joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010df4
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x10045d65
call fcn.10044b2e
push 0x5f
xor ebx, ebx
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10047d54]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10010e24
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x10010e07
mov byte [ebp - 0x15], bl
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
call fcn.10021a34
or dword [ebp - 4], 0xffffffff
movaps xmm0, xmmword [0x1004ccb0]
movups xmmword [ebp - 0x60], xmm0
pop ecx
movaps xmm0, xmmword [0x1004d2d0]
mov ecx, ebx
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0xd6f5feee
mov dword [ebp - 0x3c], 0xd5c5da93
mov dword [ebp - 0x38], 0xfef8fddf
mov word [ebp - 0x34], 0x100
lea eax, [ecx + 0x6f]
xor byte [ebp + ecx - 0x60], al
inc ecx
cmp ecx, 0x2c
jb 0x10010e71
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x33], bl
mov dword [ebp - 0x1c], 0xf3ecedee
mov dword [ebp - 0x18], 0xf7f0f1f2
mov word [ebp - 0x14], 0x100
call fcn.100013e4
push ecx
lea ecx, [ebp - 0x60]
mov edx, 0x100c6840
push ecx
mov ecx, eax
call fcn.10028ac7
cmp dword [0x100c6840], 6
pop ecx
pop ecx
jne 0x10010ef1
push ecx
mov dword [esp], 0x3f800000
lea eax, [ebp - 0x64]
push str._.3f
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0xc2480000
push eax
push 0x100509ac
push 4
pop edx
mov ecx, str.APosX
mov dword [ebp - 0x64], 0x42480000
call fcn.10023a89
add esp, 0x14
mov ecx, 0x95
mov edx, ebx
mov al, byte [edx + 0x10047d6c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10010f15
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x10010ef8
mov byte [ebp - 0x16], bl
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
call fcn.10021a34
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0xf1f2f3ec
mov dword [ebp - 0x1c], 0xf5f6f7f0
mov dword [ebp - 0x18], 0x100fbf4
call fcn.10009e75
push ecx
push 0xa6
push 0x100509b8
push 0x10028988
mov edx, 0x100500b8
mov ecx, eax
call fcn.100289e3
add esp, 0x10
mov ecx, 0xf3
mov edx, ebx
mov al, byte [edx + 0x10047d7c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10010f93
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x11
jl 0x10010f76
mov byte [ebp - 0x13], bl
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.10021a34
or dword [ebp - 4], 0xffffffff
push 0x168
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0xf3ecedee
mov dword [ebp - 0x2c], 0xf0f1f2
mov byte [ebp - 0x28], 1
call fcn.1000131e
mov edx, 0x100500b4
mov ecx, eax
call fcn.10023e13
add esp, 0xc
call fcn.10044aec
ret
Function at 0x10011805
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x10050040]
xor eax, esp
mov dword [esp + 0x40], eax
movaps xmm0, xmmword [0x1004c9c0]
lea ecx, [esp + 0xc]
and dword [esp + 4], 0
and dword [esp + 8], 0
push ebx
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 1
call fcn.1000cd8c
xor ebx, ebx
lea edx, [esp + 8]
push ebx
mov ecx, eax
call fcn.10022252
pop ecx
test al, al
je 0x10011892
movaps xmm0, xmmword [0x1004d020]
lea ecx, [esp + 0x24]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x34], 0xe1e8ef29
mov dword [esp + 0x38], 0xe7edc7e6
mov dword [esp + 0x3c], 0xf2eca6f3
mov word [esp + 0x40], 0xee
mov byte [esp + 0x42], 1
call fcn.10011938
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0x15190f3e
mov dword [esp + 0x14], 0x15163451
mov dword [esp + 0x18], 0x1d050301
mov word [esp + 0x1c], 0xa
mov byte [esp + 0x1e], 1
call fcn.1000133f
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.10022252
pop ecx
test al, al
je 0x100118dd
call fcn.10009e96
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0x140e0121
mov dword [esp + 0x14], 0x15163451
mov dword [esp + 0x18], 0x1d050301
mov word [esp + 0x1c], 0xa
mov byte [esp + 0x1e], 1
call fcn.1000133f
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.10022252
pop ecx
test al, al
je 0x10011928
call fcn.1000ce31
mov ecx, dword [esp + 0x44]
pop ebx
xor ecx, esp
call fcn.100410d7
mov esp, ebp
pop ebp
ret

