecx
mov cl, byte [ecx]
mov esi, edx
cmp cl, 0x90
je 0x100109fb
test cl, cl
je 0x100109fb
cmp cl, 0xcc
jne 0x10010a4c
mov eax, 1
cmp esi, 2
jb 0x10010a4e
mov eax, 1
mov byte [ebp - 0xd], cl
nop
nop
nop
movzx ecx, byte [edi + eax]
mov byte [ebp - 0xe], cl
push 0x229d0a1d
push eax
call fcn.100076e0
add esp, 8
mov ebx, eax
push 0xb54cca1c
call fcn.10008470
movzx ecx, byte [ebp - 0xd]
add esp, 4
cmp byte [ebp - 0xe], cl
jne 0x10010a4c
lea eax, [ebx + eax + 1]
cmp eax, esi
jne 0x10010a10
mov eax, 1
jmp 0x10010a4e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001ef40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x1004cd40]
or eax, dword [0x1004cd44]
jne 0x1001ef71
call fcn.10033680
mov dword [0x1004cd40], eax
or eax, edx
mov dword [0x1004cd44], edx
je 0x1001f0b3
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
push eax
call fcn.10005160
add esp, 4
mov word [esp + 0x18], ax
add eax, 0xffffbe4a
push 1
push eax
call fcn.10002b50
add esp, 8
add eax, 0x41b6
cmp dword [0x1004cd90], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov word [esp + 0x1a], ax
jne 0x1001f055
mov ebx, 0x35fae3d7
xor esi, esi
push 0x800
push 0x100467ba
call fcn.10009650
add esp, 8
mov dword [esp + 4], eax
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov edi, ebx
shl edi, 8
xor byte [eax + esi], bl
shr ebx, 0x18
push ebx
push edi
call fcn.100067d0
add esp, 8
mov dword [esp + 0x14], eax
push ebx
push edi
call fcn.10006690
add esp, 8
mov ebx, eax
inc esi
or ebx, dword [esp + 0x14]
push 0x97d1c801
call fcn.10008470
add esp, 4
cmp esi, eax
jne 0x1001eff0
push 0
mov esi, dword [esp + 8]
push esi
call fcn.10005f60
add esp, 8
mov dword [0x1004cd90], eax
push esi
call fcn.1002c820
add esp, 4
cmp dword [0x1004cd90], 0
je 0x1001f0a3
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [esp + 0x2f]
push eax
push 0x10045fa8
call fcn.1000a030
add esp, 8
push eax
push dword [0x1004cd90]
call fcn.1003bc10
add esp, 8
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push 0
push ecx
push 0
push 0
push 0
push edx
push esi
push edi
push 4
push dword [0x1004cd44]
push dword [0x1004cd40]
call eax
add esp, 0x2c
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
xor edx, edx
jmp 0x1001f0ab
Function at 0x1001f400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1ec
lea eax, [ebp - 0x1c]
push 0x10
push dword [ebp + 8]
push eax
call fcn.1001e260
add esp, 0xc
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp + 0xc]
xor eax, 0xfa10ba15
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
mov edi, ebx
not edi
push 0xbc70
call fcn.1000a630
add esp, 4
mov esi, eax
and esi, edi
push 0xbc70
call fcn.1000a630
add esp, 4
push 0xffff
push eax
call fcn.10007450
add esp, 8
mov edi, eax
and ebx, edi
or ebx, esi
mov esi, dword [ebp + 0xc]
not esi
push 0xbc70
call fcn.1000a630
add esp, 4
and eax, esi
mov esi, dword [ebp + 0xc]
and edi, esi
push edi
push eax
call fcn.10002e30
add esp, 8
xor eax, ebx
mov word [ebp - 0x18], ax
movzx edi, word [ebp - 0x16]
push 0x97d1c011
call fcn.10008470
add esp, 4
mov ecx, eax
shr esi, cl
push 0xffff
push edi
call fcn.10007450
add esp, 8
mov ecx, esi
and eax, esi
mov ebx, esi
not ecx
and ecx, edi
push ecx
push eax
call fcn.10002e30
add esp, 8
mov esi, eax
push ebx
push edi
call fcn.10007450
add esp, 8
mov word [ebp - 0x16], si
xor edi, edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ebp + edi + 0x10]
movzx eax, byte [ebp + esi - 0x14]
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 0x20], ebx
not al
movzx eax, al
push 0x54
push eax
call fcn.100073a0
add esp, 8
mov ecx, ebx
movzx eax, al
and cl, 0xab
movzx ecx, cl
push ecx
push eax
call fcn.10002bd0
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 0x24]
xor bl, al
