joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10071820
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 8
ja 0x1007192f
test byte [edi], 2
jne 0x1007192f
mov eax, dword [edi + 0x460]
lea esi, [esi + esi*2]
mov ecx, dword [edi + 0x48]
movss xmm2, dword [esi*8 + 0x1039dbf8]
movss xmm4, dword [esi*8 + 0x1039dbfc]
lea edx, [eax*8]
sub edx, eax
movzx eax, word [ecx + edx*4 + 4]
movd xmm5, eax
movzx eax, word [ecx + edx*4 + 6]
cvtdq2ps xmm5, xmm5
movd xmm3, eax
addss xmm5, dword [esi*8 + 0x1039dbf0]
mov eax, dword [esp + 0x14]
cvtdq2ps xmm3, xmm3
movaps xmm1, xmm5
addss xmm3, dword [esi*8 + 0x1039dbf4]
movss dword [eax + 4], xmm4
movss dword [eax], xmm2
mov ecx, dword [esi*8 + 0x1039dc00]
mov edx, dword [esi*8 + 0x1039dc04]
mov eax, dword [esp + 0x10]
addss xmm4, xmm3
movaps xmm0, xmm3
mov dword [eax], ecx
mov dword [eax + 4], edx
mulss xmm1, dword [edi + 0x24]
mov eax, dword [esp + 0x18]
mulss xmm0, dword [edi + 0x28]
movss dword [eax], xmm1
movaps xmm1, xmm2
movss dword [eax + 4], xmm0
addss xmm1, xmm5
addss xmm5, dword [0x10232f58]
movaps xmm0, xmm4
mulss xmm0, dword [edi + 0x28]
mulss xmm1, dword [edi + 0x24]
movss dword [eax + 0xc], xmm0
movaps xmm0, xmm5
addss xmm5, xmm2
movss dword [eax + 8], xmm1
mov eax, dword [esp + 0x1c]
mulss xmm0, dword [edi + 0x24]
mulss xmm3, dword [edi + 0x28]
movss dword [eax], xmm0
movss dword [eax + 4], xmm3
mulss xmm5, dword [edi + 0x24]
mulss xmm4, dword [edi + 0x28]
movss dword [eax + 8], xmm5
movss dword [eax + 0xc], xmm4
mov al, 1
pop edi
pop esi
ret 0x14
pop edi
xor al, al
pop esi
ret 0x14
Function at 0x10075320
Capabilities:
Compute adler32 checksum

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov eax, 0x5e6ea9af
push esi
push edi
mov edi, edx
xor esi, esi
mul ebx
mov ecx, 1
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
sub edx, eax
mov dword [esp + 0xc], edx
test ebx, ebx
je 0x1007543e
push ebp
xor ebx, ebx
cmp edx, 7
jbe 0x100753ae
mov ebp, 7
sub ebp, edi
movzx eax, byte [edi]
add ebx, 8
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add edi, 8
add esi, ecx
add ecx, eax
add esi, ecx
lea eax, [edi + ebp]
cmp eax, edx
jb 0x10075362
xor ebp, ebp
cmp ebx, edx
jae 0x10075402
mov eax, edx
sub eax, ebx
cmp eax, 2
jb 0x100753f3
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, ebp
mov dword [esp + 0x18], eax
nop
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebp, ecx
add edi, 2
add ecx, eax
add ebx, ecx
sub edx, 1
jne 0x100753d0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
jae 0x100753fd
jmp 0x100753f5
mov ebx, ebp
movzx eax, byte [edi]
add ecx, eax
add esi, ecx
inc edi
lea eax, [ebx + ebp]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [esp + 0x10]
add esi, eax
sub dword [esp + 0x24], edx
mov edx, 0x15b0
mov dword [esp + 0x10], edx
jne 0x10075354
pop ebp
shl esi, 0x10
pop edi
lea eax, [ecx + esi]
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x100839c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], 2
jmp fcn.10083a80
Function at 0x1008cde0
Capabilities:
Create thread

