joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a4f5
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x1000a513
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x5f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x1000a500
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret

Function at 0x1000d40c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x10], 0
je 0x1000d42a
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x5f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xf
jb 0x1000d417
pop ebx
mov byte [edx + 0x10], 0
mov eax, edx
ret

Function at 0x1000d42d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x1000d44b
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x5f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x1000d438
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x1000d44e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x15], 0
je 0x1000d46c
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x5f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x14
jb 0x1000d459
pop ebx
mov byte [edx + 0x15], 0
mov eax, edx
ret

Function at 0x1000d46f
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x1000d48d
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x5f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x1000d47a
pop ebx
mov byte [edx + 0x11], 0
mov eax, edx
ret

Function at 0x1000d490
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1d], 0
je 0x1000d4ae
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x5f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1c
jb 0x1000d49b
pop ebx
mov byte [edx + 0x1d], 0
mov eax, edx
ret
Function at 0x10011aad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10050040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1004d0d0]
lea ecx, [ebp - 0x18]
push ebx
movups xmmword [ebp - 0x18], xmm0
xor ebx, ebx
mov word [ebp - 8], 0x100
call fcn.1000d46f
mov edx, 0x100c6a47
mov ecx, eax
call fcn.100246d5
cmp byte [0x100c6a47], bl
je 0x10011b40
call fcn.100438f0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10043dd0
push 0x1000fefe
push 0x100c6af4
call fcn.10043370
call fcn.10043950
sub esp, 0xc
mov dword [ebp - 0x10], 0xc4c4f0d3
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], 0xe1ed83ce
mov word [ebp - 8], 0x100
call fcn.10001414
mov edx, 0x100c6aa0
mov ecx, eax
call fcn.10028521
add esp, 0xc
movaps xmm0, xmmword [0x1004ce30]
mov ecx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0xc], 0x91879190
movaps xmm0, xmmword [0x1004cd30]
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 8], 0x87
movaps xmm0, xmmword [0x1004ccf0]
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 6], 1
lea eax, [ecx - 0x5f]
xor byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0x35
jb 0x10011b74
lea eax, [ebp - 0x3c]
mov byte [ebp - 6], bl
push eax
call fcn.10021b2c
movaps xmm0, xmmword [0x1004d530]
pop ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xfde492f4
mov ecx, ebx
mov dword [ebp - 0x10], 0xf197fee1
mov dword [ebp - 0xc], 0x1009bed
lea eax, [ecx - 0x5f]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x1a
jb 0x10011bb0
lea eax, [ebp - 0x24]
mov byte [ebp - 9], bl
push eax
call fcn.10021b2c
movaps xmm0, xmmword [0x1004d4a0]
movups xmmword [ebp - 0x2c], xmm0
pop ecx
movaps xmm0, xmmword [0x1004ceb0]
mov ecx, ebx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x838d8b95
mov word [ebp - 8], 0xe4
mov byte [ebp - 6], 1
lea eax, [ecx - 0x5f]
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0x25
jb 0x10011bf3
lea eax, [ebp - 0x2c]
mov byte [ebp - 6], bl
push eax
call fcn.10021b2c
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100411ba
leave
ret
Function at 0x100120ef
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x10050040]
xor eax, esp
mov dword [esp + 0x40], eax
movaps xmm0, xmmword [0x1004c9e0]
lea ecx, [esp + 0xc]
and dword [esp + 4], 0
and dword [esp + 8], 0
push ebx
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 1
call fcn.1000d40c
xor ebx, ebx
lea edx, [esp + 8]
push ebx
mov ecx, eax
call fcn.1002236f
pop ecx
test al, al
je 0x1001217c
movaps xmm0, xmmword [0x1004ce20]
lea ecx, [esp + 0x24]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x34], 0xd7dadde7
mov dword [esp + 0x38], 0xd9dff5d0
mov dword [esp + 0x3c], 0xc4de94cd
mov word [esp + 0x40], 0xd8
mov byte [esp + 0x42], 1
call fcn.10012222
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0xc4d6fecd
mov dword [esp + 0x14], 0xc4c1e582
mov dword [esp + 0x18], 0xccdad2d2
mov word [esp + 0x1c], 0xd9
mov byte [esp + 0x1e], 1
call fcn.1000136f
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.1002236f
pop ecx
test al, al
je 0x100121c7
call fcn.1000a516
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0xc5c1f0d2
mov dword [esp + 0x14], 0xc4c1e582
mov dword [esp + 0x18], 0xccdad2d2
mov word [esp + 0x1c], 0xd9
mov byte [esp + 0x1e], 1
call fcn.1000136f
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.1002236f
pop ecx
test al, al
je 0x10012212
call fcn.1000d4b1
mov ecx, dword [esp + 0x44]
pop ebx
xor ecx, esp
call fcn.100411ba
mov esp, ebp
pop ebp
ret

Function at 0x10012222
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1e], 0
je 0x10012240
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x5f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1d
jb 0x1001222d
pop ebx
mov byte [edx + 0x1e], 0
mov eax, edx
ret

Function at 0x10013a71
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x34
mov eax, 0x10046016
call fcn.10044c0e
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x10013aee
lea ecx, [ebp - 0x3c]
call fcn.10009857
sub esp, 0x18
lea eax, [ebp - 0x3c]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.10002e0b
call fcn.10009935
add esp, 0x18
test al, al
je 0x10013af9
mov ecx, esi
call fcn.1000369c
mov ecx, esi
call fcn.10003640
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x10013a6c
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x100035ee
push ebx
push ebx
call esi
lea ecx, [ebp - 0x3c]
call fcn.10002655
xor eax, eax
inc eax
call fcn.10044bcc
ret 0xc
movaps xmm0, xmmword [0x1004d510]
lea ecx, [ebp - 0x24]
push 0x10
push 0x100473e0
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x100
call fcn.1000d46f
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10013b51
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x10013b6e
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x10013b5c
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x10013c54
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x10013c71
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x10013c5f
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x10013c73
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x10013c90
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x10013c7e
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x10013c92
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x10013caf
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x10013c9d
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x10013cb1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x10013cce
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x10013cbc
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x10013cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x10013ced
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x10013cdb
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x10013cef
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x10013d0c
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x10013cfa
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x10013d0e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x10013d2b
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x10013d19
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x10013d2d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x10013d4a
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x10013d38
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x10013d4c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x10013d69
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x10013d57
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x10013e0b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x10013e28
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x10013e16
mov byte [esi + 0x13], 0
pop esi
ret
Function at 0x10013e2a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x10013e47
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x10013e35
mov byte [esi + 0x14], 0
pop esi
ret
Function at 0x10014dbd
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10050040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100c6c64]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x10102a90]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x10102a98]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x10102a9c]
call fcn.10045070
mov edx, dword [0x10102aa4]
mov ecx, dword [0x10102aa0]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10045070
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x10102a9c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x10102a98], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.10014d16
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x10014eb7
or eax, 0xffffffff
jmp 0x10014ec2
mov eax, dword [0x100c6c64]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x10050c54], eax
je 0x10014ed4
mov dword [0x10050c54], eax
call fcn.10014c7a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100411ba
leave
ret