xor bl, 0x54
push dword [ebp - 0x20]
push eax
call fcn.100077e0
add esp, 8
mov byte [ebp + esi - 0x14], bl
push 0x700b0d62
call fcn.10008470
add esp, 4
sub edi, eax
mov eax, 0
not esi
add edi, 0xe7dacd64
cmp edi, 4
cmove edi, eax
push esi
push 0
call fcn.100076e0
add esp, 8
mov esi, eax
push 0x97d1c009
call fcn.10008470
add esp, 4
cmp esi, eax
jne 0x1001f4e0
mov eax, dword [ebp + 0x18]
lea ebx, [ebp - 0x1c]
test eax, eax
je 0x1001f5a0
lea esi, [ebp - 0x1f8]
push 0x102
push eax
push esi
call fcn.1001e260
add esp, 0xc
push esi
push 0x10
push ebx
call fcn.1003a170
add esp, 0xc
mov al, byte [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
cmp al, 2
je 0x1001f5ba
cmp al, 1
jne 0x1001f5e2
mov esi, 6
mov eax, 0x10048754
jmp 0x1001f5c4
mov esi, 7
mov eax, str._tH_b
lea ecx, [ebp - 0xf4]
push ecx
push eax
call fcn.1000d690
add esp, 8
push esi
push eax
push edi
call fcn.10001420
add esp, 0xc
lea edi, [edi + esi*2]
push 0xd3a1832
push 0xc
call fcn.10004200
add esp, 8
push 0x28
push edi
push ebx
call eax
add esp, 0x1ec
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10024920
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
xor ebx, ebx
nop
nop
nop
nop
nop
mov eax, 8
mov dword [ebp - 0x18], ebx
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x14], eax
mov eax, ebx
shr eax, 1
mov dword [ebp - 0x10], eax
not eax
mov esi, eax
push 0x7a913639
call fcn.10008470
add esp, 4
and eax, esi
mov dword [ebp - 0x1c], eax
push 0x7a913639
call fcn.10008470
add esp, 4
mov esi, dword [ebp - 0x10]
mov edi, eax
not edi
and esi, edi
or esi, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xedb88320
call fcn.10006690
add esp, 8
and eax, 0xed40f638
and edi, 0xedb88320
push edi
push eax
call fcn.10005680
add esp, 8
mov edi, eax
xor edi, esi
push 0xedb88320
mov esi, dword [ebp - 0x10]
push esi
call fcn.10006690
add esp, 8
test bl, 1
mov ebx, edi
cmove ebx, esi
push 0xffffffffffffffff
push 0
call fcn.100076e0
add esp, 8
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jne 0x10024940
mov eax, dword [ebp - 0x18]
mov dword [eax*4 + 0x1004d0f8], ebx
mov ebx, eax
push 0x67ec8204
call fcn.10008470
add esp, 4
mov esi, eax
push 0x67ec8204
call fcn.10008470
add esp, 4
sub ebx, esi
lea ebx, [ebx + eax + 1]
cmp ebx, 0x100
jne 0x10024930
mov dword [0x1004d524], 0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1002a2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
cmp dword [ebp + 0xc], 0
je 0x1002a433
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, edi
mov ecx, edi
not eax
and ecx, 0x6fbf86e2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], esi
call fcn.10040b00
xor esi, esi
nop
nop
nop
push 0x97d1c018
call fcn.10008470
add esp, 4
mov ecx, eax
mov eax, edi
xor edx, edx
div ecx
mov ebx, edx
mov dword [ebp - 0x20], edx
push 0x79
call fcn.10009090
add esp, 4
movzx eax, al
push eax
push ebx
call fcn.100023c0
add esp, 8
mov ebx, eax
push 0x79
call fcn.10009090
add esp, 4
sub bl, al
add bl, 0x61
push 0x60
call fcn.10009090
add esp, 4
movzx eax, al
push eax
push dword [ebp - 0x20]
call fcn.100023c0
add esp, 8
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], bl
lea ecx, [ebp - 0x2c]
push eax
call fcn.10043490
movsx ebx, byte [ebp - 0xd]
add ebx, edi
mov edi, ebx
not edi
push 0x791b91c
call fcn.10008470
add esp, 4
and eax, edi
and ebx, 0x6fbf86e2
or ebx, eax
push 0x791b91c
call fcn.10008470
add esp, 4
and eax, dword [ebp - 0x1c]
push dword [ebp - 0x18]
push eax
call fcn.10005680
add esp, 8
mov edi, eax
add esi, 0xfc1bc0cc
xor edi, ebx
push 0x6bca00ca
call fcn.10008470
add esp, 4
push eax
push esi
call fcn.100076e0
add esp, 8
mov esi, eax
push 0x97d1c015
call fcn.10008470
add esp, 4
cmp esi, eax
jne 0x1002a310
lea eax, [ebp - 0x31]
