joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3020a510
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x13c]
push str._mark_
push eax
lea ecx, [esp + 0x3c]
call fcn.301c7701
mov eax, dword [esi + 0x11c]
test eax, eax
lea edi, [esi + 0x11c]
je 0x3020a6e5
mov al, byte [esi + 0x50]
test al, al
jne 0x3020a6e5
mov ebx, dword [esi + 0x350]
test ebx, ebx
je 0x3020a56e
lea esp, [esp]
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x20]
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x3020a560
mov edx, dword [esi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
inc edx
push eax
mov dword [esi + 0x34], edx
call ebx
xor eax, eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov ecx, dword [0x303f9ce0]
or ecx, dword [0x303f9ce4]
jne 0x3020a5a3
push 0x303f9ce0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [0x303f9ce4]
mov eax, dword [0x303f9ce0]
mov ecx, dword [ebp + 8]
push edx
push eax
push 0
push ecx
call fcn.3002e260
push 0
push 0x3e8
push edx
push eax
call fcn.3002e2a0
add eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
adc edx, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
lea esp, [esp]
mov eax, dword [edi]
test eax, eax
je 0x3020a65e
mov ecx, dword [0x303314c0]
cmp eax, ecx
jbe 0x3020a5f2
mov eax, ecx
test eax, eax
jbe 0x3020a625
mov ebx, eax
mov eax, dword [edi]
mov edx, dword [edi + 8]
dec eax
mov dword [edi], eax
mov ecx, dword [edx + eax*8]
mov edx, dword [edx + eax*8 + 4]
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ecx
push eax
mov ecx, esi
mov dword [esp + 0x2c], edx
call fcn.30209ab0
dec ebx
jne 0x3020a5f8
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x3020a63f
lea ecx, [eax + 0x1800]
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x3020a63f
call fcn.301c760b
lea ecx, [esp + 0x28]
push ecx
call ebx
mov edx, dword [esp + 0x2c]
cmp edx, dword [esp + 0x1c]
ja 0x3020a662
jb 0x3020a5e0
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x18]
jae 0x3020a662
jmp 0x3020a5e0
mov byte [esi + 0x50], 1
lea ecx, [esp + 0x28]
push ecx
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 0x28]
mov dword [esi + 0x128], eax
sub eax, edx
mov dword [esi + 0x12c], ecx
sbb ecx, edi
add ebx, eax
mov al, byte [esi + 0x10]
mov dword [esi + 0x28], ebx
mov ebx, dword [esi + 0x2c]
adc ebx, ecx
test al, al
mov dword [esi + 0x2c], ebx
je 0x3020a6bb
push edi
push edx
call fcn.30208ab0
fstp st(0)
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
push edx
push eax
call fcn.30208ab0
fstp st(0)
add esp, 0x10
mov esi, dword [esi + 0x350]
test esi, esi
je 0x3020a6ec
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
mov esi, dword [esi + 8]
test esi, esi
jne 0x3020a6c5
lea ecx, [esp + 0x34]
call fcn.301c7748
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.3020a100
lea ecx, [esp + 0x34]
call fcn.301c7748
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x3020a700
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
push edi
lea ecx, [esp + 0x18]
push ecx
mov dword [esi + 0x30], eax
mov byte [esi + 0x110], 0
mov byte [esi + 0x119], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edi, [esi + 0x150]
mov ebx, 0x28
mov ecx, dword [edi + 0xa0]
call fcn.3020b830
mov ecx, dword [edi]
call fcn.3020b830
mov ecx, dword [edi + 0x140]
call fcn.3020b830
add edi, 4
dec ebx
jne 0x3020a733
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0
push 1
lea ebx, [esi + 0x348]
push ebx
call edi
test eax, eax
je 0x3020a782
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call ebp
push 0
push 1
push ebx
call edi
test eax, eax
jne 0x3020a773
mov edi, dword [esi + 0x34c]
test edi, edi
je 0x3020a7b4
lea ebp, [esi + 0x11c]
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
push ebp
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call fcn.30209ab0
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x3020a792
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov edi, dword [esi + 0x28]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov edx, dword [esi + 0x2c]
sub eax, ebp
sbb ecx, ebx
add edi, eax
adc edx, ecx
push 0xa
mov ecx, esi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edx
call fcn.3020a510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x3020add0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 4]
add esp, 0x24
ret

Function at 0x3020ae30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
neg cl
lea eax, [esp]
push eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], 0
sbb ecx, ecx
and ecx, 0xffffffe0
add ecx, 0x40
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret 0xc
Function at 0x3021b190
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ecx, eax
jne 0x3021b1a3
mov ecx, 1
mov eax, ecx
shl eax, 0x10
cdq
idiv ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0x28], ecx
mov ebp, eax
mov eax, dword [esp + 0x20]
mov edx, ebp
imul edx, esi
mov edi, edx
dec eax
sar edi, 0x10
cmp edi, eax
jl 0x3021b1e0
mov edi, edi
sub edx, ebp
mov edi, edx
sar edi, 0x10
inc ecx
cmp edi, eax
jge 0x3021b1d0
mov dword [esp + 0x28], ecx
mov edi, dword [esp + 0x18]
sub esi, ecx
test esi, esi
jle 0x3021b22a
mov dword [esp + 0x24], esi
mov edi, edi
movzx esi, bh
mov edx, ebx
sar edx, 0x10
movzx ecx, byte [edx + edi]
movzx edx, byte [edi + edx + 1]
mov eax, esi
imul edx, esi
xor eax, 0xff
imul ecx, eax
mov eax, dword [esp + 0x14]
add ecx, edx
sar ecx, 8
mov byte [eax], cl
add ebx, ebp
inc eax
mov dword [esp + 0x14], eax
dec dword [esp + 0x24]
jne 0x3021b1f0
mov ecx, dword [esp + 0x28]
sar ebx, 0x10
test ecx, ecx
movzx eax, byte [ebx + edi]
jle 0x3021b253
mov edi, dword [esp + 0x14]
mov bl, al
mov bh, bl
mov edx, ecx
shr ecx, 2
mov eax, ebx
shl eax, 0x10
mov ax, bx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x302287c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x304]
push ebx
push ebp
mov ebp, dword [eax + 0x308]
push esi
mov esi, dword [eax + 0x300]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x310]
add eax, 0xd8
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
xor edi, edi
jmp 0x30228810
mov ecx, dword [esp + 0x14]
xor edi, edi
jmp 0x30228810
mov ecx, dword [esp + 0x14]
lea esp, [esp]
cmp ebp, 0xf
jge 0x3022883c
mov eax, 0xe
sub eax, ebp
shr eax, 3
inc eax
lea ebp, [ebp + eax*8]
mov edx, dword [esp + 0x10]
movzx ebx, byte [ecx]
shl edx, 8
add edx, ebx
inc ecx
dec eax
mov dword [esp + 0x10], edx
jne 0x30228824
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x24]
movzx eax, byte [eax + edi + 0x149]
mov ecx, esi
shr ecx, 6
mov edx, eax
and edx, 0xfffffffc
movzx ebx, byte [ecx + edx + 0x302ec1c0]
sub esi, ebx
mov ecx, ebp
mov edx, esi
shl edx, cl
mov ecx, dword [esp + 0x10]
and eax, 0xfffffffe
cmp ecx, edx
jb 0x30228878
mov esi, ecx
sub esi, edx
mov dword [esp + 0x10], esi
mov esi, ebx
dec eax
movzx ecx, byte [esi + 0x302ec3d8]
movzx eax, byte [eax + 0x302ec2d1]
sub ebp, ecx
shl esi, cl
mov ecx, dword [esp + 0x24]
mov edx, edi
not edx
mov byte [ecx + edi + 0x149], al
xor eax, edx
test al, 1
je 0x302288a9
inc edi
cmp edi, 3
jl 0x30228808
mov ax, word [edi*8 + 0x302ec930]
mov ecx, dword [esp + 0x1c]
mov word [ecx], ax
movzx edx, byte [edi*8 + 0x302ec934]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
mov dword [edi + eax*4], edx
inc eax
add ecx, 2
cmp eax, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jl 0x30228800
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
mov dword [eax + 0x300], esi
pop esi
mov dword [eax + 0x308], ebp
pop ebp
mov dword [eax + 0x304], ecx
