joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002df40
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10160ecb
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x800000
mov dword [0x10254160], 0x1023f130
mov dword [0x10254168], 0x1023f2a4
push 0
mov dword [ebp - 0x14], 0x10254160
mov dword [0x1025417c], 1
mov dword [0x10254178], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1002e1d8
lea eax, [ecx + 0x800000]
mov dword [0x10254174], ecx
mov dword [0x10254170], eax
mov edx, 0x7fff
mov eax, dword [0x10254178]
mov dword [0x1025416c], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x10254178]
add ecx, eax
sub edx, 1
jne 0x1002dfd4
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0x10254180
mov dword [ebp - 0x18], 0x10254180
mov dword [ebp - 0x1c], 0x10254180
mov dword [0x10254180], 0x1023c8b8
mov dword [0x10254184], edx
mov dword [0x10254188], edx
mov byte [ebp - 4], 1
mov dword [0x10254180], 0x1023c844
mov dword [0x1025418c], edx
mov dword [0x10254194], edx
mov dword [0x10254190], edx
mov dword [0x10254198], 0x40
mov byte [ebp - 4], 2
mov dword [0x10254198], 0x80
mov byte [ebp - 4], 5
mov dword [0x1025419c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x102541b0
mov dword [ebp - 0x20], 0x102541b0
call esi
mov byte [ebp - 4], 7
mov dword [0x102541c8], 0
mov byte [ebp - 4], 8
push 0x102541d4
mov dword [ebp - 0x24], 0x102541d4
call esi
mov byte [ebp - 4], 9
mov dword [0x102541ec], 0x3e8
mov dword [ebp - 0x28], 0x10254200
mov dword [ebp - 0x2c], 0x10254200
mov dword [0x10254200], 0x1023c8b8
mov dword [0x10254204], 0
mov dword [0x10254208], 0
mov byte [ebp - 4], 0xa
mov dword [0x10254200], 0x1023c844
mov dword [0x1025420c], 0
mov dword [0x10254214], 0
mov dword [0x10254210], 0
mov dword [0x10254218], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x10254218], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
mov dword [0x102541f4], 0x3e80
mov dword [0x102541f8], 1
mov dword [0x102541fc], 0
lea eax, [eax*2 + 2]
mov dword [0x102541f0], eax
mov byte [ebp - 4], 0xe
push 0x1025421c
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x10254234
call fcn.1002d860
mov byte [ebp - 4], 0x10
mov dword [0x102541a0], 0
mov dword [0x1025425c], 0
movsd xmm0, qword [0x1023f330]
movsd qword [0x102541a8], xmm0
xorps xmm0, xmm0
mov dword [0x10254260], 0
mov dword [0x10254264], 0
mov dword [0x10254268], 0
mov dword [0x102541a4], 0
movq qword [0x102541cc], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10254160
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1002ec90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x1002ecb2
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
mov ecx, eax
movzx eax, bx
push 0xa
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x1002ed87
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x1002ed87
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1002ed7e
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x1002ed62
cmp edi, 1
jne 0x1002ed27
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x1002ed79
cmp edi, 2
jne 0x1002ed3a
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x1002ed79
cmp edi, 4
jne 0x1002ed4b
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x1002ed79
cmp edi, 8
jne 0x1002ed62
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x1002ed79
test edi, edi
jle 0x1002ed79
push edi
mov ecx, esi
call fcn.10030fe0
push edi
push ebx
push eax
call fcn.10136fe0
add esp, 0xc
mov edi, 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002f030
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
cmp esi, dword [0x10254178]
jg 0x1002f067
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1002f059
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1002f07d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1002f081
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1002f120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x10254178]
jg 0x1002f15b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1002f14d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1002f171
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1002f178
mov eax, ecx
pop esi
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1002f1e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x1025416c]
jb 0x1002f254
cmp esi, dword [0x10254170]
jae 0x1002f254
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x10254178]
jle 0x1002f269
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1002f26d
push dword [0x10254178]
push esi
push edi
call fcn.10136fe0
push 0x1025417c
call fcn.10031980
mov eax, dword [0x10254174]
add esp, 0x10
mov dword [esi], eax
mov dword [0x10254174], esi
mov esi, edi
mov dword [0x1025417c], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
jne 0x1002f24d
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10030010
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10161205
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x100301a4
cmp word [esi], 0
je 0x100301a4
lea ecx, [ebp - 0x38]