push eax
push 0x1004a016
call fcn.1000a030
add esp, 8
lea esi, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.10043410
mov ecx, dword [ebp + 0x10]
push esi
call fcn.10043300
mov ecx, esi
call fcn.10040470
push 1
mov esi, dword [ebp - 0x14]
push esi
inc esi
call fcn.100050e0
add esp, 8
cmp esi, dword [ebp + 0xc]
jne 0x1002a300
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002f100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
lea edi, [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov ecx, edi
call fcn.10044260
lea ebx, [ebp - 0xd]
mov byte [ebp - 0xd], 0x30
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x31
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x32
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x33
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x34
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x35
mov ecx, edi
push ebx
call fcn.10042a90
push 0x37
call fcn.10009090
add esp, 4
mov byte [ebp - 0xd], al
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x37
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x38
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x39
mov ecx, edi
push ebx
call fcn.10042a90
push 0x60
call fcn.10009090
add esp, 4
mov byte [ebp - 0xd], al
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x62
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x63
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x64
mov ecx, edi
push ebx
call fcn.10042a90
mov byte [ebp - 0xd], 0x65
mov ecx, edi
push ebx
call fcn.10042a90
push 0x67
call fcn.10009090
add esp, 4
mov byte [ebp - 0xd], al
mov ecx, edi
push ebx
call fcn.10042a90
mov esi, 0xffffffd8
nop
nop
nop
nop
nop
nop
nop
call fcn.10003320
mov ecx, edi
mov ebx, eax
call fcn.10043290
mov ecx, eax
mov eax, ebx
xor edx, edx
div ecx
mov ecx, edi
push edx
call fcn.10043850
movzx eax, byte [eax]
mov ecx, dword [ebp - 0x14]
mov byte [ecx + esi + 0x28], al
inc esi
jne 0x1002f200
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
mov byte [eax + 0x28], 0
call fcn.10044180
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10030ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x1004d0f0]
or eax, dword [0x1004d0f4]
jne 0x10030f1c
lea eax, [ebp - 0x36]
push eax
push 0x10047870
call fcn.1000a030
add esp, 8
mov esi, eax
call fcn.10025910
push esi
push edx
push eax
call fcn.1001ef40
add esp, 0xc
mov dword [0x1004d0f0], eax
or eax, edx
mov dword [0x1004d0f4], edx
je 0x10030fe9
cmp dword [0x1004d0e4], 0
jne 0x10030f9a
mov ebx, 0x35fae3d7
mov edi, 0xfffff800
push 0x800
push 0x100467ba
call fcn.10009650
add esp, 8
mov dword [ebp - 0x10], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
mov esi, ebx
shl esi, 8
xor byte [eax + edi + 0x800], bl
push 0x97d1c019
call fcn.10008470
add esp, 4
mov ecx, eax
shr ebx, cl
or ebx, esi
inc edi
jne 0x10030f50
push 0
mov esi, dword [ebp - 0x10]
push esi
call fcn.10005f60
add esp, 8
mov dword [0x1004d0e4], eax
push esi
call fcn.1002c820
add esp, 4
cmp dword [0x1004d0e4], 0
je 0x10030fe9
lea eax, [ebp - 0x1d]
push eax
push 0x10045fa8
call fcn.1000a030
add esp, 8
push eax
push dword [0x1004d0e4]
call fcn.1003bc10
add esp, 8
mov ebx, dword [0x1004d0f0]
mov edi, dword [0x1004d0f4]
mov esi, eax
push 0x97d1c003
call fcn.10008470
add esp, 4
push 0
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
push edi
push ebx
call esi
add esp, 0x1c
jmp 0x10030feb
xor eax, eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10032aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
push 0
push esi
call fcn.1000a9a0
add esp, 8
test al, 1
jne 0x10032af5
mov edi, esi
dec edi
je 0x10032af5
nop
nop
nop
mov ebx, edi
push 0xfffffffffffffffe
push 0
call fcn.100076e0
add esp, 8
sub esi, eax
