joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1081b20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x1081c21
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x1081c21
push ebx
call fcn.01088840
add esp, 4
test eax, eax
je 0x1081b7a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x1081b81
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x1081b60
jmp 0x1081b83
mov esi, 0x1505
jmp 0x1081b83
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x1081c21
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1081bb4
inc ebp
dec ebx
je 0x1081c1f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x1081c1f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x1081bb0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.01088840
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1081bb0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.01088870
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1081bb0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x1081c1f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x1081c21
mov edi, dword [eax + 8]
jmp 0x1081c21
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1081c50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x1081d54
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x1081d54
push ebx
call fcn.01088840
add esp, 4
test eax, eax
je 0x1081caa
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x1081cb1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x1081c90
jmp 0x1081cb3
mov esi, 0x1505
jmp 0x1081cb3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x1081d54
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1081ce4
inc ebp
dec ebx
je 0x1081d4f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x1081d4f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x1081ce0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.01088840
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1081ce0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.01088870
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1081ce0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x1081d4f
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x1081d54
mov edi, dword [eax + 8]
jmp 0x1081d54
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1081d60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.010888c0
add esp, 8
test eax, eax
je 0x1081dc4
mov esi, eax
jmp 0x1081da4
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.010888c0
add esp, 8
mov esi, eax
test eax, eax
je 0x1081dc4
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.010817d0
add esp, 0xc
xor edi, edi
test eax, eax
je 0x1081d90
cmp dword [eax + 4], 4
jne 0x1081d90
mov edi, dword [eax + 8]
jmp 0x1081d90
xor eax, eax
test edi, edi
je 0x1081e2b
test ebp, ebp
je 0x1081e2b
push ebp
call fcn.01088840
add esp, 4
test eax, eax
je 0x1081e0b
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x1081e12
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x1081df0
jmp 0x1081e14
mov esi, 0x1505
jmp 0x1081e14
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x1081e33
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x1081e54
inc ebx
dec ecx
je 0x1081e29
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x1081e29
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x1081e50
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.01088840
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x1081e50
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.01088870
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x1081e50
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x1081e2b
Function at 0x1081f50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x1081fbd
mov esi, dword [esp + 0x28]
test esi, esi
je 0x1081fbd
push esi
call fcn.01088840
add esp, 4
test eax, eax
je 0x1081f9a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x1081fa1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x1081f80
jmp 0x1081fa3
mov ebx, 0x1505
jmp 0x1081fa3
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x1081fc5
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x1081fd4
inc ebp
dec edi
je 0x1081fbb
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x1081fbb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x1081fd0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.01088840
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x1081fd0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.01088870
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x1081fd0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x1081fbd
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x1081fbd
Function at 0x1082b30
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x1082cc6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov eax, ecx
not eax
or eax, 0xffff
lea edi, [ecx + eax]
inc edi
shr ecx, 0x10
test esi, esi
je 0x1082cbf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x1082bc5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp]
mov ebx, 0x15b0
je 0x1082cbf
xor eax, eax
cmp ebx, 8
mov dword [esp], ebx
mov dword [esp + 8], esi
jb 0x1082c48
and ebx, 0x1ff8
mov dword [esp + 4], ebx
xor eax, eax
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
lea eax, [edx + 8]
movzx ebx, byte [ebp + edx + 6]
add ebx, esi
add ecx, ebx
movzx edi, byte [ebp + edx + 7]
add edi, ebx
mov ebx, dword [esp]
add ecx, edi
add edx, 0xf
cmp edx, ebx
jb 0x1082be0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, dword [esp + 4]
mov edx, eax
sub edx, ebx
jae 0x1082b8d
mov dword [esp + 0xc], edx
mov esi, ebx
and esi, 3
mov dword [esp + 4], eax
mov edx, ebp
je 0x1082c7c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
movzx ebx, byte [edx]
add edi, ebx
add ecx, edi
inc edx
dec esi
jne 0x1082c70
cmp dword [esp + 0xc], 0xfffffffc
ja 0x1082b80
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x1082c90
jmp 0x1082b80
shl ecx, 0x10
add ecx, edi
jmp 0x1082ccb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1082ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1082d41
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
not ecx
test edx, edx
je 0x1082d38
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [eax + esi]
mov ebx, ecx
shr ebx, 4
and ecx, 0xf
mov ebp, edi
not ebp
or ebp, 0xf
add ebp, edi
inc ebp
xor ebp, ecx
xor ebx, dword [ebp*4 + 0x10c280c]
mov ecx, ebx
shr ecx, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor ecx, dword [edi*4 + 0x10c280c]
inc esi
cmp edx, esi
jne 0x1082d00
lea eax, [ecx + ecx]
not eax
add eax, ecx
jmp 0x1082d43
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1088de0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x10ca6c0], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x10cb07c], ecx
test eax, eax
je 0x1088e31
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x10cb080], ecx
add eax, 2
jmp 0x1088df0
mov dword [0x10ca6bc], 0x270
ret

Function at 0x1089050
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x10890c9
xor eax, eax
mov edx, 0x4e0
mov esi, 0x80000000
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ecx + eax*4 + 4]
and ebx, esi
mov edi, edx
and edi, 2
mov ebp, eax
xor ebp, 1
add ebp, edi
mov edi, dword [ecx + ebp*4 + 4]
mov ebp, edi
and ebp, 0x7ffffffe
or ebp, ebx
shr ebp, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, ebp
mov ebx, dword [ecx + eax*4 + 0x638]
mov ebp, edi
and ebp, ebx
add edi, ebx
add ebp, ebp
sub edi, ebp
mov dword [ecx + eax*4 + 0x9c4], edi
inc eax
add edx, 2
cmp eax, 0x270
jne 0x1089070
mov eax, 0x270
jmp 0x10890db
cmp eax, 0x4e0
jb 0x10890db
mov esi, ecx
call fcn.01089120
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov ecx, edx
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, edx
mov eax, ecx
shl eax, 0xf
and eax, 0xefc60000
xor eax, ecx
mov edx, eax
shr edx, 0x12
or eax, edx
and edx, ecx
sub eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1089120
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 - 0x630]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0x1089130
mov eax, 0x353
mov edx, 0x7fffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edi, [eax - 0x270]
mov esi, dword [ecx + eax*4 + 4]
mov ebx, esi
or ebx, 0x80000000
xor esi, 0x7fffffff
and esi, ebx
and edi, 1
mov ebx, eax
or ebx, 1
add ebx, edi
mov edi, dword [ecx + ebx*4 + 4]
and edi, edx
or edi, esi
mov esi, edi
shr esi, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor esi, dword [ecx + eax*4 - 0xd48]
xor esi, edi
mov dword [ecx + eax*4 - 0x9bc], esi
inc eax
cmp eax, 0x4df
jne 0x1089180
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x108b060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x108b2cb
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x108b09c
cmp edx, esi
jae 0x108b2cb
test edi, edi
je 0x108b2cb
movzx ebp, bl
test bl, bl
js 0x108b0d0
inc edx
lea ebx, [eax + 2]
mov word [eax], bp
mov ecx, ebx
sub ecx, eax
sar ecx, 1
sub edi, ecx
mov eax, ebx
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x108b090
jmp 0x108b2cb
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x108b10f
cmp bl, 0xc2
jb 0x108b0bc
mov bh, byte [edx + 1]
movzx ecx, bh
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x108b16d
and ebp, 0x1f
shl ebp, 6
add edx, 2
and ecx, 0x3f
or ecx, ebp
lea ebx, [eax + 2]
mov word [eax], cx
mov esi, dword [esp + 0x24]
jmp 0x108b0b2
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x108b139
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x108b177
cmp ebp, 0xe0
jne 0x108b185
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jae 0x108b185
jmp 0x108b17c
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x108b2a2
cmp bl, 0xf4
ja 0x108b0bc
movzx ecx, byte [edx + 1]
je 0x108b1d3
cmp ebp, 0xf0
jne 0x108b1d8
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x108b17c
jmp 0x108b1d8
inc edx
mov esi, dword [esp + 0x24]
jmp 0x108b0be
cmp cl, 0x9f
jbe 0x108b185
mov esi, dword [esp + 0x24]
jmp 0x108b0bc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x108b2a9
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x108b2b3
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ebx, [eax + 2]
mov word [eax], si
mov esi, dword [esp + 0x24]
jmp 0x108b0b2
cmp cl, 0x8f
ja 0x108b17c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x108b2a9
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x108b2b3
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x108b2bf
and bl, 7
movzx esi, bl
shl esi, 0x12
shl ecx, 0xc
mov ebx, ecx
and ebx, 0x3f000
or ebx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ebx
add edx, 4
mov esi, ebp
and esi, 0x1ff800
cmp esi, 0xd800
je 0x108b17c
mov ebx, dword [esp]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
jb 0x108b17c
cmp edi, 2
mov esi, dword [esp + 0x24]
jb 0x108b2a2
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
xor ebx, 0x2000
or ecx, 0x3ff
and ecx, ebx
or ecx, 0xdc00
lea ebx, [eax + 4]
mov word [eax + 2], cx
jmp 0x108b0b2
mov ebx, eax
jmp 0x108b0b2
inc edx
mov esi, dword [esp + 0x24]
jmp 0x108b0bc
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x108b0be
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x108b0be
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x108b780
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x10cba78]
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x108b82e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x10c5d84]
mov eax, dword [0x10c5d94]
nop
nop
nop
nop
nop
nop
jmp eax
Function at 0x108be40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [esp + 0x3c], 0xb11f8fc3
mov dword [esp + 0x40], 0xb5d9b32a
mov dword [esp + 0x44], 0xb9dab7d8
mov dword [esp + 0x48], 0xbdebbbdb
mov dword [esp + 0x4c], 0xa190bfeb
mov dword [esp + 0x50], 0xa582a3f0
mov dword [esp + 0x54], 0xa9dfa78c
mov dword [esp + 0x58], 0xadc4abc3
mov dword [esp + 0x5c], 0xd13fafc8
mov dword [esp + 0x60], 0xd547d349
mov dword [esp + 0x64], 0xd998d7f4
mov dword [esp + 0x68], 0xddfadbac
mov dword [esp + 0x6c], 0xc18edf8f
mov dword [esp + 0x70], 0xc592c3ee
mov dword [esp + 0x74], 0xc9e6c799
mov dword [esp + 0x78], 0xcda1cbb1
mov dword [esp + 0x7c], 0xf198cfa2
mov dword [esp + 0x80], 0xf5aff3a4
mov dword [esp + 0x84], 0xf96ef7d4
mov dword [esp + 0x88], 0xfdaefbae
mov dword [esp + 0x8c], 0xe1deffd7
mov dword [esp + 0x90], 0xe572e3a3
mov dword [esp + 0x94], 0xe98ae774
mov dword [esp + 0x98], 0xed93eb8f
mov dword [esp + 0x9c], 0x118cef8b
mov dword [esp + 0xa0], 0x1579135d
mov dword [esp + 0xa4], 0x19471780
mov dword [esp + 0xa8], 0x1d4f1b4f
mov dword [esp + 0xac], 0x1301f45
mov dword [esp + 0xb0], 0x5540355
mov dword [esp + 0xb4], 0x92e0724
mov dword [esp + 0xb8], 0xd420b45
mov dword [esp + 0xbc], 0x31410f78
mov dword [esp + 0xc0], 0x351e337c
mov dword [esp + 0xc4], 0x395a3714
mov dword [esp + 0xc8], 0x3d573b53
mov dword [esp + 0xcc], 0x211e3f5b
mov dword [esp + 0xd0], 0x25452369
mov dword [esp + 0xd4], 0x294b2741
mov dword [esp + 0xd8], 0x2d012bb9
mov dword [esp + 0xdc], 0x516b2f0c
mov dword [esp + 0xe0], 0x55c05338
mov dword [esp + 0xe4], 0x593957c5
mov dword [esp + 0xe8], 0x5d0b5b3f
mov dword [esp + 0xec], 0x410d5f0f
mov dword [esp + 0xf0], 0x456c431b
mov dword [esp + 0xf4], 0x49684714
mov dword [esp + 0xf8], 0x4d644b18
mov dword [esp + 0xfc], 0x716e4f1c
mov dword [esp + 0x100], 0x75117305
mov dword [esp + 0x104], 0x79157712
mov dword [esp + 0x108], 0x7d117bea
mov dword [esp + 0x10c], 0x61297f2d
mov dword [esp + 0x110], 0x653b6335
mov dword [esp + 0x114], 0x6933674a
mov dword [esp + 0x118], 0x6d6a6b3e
mov byte [esp + 0x11c], 0
mov eax, dword [0x10cba6c]
mov ecx, 0x1f195f1d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x1f195ee1]
xor edx, ecx
mov esi, edx
not esi
or esi, 0x6481246e
add esi, edx
inc esi
mov ebx, esi
and ebx, 2
mov ebp, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and ebp, 0xfd
imul ebp, ebx
xor edx, 0x6e
add edx, esi
add edx, ebp
inc dl
mov byte [esp + ecx - 0x1f195ee1], dl
inc ecx
cmp ecx, 0x1f195ffe
jne 0x108c0a0
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x10c5e24]
mov ecx, 0x352ce1e0
xor ecx, dword [0x10c5e2c]
add ecx, edx
inc ecx
jmp ecx
Function at 0x108c8b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
mov dword [esp + 0x34], 0x118f1f63
mov dword [esp + 0x38], 0x1589139a
mov dword [esp + 0x3c], 0x98a1788
mov dword [esp + 0x40], 0xd5b0b6b
mov dword [esp + 0x44], 0x1500f5b
mov dword [esp + 0x48], 0x5220350
mov dword [esp + 0x4c], 0x396f075c
mov dword [esp + 0x50], 0x3da43ba3
mov dword [esp + 0x54], 0x31af3f58
mov dword [esp + 0x58], 0x35a733b9
mov dword [esp + 0x5c], 0x29483714
mov dword [esp + 0x60], 0x2d0a2b5c
mov dword [esp + 0x64], 0x217e2f7f
mov dword [esp + 0x68], 0x2572237e
mov dword [esp + 0x6c], 0x59062769
mov dword [esp + 0x70], 0x5dc15b31
mov dword [esp + 0x74], 0x51085fc2
mov dword [esp + 0x78], 0x551f5304
mov dword [esp + 0x7c], 0x49de5774
mov dword [esp + 0x80], 0x4d1e4b1e
mov dword [esp + 0x84], 0x416e4f17
mov dword [esp + 0x88], 0x45d24303
mov dword [esp + 0x8c], 0x79da47d4
mov dword [esp + 0x90], 0x7d137b1f
mov dword [esp + 0x94], 0x711c7f1b
mov dword [esp + 0x98], 0x75e9730d
mov dword [esp + 0x9c], 0x692777e0
mov dword [esp + 0xa0], 0x6d3f6b3f
mov dword [esp + 0xa4], 0x61306f25
mov dword [esp + 0xa8], 0x65346335
mov dword [esp + 0xac], 0x993e6744
mov dword [esp + 0xb0], 0x9de29be5
mov dword [esp + 0xb4], 0x91e19fe8
mov dword [esp + 0xb8], 0x95ce93ec
mov dword [esp + 0xbc], 0x890a97b4
mov dword [esp + 0xc0], 0x8d178b13
mov dword [esp + 0xc4], 0x81ae8feb
mov dword [esp + 0xc8], 0x85e583f9
mov dword [esp + 0xcc], 0xb91b87e1
mov dword [esp + 0xd0], 0xbde1bb29
mov dword [esp + 0xd4], 0xb1fbbf9c
mov dword [esp + 0xd8], 0xb520b328
mov dword [esp + 0xdc], 0xa929b725
mov dword [esp + 0xe0], 0xadfbabcf
mov dword [esp + 0xe4], 0xa1fdafff
mov dword [esp + 0xe8], 0xa5fca3eb
mov dword [esp + 0xec], 0xd9f8a7f4
mov dword [esp + 0xf0], 0xdd84db88
mov dword [esp + 0xf4], 0xd1fedf8c
mov dword [esp + 0xf8], 0xd5b1d3a5
mov dword [esp + 0xfc], 0xc9b5d7b2
mov dword [esp + 0x100], 0xcd51cb5a
mov dword [esp + 0x104], 0xc199cf9d
mov dword [esp + 0x108], 0xc58bc395
mov dword [esp + 0x10c], 0xf993c79a
mov dword [esp + 0x110], 0xfdfafbae
mov byte [esp + 0x114], 0
mov eax, dword [0x10cba6c]
mov dword [esp], eax
xor ecx, ecx
xor esi, esi
nop
nop
nop
movzx ebx, byte [esp + esi + 0x34]
mov edi, ecx
and edi, 0xa
mov edx, esi
xor edx, 0x3dde1305
add edx, edi
mov edi, edx
and edi, ebx
mov eax, edi
and eax, 0xfffffffd
mov ebp, edi
or ebp, 0xfffffffd
inc ebp
imul ebp, eax
mov eax, edi
and eax, 2
or edi, 2
imul edi, eax
sub ebp, edi
add edx, ebx
add edx, ebp
mov edi, edx
and edi, 0xcaa9a0e4
mov eax, edx
and eax, 2
mov ebx, eax
xor ebx, 2
imul ebx, edi
or edi, 2
imul edi, eax
mov eax, edx
xor eax, 0xe6
add eax, ebx
add eax, edi
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
mov byte [esp + esi + 0x34], al
inc esi
add ecx, 2
cmp esi, 0xe1
jne 0x108cb00
lea eax, [esp + 0x34]
push 0
push 0
push 0
push 0
push eax
call dword [esp + 0x14]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov eax, dword [eax*4 + 0x10c6030]
mov ecx, 0xe03e010e
xor ecx, dword [0x10c6038]
add eax, ecx
inc eax
jmp eax