Function at 0x100163e3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10102aec], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x10016422
xor esi, esi
push 8
mov edx, esi
pop ecx
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub ecx, 1
jne 0x100163fd
mov dword [esi*4 + 0x10102ae8], edx
inc esi
cmp esi, 0x100
jb 0x100163f8
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x10016467
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10102ae8]
inc edi
sub ebx, 1
jne 0x1001642d
jmp 0x1001646e
cmp al, 0x23
jne 0x10016455
cmp byte [edi], al
jne 0x10016455
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10102ae8]
mov al, byte [edi]
inc edi
test al, al
jne 0x10016447
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x10016c68
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10016c77
and dword [edi], 0
mov edx, 0x1004be6c
call fcn.10016bd6
mov esi, eax
test esi, esi
je 0x10016d15
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10016d0a
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x10016d0a
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10016d0a
mov ecx, ebx
call fcn.10018393
mov dword [ebp + 8], eax
test eax, eax
je 0x10016d0a
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10016cf8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x10102a94]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x10016d11
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x10016d05
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x10016d14
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1001ac5a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100c6c64]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x1001acaa
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.1001acad
mov edx, 0x1004be70
mov ecx, esi
mov edi, eax
call fcn.10016bd6
mov esi, eax
test esi, esi
je 0x1001aca9
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x10021ae3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100c6c64]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x10021b29
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.100163b5
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.10021b8e
pop edi
pop esi
ret
Function at 0x100329cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x10050040]
xor eax, esp
mov dword [esp + 0x2c], eax
movaps xmm0, xmmword [0x1004d400]
xor edx, edx
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0xa2aab5b6
movaps xmm0, xmmword [0x1004d000]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0xb9ab8de8
mov dword [esp + 0x28], 0x100cda7
mov al, dl
sub al, 0x5c
xor byte [esp + edx], al
inc edx
cmp edx, 0x2a
jb 0x10032a10
push ecx
lea eax, [esp + 4]
mov byte [esp + 0x2f], 0
push eax
mov edx, 0x10102ef4
call fcn.10028bb9
pop ecx
pop ecx
test al, al
je 0x10032a7d
mov eax, dword [0x10102ef4]
sub eax, 0
je 0x10032a72
sub eax, 1
je 0x10032a6b
sub eax, 1
je 0x10032a64
sub eax, 1
je 0x10032a5d
sub eax, 1
jne 0x10032a79
call fcn.1003ba0f
jmp 0x10032a79
call fcn.1003c079
jmp 0x10032a79
call fcn.1003ae87
jmp 0x10032a79
call fcn.1003b503
jmp 0x10032a79
xor ecx, ecx
call fcn.1003a511
mov al, 1
jmp 0x10032a7f
xor al, al
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100411ba
mov esp, ebp
pop ebp
ret
Function at 0x1003543c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x10035459
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x33
jb 0x10035447
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x1003545b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x10035478
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x10035466
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x1003547a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x100354a0
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x1a4
jb 0x10035488
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x100354a2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x100354bf
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x2b
jb 0x100354ad
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x100354c1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x100354de
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x21
jb 0x100354cc
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x100354e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x100354fd
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x100354eb
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x100354ff
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x1003551c
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x1003550a
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x1003551e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x1003553b
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x67
jb 0x10035529
mov byte [esi + 0x68], 0
pop esi
ret

Function at 0x1003553d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x1003555a
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x40
jb 0x10035548
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x1003555c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x10035582
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x8a
jb 0x1003556a
mov byte [esi + 0x8b], 0
pop esi
ret

Function at 0x10035584
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x100355a1
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x5c]
xor byte [ecx], al
inc edx
cmp edx, 0x2a
jb 0x1003558f
mov byte [esi + 0x2b], 0
pop esi
ret
Function at 0x10042220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100423d0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100422ed
mov edx, dword [ebp - 4]
cmp edx, dword [0x10050090]
jb 0x1004226a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10050094]
ja 0x1004226a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004223a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10042290
jmp 0x100422ed
cmp dword [ebp - 0x14], 0x10000
jne 0x100422d3
cmp dword [ebp - 0x18], 0x10000
jb 0x100422d3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100422c6
mov eax, dword [ebp - 8]
jmp 0x100422ef
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100422e8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100423d0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004223a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10042300
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10042400
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100423c5
mov edx, dword [ebp - 4]
cmp edx, dword [0x10050090]
jb 0x10042345
mov eax, dword [ebp - 4]
cmp eax, dword [0x10050094]
ja 0x10042345
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10042315
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004236b
jmp 0x100423c5
cmp dword [ebp - 0x14], 0x10000
jne 0x100423ae
cmp dword [ebp - 0x18], 0x10000
jb 0x100423ae
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100423a1
mov eax, dword [ebp - 8]
jmp 0x100423c7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100423c0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10042400
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10042315
xor eax, eax
mov esp, ebp
pop ebp
ret