joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100b6010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 4
push 0x3000
push 0xaa00
push 0
mov dword [ebp - 0x104], 0xfb688b84
mov dword [ebp - 0x100], 0xaddb56a9
mov dword [ebp - 0xfc], 0x6a137850
mov dword [ebp - 0xf8], 0xca07718b
mov dword [ebp - 0xf4], 0xdbd646f3
mov dword [ebp - 0xf0], 0x8f63924e
mov dword [ebp - 0xec], 0xec188a18
mov dword [ebp - 0xe8], 0xfac34545
mov dword [ebp - 0xe4], 0x449309fa
mov dword [ebp - 0xe0], 0x811f282f
mov dword [ebp - 0xdc], 0x72502318
mov dword [ebp - 0xd8], 0x6b1f2867
mov dword [ebp - 0xd4], 0xf8ebcce6
mov dword [ebp - 0xd0], 0xa8ec1cca
mov dword [ebp - 0xcc], 0xa1a608d4
mov dword [ebp - 0xc8], 0x1fbae81d
mov dword [ebp - 0xc4], 0x99c46e55
mov dword [ebp - 0xc0], 0xbe0e3cec
mov dword [ebp - 0xbc], 0x315b930c
mov dword [ebp - 0xb8], 0xc0d3a349
mov dword [ebp - 0xb4], 0xb01c43ae
mov dword [ebp - 0xb0], 0xca645a
mov dword [ebp - 0xac], 0x93c8dbb3
mov dword [ebp - 0xa8], 0xe34c4e4b
mov dword [ebp - 0xa4], 0x818e14ba
mov dword [ebp - 0xa0], 0x9ec350a9
mov dword [ebp - 0x9c], 0xf9ce5704
mov dword [ebp - 0x98], 0xf76d2fb1
mov dword [ebp - 0x94], 0x4a08f8ab
mov dword [ebp - 0x90], 0xc3a4a495
mov dword [ebp - 0x8c], 0x4b958196
mov dword [ebp - 0x88], 0x4d96ffb5
mov dword [ebp - 0x84], 0x668737b3
mov dword [ebp - 0x80], 0xec4368a2
mov dword [ebp - 0x7c], 0x3354cd2b
mov dword [ebp - 0x78], 0x9479cc46
mov dword [ebp - 0x74], 0xabcb4f9e
mov dword [ebp - 0x70], 0xce0a773b
mov dword [ebp - 0x6c], 0x4c014bce
mov dword [ebp - 0x68], 0x965d8482
mov dword [ebp - 0x64], 0x592e0286
mov dword [ebp - 0x60], 0x2a4b165d
mov dword [ebp - 0x5c], 0x206900b6
mov dword [ebp - 0x58], 0xa1d6dd98
mov dword [ebp - 0x54], 0x15907c3b
mov dword [ebp - 0x50], 0x43249818
mov dword [ebp - 0x4c], 0x40446c11
mov dword [ebp - 0x48], 0x72cde3c5
mov dword [ebp - 0x44], 0x35edf6f2
mov dword [ebp - 0x40], 0x94884fb0
mov dword [ebp - 0x3c], 0x6efabc9d
mov dword [ebp - 0x38], 0x6c314313
mov dword [ebp - 0x34], 0x2e4efcce
mov dword [ebp - 0x30], 0xd1d2e775
mov dword [ebp - 0x2c], 0xed49f6ac
mov dword [ebp - 0x28], 0x1d98db21
mov dword [ebp - 0x24], 0xac3a1088
mov dword [ebp - 0x20], 0xe755016f
mov dword [ebp - 0x1c], 0x9aa70b48
mov dword [ebp - 0x18], 0x41d19f8f
mov dword [ebp - 0x14], 0x510d139a
mov dword [ebp - 0x10], 0xc3b9ee01
mov dword [ebp - 0xc], 0x8ada4c65
mov dword [ebp - 8], 0xfe657d26
call dword [0x100b7f5c]
mov esi, eax
test esi, esi
jne 0x100029c2
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009563
mov esp, ebp
pop ebp
ret
push 0xaa00
push 0x1001f068
push esi
call fcn.1000ea00
add esp, 0xc
mov eax, 0xff
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x105]
xor byte [ebp + eax - 0x104], cl
dec eax
jne 0x100029e0
mov dl, byte [ebp - 5]
xor byte [ebp - 0x104], dl
push 0xaa00
push esi
mov edx, esi
lea ecx, [ebp - 0x104]
call fcn.10008620
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009563
mov esp, ebp
pop ebp
ret
Function at 0x10002a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100b6010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 4
push 0x3000
push 0x15600
push 0
mov dword [ebp - 0x104], 0x76be04ed
mov dword [ebp - 0x100], 0xc7c4471a
mov dword [ebp - 0xfc], 0x6ae9fbe5
mov dword [ebp - 0xf8], 0x32cfaf7f
mov dword [ebp - 0xf4], 0x6e81bc7c
mov dword [ebp - 0xf0], 0x4d326541
mov dword [ebp - 0xec], 0xe66154fe
mov dword [ebp - 0xe8], 0xf36544b2
mov dword [ebp - 0xe4], 0x9f9fcd5
mov dword [ebp - 0xe0], 0x5c3bf90c
mov dword [ebp - 0xdc], 0xcc973349
mov dword [ebp - 0xd8], 0x9492a9b7
mov dword [ebp - 0xd4], 0x99ba1d0b
mov dword [ebp - 0xd0], 0xc8c3ec7f
mov dword [ebp - 0xcc], 0x3f8be9d0
mov dword [ebp - 0xc8], 0x2d5c4332
mov dword [ebp - 0xc4], 0x6fb01316
mov dword [ebp - 0xc0], 0xb7a44495
mov dword [ebp - 0xbc], 0x5c871aef
mov dword [ebp - 0xb8], 0x647fb9b6
mov dword [ebp - 0xb4], 0x6a2eea29
mov dword [ebp - 0xb0], 0xb19d6a60
mov dword [ebp - 0xac], 0x850c0ea5
mov dword [ebp - 0xa8], 0x3daa0e70
mov dword [ebp - 0xa4], 0x9e0ffaba
mov dword [ebp - 0xa0], 0x951c131a
mov dword [ebp - 0x9c], 0x89ddd3fd
mov dword [ebp - 0x98], 0x788b4d09
mov dword [ebp - 0x94], 0xd658ed38
mov dword [ebp - 0x90], 0x1b3b4f93
mov dword [ebp - 0x8c], 0x62c2e5b3
mov dword [ebp - 0x88], 0x337547e1
mov dword [ebp - 0x84], 0x9b4e52e1
mov dword [ebp - 0x80], 0xebfa57a2
mov dword [ebp - 0x7c], 0xb414ad0e
mov dword [ebp - 0x78], 0x861c7e9c
mov dword [ebp - 0x74], 0x3a8b29cb
mov dword [ebp - 0x70], 0xe50f04e0
mov dword [ebp - 0x6c], 0xbb1ce25d
mov dword [ebp - 0x68], 0xe543604f
mov dword [ebp - 0x64], 0x50681960
mov dword [ebp - 0x60], 0xe827e2bb
mov dword [ebp - 0x5c], 0xe7193b5a
mov dword [ebp - 0x58], 0x60bd68a5
mov dword [ebp - 0x54], 0x46eec4cd
mov dword [ebp - 0x50], 0x7c4f141
mov dword [ebp - 0x4c], 0xc7d1f55
mov dword [ebp - 0x48], 0xb84eed7
mov dword [ebp - 0x44], 0x242615d9
mov dword [ebp - 0x40], 0x28f0d59c
mov dword [ebp - 0x3c], 0x2c87386c
mov dword [ebp - 0x38], 0xbda8933d
mov dword [ebp - 0x34], 0x71fad4d4
mov dword [ebp - 0x30], 0x8424d219
mov dword [ebp - 0x2c], 0x57d380f
mov dword [ebp - 0x28], 0xa524fa04
mov dword [ebp - 0x24], 0x2684d505
mov dword [ebp - 0x20], 0x89250ca0
mov dword [ebp - 0x1c], 0x9f190a3
mov dword [ebp - 0x18], 0x2fa2e201
mov dword [ebp - 0x14], 0xff584666
mov dword [ebp - 0x10], 0x9340d915
mov dword [ebp - 0xc], 0x244ea342
mov dword [ebp - 8], 0xfa77ba98
call dword [0x100b7f5c]
mov esi, eax
test esi, esi
jne 0x10002c92
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009563
mov esp, ebp
pop ebp
ret
push 0x15600
push 0x10029a68
push esi
call fcn.1000ea00
add esp, 0xc
mov eax, 0xff
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x105]
xor byte [ebp + eax - 0x104], cl
dec eax
jne 0x10002cb0
mov dl, byte [ebp - 5]
xor byte [ebp - 0x104], dl
push 0x15600
push esi
mov edx, esi
lea ecx, [ebp - 0x104]
call fcn.10008620
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009563
mov esp, ebp
pop ebp
ret
Function at 0x10002d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100b6010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 4
push 0x3000
push 0x48800
push 0
mov dword [ebp - 0x104], 0xe04221ea
mov dword [ebp - 0x100], 0x343ae4a1
mov dword [ebp - 0xfc], 0x25d89810
mov dword [ebp - 0xf8], 0x33f00fed
mov dword [ebp - 0xf4], 0xa03239e1
mov dword [ebp - 0xf0], 0x64e0412f
mov dword [ebp - 0xec], 0xfc935ade
mov dword [ebp - 0xe8], 0x13c854ee
mov dword [ebp - 0xe4], 0xd114bb9
mov dword [ebp - 0xe0], 0xb17d1ebc
mov dword [ebp - 0xdc], 0xdafb76a1
mov dword [ebp - 0xd8], 0x5fd353bf
mov dword [ebp - 0xd4], 0x7e1f6f82
mov dword [ebp - 0xd0], 0xc49c8c10
mov dword [ebp - 0xcc], 0x386db85b
mov dword [ebp - 0xc8], 0x3db092c0
mov dword [ebp - 0xc4], 0x2d3070fe
mov dword [ebp - 0xc0], 0x31447b66
mov dword [ebp - 0xbc], 0x696dfc16
mov dword [ebp - 0xb8], 0x830d9475
mov dword [ebp - 0xb4], 0x47f5cb0f
mov dword [ebp - 0xb0], 0xfae9a566
mov dword [ebp - 0xac], 0xdcd7965e
mov dword [ebp - 0xa8], 0x256e31e
mov dword [ebp - 0xa4], 0xf240f0e1
mov dword [ebp - 0xa0], 0x49a8e356
mov dword [ebp - 0x9c], 0xd49ba17
mov dword [ebp - 0x98], 0x984ef13f
mov dword [ebp - 0x94], 0x8269434b
mov dword [ebp - 0x90], 0x7abbdced
mov dword [ebp - 0x8c], 0x739f8336
mov dword [ebp - 0x88], 0xaa07a770
mov dword [ebp - 0x84], 0x93781903
mov dword [ebp - 0x80], 0x7ec72032
mov dword [ebp - 0x7c], 0x4fbfd66
mov dword [ebp - 0x78], 0x9eeccab8
mov dword [ebp - 0x74], 0x1b17aa4
mov dword [ebp - 0x70], 0x9e993b59
mov dword [ebp - 0x6c], 0xc4114fa8
mov dword [ebp - 0x68], 0x93187bdf
mov dword [ebp - 0x64], 0x835b4aa3
mov dword [ebp - 0x60], 0xef97f431
mov dword [ebp - 0x5c], 0x25b35f60
mov dword [ebp - 0x58], 0x9860728f
mov dword [ebp - 0x54], 0x43a6dbf2
mov dword [ebp - 0x50], 0x98d6b3e0
mov dword [ebp - 0x4c], 0x68980986
mov dword [ebp - 0x48], 0x1af7ef4c
mov dword [ebp - 0x44], 0x5ad6b5cc
mov dword [ebp - 0x40], 0x733b163a
mov dword [ebp - 0x3c], 0xac483194
mov dword [ebp - 0x38], 0xd3e8c133
mov dword [ebp - 0x34], 0xdc32b1ab
mov dword [ebp - 0x30], 0x614825e6
mov dword [ebp - 0x2c], 0xa7347263
mov dword [ebp - 0x28], 0x21187d0c
mov dword [ebp - 0x24], 0xacb56882
