joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bc50
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x1003bcc5
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
sar eax, 8
xor byte [esi + ebx], al
movsx eax, byte [esi + ebx]
inc esi
mov edx, dword [ecx + 4]
xor eax, edx
movzx eax, al
shr edx, 8
mov eax, dword [eax*4 + 0x1007c2f8]
xor eax, edx
mov edx, dword [ecx + 0xc]
mov dword [ecx + 4], eax
movzx eax, al
add eax, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x1007c2f8]
mov dword [ecx + 0xc], edx
cmp esi, edi
jb 0x1003bc62
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x1003bcd0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [ebp + 0xc], ebx
jbe 0x1003bd49
push esi
nop
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0xc]
mov esi, edx
and esi, 0xfffd
movsx eax, byte [ebx + eax]
or esi, 2
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x1007c2f8]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 4], eax
movzx eax, al
add eax, dword [edi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x1007c2f8]
mov eax, esi
xor eax, 1
mov dword [edi + 0xc], edx
imul eax, esi
sar eax, 8
xor byte [ebx + ecx], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x1003bce0
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1003c710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e818
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100c400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov dword [edi + 0xc], vtable.CZipAutoBuffer.0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x3c]
push 0
mov dword [edi], vtable.ZipArchiveLib::CBaseLibCompressor.0
push 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1003d250
mov dword [esi], eax
mov eax, edi
mov byte [edi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e5e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e908
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100c400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [ebp + 8]
call fcn.1003e930
push 0
push 0xc
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CZipAutoBuffer.0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.1003bae0
mov ecx, dword [ebp + 0x10]
push 0
push 0xc
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call fcn.10032d60
mov eax, dword [edi + 8]
xor ecx, ecx
mov esi, dword [edi + 0xc]
mov ebx, dword [edi + 4]
mov dword [ebp + 0x10], ecx
mov dword [ebp + 8], eax
nop word [eax + eax]
mov eax, esi
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov eax, dword [ebp - 0x14]
sar edx, 8
xor dl, byte [eax + ecx]
mov ecx, ebx
movsx eax, dl
xor eax, ebx
shr ecx, 8
movzx eax, al
mov ebx, dword [eax*4 + 0x1007c2f8]
xor ebx, ecx
mov ecx, dword [ebp + 0x10]
movzx eax, bl
inc ecx
add eax, dword [ebp + 8]
imul eax, eax, 0x8088405
mov dword [edi + 4], ebx
mov dword [ebp + 0x10], ecx
inc eax
mov dword [edi + 8], eax
mov dword [ebp + 8], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1007c2f8]
mov dword [edi + 0xc], esi
cmp ecx, 0xc
jl 0x1003e660
cmp byte [ebp + 0x14], 0
jne 0x1003e6f2
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx + 0xc]
shr al, 3
test al, 1
je 0x1003e6e2
xor eax, eax
cmp byte [ecx + 0x11], dl
jmp 0x1003e6e7
xor eax, eax
cmp byte [ecx + 0x17], dl
sete al
test eax, eax
jne 0x1003e6f2
xor bl, bl
jmp 0x1003e6f4
mov bl, 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1003e704
push eax
call fcn.10069087
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003e720
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e908
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100c400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0xc
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.CZipAutoBuffer.0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.1003bae0
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1003e930
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 8
mov dword [ebp + 8], 0
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
movzx ebx, al
sar ecx, 6
test cl, cl
movzx eax, cl
mov ecx, dword [esi + 4]
cmovne ebx, eax
mov edx, dword [esi + 0xc]
movsx eax, bl
mov edi, edx
xor eax, ecx
and edi, 0xfffd
movzx eax, al
or edi, 2
shr ecx, 8
mov eax, dword [eax*4 + 0x1007c2f8]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 4], eax
movzx eax, al
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x1007c2f8]
mov eax, edi
xor eax, 1
mov dword [esi + 0xc], edx
mov edx, dword [ebp - 0x14]
imul eax, edi
sar eax, 8
xor al, bl
mov byte [edx + ecx], al
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0xa
jl 0x1003e795
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov edi, edx
and edi, 0xfffd
movzx eax, word [eax + 0x10]
or edi, 2
shl eax, 0x10
mov ebx, eax
mov dword [ebp + 8], eax
sar ebx, 0x10
movsx eax, bl
xor eax, ecx
shr ecx, 8
movzx eax, al
push 0
push 0xc
mov eax, dword [eax*4 + 0x1007c2f8]
xor eax, ecx
mov ecx, dword [ebp - 0x14]
mov dword [esi + 4], eax
movzx eax, al
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x1007c2f8]
mov eax, edi
xor eax, 1
mov dword [esi + 0xc], edx
imul eax, edi
sar eax, 8
xor al, bl
mov ebx, dword [ebp + 8]
mov byte [ecx + 0xa], al
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov edi, edx
sar ebx, 0x18
and edi, 0xfffd
movsx eax, bl
or edi, 2
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x1007c2f8]
xor eax, ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi + 4], eax
movzx eax, al
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x1007c2f8]
mov eax, edi
xor eax, 1
mov dword [esi + 0xc], edx
imul eax, edi
sar eax, 8
xor al, bl
mov ebx, dword [ebp - 0x14]
push ebx
mov byte [ebx + 0xb], al
call fcn.10033db0
mov eax, dword [ebp + 0xc]
push ebx
add dword [eax + 0x18], 0xc
adc dword [eax + 0x1c], 0
call fcn.10069087
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003e930
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor edx, edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov dword [esi + 4], 0x12345678
mov dword [esi + 8], 0x23456789
mov dword [esi + 0xc], 0x34567890
cmp dword [ecx + 8], edx
jbe 0x1003e9c4
push ebx
push edi
mov ebx, 0x12345678
mov edi, 0x23456789
mov eax, 0x34567890
nop word [eax + eax]
mov ecx, dword [ecx + 4]
movsx ecx, byte [ecx + edx]
mov edx, ebx
xor ecx, ebx
shr edx, 8
movzx ecx, cl
mov ebx, dword [ecx*4 + 0x1007c2f8]
xor ebx, edx
mov edx, dword [ebp - 4]
movzx ecx, bl
inc edx
add ecx, edi
mov dword [esi + 4], ebx
imul edi, ecx, 0x8088405
mov dword [ebp - 4], edx
inc edi
mov ecx, edi
mov dword [esi + 8], edi
shr ecx, 0x18
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1007c2f8]
mov ecx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, dword [ecx + 8]
jb 0x1003e970
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10041f10
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov bl, byte [ecx + 0x34]
push esi
mov esi, dword [ecx + 0x38]
test esi, esi
jle 0x10041f43
mov edx, dword [ecx + 0x260]
push edi
movzx edi, bl
mov eax, edx
shl edx, 8
shr eax, 0x18
xor eax, edi
xor edx, dword [eax*4 + 0x1007ffa0]
sub esi, 1
jne 0x10041f26
mov dword [ecx + 0x260], edx
pop edi
mov eax, dword [ecx + 0x34]
mov byte [ecx + eax + 0x58], 1
mov edx, dword [ecx + 0x38]
mov eax, edx
sub eax, 1
je 0x10041ff0
sub eax, 1
je 0x10041fd5
sub eax, 1
je 0x10041fae
mov byte [edx + ecx + 0x54], 1
mov edx, dword [ecx + 0x24]
mov eax, dword [ecx + 0x44]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
mov esi, dword [ecx + 0x44]
inc esi
mov dword [ecx + 0x44], esi
mov dl, byte [ecx + 0x38]
mov eax, dword [ecx + 0x24]
sub dl, 4
mov byte [esi + eax], dl
inc dword [ecx + 0x44]
pop esi
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
Function at 0x10043380
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x100c400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor edx, edx
mov dword [ebp - 0x154], edi
lea esi, [edi + 0x1c]
mov ecx, dword [esi]
lea esi, [esi + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
and ecx, 0xff00ff
and eax, 0xff00ff00
or eax, ecx
mov dword [ebp + edx*4 - 0x144], eax
inc edx
cmp edx, 0x10
jb 0x100433a3
lea eax, [ebp - 0x13c]
mov edx, 0x40
mov ecx, dword [eax + 0x2c]
lea eax, [eax + 4]
xor ecx, dword [eax + 0x14]
xor ecx, dword [eax - 0xc]
xor ecx, dword [eax - 4]
rol ecx, 1
mov dword [eax + 0x34], ecx
sub edx, 1
jne 0x100433d5
mov ecx, dword [ebp - 0x154]
mov eax, dword [edi + 8]
mov esi, eax
mov ebx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
mov dword [ebp - 0x158], eax
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], edx
nop dword [eax]
mov ecx, ebx
mov edx, esi
not ecx
rol esi, 5
and ecx, eax
mov eax, edi
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 0x150]
add esi, ecx
add eax, 0x5a827999
mov ecx, dword [ebp - 0x14c]
add esi, dword [ebp + ecx*4 - 0x144]
inc ecx
add esi, eax
mov dword [ebp - 0x14c], ecx
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x150], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x148], eax
ror edi, 2
mov ebx, edx
cmp ecx, 0x14
jb 0x10043420
mov edx, 0x14
nop dword [eax]
xor eax, edi
mov ecx, esi
xor eax, ebx
rol esi, 5
add esi, eax
mov eax, dword [ebp - 0x150]
add esi, dword [ebp + edx*4 - 0x144]
add eax, 0x6ed9eba1
add esi, eax
inc edx
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x150], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x148], eax
ror edi, 2
mov ebx, ecx
cmp edx, 0x28
jb 0x10043480
mov dword [ebp - 0x14c], 0x28
nop word [eax + eax]
mov ecx, edi
mov edx, esi
xor ecx, ebx
rol esi, 5
add esi, dword [ebp - 0x150]
and ecx, eax
mov eax, edi
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 0x14c]
add ecx, 0x8f1bbcdc
add ecx, dword [ebp + eax*4 - 0x144]
mov eax, edi
mov edi, ebx
add esi, ecx
mov ecx, dword [ebp - 0x148]
mov ebx, edx
mov edx, dword [ebp - 0x14c]
inc edx
ror edi, 2
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
cmp edx, 0x3c
jb 0x100434d0
mov edx, 0x3c
nop
xor eax, edi
mov dword [ebp - 0x14c], esi
xor eax, ebx
rol esi, 5
add eax, 0xca62c1d6
add esi, ecx
add eax, dword [ebp + edx*4 - 0x144]
inc edx
mov ecx, dword [ebp - 0x148]
add esi, eax
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 0x14c]
ror edi, 2
mov dword [ebp - 0x148], eax
cmp edx, 0x50
jb 0x10043530
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x158]
add eax, esi
add dword [edx + 0x10], edi
add dword [edx + 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [edx + 8], eax
xor ecx, ebp
mov eax, ebx
add dword [edx + 0xc], eax
mov eax, dword [ebp - 0x148]
add dword [edx + 0x14], eax
pop edi
pop esi
pop ebx
call fcn.10069076
mov esp, ebp
pop ebp
ret
Function at 0x10043740
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x40]
cmp ecx, 0xffffffff
jne 0x10043755
xor al, al
pop esi
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ecx + ebx]
cmp eax, 0x40
jbe 0x100437ba
push edi
cmp ecx, 0x40
ja 0x100437a2
push ecx
push esi
lea ecx, [esi + 0x44]
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov dword [esi + 0x5c], 0xc3d2e1f0
call fcn.100435b0
push ebx
push dword [ebp + 8]
lea ecx, [esi + 0x44]
call fcn.100435b0
add dword [esi + 0x40], ebx
mov al, 1
pop edi
pop ebx
pop esi
pop ebp
ret 8
push ebx
push dword [ebp + 8]
lea eax, [ecx + esi]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov al, 1
add dword [esi + 0x40], ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x100437e0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x40]
cmp ecx, 0xffffffff
je 0x100438a1
cmp ecx, 0x40
jbe 0x1004380d
push edi
lea ecx, [edi + 0x44]
call fcn.10043630
mov dword [edi + 0x40], 0x14
mov ecx, 0x14
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [ecx + edi]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [edi]
lea ecx, [edi + 0x44]
add esp, 0xc
movaps xmm2, xmmword [str.6666666666666666]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi], xmm1
push 0x40
movups xmm0, xmmword [edi + 0x10]
push edi
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x10], xmm1
movups xmm0, xmmword [edi + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [edi + 0x30]
pxor xmm2, xmm0
movups xmmword [edi + 0x30], xmm2
mov dword [edi + 0x48], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x4c], 0x67452301
mov dword [edi + 0x50], 0xefcdab89
mov dword [edi + 0x54], 0x98badcfe
mov dword [edi + 0x58], 0x10325476
mov dword [edi + 0x5c], 0xc3d2e1f0
call fcn.100435b0
mov dword [edi + 0x40], 0xffffffff
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100438b4
push eax
push dword [ebp + 8]
lea ecx, [edi + 0x44]
call fcn.100435b0
pop edi
pop esi
pop ebp
ret 8
Function at 0x100438c0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100c400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x1c], eax
cmp dword [edi + 0x40], 0xffffffff
je 0x100438e9
push 0
push 0
call fcn.100437e0
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x44]
call fcn.10043630
movups xmm0, xmmword [edi]
lea ecx, [edi + 0x44]
movaps xmm2, xmmword [0x100ba650]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi], xmm1
push 0x40
movups xmm0, xmmword [edi + 0x10]
push edi
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x10], xmm1
movups xmm0, xmmword [edi + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [edi + 0x30]
pxor xmm2, xmm0
movups xmmword [edi + 0x30], xmm2
mov dword [edi + 0x48], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x4c], 0x67452301
mov dword [edi + 0x50], 0xefcdab89
mov dword [edi + 0x54], 0x98badcfe
mov dword [edi + 0x58], 0x10325476
mov dword [edi + 0x5c], 0xc3d2e1f0
call fcn.100435b0
push 0x14
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x44]
call fcn.100435b0
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x44]
call fcn.10043630
cmp dword [ebp + 0xc], 0
pop edi
pop esi
jbe 0x100439a0
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069076
mov esp, ebp
pop ebp
ret 8
Function at 0x10047070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
lea eax, [esp + 8]
mov ecx, 0x41
push esi
push edi
mov esi, 0x100d3240
mov edi, 0x100d3344
rep movsd dword es:[edi], dword [esi]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x100470d3
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x100470c9
xor ecx, ecx
cmp esi, 0x104
jae 0x10047105
mov al, byte [esp + ecx + 0x10]
inc ecx
mov byte [esi + 0x100d3240], al
inc esi
cmp ecx, 8
jl 0x100470b0
cmp esi, 0x104
jb 0x100470a3
jmp 0x10047105
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand_s]
nop dword [eax]
lea eax, [esp + 0xc]
push eax
call edi
add esp, 4
test eax, eax
jne 0x10047180
mov al, byte [esp + 0xc]
mov byte [esi + 0x100d3240], al
inc esi
cmp esi, 0x104
jb 0x100470e0
xor ecx, ecx
nop word [eax + eax]
movzx eax, byte [ecx + 0x100d3344]
not al
xor byte [ecx + 0x100d3240], al
movzx eax, byte [ecx + 0x100d3345]
not al
xor byte [ecx + 0x100d3241], al
movzx eax, byte [ecx + 0x100d3346]
not al
xor byte [ecx + 0x100d3242], al
movzx eax, byte [ecx + 0x100d3347]
not al
xor byte [ecx + 0x100d3243], al
movzx eax, byte [ecx + 0x100d3348]
not al
xor byte [ecx + 0x100d3244], al
add ecx, 5
cmp ecx, 0x104
jl 0x10047110
push 0x100d3240
call fcn.10047190
push 0x100d3344
call fcn.10047190
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
mov ecx, 0xd7
call fcn.1002bdd0
int3
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x3091abe
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0x5a4d
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
cmp word [esi], ax
jne 0x3091c21
mov ebx, dword [esi + 0x3c]
add ebx, esi
cmp dword [ebx], 0x4550
jne 0x3091c21
mov eax, dword [edi + 0x688]
test eax, eax
je 0x3091c21
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0xffffffffffffffff
call eax
test eax, eax
je 0x3091c21
mov eax, 0x1c0
cmp word [ebp - 4], ax
je 0x3091b26
mov eax, 0xaa64
cmp word [ebp - 4], ax
jne 0x3091c21
cmp dword [ebx + 8], 0x27debf2c
jne 0x3091b51
push 0x4b2e8f83
push 0x4b2e8de3
push 0x4b280000
mov edx, esi
mov ecx, edi
call fcn.03091a38
add esp, 0xc
xor eax, eax
jmp 0x3091c26
cmp dword [ebx + 8], 0x88330560
jne 0x3091b66
push 0x4b3fabde
push 0x4b3fa92b
jmp 0x3091b39
cmp dword [ebx + 8], 0xe892dd44
jne 0x3091b7b
push 0x4b406b8e
push 0x4b4068db
jmp 0x3091b39
and dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push 0
push 1
push ecx
push 0x2bcd03a7
push esi
mov ecx, edi
call fcn.03092131
test eax, eax
js 0x3091c26
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x3091c21
lea eax, [ebx - 0x140]
mov dword [ebp - 0x1c], 0x3f3f3fe8
push 8
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x18], 0x843f
push ecx
mov edx, 0x140
mov byte [ebp - 0x16], 0xc0
mov ecx, eax
mov dword [ebp - 0x24], 0x1b8
mov word [ebp - 0x20], 0x8400
mov byte [ebp - 0x1e], 0xc0
mov dword [ebp - 0x10], eax
call fcn.030926c9
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x3091bf1
mov ecx, dword [ebp - 0x10]
mov edx, 0x140
jmp 0x3091c0e
push 7
lea eax, [ebp - 0x1c]
mov edx, 0x200
push eax
mov ecx, ebx
call fcn.030926c9
test eax, eax
jne 0x3091c2b
mov edx, 0x200
mov ecx, ebx
push 8
lea eax, [ebp - 0x24]
push eax
call fcn.030926c9
test eax, eax
jne 0x3091b4a
mov eax, 0xe0010001
pop edi
pop esi
pop ebx
leave
ret
push eax
push dword [ebp - 0x14]
push esi
jmp 0x3091b3e

Function at 0x3092551
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x309256f
mov eax, dword [ecx + 0x3c]
cmp eax, 0x400
jg 0x309256f
add eax, ecx
cmp dword [eax], 0x4550
je 0x3092571
xor eax, eax
ret