mov eax, dword [ebp + 8]
mov ecx, eax
movzx eax, byte [eax + esi]
xor byte [ecx + edi], al
push 0x82b90285
call fcn.10008470
add esp, 4
sub edi, eax
mov esi, ebx
add edi, 0x1568c283
jne 0x10032ac0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10035910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x1004ccd8]
or eax, dword [0x1004ccdc]
jne 0x1003595c
lea eax, [ebp - 0x40]
push eax
push 0x100465d0
call fcn.1000a030
add esp, 8
mov esi, eax
call fcn.10025910
push esi
push edx
push eax
call fcn.1001ef40
add esp, 0xc
mov dword [0x1004ccd8], eax
or eax, edx
mov dword [0x1004ccdc], edx
je 0x10035a28
cmp dword [0x1004c1b4], 0
jne 0x100359e7
mov ebx, 0x35fae3d7
xor edi, edi
push 0x800
push 0x100467ba
call fcn.10009650
add esp, 8
mov dword [ebp - 0x10], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
mov esi, ebx
shl esi, 8
xor byte [eax + edi], bl
push 0x97d1c019
call fcn.10008470
add esp, 4
mov ecx, eax
shr ebx, cl
or ebx, esi
push 1
push edi
inc edi
call fcn.100050e0
add esp, 8
cmp edi, 0x800
jne 0x10035990
push 0
mov esi, dword [ebp - 0x10]
push esi
call fcn.10005f60
add esp, 8
mov dword [0x1004c1b4], eax
push esi
call fcn.1002c820
add esp, 4
cmp dword [0x1004c1b4], 0
je 0x10035a28
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x22]
push eax
push 0x10045fa8
call fcn.1000a030
add esp, 8
push eax
push dword [0x1004c1b4]
call fcn.1003bc10
add esp, 8
push 0
push esi
push 0
push edi
push 2
push dword [0x1004ccdc]
push dword [0x1004ccd8]
call eax
add esp, 0x1c
jmp 0x10035a2a
xor eax, eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1003e930
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x220
push 0x97d1c105
call fcn.10008470
add esp, 4
lea esi, [ebp - 0x226]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x1e]
push eax
push 0x10046068
call fcn.1000d690
add esp, 8
push 0xffffffffffffffff
push eax
push esi
call fcn.1001db50
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1003e9d4
mov edi, dword [0x1004cd74]
mov esi, eax
push 0x9b74722c
call fcn.10008470
add esp, 4
lea eax, [edi + eax - 0xca5b22c]
mov dword [ebp - 0xc], 0
mov dword [0x1004cd74], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 4
push 0x1004cd74
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x220
pop esi
pop edi
pop ebp
ret
Function at 0x1003ecf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x1003ee08
test eax, eax
je 0x1003ee08
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1003ee08
test ecx, ecx
jle 0x1003ee06
mov edi, dword [0x1004c00c]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
movzx eax, byte [eax + ecx]
push edi
push eax
call fcn.100077e0
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
push 0x97d1c009
call fcn.10008470
add esp, 4
mov esi, edi
mov ecx, eax
shl esi, cl
push 0x97d1c019
call fcn.10008470
add esp, 4
mov ecx, eax
mov eax, esi
shr edi, cl
not eax
mov ecx, edi
mov dword [ebp - 0x20], eax
not ecx
mov ebx, ecx
mov dword [ebp - 0x1c], ecx
push 0x2e56f248
push eax
call fcn.100067d0
add esp, 8
and esi, 0xd1a90db7
mov dword [ebp - 0x18], eax
push 0x2e56f248
push ebx
call fcn.100067d0
add esp, 8
mov dword [ebp - 0x14], eax
push 0xd1a90db7
push edi
call fcn.100067d0
add esp, 8
mov ebx, eax
or esi, dword [ebp - 0x18]
or ebx, dword [ebp - 0x14]
xor ebx, esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.10005680
add esp, 8
mov esi, eax
not esi
push 0xb9873249
call fcn.10008470
add esp, 4
or eax, 0xd1a90db7
push eax
push esi
mov esi, dword [ebp + 0x10]
call fcn.100067d0
mov ecx, dword [ebp + 0xc]
add esp, 8
mov edi, eax
inc dword [ebp - 0x10]
or edi, ebx
inc edi
cmp ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
jne 0x1003ed30
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret