joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100013d3
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 3], 0
je 0x100013f1
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x40]
xor byte [ecx], al
inc ebx
cmp ebx, 2
jb 0x100013de
pop ebx
mov byte [edx + 3], 0
mov eax, edx
ret

Function at 0x100013f4
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 9], 0
je 0x10001412
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x40]
xor byte [ecx], al
inc ebx
cmp ebx, 8
jb 0x100013ff
pop ebx
mov byte [edx + 9], 0
mov eax, edx
ret

Function at 0x10001415
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x10001432
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x40]
xor byte [ecx], al
inc edx
cmp edx, 8
jb 0x10001420
mov byte [esi + 9], 0
pop esi
ret

Function at 0x10001434
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x10001451
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x40]
xor byte [ecx], al
inc edx
cmp edx, 0x15
jb 0x1000143f
mov byte [esi + 0x16], 0
pop esi
ret

Function at 0x10001453
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x10001470
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x40]
xor byte [ecx], al
inc edx
cmp edx, 0x11
jb 0x1000145e
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x10001472
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x1000148f
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x40]
xor byte [ecx], al
inc edx
cmp edx, 6
jb 0x1000147d
mov byte [esi + 7], 0
pop esi
ret

Function at 0x10001491
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x100014ae
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x40]
xor byte [ecx], al
inc edx
cmp edx, 0xd
jb 0x1000149c
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x100014b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x100014cd
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x40]
xor byte [ecx], al
inc edx
cmp edx, 7
jb 0x100014bb
mov byte [esi + 8], 0
pop esi
ret

Function at 0x100014cf
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x100014ec
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x40]
xor byte [ecx], al
inc edx
cmp edx, 4
jb 0x100014da
mov byte [esi + 5], 0
pop esi
ret

Function at 0x100014ee
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x1000150b
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x40]
xor byte [ecx], al
inc edx
cmp edx, 5
jb 0x100014f9
mov byte [esi + 6], 0
pop esi
ret

Function at 0x1000150d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xc], 0
je 0x1000152b
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xb
jb 0x10001518
pop ebx
mov byte [edx + 0xc], 0
mov eax, edx
ret
Function at 0x1000152e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x1000154b
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3f]
xor byte [ecx], al
inc edx
cmp edx, 0xb
jb 0x10001539
mov byte [esi + 0xc], 0
pop esi
ret

Function at 0x1000154d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xd], 0
je 0x1000156b
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x10001558
pop ebx
mov byte [edx + 0xd], 0
mov eax, edx
ret

Function at 0x1000156e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xa], 0
je 0x1000158c
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3f]
xor byte [ecx], al
inc ebx
cmp ebx, 9
jb 0x10001579
pop ebx
mov byte [edx + 0xa], 0
mov eax, edx
ret

Function at 0x1000158f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x100015ac
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3f]
xor byte [ecx], al
inc edx
cmp edx, 0x19
jb 0x1000159a
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x100015ae
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x100015cb
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3f]
xor byte [ecx], al
inc edx
cmp edx, 9
jb 0x100015b9
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x100015cd
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x100015ea
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3f]
xor byte [ecx], al
inc edx
cmp edx, 0xc
jb 0x100015d8
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x10003119
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x10003127
pop esi
mov eax, edx
pop ebp
ret 4

Function at 0x10003140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ecx + 0x14], 0xf
mov edi, dword [ecx + 0x10]
jbe 0x10003153
mov ecx, dword [ecx]
xor esi, esi
mov edx, 0x811c9dc5
test edi, edi
je 0x1000316f
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x1000315e
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x1000361b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x10003674
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp - 4]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000364c
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x10003673
lea eax, [ebp - 4]
mov esi, 0xf8
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003673
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x10003677
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x100036b1
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100036b5
cmp edx, esi
jne 0x1000369a
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x100036d5
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100036d9
cmp edx, esi
jne 0x100036be
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x100036f9
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100036fd
cmp edx, esi
jne 0x100036e2
popfd
popal
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10006c94
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x40
push 2
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [edi]
mov word [ebx], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
leave
ret
Function at 0x1000921b
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x14], 0
je 0x10009239
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x10009226
pop ebx
mov byte [edx + 0x14], 0
mov eax, edx
ret

Function at 0x1000923c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x15], 0
je 0x1000925a
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x14
jb 0x10009247
pop ebx
mov byte [edx + 0x15], 0
mov eax, edx
ret

Function at 0x1000925d
Capabilities:
Get disk information

Disassembly:
push 0x40
mov eax, 0x10045784
call fcn.10044b7e
mov ebx, ecx
mov dword [ebp - 0x44], ebx
and dword [ebp - 4], 0
mov dword [ebp - 0x4c], ebx
and dword [ebp - 0x48], 0
push 0x100473e0
call fcn.10002653
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
mov dword [ebp - 4], ecx
push 0x10047a08
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x13]
xor edx, edx
dec ecx
push 0xa
pop esi
div esi
add dl, 0x30
mov byte [ecx], dl
test eax, eax
jne 0x100092ad
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
push 0xf
pop esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x13]
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
cmp ecx, eax
jne 0x100092e2
mov edx, esi
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x2c], edx
jmp 0x100092f4
lea eax, [ebp - 0x13]
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.10013a30
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
cmp ebx, eax
je 0x10009326
mov edx, dword [ebx + 0x14]
cmp edx, esi
jbe 0x1000930a
mov ecx, dword [ebx]
inc edx
call fcn.10002c13
push 6
xor eax, eax
mov dword [ebx + 0x14], esi
pop ecx
lea esi, [ebp - 0x40]
mov dword [ebx + 0x10], eax
mov edi, ebx
mov byte [ebx], al
rep movsd dword es:[edi], dword [esi]
push 0xf
pop esi
mov edx, esi
mov byte [ebp - 0x40], al
cmp edx, esi
jbe 0x10009333
mov ecx, dword [ebp - 0x40]
inc edx
call fcn.10002c13
mov eax, ebx
call fcn.10044b3c
ret
Function at 0x10009edb
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x10009ef9
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x10009ee6
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret

Function at 0x1000cdf2
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x10], 0
je 0x1000ce10
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0xf
jb 0x1000cdfd
pop ebx
mov byte [edx + 0x10], 0
mov eax, edx
ret

Function at 0x1000ce13
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x13], 0
je 0x1000ce31
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x1000ce1e
pop ebx
mov byte [edx + 0x13], 0
mov eax, edx
ret

Function at 0x1000ce34
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x1000ce52
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x1000ce3f
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x1000ce55
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x1000ce73
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x1000ce60
pop ebx
mov byte [edx + 0x11], 0
mov eax, edx
ret

Function at 0x1000ce76
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1d], 0
je 0x1000ce94
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1c
jb 0x1000ce81
pop ebx
mov byte [edx + 0x1d], 0
mov eax, edx
ret
Function at 0x10010e5b
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x10045dc0
call fcn.10044b7e
push 0x5f
xor ebx, ebx
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10047d54]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10010e8b
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x10010e6e
mov byte [ebp - 0x15], bl
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
call fcn.10021a7b
or dword [ebp - 4], 0xffffffff
movaps xmm0, xmmword [0x1004d260]
movups xmmword [ebp - 0x60], xmm0
pop ecx
movaps xmm0, xmmword [0x1004d100]
mov ecx, ebx
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0xa1808d83
mov dword [ebp - 0x3c], 0xaab8a9e6
mov dword [ebp - 0x38], 0x898d8ea2
mov word [ebp - 0x34], 0x100
lea eax, [ecx - 0x3e]
xor byte [ebp + ecx - 0x60], al
inc ecx
cmp ecx, 0x2c
jb 0x10010ed8
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x33], bl
mov dword [ebp - 0x1c], 0x40414243
mov dword [ebp - 0x18], 0x44454647
mov word [ebp - 0x14], 0x100
call fcn.100013f4
push ecx
lea ecx, [ebp - 0x60]
mov edx, 0x100c6840
push ecx
mov ecx, eax
call fcn.10028b0e
cmp dword [0x100c6840], 6
pop ecx
pop ecx
jne 0x10010f58
push ecx
mov dword [esp], 0x3f800000
lea eax, [ebp - 0x64]
push str._.3f
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0xc2480000
push eax
push 0x100509ac
push 4
pop edx
mov ecx, str.APosX
mov dword [ebp - 0x64], 0x42480000
call fcn.10023ad0
add esp, 0x14
mov ecx, 0x95
mov edx, ebx
mov al, byte [edx + 0x10047d6c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10010f7c
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x10010f5f
mov byte [ebp - 0x16], bl
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
call fcn.10021a7b
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x46474041
mov dword [ebp - 0x1c], 0x4a4b4445
mov dword [ebp - 0x18], 0x1004849
call fcn.10009edb
push ecx
push 0xa6
push 0x100509b8
push 0x100289cf
mov edx, 0x100500b8
mov ecx, eax
call fcn.10028a2a
add esp, 0x10
mov ecx, 0xf3
mov edx, ebx
mov al, byte [edx + 0x10047d7c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10010ffa
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x11
jl 0x10010fdd
mov byte [ebp - 0x13], bl
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.10021a7b
or dword [ebp - 4], 0xffffffff
push 0x168
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x40414243
mov dword [ebp - 0x2c], 0x454647
mov byte [ebp - 0x28], 1
call fcn.1000132e
mov edx, 0x100500b4
mov ecx, eax
call fcn.10023e5a
add esp, 0xc
call fcn.10044b3c
ret
Function at 0x10011865
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x10050040]
xor eax, esp
mov dword [esp + 0x40], eax
movaps xmm0, xmmword [0x1004c9f0]
lea ecx, [esp + 0xc]
and dword [esp + 4], 0
and dword [esp + 8], 0
push ebx
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 1
call fcn.1000cdf2
xor ebx, ebx
lea edx, [esp + 8]
push ebx
mov ecx, eax
call fcn.10022299
pop ecx
test al, al
je 0x100118f2
movaps xmm0, xmmword [0x1004d410]
lea ecx, [esp + 0x24]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x34], 0xb6bdbc84
mov dword [esp + 0x38], 0xb8b094b3
mov dword [esp + 0x3c], 0xa5b9f5ae
mov word [esp + 0x40], 0xbb
mov byte [esp + 0x42], 1
call fcn.10011998
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0xa6b4a093
mov dword [esp + 0x14], 0xa6a383e4
mov dword [esp + 0x18], 0xaeb8bcbc
mov word [esp + 0x1c], 0xbf
mov byte [esp + 0x1e], 1
call fcn.1000134f
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.10022299
pop ecx
test al, al
je 0x1001193d
call fcn.10009efc
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0xa7a3ae8c
mov dword [esp + 0x14], 0xa6a383e4
mov dword [esp + 0x18], 0xaeb8bcbc
mov word [esp + 0x1c], 0xbf
mov byte [esp + 0x1e], 1
call fcn.1000134f
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.10022299
pop ecx
test al, al
je 0x10011988
call fcn.1000ce98
mov ecx, dword [esp + 0x44]
pop ebx
xor ecx, esp
call fcn.1004111d
mov esp, ebp
pop ebp
ret

