joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002c6a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov edx, dword [esp + 0x14]
mov dword [ecx], vtable.CvStatModel.0
mov dword [esp], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov dword [esp + 0xc], 0
mov dword [ecx], vtable.CvANN_MLP.0
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
movsd xmm0, qword [edx + 0x18]
movsd qword [ecx + 0x18], xmm0
movsd xmm0, qword [edx + 0x20]
movsd qword [ecx + 0x20], xmm0
movsd xmm0, qword [edx + 0x28]
movsd qword [ecx + 0x28], xmm0
movsd xmm0, qword [edx + 0x30]
movsd qword [ecx + 0x30], xmm0
movsd xmm0, qword [edx + 0x38]
movsd qword [ecx + 0x38], xmm0
movsd xmm0, qword [edx + 0x40]
movsd qword [ecx + 0x40], xmm0
mov eax, dword [edx + 0x48]
mov dword [ecx + 0x48], eax
mov eax, dword [edx + 0x4c]
mov dword [ecx + 0x4c], eax
mov eax, dword [edx + 0x50]
mov dword [ecx + 0x50], eax
movdqu xmm0, xmmword [edx + 0x58]
movdqu xmmword [ecx + 0x58], xmm0
movdqu xmm0, xmmword [edx + 0x68]
movdqu xmmword [ecx + 0x68], xmm0
movdqu xmm0, xmmword [edx + 0x78]
movdqu xmmword [ecx + 0x78], xmm0
movdqu xmm0, xmmword [edx + 0x88]
movdqu xmmword [ecx + 0x88], xmm0
movdqu xmm0, xmmword [edx + 0x98]
movdqu xmmword [ecx + 0x98], xmm0
mov byte [esp + 0xc], 1
mov eax, dword [edx + 0xa8]
mov dword [ecx + 0xa8], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x100111b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1002c6c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], vtable.CvMLData.0
lea ecx, [edi + 0x34]
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
movzx eax, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
lea eax, [esi + 0x34]
push ecx
push eax
mov dword [esp + 0x24], ecx
call fcn.10018900
mov dword [esp + 0x14], 1
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100116e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1002c758
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov edx, dword [esp + 0x14]
mov dword [ecx], vtable.CvAdaptiveSkinDetector.0
mov dword [esp], ecx
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x18], eax
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x1c], eax
movsd xmm0, qword [edx + 0x20]
movsd qword [ecx + 0x20], xmm0
movsd xmm0, qword [edx + 0x28]
movsd qword [ecx + 0x28], xmm0
mov dword [ecx + 0x30], vtable.CvAdaptiveSkinDetector::Histogram.0
mov eax, dword [edx + 0x34]
mov dword [ecx + 0x34], eax
mov dword [esp + 0xc], 0
mov dword [ecx + 0x38], vtable.CvAdaptiveSkinDetector::Histogram.0
mov eax, dword [edx + 0x3c]
mov dword [ecx + 0x3c], eax
mov byte [esp + 0xc], 1
mov eax, dword [edx + 0x40]
mov dword [ecx + 0x40], eax
mov eax, dword [edx + 0x44]
mov dword [ecx + 0x44], eax
mov eax, dword [edx + 0x48]
mov dword [ecx + 0x48], eax
mov eax, dword [edx + 0x4c]
mov dword [ecx + 0x4c], eax
mov eax, dword [edx + 0x50]
mov dword [ecx + 0x50], eax
mov eax, dword [edx + 0x54]
mov dword [ecx + 0x54], eax
mov eax, dword [edx + 0x58]
mov dword [ecx + 0x58], eax
mov eax, dword [edx + 0x5c]
mov dword [ecx + 0x5c], eax
mov eax, dword [edx + 0x60]
mov dword [ecx + 0x60], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x10011b70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1002c805
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
call fcn.100172c0
mov dword [esp + 0x18], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.100172c0
mov byte [esp + 0x18], 1
lea esi, [ebx + 0x1c]
mov eax, dword [edi + 0x18]
lea ecx, [esi + 8]
mov dword [ebx + 0x18], eax
mov dword [esi], vtable.cv::Octree.0
mov eax, dword [edi + 0x20]
mov dword [esi + 4], eax
lea eax, [edi + 0x24]
push eax
mov dword [esp + 0x24], esi
call fcn.100172c0
mov byte [esp + 0x18], 2
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x14]
call fcn.100174e0
mov dword [esp + 0x18], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10012370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002c8d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], vtable.CFileBase.0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov dword [esp + 0x14], 0
lea ecx, [edi + 0xc]
mov dword [edi], vtable.CFileDisk.0
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0xc]
push eax
call fcn.10003680
mov byte [esp + 0x14], 1
lea ecx, [edi + 0x2c]
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov dword [ecx], vtable.CFileBase.0
mov eax, dword [esi + 0x30]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 0x1c], ecx
mov dword [ecx + 8], eax
mov byte [esp + 0x14], 2
mov dword [ecx], vtable.CFileMemory.0
mov eax, dword [esi + 0x38]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x3c]
mov dword [ecx + 0x10], eax
movzx eax, byte [esi + 0x40]
mov byte [ecx + 0x14], al
mov eax, dword [esi + 0x44]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x48]
mov dword [ecx + 0x1c], eax
mov byte [esp + 0x14], 3
movzx eax, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100148c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1002cabc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edi, ecx
push 0xffffffffffffffff
push eax
push esi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov dword [esp + 0x14], edi
mov word [edi], ax
call fcn.10003680
mov dword [esp + 0x14], 0
lea ecx, [edi + 0x24]
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x21], al
movzx eax, byte [esi + 0x22]
mov byte [edi + 0x22], al
movzx eax, byte [esi + 0x23]
mov byte [edi + 0x23], al
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x24]
push eax
call fcn.10003680
mov byte [esp + 0x14], 1
lea ecx, [edi + 0x5c]
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x5c]
push eax
call fcn.10003680
mov byte [esp + 0x14], 2
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
movzx eax, byte [esi + 0x8c]
mov byte [edi + 0x8c], al
movzx eax, byte [esi + 0x8d]
lea ecx, [edi + 0xa0]
mov byte [edi + 0x8d], al
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x94]
mov dword [edi + 0x94], eax
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0xa0]
push eax
call fcn.10003680
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1001cdb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, edx
cmp ecx, ebx
je 0x1001cef8
push esi
push edi
mov edi, dword [esp + 0x10]
lea esi, [ecx + 0x1c]
lea eax, [esi - 0x1c]
cmp edi, eax
je 0x1001cdda
push 0xffffffffffffffff
push 0
lea eax, [esi - 0x1c]
mov ecx, edi
push eax
call fcn.10003680
mov eax, dword [esi - 4]
lea ecx, [edi + 0x24]
mov dword [edi + 0x18], eax
mov eax, dword [esi]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 4]
mov byte [edi + 0x20], al
movzx eax, byte [esi + 5]
mov byte [edi + 0x21], al
movzx eax, byte [esi + 6]
mov byte [edi + 0x22], al
movzx eax, byte [esi + 7]
mov byte [edi + 0x23], al
lea eax, [esi + 8]
cmp ecx, eax
je 0x1001ce15
push 0xffffffffffffffff
push 0
push eax
call fcn.10003680
mov eax, dword [esi + 0x20]
lea ecx, [edi + 0x5c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x58], eax
lea eax, [esi + 0x40]
cmp ecx, eax
je 0x1001ce59
push 0xffffffffffffffff
push 0
push eax
call fcn.10003680
mov eax, dword [esi + 0x58]
lea ecx, [edi + 0xa0]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x88], eax
movzx eax, byte [esi + 0x70]
mov byte [edi + 0x8c], al
movzx eax, byte [esi + 0x71]
mov byte [edi + 0x8d], al
mov eax, dword [esi + 0x74]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x94], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x9c], eax
lea eax, [esi + 0x84]
cmp ecx, eax
je 0x1001cedb
push 0xffffffffffffffff
push 0
push eax
call fcn.10003680
add esi, 0xb8
add edi, 0xb8
lea ecx, [esi - 0x1c]
cmp ecx, ebx
jne 0x1001cdc4
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 8]
pop ebx
ret
Function at 0x1001ce71
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, edx
cmp ecx, ebx
je 0x1001cef8
push esi
push edi
mov edi, dword [esp + 0x10]
lea esi, [ecx + 0x1c]
lea eax, [esi - 0x1c]
cmp edi, eax
je 0x1001cdda
push 0xffffffffffffffff
push 0
lea eax, [esi - 0x1c]
mov ecx, edi
push eax
call fcn.10003680
mov eax, dword [esi - 4]
lea ecx, [edi + 0x24]
mov dword [edi + 0x18], eax
mov eax, dword [esi]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 4]
mov byte [edi + 0x20], al
movzx eax, byte [esi + 5]
mov byte [edi + 0x21], al
movzx eax, byte [esi + 6]
mov byte [edi + 0x22], al
movzx eax, byte [esi + 7]
mov byte [edi + 0x23], al
lea eax, [esi + 8]
cmp ecx, eax
je 0x1001ce15
push 0xffffffffffffffff
push 0
push eax
call fcn.10003680
mov eax, dword [esi + 0x20]
lea ecx, [edi + 0x5c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x58], eax
lea eax, [esi + 0x40]
cmp ecx, eax
je 0x1001ce59
push 0xffffffffffffffff
push 0
push eax
call fcn.10003680
mov eax, dword [esi + 0x58]
lea ecx, [edi + 0xa0]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x88], eax
movzx eax, byte [esi + 0x70]
mov byte [edi + 0x8c], al
movzx eax, byte [esi + 0x71]
mov byte [edi + 0x8d], al
mov eax, dword [esi + 0x74]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x94], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x9c], eax
lea eax, [esi + 0x84]
cmp ecx, eax
je 0x1001cedb
push 0xffffffffffffffff
push 0
push eax
call fcn.10003680
add esi, 0xb8
add edi, 0xb8
lea ecx, [esi - 0x1c]
cmp ecx, ebx
jne 0x1001cdc4
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 8]
pop ebx
ret

Function at 0x1008fe27
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [ebp + 0xcc53f]
or al, 0
push 0xc35a227
call fcn.10128f04
xor eax, 0x90cde80c
or dword [eax], eax
stosd dword es:[edi], eax
sbb ebp, 0x1dd0956
inc edx
pushal
jg 0x1008fe30
cmp al, 0xfd
into
jp 0x1008fe35
jno 0x1008fe2b
pop ebp
ror byte [ebp - 0x3f], cl
pop ebp
sbb eax, 0x58996561
lodsd eax, dword [esi]
adc eax, 0xac76c8a9
adc esp, dword [ebx - 0x1ef7a944]
std
push cs
ljmp 0x35a9

Function at 0x100dcc76
Capabilities:
Encode data using xor

Disassembly:
call fcn.10124190
xor byte [ebp + 0x3a], ah
invalid

Function at 0x100e15a5
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esp, [esp + 0x14]
jg 0x100ea656
push eax
bswap eax
mov eax, 0x10758c2
movzx ax, al
mov eax, dword [esp + 4]
jmp fcn.100fca88
Function at 0x10108924
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x30], edi
lea edi, [ecx + 0xbbcb54f]
mov word [esp], si
bswap di
mov edi, 0x10026e6a
mov word [esp], cx
mov edi, dword [edi + 0xbc554]
call fcn.100c5772
push edx
mov bl, 0x6c
jp 0x101089b2
cmp esp, ecx
fnstsw word [ebp + 0x26223d6f]
fld dword [ebp + 0x56]
sub dword [edx], ebp
adc eax, 0xf1ae11ad
std
inc ecx
mov ebp, 0x44be01e2
sbb ch, ch
mov al, byte [0xf936a83e]
dec ebx
push ebx
imul ebx, dword fs:[ebp + ebp*4 + 0x6563c898], 0xd5c9b59d
leave
invalid
mov eax, 0x6680eb58
or dword [ecx], esi
and byte [esi + 9], 0x31
dec ebp
xchg edx, eax
pushfd
pop esp
sub dword [ebx - 0x2d], 0xffffff9e
mov al, byte [0xa3f2e124]
sbb al, 0xd5
xor byte [ecx - 0x5d], al
pop ecx
in eax, 0x26
jge 0x101089af
xor dword [ebx + eax*4 + 0x5b], edx
ret 0x4282