mov dword [ebp - 0x20], 0x1229bb2a
mov dword [ebp - 0x1c], 0x4ee6aa2f
mov dword [ebp - 0x18], 0xd16abb54
mov dword [ebp - 0x14], 0x258dce95
mov dword [ebp - 0x10], 0xdaf6f09a
mov dword [ebp - 0xc], 0x745382e4
mov dword [ebp - 8], 0x3559be52
call dword [0x100b7f5c]
mov esi, eax
test esi, esi
jne 0x10002f62
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009563
mov esp, ebp
pop ebp
ret
push 0x48800
push 0x1003f068
push esi
call fcn.1000ea00
add esp, 0xc
mov eax, 0xff
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x105]
xor byte [ebp + eax - 0x104], cl
dec eax
jne 0x10002f80
mov dl, byte [ebp - 5]
xor byte [ebp - 0x104], dl
push 0x48800
push esi
mov edx, esi
lea ecx, [ebp - 0x104]
call fcn.10008620
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009563
mov esp, ebp
pop ebp
ret
Function at 0x10002fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100b6010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 4
push 0x3000
push 0x2600
push 0
mov dword [ebp - 0x104], 0xd397a5fb
mov dword [ebp - 0x100], 0x6f4257fb
mov dword [ebp - 0xfc], 0x45907f69
mov dword [ebp - 0xf8], 0x179d8df9
mov dword [ebp - 0xf4], 0xa486b086
mov dword [ebp - 0xf0], 0x9a79f005
mov dword [ebp - 0xec], 0x5f75aa5d
mov dword [ebp - 0xe8], 0x3e511bcd
mov dword [ebp - 0xe4], 0xc3b16a6b
mov dword [ebp - 0xe0], 0x8d99bd20
mov dword [ebp - 0xdc], 0x3cb156c
mov dword [ebp - 0xd8], 0xbc2935ac
mov dword [ebp - 0xd4], 0xbf7e6297
mov dword [ebp - 0xd0], 0xc1a3b1d8
mov dword [ebp - 0xcc], 0x47e475f3
mov dword [ebp - 0xc8], 0x1d04e7d6
mov dword [ebp - 0xc4], 0x7836cc3a
mov dword [ebp - 0xc0], 0x8066b547
mov dword [ebp - 0xbc], 0xfc9c2118
mov dword [ebp - 0xb8], 0xf9a98d17
mov dword [ebp - 0xb4], 0x6ada1cc7
mov dword [ebp - 0xb0], 0x4cd3b6e0
mov dword [ebp - 0xac], 0xef82e01c
mov dword [ebp - 0xa8], 0x184cacde
mov dword [ebp - 0xa4], 0x79e0ac5c
mov dword [ebp - 0xa0], 0xad720706
mov dword [ebp - 0x9c], 0x7076f513
mov dword [ebp - 0x98], 0x1c586eeb
mov dword [ebp - 0x94], 0x98994731
mov dword [ebp - 0x90], 0xb5e26f2a
mov dword [ebp - 0x8c], 0xa0479950
mov dword [ebp - 0x88], 0x925b7e27
mov dword [ebp - 0x84], 0x3074fcbd
mov dword [ebp - 0x80], 0x38100caf
mov dword [ebp - 0x7c], 0xc555c0c6
mov dword [ebp - 0x78], 0xbffa58b1
mov dword [ebp - 0x74], 0xaf0fd526
mov dword [ebp - 0x70], 0x47b30f9c
mov dword [ebp - 0x6c], 0x55e9a38e
mov dword [ebp - 0x68], 0x27d5f4a0
mov dword [ebp - 0x64], 0x23d2044b
mov dword [ebp - 0x60], 0x326aaef1
mov dword [ebp - 0x5c], 0x32c4f568
mov dword [ebp - 0x58], 0xd3254352
mov dword [ebp - 0x54], 0xa35c2508
mov dword [ebp - 0x50], 0xdc456f23
mov dword [ebp - 0x4c], 0x1ab77e05
mov dword [ebp - 0x48], 0xfb66a3fc
mov dword [ebp - 0x44], 0x72a7592e
mov dword [ebp - 0x40], 0x7c66fbc9
mov dword [ebp - 0x3c], 0x7bc83bfc
mov dword [ebp - 0x38], 0x98c2e0c
mov dword [ebp - 0x34], 0xdfed1b48
mov dword [ebp - 0x30], 0x7ffbf72d
mov dword [ebp - 0x2c], 0x47f327ea
mov dword [ebp - 0x28], 0x1a5daee3
mov dword [ebp - 0x24], 0x82200775
mov dword [ebp - 0x20], 0xf2466ba8
mov dword [ebp - 0x1c], 0x290fca93
mov dword [ebp - 0x18], 0x13632cc0
mov dword [ebp - 0x14], 0xf1da734c
mov dword [ebp - 0x10], 0x77aaaec7
mov dword [ebp - 0xc], 0xd85c214f
mov dword [ebp - 8], 0x875f8f9f
call dword [0x100b7f5c]
mov esi, eax
test esi, esi
jne 0x10003232
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009563
mov esp, ebp
pop ebp
ret
push 0x2600
push 0x10087868
push esi
call fcn.1000ea00
add esp, 0xc
mov eax, 0xff
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x105]
xor byte [ebp + eax - 0x104], cl
dec eax
jne 0x10003250
mov dl, byte [ebp - 5]
xor byte [ebp - 0x104], dl
push 0x2600
push esi
mov edx, esi
lea ecx, [ebp - 0x104]
call fcn.10008620
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009563
mov esp, ebp
pop ebp
ret
Function at 0x100032a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100b6010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 4
push 0x3000
push 0x23c00
push 0
mov dword [ebp - 0x104], 0xc311f842
mov dword [ebp - 0x100], 0xf3fb30fb
mov dword [ebp - 0xfc], 0xfb7f8cd9
mov dword [ebp - 0xf8], 0x3d1e305b
mov dword [ebp - 0xf4], 0x81e25465
mov dword [ebp - 0xf0], 0x3aa697a5
mov dword [ebp - 0xec], 0xb2f4460e
mov dword [ebp - 0xe8], 0x692b33aa
mov dword [ebp - 0xe4], 0xad4b1f3d
mov dword [ebp - 0xe0], 0xee9b8074
mov dword [ebp - 0xdc], 0x91fca6f3
mov dword [ebp - 0xd8], 0xe5ceff6d
mov dword [ebp - 0xd4], 0x2b827577
mov dword [ebp - 0xd0], 0xa6fb1407
mov dword [ebp - 0xcc], 0x66737ead
mov dword [ebp - 0xc8], 0x7306791f
mov dword [ebp - 0xc4], 0xce54d452
mov dword [ebp - 0xc0], 0x7193e21d
mov dword [ebp - 0xbc], 0x3b52641b
mov dword [ebp - 0xb8], 0x89a3ba20
mov dword [ebp - 0xb4], 0x8f103c88
mov dword [ebp - 0xb0], 0x878a08a4
mov dword [ebp - 0xac], 0x166ba138
mov dword [ebp - 0xa8], 0x486f6f60
mov dword [ebp - 0xa4], 0xf5dcc0e6
mov dword [ebp - 0xa0], 0x7ca1d5cc
mov dword [ebp - 0x9c], 0x76af2685
mov dword [ebp - 0x98], 0x61591e15
mov dword [ebp - 0x94], 0x10d798c2
mov dword [ebp - 0x90], 0x87a79582
mov dword [ebp - 0x8c], 0x5762985b
mov dword [ebp - 0x88], 0x59b39288
mov dword [ebp - 0x84], 0x35b13032
mov dword [ebp - 0x80], 0x477cd92e
mov dword [ebp - 0x7c], 0x66a12ed5
mov dword [ebp - 0x78], 0x89e0c994
mov dword [ebp - 0x74], 0xe298d01d
mov dword [ebp - 0x70], 0x8d8538d1
mov dword [ebp - 0x6c], 0x273ed40d
mov dword [ebp - 0x68], 0x2a77971d
mov dword [ebp - 0x64], 0x42afca4b
mov dword [ebp - 0x60], 0x236af4d8
mov dword [ebp - 0x5c], 0xdaf42655
mov dword [ebp - 0x58], 0x8e6bd991
mov dword [ebp - 0x54], 0x2fee2b0c
mov dword [ebp - 0x50], 0xc46db2e
mov dword [ebp - 0x4c], 0xe49912f0
mov dword [ebp - 0x48], 0x6280d8f6
mov dword [ebp - 0x44], 0x9f05593
mov dword [ebp - 0x40], 0xae014047
mov dword [ebp - 0x3c], 0xaa94b343
mov dword [ebp - 0x38], 0x8ba1d67c
mov dword [ebp - 0x34], 0x9afa307b
mov dword [ebp - 0x30], 0x9a57d753
mov dword [ebp - 0x2c], 0x7e3b7ac0
mov dword [ebp - 0x28], 0x867f284c
mov dword [ebp - 0x24], 0x2001a314
mov dword [ebp - 0x20], 0x67a8ba17
mov dword [ebp - 0x1c], 0xc68ef078
mov dword [ebp - 0x18], 0x95c4dc57
mov dword [ebp - 0x14], 0x579e91d6
mov dword [ebp - 0x10], 0xb1bd7346
mov dword [ebp - 0xc], 0xfa816997
mov dword [ebp - 8], 0x66d75f7e
call dword [0x100b7f5c]
mov esi, eax
test esi, esi
jne 0x10003502
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009563
mov esp, ebp
pop ebp
ret
push 0x23c00
push 0x10089e68
push esi
call fcn.1000ea00
add esp, 0xc
mov eax, 0xff
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x105]
xor byte [ebp + eax - 0x104], cl
dec eax
jne 0x10003520
mov dl, byte [ebp - 5]
xor byte [ebp - 0x104], dl
push 0x23c00
push esi
mov edx, esi
lea ecx, [ebp - 0x104]
call fcn.10008620
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009563
mov esp, ebp
pop ebp
ret
Function at 0x10003570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100b6010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 4
mov cl, 0x64
push 0x3000
mov byte [ebp - 0xba], cl
push 0x7200
mov cl, 0xd8
push 0
mov dword [ebp - 0x104], 0x46cdd13f
mov dword [ebp - 0x100], 0xfe2604aa
mov dword [ebp - 0xfc], 0x65ad3862
mov dword [ebp - 0xf8], 0x220d3935
mov dword [ebp - 0xf4], 0x537fc057
mov dword [ebp - 0xf0], 0x657b560f
mov dword [ebp - 0xec], 0xce8721df
mov dword [ebp - 0xe8], 0xf829ea05
mov dword [ebp - 0xe4], 0xb1a688e
mov dword [ebp - 0xe0], 0xbd0064ec
mov dword [ebp - 0xdc], 0xd6b85796
mov dword [ebp - 0xd8], 0xcf8cff84
mov dword [ebp - 0xd4], 0x959f2c21
mov dword [ebp - 0xd0], 0xdbb4503e
mov dword [ebp - 0xcc], 0xaec32
mov dword [ebp - 0xc8], 0xbda78094
mov dword [ebp - 0xc4], 0xb96e05e2
mov dword [ebp - 0xc0], 0x79609c31
mov word [ebp - 0xbc], 0xc7e6
mov dword [ebp - 0xb9], 0xe3e48dd8
mov dword [ebp - 0xb5], 0x6b8a1b57
mov dword [ebp - 0xb1], 0xb19f33e1
mov dword [ebp - 0xad], 0x3a3b41f2
mov dword [ebp - 0xa9], 0x30d46256
mov dword [ebp - 0xa5], 0x73db844
mov dword [ebp - 0xa1], 0xd409fc06
mov dword [ebp - 0x9d], 0x76c5f4fc
mov dword [ebp - 0x99], 0x31b5b6ab
mov dword [ebp - 0x95], 0x30a6a1b
mov dword [ebp - 0x91], 0xd8217185
mov dword [ebp - 0x8d], 0x425514d1