call fcn.10005200
mov dword [ebp - 4], 0
cmp word [esi], 0
je 0x1003017e
cmp word [esi + 2], 0
je 0x100300bb
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030070
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x100300bb
cmp word [esi + ecx*2 - 4], 0x3a
je 0x100300bb
lea eax, [ecx - 1]
push eax
push esi
lea ecx, [ebp - 0x38]
call fcn.100323c0
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x100300af
cmp dword [ebp - 0x14], esi
je 0x1003017e
mov esi, dword [ebp - 0x1c]
mov eax, esi
cmp word [eax], 0
je 0x1003017e
cmp word [esi + 2], 0x3a
jne 0x100300cd
cmp word [esi + 4], 0
je 0x1003017e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1003017e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003017e
cmp eax, 3
jne 0x1003017a
push 0x5c
push esi
call fcn.10136b8f
mov edx, eax
add esp, 8
test edx, edx
je 0x1003017a
cmp word [edx + 2], 0
jne 0x10030128
sub edx, 2
cmp edx, esi
jb 0x1003017a
cmp word [edx], 0x5c
je 0x10030128
sub edx, 2
cmp edx, esi
jae 0x10030117
xor esi, esi
jmp 0x10030183
lea ecx, [ebp - 0x64]
call fcn.10005200
mov byte [ebp - 4], 1
sub edx, esi
sar edx, 1
lea ecx, [ebp - 0x64]
push edx
push esi
call fcn.100323c0
lea ecx, [ebp - 0x64]
call fcn.10032070
mov ecx, eax
call fcn.10030010
test eax, eax
je 0x1003016e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.100052c0
jmp 0x10030183
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.100052c0
xor esi, esi
jmp 0x10030183
mov esi, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100052c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100301c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016124d
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x1003031c
cmp word [esi], 0
je 0x1003031c
push 0x44
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.10137560
or dword [ebp - 0x50], 1
xor eax, eax
mov dword [ebp - 0x38], vtable.CVolCommonBaseWithMemManager.0
add esp, 0xc
mov dword [ebp - 0x7c], 0x44
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x38]
push esi
call fcn.100310d0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
cmove eax, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10030289
xor esi, esi
jmp 0x100302ac
push 0x1f4
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x100302e7
mov eax, dword [ebp - 0x38]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolWrapperObject.virtual_12
jne 0x100302e2
mov ecx, 0x10254168
call fcn.10031b50
jmp 0x100302e7
lea ecx, [ebp - 0x38]
call eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100312b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
je 0x1003137f
cmp word [eax], 0
je 0x1003137f
push ebx
push edi
push 0x1023f1e0
push eax
or ebx, 0xffffffff
call fcn.1013e6bd
mov edi, eax
add esp, 8
test edi, edi
je 0x10031352
push 2
push 0
push edi
call fcn.10145ee4
push edi
call fcn.10147076
push 0
push 0
push edi
mov ebx, eax
call fcn.10145ee4
add esp, 0x1c
test ebx, ebx
jle 0x10031342
push edi
push ebx
push 1
push ebx
mov ecx, esi
call fcn.10030f80
push eax
call fcn.101469c4
push edi
mov ebx, eax
call fcn.1013e717
add esp, 0x14
test eax, eax
jne 0x10031346
push ebx
mov ecx, esi
call fcn.10030fe0
push edi
call fcn.1013e2c8
add esp, 4
mov eax, ebx
pop edi
pop ebx
pop esi
pop ebp
ret 8
xor ebx, ebx
jmp 0x10031349
or ebx, 0xffffffff
push edi
call fcn.1013e2c8
add esp, 4
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10031361
mov edx, dword [esi]
push ecx
mov ecx, esi
call dword [edx + 0xc]
pop edi
mov eax, ebx
mov dword [esi + 0xc], 0
pop ebx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
pop esi
pop ebp
ret 8
or eax, 0xffffffff
pop esi
pop ebp
ret 8

Function at 0x1005aa60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x1005aa87
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x1005aa76
pop edi
movzx eax, dl
pop esi
ret
Function at 0x100c2d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10135be0
mov eax, dword [0x1024ed04]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x24], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x100c2ee5
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
nop dword [eax]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x100c2e75
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.100c2750
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x100c2e10
test ebp, ebp
mov ebp, dword [esp + 0x24]
je 0x100c2ecc
mov ecx, dword [esp + 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 6], dl
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10134fc2
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10134fc2
add esp, 0x28
ret
Function at 0x100c6b60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10135be0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x10], edi
test edi, edi
je 0x100c6ba9
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x100c6ba9
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x10], edi
jne 0x100c6b90
mov edx, dword [esp + 0x2c]
movzx ecx, byte [edx + 0xc]
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x24], ecx
cmp esi, 0x10
jb 0x100c6c7a
nop dword [eax]
mov eax, esi
mov edx, ecx
shr eax, 4
xor edi, edi
add ecx, eax
cmp ecx, eax
cmovae edi, ecx
neg edx
mov dword [esp + 0x24], edi
cmp ecx, eax
mov edi, dword [esp + 0x2c]
push edi
push dword [esp + 0x2c]
cmovae edx, eax
push edx
push ebx
push ebp
mov dword [esp + 0x28], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x100c6c56
mov edx, 0xc
mov eax, 1
nop
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x100c6c40
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, edx
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x100c6be0
mov edi, dword [esp + 0x10]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x2c]
test esi, esi
je 0x100c6ce8
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push edx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x100c6cc9
push edx
call fcn.100c6d30
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x100c6cd6
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100c7320
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10135be0
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x100c733f
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x100c740f
jb 0x100c7364
test eax, eax
jne 0x100c740f
push ebx
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x16c]
mov dword [ebp + 0x30], eax
mov dword [esp + 0x14], ecx
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x100c73b0
nop
test esi, esi
je 0x100c7401
mov al, byte [edi]
dec esi
xor byte [ecx + ebp + 0x40], al
inc edi
inc ecx
and ecx, 0xf
mov dword [esp + 0x18], ecx
jne 0x100c7380
lea eax, [ebp + 0x60]
push eax
lea ebx, [ebp + 0x40]
push ebx
call fcn.100c89c0
mov eax, dword [esp + 0x20]
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x100c73b3
lea ebx, [ebp + 0x40]
mov eax, esi
lea ecx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x100c73d5
push eax
push edi
push ecx
push ebx
call fcn.100c8790
add edi, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x100c73fd
mov ecx, esi
nop dword [eax + eax]
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x100c73e0
pop edi
pop ebx
pop esi
mov dword [ebp + 0x16c], ecx
xor eax, eax
pop ebp
pop ecx
ret
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
pop esi
mov dword [ebp + 0x16c], ecx
xor eax, eax
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
Function at 0x100c8570
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.10135be0
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebp, 0xc
jne 0x100c85db
mov eax, dword [esp + 0x24]
lea ebx, [ebp - 0xb]
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x100c8706
push edi
xor edi, edi
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x40], edi
lea ebx, [esi + 0x40]
mov dword [ebx + 4], edi
lea edx, [esi + 0x60]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x14], edx
cmp ebp, 0x10
jb 0x100c866f
mov eax, ebp
lea ecx, [esi + 0x41]
shr eax, 4
mov esi, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2c], eax
lea edx, [edi + 2]
mov eax, ecx
mov ebx, 4
nop dword [eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub ebx, 1
jne 0x100c8620
push dword [esp + 0x14]
push esi
call fcn.100c89c0
mov ecx, dword [esp + 0x20]
add esp, 8
add edi, 0x10
sub ebp, 0x10
sub dword [esp + 0x2c], 1
jne 0x100c8613
mov esi, dword [esp + 0x24]
lea ebx, [esi + 0x40]
lea edx, [esi + 0x60]
test ebp, ebp
je 0x100c868e
mov ecx, ebx
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub ebp, 1
jne 0x100c8675
push edx
push ebx
call fcn.100c89c0
add esp, 8
mov edx, dword [esp + 0x1c]
xor eax, eax
shld eax, edx, 3
xor byte [esi + 0x4b], al
shl edx, 3
xor byte [esi + 0x4f], dl
mov ecx, edx
mov dword [esp + 0x24], eax
shrd ecx, eax, 0x18
xor byte [esi + 0x4c], cl
mov edi, eax
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
xor byte [esi + 0x4d], cl
shrd eax, edi, 8
xor byte [esi + 0x4e], al
lea eax, [esi + 0x60]
push eax
push ebx
call fcn.100c89c0
movzx ebx, byte [esi + 0x4c]
add esp, 8
movzx eax, byte [esi + 0x4d]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4f]
shl ebx, 8
or ebx, eax
mov eax, dword [esi + 0x40]
mov dword [esi], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
mov dword [esi + 0xc], eax
pop edi
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
inc ebx
add esp, 0xc
mov eax, ebx
mov byte [esi + 0xf], bl
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [esi + 0xe], al
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100cfe30
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x100cfe44
mov dword [esp + 0x18], fcn.100ce610
jmp fcn.100c6880
mov dword [esp + 0x18], fcn.100cd8b0
jmp fcn.100c6580
Function at 0x10133030
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10133040

Function at 0x101332c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x101332cc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.101332e0

Function at 0x1014fb8a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014fa00

Function at 0x10152205
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10151d58