Function at 0x10011998
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1e], 0
je 0x100119b6
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x3e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1d
jb 0x100119a3
pop ebx
mov byte [edx + 0x1e], 0
mov eax, edx
ret

Function at 0x10013178
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x34
mov eax, 0x10045fcd
call fcn.10044b7e
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x100131f5
lea ecx, [ebp - 0x3c]
call fcn.1000925d
sub esp, 0x18
lea eax, [ebp - 0x3c]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.10002de6
call fcn.1000933b
add esp, 0x18
test al, al
je 0x10013200
mov ecx, esi
call fcn.10003677
mov ecx, esi
call fcn.1000361b
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x10013173
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x100035c9
push ebx
push ebx
call esi
lea ecx, [ebp - 0x3c]
call fcn.10002630
xor eax, eax
inc eax
call fcn.10044b3c
ret 0xc
movaps xmm0, xmmword [0x1004cf70]
lea ecx, [ebp - 0x24]
push 0x10
push 0x100473e0
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x100
call fcn.1000ce55
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10013265
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x10013282
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x10013270
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x1001342c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x10013449
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x10013437
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x1001344b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x10013468
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x10013456
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x1001346a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x10013487
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x10013475
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x10013489
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x100134a6
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x10013494
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x100134a8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x100134c5
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x100134b3
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x100134c7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x100134e4
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x100134d2
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x100134e6
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x10013503
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x100134f1
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x10013505
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x10013522
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x10013510
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x10013524
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x10013541
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x1001352f
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x100135e3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x10013600
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x100135ee
mov byte [esi + 0x15], 0
pop esi
ret
Function at 0x10013602
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x1001361f
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x3e]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x1001360d
mov byte [esi + 0x14], 0
pop esi
ret
Function at 0x10014569
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10050040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100c68c8]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x100fd1cc]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x100fd1d0]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x100fd1d4]
call fcn.10044fe0
mov edx, dword [0x100fd1dc]
mov ecx, dword [0x100fd1d8]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10044fe0
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x100fd1d4], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x100fd1d0], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.100144c2
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x10014663
or eax, 0xffffffff
jmp 0x1001466e
mov eax, dword [0x100c68c8]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x10050c54], eax
je 0x10014680
mov dword [0x10050c54], eax
call fcn.10014426
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004111d
leave
ret

Function at 0x10015b8f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100fd224], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x10015bce
xor esi, esi
push 8
mov edx, esi
pop ecx
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub ecx, 1
jne 0x10015ba9
mov dword [esi*4 + 0x100fd220], edx
inc esi
cmp esi, 0x100
jb 0x10015ba4
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x10015c13
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100fd220]
inc edi
sub ebx, 1
jne 0x10015bd9
jmp 0x10015c1a
cmp al, 0x23
jne 0x10015c01
cmp byte [edi], al
jne 0x10015c01
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100fd220]
mov al, byte [edi]
inc edi
test al, al
jne 0x10015bf3
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret