joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100df442
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
movdqa xmm2, xmmword [0x10187140]
movdqa xmm3, xmmword [0x101aeb40]
mov esi, dword [edx]
mov dword [edx], 0
and ecx, 0xfffffffe
xor edx, edx
add esi, 0x20
sar esi, 6
movd xmm0, esi
pshufd xmm0, xmm0, 0
mov esi, 0xfffffff0
movdqu xmm7, xmmword [eax + esi + 0x10]
pxor xmm1, xmm1
movdqa xmm5, xmm3
movdqa xmm4, xmm7
punpcklwd xmm7, xmm1
punpckhwd xmm4, xmm1
paddd xmm7, xmm0
paddd xmm4, xmm0
movdqa xmm1, xmm7
movdqa xmm6, xmm4
pxor xmm1, xmm2
pxor xmm6, xmm2
pcmpgtd xmm5, xmm6
movdqa xmm6, xmm3
pcmpgtd xmm6, xmm1
pxor xmm1, xmm1
psubd xmm1, xmm7
pand xmm7, xmm6
psrad xmm1, 0x1f
psrld xmm1, 0x16
pandn xmm6, xmm1
pxor xmm1, xmm1
psubd xmm1, xmm4
pand xmm4, xmm5
por xmm6, xmm7
psrad xmm1, 0x1f
pslld xmm6, 0x10
psrld xmm1, 0x16
psrad xmm6, 0x10
pandn xmm5, xmm1
por xmm5, xmm4
pslld xmm5, 0x10
psrad xmm5, 0x10
packssdw xmm6, xmm5
movdqu xmmword [eax + esi + 0x10], xmm6
add esi, 0x10
jne 0x100df480
inc edx
add eax, ecx
cmp edx, 8
jne 0x100df47b
pop esi
ret

Function at 0x100dfd7e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
movdqa xmm2, xmmword [0x10187140]
movdqa xmm3, xmmword [0x101aeb80]
pxor xmm1, xmm1
mov esi, dword [edx]
mov dword [edx], 0
and ecx, 0xfffffffe
xor edx, edx
add esi, 0x20
sar esi, 6
movd xmm0, esi
pshufd xmm0, xmm0, 0
mov esi, 0xfffffff8
movq xmm4, qword [eax + esi + 8]
movdqa xmm6, xmm3
punpcklwd xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm5, xmm4
pxor xmm5, xmm2
pcmpgtd xmm6, xmm5
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm4, xmm6
psrad xmm5, 0x1f
psrld xmm5, 0x14
pandn xmm6, xmm5
por xmm6, xmm4
pshuflw xmm4, xmm6, 0xe8
pshufhw xmm4, xmm4, 0xe8
pshufd xmm4, xmm4, 0xe8
movq qword [eax + esi + 8], xmm4
add esi, 8
jne 0x100dfdc0
inc edx
add eax, ecx
cmp edx, 4
jne 0x100dfdbb
pop esi
ret

Function at 0x100dfe20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
movdqa xmm2, xmmword [0x10187140]
movdqa xmm3, xmmword [0x101aeb80]
mov esi, dword [edx]
mov dword [edx], 0
and ecx, 0xfffffffe
xor edx, edx
add esi, 0x20
sar esi, 6
movd xmm0, esi
pshufd xmm0, xmm0, 0
mov esi, 0xfffffff0
movdqu xmm7, xmmword [eax + esi + 0x10]
pxor xmm1, xmm1
movdqa xmm5, xmm3
movdqa xmm4, xmm7
punpcklwd xmm7, xmm1
punpckhwd xmm4, xmm1
paddd xmm7, xmm0
paddd xmm4, xmm0
movdqa xmm1, xmm7
movdqa xmm6, xmm4
pxor xmm1, xmm2
pxor xmm6, xmm2
pcmpgtd xmm5, xmm6
movdqa xmm6, xmm3
pcmpgtd xmm6, xmm1
pxor xmm1, xmm1
psubd xmm1, xmm7
pand xmm7, xmm6
psrad xmm1, 0x1f
psrld xmm1, 0x14
pandn xmm6, xmm1
pxor xmm1, xmm1
psubd xmm1, xmm4
pand xmm4, xmm5
por xmm6, xmm7
psrad xmm1, 0x1f
pslld xmm6, 0x10
psrld xmm1, 0x14
psrad xmm6, 0x10
pandn xmm5, xmm1
por xmm5, xmm4
pslld xmm5, 0x10
psrad xmm5, 0x10
packssdw xmm6, xmm5
movdqu xmmword [eax + esi + 0x10], xmm6
add esi, 0x10
jne 0x100dfe5e
inc edx
add eax, ecx
cmp edx, 8
jne 0x100dfe59
pop esi
ret
Function at 0x100e075c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
movdqa xmm2, xmmword [0x10187140]
movdqa xmm3, xmmword [0x101aebc0]
pxor xmm1, xmm1
mov esi, dword [edx]
mov dword [edx], 0
and ecx, 0xfffffffe
xor edx, edx
add esi, 0x20
sar esi, 6
movd xmm0, esi
pshufd xmm0, xmm0, 0
mov esi, 0xfffffff8
movq xmm4, qword [eax + esi + 8]
movdqa xmm6, xmm3
punpcklwd xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm5, xmm4
pxor xmm5, xmm2
pcmpgtd xmm6, xmm5
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm4, xmm6
psrad xmm5, 0x1f
psrld xmm5, 0x12
pandn xmm6, xmm5
por xmm6, xmm4
pshuflw xmm4, xmm6, 0xe8
pshufhw xmm4, xmm4, 0xe8
pshufd xmm4, xmm4, 0xe8
movq qword [eax + esi + 8], xmm4
add esi, 8
jne 0x100e079e
inc edx
add eax, ecx
cmp edx, 4
jne 0x100e0799
pop esi
ret

Function at 0x100e07fe
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
movdqa xmm2, xmmword [0x10187140]
movdqa xmm3, xmmword [0x101aebc0]
mov esi, dword [edx]
mov dword [edx], 0
and ecx, 0xfffffffe
xor edx, edx
add esi, 0x20
sar esi, 6
movd xmm0, esi
pshufd xmm0, xmm0, 0
mov esi, 0xfffffff0
movdqu xmm7, xmmword [eax + esi + 0x10]
pxor xmm1, xmm1
movdqa xmm5, xmm3
movdqa xmm4, xmm7
punpcklwd xmm7, xmm1
punpckhwd xmm4, xmm1
paddd xmm7, xmm0
paddd xmm4, xmm0
movdqa xmm1, xmm7
movdqa xmm6, xmm4
pxor xmm1, xmm2
pxor xmm6, xmm2
pcmpgtd xmm5, xmm6
movdqa xmm6, xmm3
pcmpgtd xmm6, xmm1
pxor xmm1, xmm1
psubd xmm1, xmm7
pand xmm7, xmm6
psrad xmm1, 0x1f
psrld xmm1, 0x12
pandn xmm6, xmm1
pxor xmm1, xmm1
psubd xmm1, xmm4
pand xmm4, xmm5
por xmm6, xmm7
psrad xmm1, 0x1f
pslld xmm6, 0x10
psrld xmm1, 0x12
psrad xmm6, 0x10
pandn xmm5, xmm1
por xmm5, xmm4
pslld xmm5, 0x10
psrad xmm5, 0x10
packssdw xmm6, xmm5
movdqu xmmword [eax + esi + 0x10], xmm6
add esi, 0x10
jne 0x100e083c
inc edx
add eax, ecx
cmp edx, 8
jne 0x100e0837
pop esi
ret

Function at 0x100fcbcd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov dword [ebp - 0x10], ecx
mov edi, edx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
push esi
push ebx
call fcn.100fcc2b
add esp, 8
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
lea ecx, [eax + 8]
push esi
push ebx
call fcn.100fcc2b
add esp, 8
lea edx, [edi + esi*8]
mov edi, dword [ebp - 0x10]
lea ecx, [edi + ebx*8]
push esi
push ebx
call fcn.100fcc2b
add esp, 8
mov eax, dword [ebp - 0x14]
lea ecx, [edi + ebx*8 + 8]
lea edx, [eax + esi*8 + 8]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.100fcc2b
Function at 0x100fd67e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
add ecx, 3
mov edi, 4
mov ebx, 0xff
movzx eax, byte [edx]
movzx ebp, byte [edx + 1]
movzx esi, byte [edx + 2]
add ebp, eax
lea eax, [ebp + ebp*4]
movzx ebp, byte [edx - 1]
add esi, ebp
movzx ebp, byte [edx - 2]
lea esi, [esi + esi*4]
lea eax, [ebp + eax*4]
movzx ebp, byte [edx + 3]
sub eax, esi
lea esi, [eax + ebp + 0x10]
sar esi, 5
mov eax, esi
not eax
sar eax, 0x1f
cmp esi, ebx
cmovbe eax, esi
mov byte [ecx - 3], al
movzx eax, byte [edx + 1]
movzx esi, byte [edx + 2]
movzx ebp, byte [edx + 3]
add esi, eax
lea eax, [esi + esi*4]
movzx esi, byte [edx]
add ebp, esi
lea esi, [ebp + ebp*4]
movzx ebp, byte [edx - 1]
lea eax, [ebp + eax*4]
movzx ebp, byte [edx + 4]
sub eax, esi
lea esi, [eax + ebp + 0x10]
sar esi, 5
mov eax, esi
not eax
sar eax, 0x1f
cmp esi, ebx
cmovbe eax, esi
mov byte [ecx - 2], al
movzx eax, byte [edx + 2]
movzx esi, byte [edx + 3]
movzx ebp, byte [edx + 4]
add esi, eax
lea eax, [esi + esi*4]
movzx esi, byte [edx + 1]
add ebp, esi
lea esi, [ebp + ebp*4]
movzx ebp, byte [edx]
lea eax, [ebp + eax*4]
movzx ebp, byte [edx + 5]
sub eax, esi
lea esi, [eax + ebp + 0x10]
sar esi, 5
mov eax, esi
not eax
sar eax, 0x1f
cmp esi, ebx
cmovbe eax, esi
mov byte [ecx - 1], al
movzx eax, byte [edx + 3]
movzx esi, byte [edx + 4]
movzx ebp, byte [edx + 5]
add esi, eax
lea eax, [esi + esi*4]
movzx esi, byte [edx + 2]
add ebp, esi
movzx esi, byte [edx + 1]
lea eax, [esi + eax*4]
lea esi, [ebp + ebp*4]
sub eax, esi
movzx esi, byte [edx + 6]
lea esi, [eax + esi + 0x10]
sar esi, 5
mov eax, esi
not eax
sar eax, 0x1f
cmp esi, ebx
cmovbe eax, esi
add edx, dword [esp + 0x18]
mov byte [ecx], al
add ecx, dword [esp + 0x14]
dec edi
jne 0x100fd68f
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100fdc29
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
add eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
movzx edx, byte [eax + esi - 2]
movzx ebx, byte [eax + esi + 6]
movzx edi, byte [eax + esi]
movzx ecx, byte [eax + esi - 4]
movzx ebp, byte [eax + esi + 4]
mov dword [esp], edx
movzx edx, byte [eax + esi + 2]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edi
lea ebx, [edx + edi]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], edx
mov edx, ebp
lea ebx, [ebx + ebx*4]
add ecx, edi
lea ebx, [ecx + ebx*4]
mov ecx, dword [esp]
lea ecx, [ebp + ecx]
mov ebp, 0xff
lea ecx, [ecx + ecx*4]
sub ebx, ecx
add ebx, 0x10
sar ebx, 5
mov ecx, ebx
not ecx
sar ecx, 0x1f
cmp ebx, ebp
mov ebp, 0xff
cmovbe ecx, ebx
movzx ebx, byte [eax + esi + 8]
mov eax, dword [esp + 0xc]
add edx, dword [esp + 0x14]
add edi, dword [esp + 0x18]
add ebx, dword [esp]
mov byte [eax + esi], cl
lea eax, [edx + edx*4]
mov edx, dword [esp + 8]
lea ecx, [ebx + eax*4]
lea eax, [edi + edi*4]
sub ecx, eax
add ecx, 0x10
sar ecx, 5
mov eax, ecx
not eax
sar eax, 0x1f
cmp ecx, ebp
cmovbe eax, ecx
mov byte [edx + esi], al
inc esi
cmp esi, 2
jne 0x100fdc44
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4012a4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [0x41b5b0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5b4]
mov dword [ebp - 0x34], eax
call fcn.0040129d
mov edi, dword [ebp - 0x14]
mov eax, dword [0x41b5b8]
add edi, 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5bc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 8]
mov eax, edx
mov ecx, dword [0x2d386cc]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132d
push 0x418228
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0x2d386cc]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d386c8]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x2d386c8], eax
mov eax, dword [0x2d38620]
cmove eax, dword [ebp - 0x24]
mov dword [0x2d38620], eax
lea eax, [edi + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x2d386c4], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x1c]
sub ebx, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x1c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4012f5
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d37c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a35c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404ce5
mov dword [ebp - 0x14], eax
cmp dword [0x43ed80], esi
jne 0x40d46f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d54f
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d54f
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d54f
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43ed80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43ed84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43ed88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ed90], eax
test eax, eax
je 0x40d46c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ed8c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d494
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d487
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d4a9
push 4
pop eax
jmp 0x40d551
cmp dword [ebp - 0x14], esi
je 0x40d4a9
push dword [0x43ed80]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d48e
mov eax, dword [0x43ed8c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d507
cmp dword [0x43ed90], edi
je 0x40d507
push eax
call ebx
push dword [0x43ed90]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d507
test eax, eax
je 0x40d507
call ecx
test eax, eax
je 0x40d4fc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4fc
test byte [ebp - 8], 1
jne 0x40d507
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d537
mov eax, dword [0x43ed84]
cmp eax, edi
je 0x40d534
push eax
call ebx
test eax, eax
je 0x40d534
call eax
mov esi, eax
test esi, esi
je 0x40d534
mov eax, dword [0x43ed88]
cmp eax, edi
je 0x40d534
push eax
call ebx
test eax, eax
je 0x40d534
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43ed80]
call ebx
test eax, eax
je 0x40d54f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d551
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040404b
mov esp, ebp
pop ebp
ret
Function at 0x10001cd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push esi
push edi
push 0x104
push eax
call dword [0x1001c264]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10023ac8
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [0x1001c314]
lea edx, [esp + 0x14]
push edx
call dword [0x1001c324]
lea ebx, [esp + eax + 0x14]
mov eax, dword [0x10023ae4]
or ecx, 0xffffffff
push ebx
lea edi, [eax + 0x10]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10006160
mov edi, 0x100248ec
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x28]
push 2
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x1001c318]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001e71
mov esi, dword [0x10023ae4]
mov ecx, 0x17e
lea edi, [esp + 0x21c]
push 0
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call dword [0x1001c378]
push eax
call dword [0x1001c374]
mov edi, dword [0x1001c368]
add esp, 8
call edi
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fmul qword [0x1001cb60]
call fcn.1001ad50
test al, al
je 0x10001de1
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x10001dff
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x224]
push 0x5f8
push edx
push ebx
call dword [0x1001c328]
push ebx
call dword [0x1001c32c]
mov edi, str.AuZrOgo
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call fcn.100084f0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x808
ret
Function at 0x10002340
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1001b218
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x1001cbbc
mov edi, dword [0x1001c16c]
lea eax, [esi + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0
call edi
lea ecx, [esi + 0x10]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov edi, dword [0x1001c25c]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x2c]
mov edi, dword [0x1001c32c]
push ecx
call edi
mov edx, dword [esi + 0x30]
push edx
call edi
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x100023b7
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call sym.dhcpcsvc.dll_DhcpRequestParams
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10005060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x10005070
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x1000508c
cmp al, 0x2b
jne 0x1000508c
mov al, 1
ret
xor al, al
ret

Function at 0x10006b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
add edx, 0x14
mov edx, dword [edx]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x10006b51
mov esi, dword [edx + 0x28]
mov edi, dword [ebp + 8]
mov bx, word [esi]
mov bh, byte [edi]
cmp bl, 0x5a
jg 0x10006b45
cmp bl, 0x41
jl 0x10006b45
add bl, 0x20
cmp bl, bh
jne 0x10006b24
inc esi
inc esi
inc edi
test bx, bx
jne 0x10006b33
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bca0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [0x1001c228]
test eax, eax
je 0x1000bd16
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [0x1001c14c]
test eax, eax
je 0x1000bd16
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x1000bd16
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x1000bd04
mov edx, esi
cmp edi, ebx
jb 0x1000bd0e
add edx, ebx
cmp edi, edx
jbe 0x1000bd20
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x1000bcf6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x1000c480
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x10025a68
mov eax, edx
mov esi, 8
test al, 1
je 0x1000c49c
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000c49e
shr eax, 1
dec esi
jne 0x1000c48f
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x10025e68
jl 0x1000c488
pop esi
ret

Function at 0x1000e1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.10006f00
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x1000e214
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x1000e1e3
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1000fce0
Capabilities:
Encode data using xor

Disassembly:
push esi
call sym.dhcpcsvc.dll_DhcpUndoRequestParams
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x1000fd15
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10025a68]
xor eax, edx
inc ecx
dec esi
jne 0x1000fcf6
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000fd31
push esi
push 0x100246f8
push eax
call dword [0x1001c4dc]
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x10010780
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1001b203
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.10001b90
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x1001cbbc
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.1001ac66
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x100107e7
push 0x64
push ebx
push 8
mov ecx, eax
call sym.dhcpcsvc.dll_McastGenUID
jmp 0x100107e9
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x10002cb0
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.10001670
push 1
push ebx
push ebx
push esi
push 0x1000d580
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.10001670
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4