Disassembly:
sub dword [esp + 8], 1
jne 0x1008ce0a
push 0
push 0
push dword [esp + 0x14]
push 0x1008a6e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x1039f22c]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, 1
ret 0xc
Function at 0x100976d0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword fs:[0x2c]
movaps xmm2, xmm3
mov ecx, dword [0x1039ea44]
movaps xmm0, xmm2
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [eax + ecx*4]
mulss xmm0, dword [ebx]
push esi
push edi
movss dword [esp + 0x10], xmm2
movss dword [ebp], xmm0
movaps xmm0, xmm2
mulss xmm0, dword [ebx + 4]
movss dword [ebp + 4], xmm0
mov eax, dword [0x103a0fac]
cmp eax, dword [ecx + 4]
jle 0x10097797
push 0x103a0fac
call fcn.10151b0d
add esp, 4
cmp dword [0x103a0fac], 0xffffffff
jne 0x10097797
mov eax, dword [0x1039ead8]
mov edi, dword [eax + 0x30]
test edi, edi
je 0x10097782
nop dword [eax]
mov edx, dword [edi + 0xc]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10097748
sub ecx, esi
lea esi, [ecx + 1]
mov ecx, 0x4fa38bcd
test esi, esi
je 0x1009777b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub esi, 1
jne 0x10097760
cmp ecx, 0x84616929
je 0x10097784
mov edi, dword [edi + 4]
test edi, edi
jne 0x10097740
xor edi, edi
push 0x103a0fac
mov dword [0x103a0fa8], edi
call fcn.10151ac3
add esp, 4
mov ecx, dword [0x103a0fa8]
movss xmm2, dword [ebx + 8]
movaps xmm1, xmm2
pop edi
mov eax, dword [ecx + 0x1c]
pop esi
mov eax, dword [eax + 0x2c]
xor eax, ecx
mov dword [esp + 0x14], eax
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x10232d50]
mulss xmm0, dword [esp + 8]
subss xmm1, xmm0
addss xmm2, xmm1
mulss xmm2, dword [0x10232d64]
mulss xmm2, dword [esp + 8]
movss dword [ebp + 8], xmm2
pop ebp
movss dword [ebx + 8], xmm1
pop ebx
pop ecx
ret 0xc
Function at 0x1009a270
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a0fd4]
cmp eax, dword [ecx + 4]
jle 0x1009a307
push 0x103a0fd4
call fcn.10151b0d
add esp, 4
cmp dword [0x103a0fd4], 0xffffffff
jne 0x1009a307
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009a2f2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009a2b8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009a2eb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009a2d0
cmp ecx, 0x5c260c2a
je 0x1009a2f4
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009a2b0
xor esi, esi
push 0x103a0fd4
mov dword [0x103a0fdc], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a0fdc]
pop edi
pop esi
ret

Function at 0x1009c500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ade8d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10249010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
call fcn.1015165a
mov dword [ebp - 0x10], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x1009c6d0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1009c56c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1009c810
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a1004]
cmp eax, dword [ecx + 4]
jle 0x1009c8a7
push 0x103a1004
call fcn.10151b0d
add esp, 4
cmp dword [0x103a1004], 0xffffffff
jne 0x1009c8a7
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009c892
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c858
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009c88b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009c870
cmp ecx, 0xee8b9a11
je 0x1009c894
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009c850
xor esi, esi
push 0x103a1004
mov dword [0x103a1014], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a1014]
pop edi
pop esi
ret
Function at 0x1009c8b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a1000]
cmp eax, dword [ecx + 4]
jle 0x1009c947
push 0x103a1000
call fcn.10151b0d
add esp, 4
cmp dword [0x103a1000], 0xffffffff
jne 0x1009c947
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009c932
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c8f8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009c92b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009c910
cmp ecx, 0xbaadee37
je 0x1009c934
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009c8f0
xor esi, esi
push 0x103a1000
mov dword [0x103a101c], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a101c]
pop edi
pop esi
ret

Function at 0x1009c950
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a1020]
cmp eax, dword [ecx + 4]
jle 0x1009c9e7
push 0x103a1020
call fcn.10151b0d
add esp, 4
cmp dword [0x103a1020], 0xffffffff
jne 0x1009c9e7
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009c9d2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c998
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009c9cb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009c9b0
cmp ecx, 0xad013136
je 0x1009c9d4
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009c990
xor esi, esi
push 0x103a1020
mov dword [0x103a1018], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a1018]
pop edi
pop esi
ret

Function at 0x1009c9f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a1008]
cmp eax, dword [ecx + 4]
jle 0x1009ca87
push 0x103a1008
call fcn.10151b0d
add esp, 4
cmp dword [0x103a1008], 0xffffffff
jne 0x1009ca87
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009ca72
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009ca38
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009ca6b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009ca50
cmp ecx, 0x84616929
je 0x1009ca74
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009ca30
xor esi, esi
push 0x103a1008
mov dword [0x103a1024], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a1024]
pop edi
pop esi
ret
Function at 0x1009ca90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a1010]
cmp eax, dword [ecx + 4]
jle 0x1009cb27
push 0x103a1010
call fcn.10151b0d
add esp, 4
cmp dword [0x103a1010], 0xffffffff
jne 0x1009cb27
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009cb12
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009cad8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009cb0b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009caf0
cmp ecx, 0xb5599648
je 0x1009cb14
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009cad0
xor esi, esi
push 0x103a1010
mov dword [0x103a100c], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a100c]
pop edi
pop esi
ret
Function at 0x100ab210
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x100ab260
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100ab222
mov eax, dword [edi]
jmp 0x100ab347
cmp eax, 0x4e0
jb 0x100ab347
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x100ab280
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x100ab2d0
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x100ba2f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a2598]
cmp eax, dword [ecx + 4]
jle 0x100ba387
push 0x103a2598
call fcn.10151b0d
add esp, 4
cmp dword [0x103a2598], 0xffffffff
jne 0x100ba387
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100ba372
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ba338
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100ba36b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100ba350
cmp ecx, 0x77798729
je 0x100ba374
mov esi, dword [esi + 4]
test esi, esi
jne 0x100ba330
xor esi, esi
push 0x103a2598
mov dword [0x103a25a0], esi
call fcn.10151ac3
add esp, 4
mov ecx, dword [0x103a25a0]
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x30]
xor eax, ecx
jne 0x100ba3d3
mov eax, dword [0x1039f244]
cmp byte [eax + 0x189c], 0
je 0x100ba3d3
mov eax, dword [0x1039f500]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x25c]
sub eax, 8
je 0x100ba3d3
sub eax, 1
je 0x100ba3d3
sub eax, 1
je 0x100ba3d3
test byte [ecx + 0x104], 1
jne 0x100ba3d3
mov eax, dword [esp + 0xc]
and dword [eax + 0x30], 0xfffffffd
pop edi
pop esi
ret 4

Function at 0x100bc310
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov edx, ecx
mov dword [esp + 4], edx
push ebx
push ebp
push esi
push edi
test eax, eax
jne 0x100bc32f
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x10], esi
cmp dword [eax + 4], ebx
jle 0x100bc3c5
mov ecx, dword [esp + 0x20]
xor ebp, ebp
mov edi, dword [eax]
mov eax, dword [edi + ebp + 0x28]
add edi, ebp
test eax, eax
je 0x100bc374
cmp dword [eax + 4], 0
jle 0x100bc374
push 0
push ecx
push eax
mov ecx, edx
call fcn.100bc310
mov ecx, eax
test ecx, ecx
je 0x100bc374
mov eax, dword [edi + 0x2c]
add eax, ecx
add esi, eax
mov dword [esp + 0x10], esi
mov edx, dword [edi]
mov eax, edx
lea esi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100bc380
sub eax, esi
mov esi, 0x4fa38bcd
lea ecx, [eax + 1]
test ecx, ecx
je 0x100bc3a8
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, esi
imul esi, eax, 0xf1546419
sub ecx, 1
jne 0x100bc395
mov ecx, dword [esp + 0x20]
cmp esi, ecx
je 0x100bc3d1
mov eax, dword [esp + 0x1c]
inc ebx
mov esi, dword [esp + 0x10]
add ebp, 0x3c
mov edx, dword [esp + 0x14]
cmp ebx, dword [eax + 4]
jl 0x100bc346
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov eax, dword [edi + 0x2c]
add eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x100bc3f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [ecx + 4]
push esi
push edi
mov edi, dword [ecx]
cmp edi, ebp
je 0x100bc445
nop dword [eax]
mov ebx, dword [edi]
test ebx, ebx
je 0x100bc43e
mov edx, dword [ebx + 0xc]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100bc410
sub eax, esi
mov ecx, 0x4fa38bcd
lea esi, [eax + 1]
test esi, esi
je 0x100bc438
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub esi, 1
jne 0x100bc425
cmp ecx, dword [esp + 0x14]
je 0x100bc44e
add edi, 4
cmp edi, ebp
jne 0x100bc400
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 4
Function at 0x100bf980
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b11b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10249010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea esi, [ebx + 4]
lea ecx, [esi + 0x48]
mov dword [ebp + 8], esi
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [esi], eax
mov eax, dword [edi + 8]
mov dword [esi + 4], eax
movzx eax, byte [edi + 0xc]
mov byte [esi + 8], al
mov eax, dword [edi + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x40], eax
movzx eax, byte [edi + 0x48]
mov byte [esi + 0x44], al
lea eax, [edi + 0x4c]
push eax
call fcn.100180b0
lea eax, [edi + 0x64]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x60]
call fcn.10095280
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ca6a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a25d8]
cmp eax, dword [ecx + 4]
jle 0x100ca737
push 0x103a25d8
call fcn.10151b0d
add esp, 4
cmp dword [0x103a25d8], 0xffffffff
jne 0x100ca737
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100ca722
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ca6e8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100ca71b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100ca700
cmp ecx, 0x8ff61511
je 0x100ca724
mov esi, dword [esi + 4]
test esi, esi
jne 0x100ca6e0
xor esi, esi
push 0x103a25d8
mov dword [0x103a25dc], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a25dc]
pop edi
pop esi
ret

Function at 0x100ca880
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b17dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10249010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.100180b0
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
call fcn.100180b0
mov ecx, dword [ebp + 0x10]
movss xmm0, dword [ebp + 0x18]
movzx eax, byte [ecx]
mov byte [esi + 0x30], al
mov eax, dword [ecx + 4]
mov dword [esi + 0x34], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x38], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x40], eax
movzx eax, byte [ecx + 0x14]
mov byte [esi + 0x44], al
movzx eax, byte [ecx + 0x15]
mov byte [esi + 0x45], al
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x48], eax
movzx eax, byte [ecx + 0x1c]
mov byte [esi + 0x4c], al
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x50], eax
movzx eax, byte [ecx + 0x24]
mov byte [esi + 0x54], al
mov eax, dword [ecx + 0x28]
mov dword [esi + 0x58], eax
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x5c], eax
mov eax, dword [ecx]
mov dword [esi + 0x60], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x64], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x68], eax
mov eax, esi
movss dword [esi + 0x6c], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100d7be0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a2604]
cmp eax, dword [ecx + 4]
jle 0x100d7c77
push 0x103a2604
call fcn.10151b0d
add esp, 4
cmp dword [0x103a2604], 0xffffffff
jne 0x100d7c77
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100d7c62
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d7c28
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100d7c5b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100d7c40
cmp ecx, 0xb5599648
je 0x100d7c64
mov esi, dword [esi + 4]
test esi, esi
jne 0x100d7c20
xor esi, esi
push 0x103a2604
mov dword [0x103a25f0], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a25f0]
pop edi
pop esi
ret

Function at 0x100d7c80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1039ea44]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103a260c]
cmp eax, dword [ecx + 4]
jle 0x100d7d17
push 0x103a260c
call fcn.10151b0d
add esp, 4
cmp dword [0x103a260c], 0xffffffff
jne 0x100d7d17
mov eax, dword [0x1039ead8]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100d7d02
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d7cc8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100d7cfb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100d7ce0
cmp ecx, 0xb5599648
je 0x100d7d04
mov esi, dword [esi + 4]
test esi, esi
jne 0x100d7cc0
xor esi, esi
push 0x103a260c
mov dword [0x103a2608], esi
call fcn.10151ac3
add esp, 4
mov eax, dword [0x103a2608]
pop edi
pop esi
ret