Function at 0x10011938
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1e], 0
je 0x10011956
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x6f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1d
jb 0x10011943
pop ebx
mov byte [edx + 0x1e], 0
mov eax, edx
ret

Function at 0x10013118
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x34
mov eax, 0x10045f72
call fcn.10044b2e
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x10013195
lea ecx, [ebp - 0x3c]
call fcn.10009249
sub esp, 0x18
lea eax, [ebp - 0x3c]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.10002dd4
call fcn.10009327
add esp, 0x18
test al, al
je 0x100131a0
mov ecx, esi
call fcn.10003665
mov ecx, esi
call fcn.10003609
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x10013113
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x100035b7
push ebx
push ebx
call esi
lea ecx, [ebp - 0x3c]
call fcn.1000261e
xor eax, eax
inc eax
call fcn.10044aec
ret 0xc
movaps xmm0, xmmword [0x1004ce20]
lea ecx, [ebp - 0x24]
push 0x10
push 0x100473e0
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x100
call fcn.1000cdef
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10013205
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x10013222
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x10013210
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x100133cc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x100133e9
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x100133d7
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x100133eb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x10013408
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x100133f6
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x1001340a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x10013427
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x10013415
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x10013429
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x10013446
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x10013434
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x10013448
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x10013465
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x10013453
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x10013467
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x10013484
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x10013472
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x10013486
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x100134a3
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x10013491
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x100134a5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x100134c2
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x100134b0
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x100134c4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x100134e1
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x100134cf
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x10013583
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x100135a0
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x1001358e
mov byte [esi + 0x15], 0
pop esi
ret
Function at 0x100135a2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x100135bf
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x6f]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x100135ad
mov byte [esi + 0x14], 0
pop esi
ret
Function at 0x10014509
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10050040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100c68c8]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x100fd1cc]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x100fd1d0]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x100fd1d4]
call fcn.10044f90
mov edx, dword [0x100fd1dc]
mov ecx, dword [0x100fd1d8]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10044f90
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x100fd1d4], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x100fd1d0], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.10014462
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x10014603
or eax, 0xffffffff
jmp 0x1001460e
mov eax, dword [0x100c68c8]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x10050c54], eax
je 0x10014620
mov dword [0x10050c54], eax
call fcn.100143c6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410d7
leave
ret

Function at 0x10015b2f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100fd224], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x10015b6e
xor esi, esi
push 8
mov edx, esi
pop ecx
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub ecx, 1
jne 0x10015b49
mov dword [esi*4 + 0x100fd220], edx
inc esi
cmp esi, 0x100
jb 0x10015b44
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x10015bb3
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100fd220]
inc edi
sub ebx, 1
jne 0x10015b79
jmp 0x10015bba
cmp al, 0x23
jne 0x10015ba1
cmp byte [edi], al
jne 0x10015ba1
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100fd220]
mov al, byte [edi]
inc edi
test al, al
jne 0x10015b93
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x100163b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100163c3
and dword [edi], 0
mov edx, 0x1004bf38
call fcn.10016322
mov esi, eax
test esi, esi
je 0x10016461
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10016456
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x10016456
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10016456
mov ecx, ebx
call fcn.10017adf
mov dword [ebp + 8], eax
test eax, eax
je 0x10016456
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10016444
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x100fd1e0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1001645d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x10016451
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x10016460
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1001ab70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100c68c8]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x1001abc0
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.1001abc3
mov edx, 0x1004bf3c
mov ecx, esi
mov edi, eax
call fcn.10016322
mov esi, eax
test esi, esi
je 0x1001abbf
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x100219eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100c68c8]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x10021a31
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.10015b01
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.10021a71
pop edi
pop esi
ret
Function at 0x100328e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x10050040]
xor eax, esp
mov dword [esp + 0x2c], eax
movaps xmm0, xmmword [0x1004d470]
xor edx, edx
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0xf1ffe2e3
movaps xmm0, xmmword [0x1004d440]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0xeaf6d2b5
mov dword [esp + 0x28], 0x1009af2
mov al, dl
add al, 0x71
xor byte [esp + edx], al
inc edx
cmp edx, 0x2a
jb 0x10032928
push ecx
lea eax, [esp + 4]
mov byte [esp + 0x2f], 0
push eax
mov edx, 0x100fd62c
call fcn.10028ac7
pop ecx
pop ecx
test al, al
je 0x10032995
mov eax, dword [0x100fd62c]
sub eax, 0
je 0x1003298a
sub eax, 1
je 0x10032983
sub eax, 1
je 0x1003297c
sub eax, 1
je 0x10032975
sub eax, 1
jne 0x10032991
call fcn.1003b92c
jmp 0x10032991
call fcn.1003bf96
jmp 0x10032991
call fcn.1003ada4
jmp 0x10032991
call fcn.1003b420
jmp 0x10032991
xor ecx, ecx
call fcn.1003a42e
mov al, 1
jmp 0x10032997
xor al, al
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100410d7
mov esp, ebp
pop ebp
ret
Function at 0x10035359
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x10035376
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x33
jb 0x10035364
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x10035378
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x10035395
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x10035383
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x10035397
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x100353bd
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x1a4
jb 0x100353a5
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x100353bf
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x100353dc
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x2b
jb 0x100353ca
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x100353de
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x100353fb
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x21
jb 0x100353e9
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x100353fd
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x1003541a
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x10035408
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x1003541c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x10035439
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x10035427
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x1003543b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x10035458
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x67
jb 0x10035446
mov byte [esi + 0x68], 0
pop esi
ret

Function at 0x1003545a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x10035477
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x40
jb 0x10035465
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x10035479
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x1003549f
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x8a
jb 0x10035487
mov byte [esi + 0x8b], 0
pop esi
ret

Function at 0x100354a1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x100354be
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x71]
xor byte [ecx], al
inc edx
cmp edx, 0x2a
jb 0x100354ac
mov byte [esi + 0x2b], 0
pop esi
ret
Function at 0x10042140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100422f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004220d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10050090]
jb 0x1004218a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10050094]
ja 0x1004218a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004215a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100421b0
jmp 0x1004220d
cmp dword [ebp - 0x14], 0x10000
jne 0x100421f3
cmp dword [ebp - 0x18], 0x10000
jb 0x100421f3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100421e6
mov eax, dword [ebp - 8]
jmp 0x1004220f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10042208
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100422f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004215a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10042220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10042320
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100422e5
mov edx, dword [ebp - 4]
cmp edx, dword [0x10050090]
jb 0x10042265
mov eax, dword [ebp - 4]
cmp eax, dword [0x10050094]
ja 0x10042265
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10042235
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004228b
jmp 0x100422e5
cmp dword [ebp - 0x14], 0x10000
jne 0x100422ce
cmp dword [ebp - 0x18], 0x10000
jb 0x100422ce
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100422c1
mov eax, dword [ebp - 8]
jmp 0x100422e7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100422e0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10042320
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10042235
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40b053
Capabilities:
Parse pe header
Terminate process

Disassembly:
call fcn.00412762
jmp 0x40b05d
push 0x14
push 0x41fcb8
call fcn.0040c1a0
call fcn.00412949
movzx esi, ax
push 2
call fcn.00412715
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x40b08b
xor ebx, ebx
jmp 0x40b0be
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40b087
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40b087
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x40b0be
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.0040b517
test eax, eax
jne 0x40b0d2
push 0x1c
call fcn.0040b1ad
pop ecx
call fcn.004109f4
test eax, eax
jne 0x40b0e3
push 0x10
call fcn.0040b1ad
pop ecx
call fcn.004127fe
and dword [ebp - 4], 0
call fcn.00412151
test eax, eax
jns 0x40b0fd
push 0x1b
call fcn.0040b1ad
pop ecx
call dword [0x41b080]
mov dword [0x42483c], eax
call fcn.0041283e
mov dword [0x4222d0], eax
call fcn.00412405
test eax, eax
jns 0x40b123
push 8
call fcn.0040b65b
pop ecx
call fcn.00412634
test eax, eax
jns 0x40b134
push 9
call fcn.0040b65b
pop ecx
push 1
call fcn.0040b695
pop ecx
test eax, eax
je 0x40b147
push eax
call fcn.0040b65b
pop ecx
call fcn.00412cac
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x40b169
push esi
call fcn.0040b8fe
call fcn.0040b686
jmp 0x40b19e
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.0040c1e5
ret