mov dword [eax + 0x310], edx
pop ebx
add esp, 0x10
ret 8
Function at 0x3024c3a0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x3024c3ce
mov edx, dword [esp]
mov dword [eax], edx
pop ecx
ret

Function at 0x3024ed50
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x10]
push ebx
push esi
add eax, 0x18
add edx, 4
push edi
mov dword [esp + 0x14], 8
xor ebx, ebx
nop
movzx esi, word [edx - 4]
mov edi, dword [eax - 0x18]
add esi, edi
cmp esi, ebx
jge 0x3024ed81
xor esi, esi
jmp 0x3024ed8f
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x3024ed8f
mov esi, edi
mov word [edx - 4], si
movzx esi, word [edx - 2]
mov edi, dword [eax - 0x14]
add esi, edi
cmp esi, ebx
jge 0x3024eda4
xor esi, esi
jmp 0x3024edb2
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x3024edb2
mov esi, edi
mov word [edx - 2], si
movzx esi, word [edx]
mov edi, dword [eax - 0x10]
add esi, edi
cmp esi, ebx
jge 0x3024edc6
xor esi, esi
jmp 0x3024edd4
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x3024edd4
mov esi, edi
mov word [edx], si
movzx esi, word [edx + 2]
mov edi, dword [eax - 0xc]
add esi, edi
cmp esi, ebx
jge 0x3024ede8
xor esi, esi
jmp 0x3024edf6
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x3024edf6
mov esi, edi
mov word [edx + 2], si
movzx esi, word [edx + 4]
mov edi, dword [eax - 8]
add esi, edi
cmp esi, ebx
jge 0x3024ee0b
xor esi, esi
jmp 0x3024ee19
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x3024ee19
mov esi, edi
mov word [edx + 4], si
movzx esi, word [edx + 6]
mov edi, dword [eax - 4]
add esi, edi
cmp esi, ebx
jge 0x3024ee2e
xor esi, esi
jmp 0x3024ee3c
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x3024ee3c
mov esi, edi
mov word [edx + 6], si
movzx esi, word [edx + 8]
mov edi, dword [eax]
add esi, edi
cmp esi, ebx
jge 0x3024ee50
xor esi, esi
jmp 0x3024ee5e
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x3024ee5e
mov esi, edi
mov word [edx + 8], si
movzx esi, word [edx + 0xa]
mov edi, dword [eax + 4]
add esi, edi
cmp esi, ebx
jge 0x3024ee73
xor esi, esi
jmp 0x3024ee81
mov edi, 1
shl edi, cl
dec edi
cmp esi, edi
jl 0x3024ee81
mov esi, edi
mov word [edx + 0xa], si
add edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax - 4], ebx
mov dword [eax - 8], ebx
mov dword [eax - 0xc], ebx
mov dword [eax - 0x10], ebx
mov dword [eax - 0x14], ebx
mov dword [eax - 0x18], ebx
add eax, 0x20
dec esi
mov dword [esp + 0x14], esi
jne 0x3024ed70
pop edi
pop esi
pop ebx
ret
Function at 0x30261240
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
jle 0x302612b0
push ebx
mov al, byte [esi]
mov cl, byte [edi]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp], al
mov al, byte [esi + 1]
mov cl, byte [edi + 1]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 1], al
mov al, byte [esi + 2]
mov cl, byte [edi + 2]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 2], al
mov al, byte [esi + 3]
mov cl, byte [edi + 3]
mov bl, al
xor bl, cl
or al, cl
mov ecx, dword [esp + 0x1c]
shr bl, 1
sub al, bl
mov ebx, dword [esp + 0x24]
mov byte [ebp + 3], al
add esi, dword [esp + 0x20]
add edi, ebx
add ebp, ecx
dec edx
jne 0x30261252
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x302618d0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
jle 0x30261994
push ebx
mov al, byte [esi]
mov cl, byte [edi]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp], al
mov al, byte [esi + 1]
mov cl, byte [edi + 1]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 1], al
mov al, byte [esi + 2]
mov cl, byte [edi + 2]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 2], al
mov al, byte [esi + 3]
mov cl, byte [edi + 3]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 3], al
mov al, byte [esi + 4]
mov cl, byte [edi + 4]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 4], al
mov al, byte [esi + 5]
mov cl, byte [edi + 5]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 5], al
mov al, byte [esi + 6]
mov cl, byte [edi + 6]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [ebp + 6], al
mov al, byte [esi + 7]
mov cl, byte [edi + 7]
mov bl, al
xor bl, cl
or al, cl
mov ecx, dword [esp + 0x1c]
shr bl, 1
sub al, bl
mov ebx, dword [esp + 0x24]
mov byte [ebp + 7], al
add esi, dword [esp + 0x20]
add edi, ebx
add ebp, ecx
dec edx
jne 0x302618e6
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x30262490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
push esi
push edi
mov edi, eax
mov esi, ecx
jle 0x302624f5
push ebx
mov cl, byte [edi]
mov al, byte [esi]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi], al
mov cl, byte [edi + 1]
mov al, byte [esi + 1]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 1], al
mov cl, byte [edi + 2]
mov al, byte [esi + 2]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 2], al
mov al, byte [esi + 3]
mov cl, byte [edi + 3]
mov bl, al
xor bl, cl
or al, cl
mov ecx, dword [esp + 0x14]
shr bl, 1
sub al, bl
mov byte [esi + 3], al
add edi, edx
add esi, ecx
dec ebp
jne 0x302624a0
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x30262500
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
jle 0x302625ad
push ebx
mov al, byte [edi]
mov cl, byte [ebp]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi], cl
mov al, byte [edi + 1]
mov cl, byte [ebp + 1]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 1]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 1], cl
mov al, byte [edi + 2]
mov cl, byte [ebp + 2]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 2]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 2], cl
mov al, byte [edi + 3]
mov cl, byte [ebp + 3]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 3]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
mov eax, dword [esp + 0x20]
shr bl, 1
sub cl, bl
mov ebx, dword [esp + 0x24]
mov byte [esi + 3], cl
mov ecx, dword [esp + 0x1c]
add edi, eax
add ebp, ebx
add esi, ecx
dec edx
jne 0x30262516
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x30262c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
push esi
push edi
mov edi, eax
mov esi, ecx
jle 0x30262cc9
push ebx
mov cl, byte [edi]
mov al, byte [esi]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi], al
mov cl, byte [edi + 1]
mov al, byte [esi + 1]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 1], al
mov cl, byte [edi + 2]
mov al, byte [esi + 2]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 2], al
mov cl, byte [edi + 3]
mov al, byte [esi + 3]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 3], al
mov cl, byte [edi + 4]
mov al, byte [esi + 4]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 4], al
mov cl, byte [edi + 5]
mov al, byte [esi + 5]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 5], al
mov cl, byte [edi + 6]
mov al, byte [esi + 6]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov byte [esi + 6], al
mov al, byte [esi + 7]
mov cl, byte [edi + 7]
mov bl, al
xor bl, cl
or al, cl
mov ecx, dword [esp + 0x14]
shr bl, 1
sub al, bl
mov byte [esi + 7], al
add edi, edx
add esi, ecx
dec ebp
jne 0x30262c24
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x30262cd0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
jle 0x30262dfd
push ebx
mov al, byte [edi]
mov cl, byte [ebp]
mov bl, al
xor bl, cl
or al, cl
shr bl, 1
sub al, bl
mov cl, byte [esi]
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi], cl
mov al, byte [edi + 1]
mov cl, byte [ebp + 1]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 1]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 1], cl
mov al, byte [edi + 2]
mov cl, byte [ebp + 2]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 2]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 2], cl
mov al, byte [edi + 3]
mov cl, byte [ebp + 3]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 3]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 3], cl
mov al, byte [edi + 4]
mov cl, byte [ebp + 4]
mov bl, al
xor bl, cl
shr bl, 1
or al, cl
mov cl, byte [esi + 4]
sub al, bl
mov bl, cl
xor bl, al
shr bl, 1
or cl, al
sub cl, bl
mov byte [esi + 4], cl
mov al, byte [edi + 5]
mov cl, byte [ebp + 5]
mov bl, al
xor bl, cl
shr bl, 1
or al, cl
mov cl, byte [esi + 5]
sub al, bl
mov bl, cl
xor bl, al
shr bl, 1
or cl, al
sub cl, bl
mov byte [esi + 5], cl
mov al, byte [edi + 6]
mov cl, byte [ebp + 6]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 6]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
shr bl, 1
sub cl, bl
mov byte [esi + 6], cl
mov al, byte [edi + 7]
mov cl, byte [ebp + 7]
mov bl, al
xor bl, cl
or al, cl
mov cl, byte [esi + 7]
shr bl, 1
sub al, bl
mov bl, cl
xor bl, al
or cl, al
mov eax, dword [esp + 0x20]
shr bl, 1
sub cl, bl
mov ebx, dword [esp + 0x24]
mov byte [esi + 7], cl
mov ecx, dword [esp + 0x1c]
add edi, eax
add ebp, ebx
add esi, ecx
dec edx
jne 0x30262ce6
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x3028d050
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
cdq
and edx, 7
push ebx
mov ebx, dword [esp + 0x10]
add eax, edx
push ebp
sar eax, 3
and ecx, 7
test eax, eax
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
jle 0x3028d09c
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.30288290
xor edx, edx
mov ecx, ebx
shr ecx, 8
mov dh, bl
xor eax, ecx
and eax, 0xff
xor edx, dword [eax*4 + 0x302fc630]
dec edi
mov ebx, edx
jne 0x3028d076
pop edi
test ebp, ebp
jle 0x3028d0c8
push 1
mov ecx, esi
call fcn.30288290
mov ecx, ebx
shr ecx, 0xf
and ecx, 1
and ebx, 0x7fff
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x3028d0c5
xor ebx, 0x8005
dec ebp
jne 0x3028d0a0
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x3028d69d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.3028d660
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x3028d738
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x304076e4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x3028d738
cmp eax, 1
je 0x3028d759
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x3028d738
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x3028d705
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x3028d734
xor eax, eax
inc eax
jmp 0x3028d778
cmp edi, eax
jae 0x3028d73c
xor eax, eax
jmp 0x3028d778
cmp eax, esi
jae 0x3028d743
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x304076e4]
jmp 0x3028d75c
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3028f56b
Capabilities:
Terminate process

Disassembly:
push 8
push 0x302fcab8
call fcn.3028f318
push 8
call fcn.3028e809
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x30407724], esi
jne 0x3028f59f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x30407720], esi
mov al, byte [ebp + 0x10]
mov byte [0x3040771c], al
cmp dword [ebp + 0xc], edi
jne 0x3028f5e9
cmp dword [0x30408d90], edi
je 0x3028f5d9
mov eax, dword [0x30408d8c]
sub eax, 4
mov dword [0x30408d8c], eax
cmp eax, dword [0x30408d90]
jb 0x3028f5d9
mov eax, dword [eax]
cmp eax, edi
je 0x3028f5ba
call eax
jmp 0x3028f5ba
push 0x3030003c
mov eax, 0x30300034
call fcn.3028f553
pop ecx
push 0x30300044
mov eax, 0x30300040
call fcn.3028f553
pop ecx
or dword [ebp - 4], 0xffffffff
call fcn.3028f61a
cmp dword [ebp + 0x10], edi
jne 0x3028f628
mov dword [0x30407724], esi
push dword [ebp + 8]
call fcn.3028f511
xor edi, edi
xor esi, esi
inc esi
call fcn.3028f353
ret