Function at 0x1011ab35
Capabilities:
Encode data using xor

Disassembly:
pushal
mov dword [esp + 0x30], eax
mov byte [esp], 0x37
mov al, dl
pushfd
movzx ax, bl
mov eax, 0x1000e2fb
call fcn.100ecbb6
nop
imul edx, dword [ebx - 0xc], 0xffffff8b
adc byte [edi - 0x3d], ch
jnp 0x100fa8ad
ret
invalid
xor ebp, dword [edx + ebp - 0x3031b9cb]
les ecx, [ebx + 0x77]
cmp al, 0x82
invalid
mov bh, dl
mov esi, 0xc664106e
mov byte [0x87373dfc], al
push edx
push edx
sub ebp, dword [esi + 0x33f5d020]
pop esp
inc edx
push ebx
sub edx, dword [ebp + edx*8 - 0x3e92cec9]
pushfd
and bl, byte [edi - 0x354b4be7]
add byte [ebx], dh
into
sub dl, ah
invalid
cmp bh, byte [edx]
push cs
jo 0x100fa834
stosd dword es:[edi], eax
shl esp, cl
inc esi
pop eax
imul ebp, dword [ebp - 0x79], 0xb7e30bc9
pop es
pop eax
mov ah, 0xd5
out dx, eax
clc
xchg edi, eax
pop es
dec eax
jnp 0x100fa86e
daa
imul esp
rcl dword [edx + ebp], cl
dec eax
push esi
test al, 3
js 0x100fa8f1
sbb byte [ebp + 0x7a84083a], dh
or eax, 0x1f0e9011
mov ch, 0x3a
or byte [edx + edi*2 + 0xe90110d], al
pop ds
or eax, 0x1d27c571
popal
jb 0x100fa87e
jg 0x100fa944
std
sar ebp, 0x8f
sub dword [eax - 0x76], 0x24
imul esi, dword [ebx], 0x44
shr dword [ebp - 0xa76af12], 1
pop dword [ebx + 0x6b248a68]
xor eax, dword [ecx + edx*8 - 0x53]
out dx, al
push eax
mov ebp, esi
jnp 0x100fa8d8
test byte [ecx], bl
cmp eax, 0x32843ac9
push es
pop ebp
mov byte [eax + 0x28], al
aaa
mov esi, cs
mov ds, edi
adc ah, 0xd5
dec ecx
mov al, byte [ebx]
cli
movsb byte es:[edi], byte [esi]
in eax, 0x78
inc esi
xchg dword [bx + si + 0x33d4], esi
xchg ecx, eax
test eax, 0xbcaf28ac
ret 0x53d3
push cs
nop
mov eax, dword [0x12d0d8e0]
cmc
mov esi, 0x3eb28500
xor byte [edi + 0x52faa5e4], cl
push edx
xor byte [esi + 0x5f], cl
mov edx, ecx
sub al, 0x15
dec edx
pop ebx
jo 0x100fa932
or al, 0x54
mov bl, 0x50
outsb dx, byte [esi]
invalid
mov byte [esp], dl
jmp 0x100fa813
Function at 0x102a320
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 8

Function at 0x102a350
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x102a380
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c0]
push esi
call ecx
xor eax, eax
test esi, esi
setne al
pop esi
pop ebp
ret 0xc

Function at 0x102e580
Capabilities:
Get disk information via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x260]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push eax
call ecx
mov esi, eax
test esi, esi
je 0x102e5dc
cmp esi, 0xffffffff
je 0x102e5dc
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi + 0x25c]
push ebx
lea edx, [ebp + 0xc]
push edx
push 0xc
push eax
push ebx
push ebx
push 0x2d1080
push esi
call ecx
test eax, eax
je 0x102e5d3
mov ebx, 1
mov edx, dword [edi + 0x1c0]
push esi
call edx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x102ead0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x102eb18
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x102eb17
mov ecx, 1
cmp edi, ecx
jbe 0x102eb14
movzx eax, byte [ebp + 0x10]
cdq
push ebx
mov ebx, 0xff
idiv ebx
lea eax, [esi + 1]
or esi, 0xffffffff
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
inc ecx
xor byte [eax], bl
inc eax
cmp ecx, edi
jb 0x102eb01
mov esi, dword [ebp + 8]
pop ebx
xor byte [esi], 0xac
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x102eb30
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x102eb73
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x102eb73
xor byte [esi], 0xac
lea ecx, [eax - 1]
test ecx, ecx
jbe 0x102eb73
movzx eax, byte [ebp + 0x10]
push edi
cdq
mov edi, 0xff
idiv edi
pop edi
lea eax, [ecx + esi]
or esi, 0xffffffff
push ebx
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
dec ecx
xor byte [eax], bl
dec eax
test ecx, ecx
ja 0x102eb63
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x102f200
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push edi
push 0x15
push 8
xor edi, edi
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x102f264
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esi + 4], ecx
lea ecx, [ebp + 8]
push ecx
push edi
push esi
push 0x102f090
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push edi
push edi
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x102f258
cmp edi, 0xffffffff
jne 0x102f266
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x102fbe0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x102fbf2
xor eax, eax
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
cmp esi, 8
jb 0x102fcb4
mov edi, esi
shr edi, 3
push ebx
lea esp, [esp]
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
inc ecx
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
inc ecx
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
inc ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
inc ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
inc ecx
sub esi, 8
sub edi, 1
jne 0x102fc10
pop ebx
test esi, esi
je 0x102fcd7
jmp 0x102fcc0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edx + edi*4]
inc ecx
sub esi, 1
jne 0x102fcc0
pop edi
not eax
pop esi
pop ebp
ret 0x10