mov dword [ebp - 0x89], 0x7669debf
mov dword [ebp - 0x85], 0xacb46d75
mov dword [ebp - 0x81], 0xa8e81df7
mov dword [ebp - 0x7d], 0xdc9c297e
mov dword [ebp - 0x79], 0x6e670399
mov dword [ebp - 0x75], 0x8270a522
mov dword [ebp - 0x71], 0xef0f2ace
mov dword [ebp - 0x6d], 0x24ee376e
mov dword [ebp - 0x69], 0x7432944c
mov dword [ebp - 0x65], 0xbf3ef759
mov dword [ebp - 0x61], 0xebd99de5
mov dword [ebp - 0x5d], 0x9f82392c
mov dword [ebp - 0x59], 0x582767d2
mov dword [ebp - 0x55], 0x485aa9cb
mov dword [ebp - 0x51], 0x53969e80
mov dword [ebp - 0x4d], 0xc010da3a
mov dword [ebp - 0x49], 0x236dd812
mov dword [ebp - 0x45], 0x7454def5
mov dword [ebp - 0x41], 0x146900de
mov dword [ebp - 0x3d], 0xfee333f0
mov byte [ebp - 0x39], cl
mov dword [ebp - 0x38], 0xb3ab8dfa
mov dword [ebp - 0x34], 0x95bfdd96
mov dword [ebp - 0x30], 0x6ea9536a
mov dword [ebp - 0x2c], 0xc536e48c
mov dword [ebp - 0x28], 0x51a6b803
mov dword [ebp - 0x24], 0x8d7d8232
mov dword [ebp - 0x20], 0xce3bb9d3
mov dword [ebp - 0x1c], 0xfa2f1c8e
mov dword [ebp - 0x18], 0xad3c6a3b
mov dword [ebp - 0x14], 0x86a03043
mov dword [ebp - 0x10], 0x86b13ba0
mov dword [ebp - 0xc], 0xfb85f1ed
mov dword [ebp - 8], 0x1f12d1cc
call dword [0x100b7f5c]
mov esi, eax
test esi, esi
jne 0x100037e1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009563
mov esp, ebp
pop ebp
ret
push 0x7200
push 0x100ada68
push esi
call fcn.1000ea00
add esp, 0xc
mov eax, 0xff
lea esp, [esp]
mov cl, byte [ebp + eax - 0x105]
xor byte [ebp + eax - 0x104], cl
dec eax
jne 0x10003800
mov dl, byte [ebp - 5]
xor byte [ebp - 0x104], dl
push 0x7200
push esi
mov edx, esi
lea ecx, [ebp - 0x104]
call fcn.10008620
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009563
mov esp, ebp
pop ebp
ret
Function at 0x10004730
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10018938
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100b6010]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
mov eax, dword [0x100b6010]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x60], ebx
mov esi, 0x15
mov dword [esp + 0x30], esi
call fcn.100068c0
mov dword [esp + 0x34], eax
lea eax, [ebx + 2]
mov dword [esp + 0x38], esi
call fcn.100068c0
mov dword [esp + 0x3c], eax
mov esi, 0x16
lea eax, [ebx + 0xe]
mov dword [esp + 0x40], esi
call fcn.100068c0
mov dword [esp + 0x44], eax
lea eax, [ebx + 0xf]
mov dword [esp + 0x48], esi
call fcn.100068c0
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.10008bc0
add esp, 8
test eax, eax
je 0x10004828
mov eax, dword [esp + 0x28]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100047f0
sub eax, edx
mov edi, eax
xor esi, esi
mov ecx, dword [esp + esi*8 + 0x30]
mov edx, dword [esp + 0x28]
push ecx
mov eax, edi
sub eax, ecx
mov ecx, dword [esp + esi*8 + 0x38]
push ecx
add edx, eax
push edx
call fcn.10009de5
add esp, 0xc
cmp eax, ebx
je 0x10004828
inc esi
cmp esi, 4
jb 0x100047fd
mov dword [esp + 0x14], ebx
lea esi, [esp + 0x18]
mov dword [esp + 0x60], 0xffffffff
call fcn.100089f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10009563
mov esp, ebp
pop ebp
ret
Function at 0x10008620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b6010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push edi
mov edi, ecx
mov ebx, edx
je 0x1000874d
test edi, edi
je 0x1000874d
test ebx, ebx
je 0x1000874d
push esi
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.1000f830
add esp, 0xc
xor esi, esi
xor eax, eax
mov edi, edi
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, 0x100
jb 0x10008670
xor eax, eax
jmp 0x10008690
movzx ecx, byte [ebp + eax - 0x104]
mov edx, eax
and edx, 0xff
movzx edx, byte [edx + edi]
add edx, ecx
add esi, edx
and esi, 0xff
mov dl, byte [ebp + esi - 0x104]
mov byte [ebp + eax - 0x104], dl
inc eax
mov byte [ebp + esi - 0x104], cl
cmp eax, 0x100
jb 0x10008690
mov eax, dword [ebp + 0xc]
xor esi, esi
xor edi, edi
test eax, eax
je 0x1000874c
mov edx, dword [ebp + 8]
mov ecx, ebx
sub edx, ebx
mov dword [ebp - 0x108], eax
jmp 0x100086f0
inc esi
and esi, 0xff
movzx eax, byte [ebp + esi - 0x104]
add edi, eax
and edi, 0xff
mov bl, byte [ebp + edi - 0x104]
mov byte [ebp + esi - 0x104], bl
mov byte [ebp + edi - 0x104], al
movzx ebx, byte [ebp + esi - 0x104]
add ebx, eax
and ebx, 0x800000ff
jns 0x10008736
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x104]
xor al, byte [edx + ecx]
inc ecx
dec dword [ebp - 0x108]
mov byte [ecx - 1], al
jne 0x100086f0
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10009563
mov esp, ebp
pop ebp
ret

Function at 0x1000a2dd
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
jne 0x1000a30e
call fcn.1000c26c
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.1000c21f
add esp, 0x14
or eax, 0xffffffff
jmp 0x1000a38a
push esi
call fcn.1000cdb3
push 0x214
push 1
call fcn.1000f6bf
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x1000a372
call fcn.1000cf7b
push dword [eax + 0x6c]
push esi
call fcn.1000ce37
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0x1c]
pop ecx
pop ecx
mov dword [esi + 0x54], edi
cmp eax, ebx
jne 0x1000a34f
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x1000a266
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, ebx
jne 0x1000a389
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push esi
call fcn.100097ba
pop ecx
cmp dword [ebp - 4], ebx
je 0x1000a387
push dword [ebp - 4]
call fcn.1000c292
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret