joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x447f61
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x447eac
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x447ee5
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call sym.sync_atomic.LoadUint64
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x447ea1
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x447eef
inc eax
cmp eax, 4
jge 0x447f04
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x447f5a
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call sym.sync_atomic.StoreUint64
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x447f2b
jmp 0x447eee
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect._dedup_.seenLossy
Function at 0x44c5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44c75a
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.003c723b
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x44c5df
inc ebx
cmp edx, ebx
jle 0x44c6fe
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x44c6a2
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x44c653
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x44c5de
lea edi, [esp + 0x28]
call fcn.003c723b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym.net_netip.parseIPv6
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.003c771e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.003c771e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.003c723b
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym.net_netip.parseIPv4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.003c771e
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.003c771e
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.003c723a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x4b6a16]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.003c723b
lea ecx, [0x4a26e0]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call sym.runtime.convT
mov ecx, dword [esp + 8]
lea edx, [0x4e5904]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.003c723a
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x4b5e44]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.003c723b
lea ecx, [0x4a26e0]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call sym.runtime.convT
mov ecx, dword [esp + 8]
lea edx, [0x4e5904]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call sym.runtime.morestack_noctxt
jmp sym.net_netip.ParseAddr
Function at 0x4512a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45145c
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.003c7237
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4512d8
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x451301
lea eax, [0x491c00]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call sym.runtime.makeslice
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.003c7237
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
or edx, ecx
test bl, bl
je 0x451344
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x451353
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x451362
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x451371
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x451380
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x45138c
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x451398
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x46], ax
mov word [esp + 0x48], dx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x38]
cmp eax, edx
jae 0x451408
mov dword [esp + 0x24], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x491c00]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call sym.runtime.memmove
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.003c76f6
add esp, 0x5c
ret
call sym.runtime.morestack_noctxt
jmp sym.vendor_golang.org_x_net_dns_dnsmessage.NewBuilder
Function at 0x465040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5dbf38]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4651b1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4650d7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x465076
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4650e3
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4650a1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4650e3
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4650e3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call sym.net.favoriteAddrFamily
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call sym.net.socket
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call sym.runtime.morestack_noctxt
jmp sym.net.internetSocket
Function at 0x10002220
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x24
xor eax, eax
push ebx
push ebp
mov dword [esp + 0xe], eax
push esi
lea ecx, [esp + 0xc]
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x1a], eax
lea edx, [esp + 0x14]
push ecx
mov dword [esp + 0x22], eax
push edx
push edi
mov word [esp + 0x20], 0
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x1000226f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret 8
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push eax
call ebx
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x16]
mov ebp, dword [sym.imp.WS2_32.dll_ntohs]
push ecx
mov dword [esi + 4], eax
call ebp
xor edx, edx
mov word [esi + 0xa], ax
mov dword [esp + 0x26], edx
lea eax, [esp + 0x10]
mov dword [esp + 0x2a], edx
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x32], edx
push ecx
push edi
mov word [esp + 0x30], 0
mov word [esp + 0x3e], dx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
jne 0x100022d8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret 8
mov edx, dword [esp + 0x28]
push edx
call ebx
mov dword [esi], eax
mov eax, dword [esp + 0x26]
push eax
call ebp
mov word [esi + 8], ax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x24
ret 8
Function at 0x10003370
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10257a28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
push edi
lea eax, [ebx + 0x18]
push 1
push eax
lea ecx, [esp + 0x1c]
call fcn.1009cf30
mov ecx, dword [esp + 0x30]
mov esi, dword [ebx + 4]
xor edx, edx
mov dword [esp + 0x28], 0
mov edi, dword [ecx]
mov ecx, dword [ebx]
mov eax, edi
mov dword [esp + 0x10], edi
shr eax, 4
div esi
test ecx, ecx
mov ebp, edx
je 0x100033e3
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x100033df
cmp dword [eax + 8], edi
je 0x100033d7
mov eax, dword [eax]
test eax, eax
jne 0x100033ca
jmp 0x100033df
test eax, eax
jne 0x10003488
test ecx, ecx
jne 0x1000340e
lea edi, [esi*4]
push edi
call fcn.1024ac71
mov edx, eax
mov ecx, edi
mov dword [ebx], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov dword [ebx + 4], esi
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x1000344e
mov eax, dword [ebx + 0x14]
push 0xfc
lea ecx, [ebx + 0x10]
push eax
push ecx
call fcn.1009c080
mov ecx, dword [ebx + 0x14]
mov edx, ecx
shl edx, 6
sub edx, ecx
dec ecx
test ecx, ecx
lea eax, [eax + edx*4 - 0xf4]
jl 0x1000344e
inc ecx
mov edx, dword [ebx + 0xc]
mov dword [eax], edx
mov dword [ebx + 0xc], eax
sub eax, 0xfc
dec ecx
jne 0x1000343e
mov edx, dword [ebx + 0xc]
mov ecx, 0x3c
mov eax, dword [edx]
lea edi, [edx + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
inc eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [edx + 8], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov dword [edx + 4], ebp
mov dword [edx + 8], ecx
mov ecx, dword [ebx]
mov eax, edx
mov ecx, dword [ecx + ebp*4]
mov dword [edx], ecx
mov ecx, dword [ebx]
mov dword [ecx + ebp*4], edx
mov esi, dword [esp + 0x30]
lea edi, [eax + 0xc]
mov ecx, 0x3c
mov dword [esp + 0x28], 0xffffffff
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
call fcn.1009cf90
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x100037d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov dword [esp + 0x20], ecx
push edi
xor ebx, ebx
mov ecx, 0x3b
xor eax, eax
lea edi, [esp + 0x2c]
mov dword [esp + 0x28], ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x11c]
mov dword [esp + 0x16], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1a], eax
lea edx, [esp + 0x14]
push ecx
mov dword [esp + 0x22], eax
push edx
push edi
mov word [esp + 0x20], bx
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x100039c3
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
call ebp
mov ecx, dword [esp + 0x16]
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
push ecx
mov dword [esp + 0x34], eax
call esi
mov word [esp + 0x36], ax
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push edi
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x100039ad
mov ecx, dword [esp + 0x18]
push ecx
call ebp
mov edx, dword [esp + 0x16]
mov dword [esp + 0x2c], eax
push edx
call esi
mov edx, dword [esp + 0x16]
mov ecx, dword [esp + 0x124]
mov word [esp + 0x34], ax
mov eax, dword [esp + 0x120]
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
call esi
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, 0x102f4c08
call fcn.100160d0
mov ecx, dword [esp + 0x12c]
mov dword [esp + 0x40], eax
mov ax, word [esp + 0x128]
mov ebp, 1
cmp ax, 4
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
mov word [esp + 0x54], bp
mov dword [esp + 0x58], 0xff
mov word [esp + 0x56], ax
mov dword [esp + 0x5c], ecx
je 0x1000390e
cmp ax, 5
jne 0x10003924
push ecx
lea ecx, [esp + 0x8c]
push 0x102f8f98
push ecx
call fcn.10046d50
add esp, 0xc
mov eax, dword [esp + 0x130]
cmp eax, ebx
mov eax, dword [esp + 0x134]
je 0x10003951
mov ecx, eax
lea esi, [esp + 0x130]
mov edx, ecx
lea edi, [esp + 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x138]
or edx, 0xffffffff
mov dword [esp + 0x7c], ebx
cmp eax, edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], edx
je 0x10003992
mov ecx, dword [esp + 0x13c]
cmp ecx, edx
je 0x10003992
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
call fcn.10003370
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0x24
cmp dword [0x1030aa70], ebx
je 0x100039eb
push 0x9d
push 0xffffffffffffffff
push str.AddTableItem_getpeername_fail_____Ret:_d__Line:_d_
jmp 0x100039d7
cmp dword [0x1030aa70], ebx
je 0x100039eb
push 0x8f
push 0xffffffffffffffff
push str.AddTableItem_getsockname_fail_____Ret:_d__Line:_d_
push str.CConnTrack
push 4
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0x24
Function at 0x100046f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10257ab0
push eax
mov eax, dword [0x1030aa70]
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
test eax, eax
push edi
je 0x10004735
mov eax, dword [esp + 0x2c]
push eax
push ebp
push str.XORALG__begin__len__lu__key__lu__r_n
push str.DataProc
push 1
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
mov ebx, dword [esp + 0x20]
xor edi, edi
test ebp, ebp
jle 0x100047a4
mov esi, ebp
sub esi, edi
cmp esi, 0x64
jle 0x1000474d
mov esi, 0x64
mov eax, dword [0x1030aa70]
test eax, eax
je 0x1000479e
lea ecx, [edi + ebx]
push esi
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.100a8830
add esp, 0xc
mov eax, dword [eax]
mov dword [esp + 0x18], 0
push eax
push esi
push str.XORALG__begin__src__lu____s__r_n
push str.DataProc
push 1
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.1008ec90
add edi, esi
cmp edi, ebp
jl 0x1000473f
test ebp, ebp
jle 0x100047cc
mov eax, dword [esp + 0x24]
mov cx, word [esp + 0x2e]
mov esi, ebx
mov edi, ebp
sub esi, eax
mov bl, byte [esi + eax]
mov edx, dword [esp + 0x2c]
xor bl, dl
xor bl, dh
xor bl, cl
xor bl, ch
mov byte [eax], bl
inc eax
dec edi
jne 0x100047b7
mov eax, dword [0x1030aa70]
test eax, eax
je 0x100047f4
mov ecx, dword [esp + 0x2c]
push ecx
push ebp
push str.XORALG__ret__len__lu__key__lu_
push str.DataProc
push 1
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
xor edi, edi
test ebp, ebp
jle 0x10004863
mov esi, ebp
sub esi, edi
cmp esi, 0x64
jle 0x10004808
mov esi, 0x64
mov eax, dword [0x1030aa70]
test eax, eax
je 0x1000485d
mov edx, dword [esp + 0x24]
push esi
lea ecx, [esp + 0x30]
lea eax, [edi + edx]
push eax
push ecx
call fcn.100a8830
add esp, 0xc
mov edx, dword [eax]
mov dword [esp + 0x18], 1
push edx
push esi
push str.XORALG__ret__dst__lu____s__r_n
push str.DataProc
push 1
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], 0xffffffff
call fcn.1008ec90
add edi, esi
cmp edi, ebp
jl 0x100047fa
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x10004880
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10257ad0
push eax
mov eax, dword [0x1030aa70]
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
test eax, eax
push edi
je 0x100048c5
mov eax, dword [esp + 0x2c]
push eax
push ebp
push str.XORALGDefault__begin__len__lu__key__lu__r_n
push str.DataProc
push 1
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
mov ebx, dword [esp + 0x20]
xor edi, edi
test ebp, ebp
jle 0x10004934
mov esi, ebp
sub esi, edi
cmp esi, 0x64
jle 0x100048dd
mov esi, 0x64
mov eax, dword [0x1030aa70]
test eax, eax
je 0x1000492e
lea ecx, [edi + ebx]
push esi
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.100a8830
add esp, 0xc
mov eax, dword [eax]
mov dword [esp + 0x18], 0
push eax
push esi
push str.XORALGDefault__begin__src__lu____s__r_n
push str.DataProc
push 1
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.1008ec90
add edi, esi
cmp edi, ebp
jl 0x100048cf
test ebp, ebp
jle 0x10004951
mov eax, dword [esp + 0x24]
mov esi, ebx
sub esi, eax
mov edi, ebp
mov cl, byte [esi + eax]
mov bl, byte [esp + 0x2c]
xor cl, bl
mov byte [eax], cl
inc eax
dec edi
jne 0x10004942
mov eax, dword [0x1030aa70]
test eax, eax
je 0x10004979
mov edx, dword [esp + 0x2c]
push edx
push ebp
push str.XORALGDefault__ret__len__lu__key__lu_
push str.DataProc
push 1
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
xor edi, edi
test ebp, ebp
jle 0x100049e8
mov esi, ebp
sub esi, edi
cmp esi, 0x64
jle 0x1000498d
mov esi, 0x64
mov eax, dword [0x1030aa70]
test eax, eax
je 0x100049e2
mov eax, dword [esp + 0x24]
push esi
lea edx, [esp + 0x30]
lea ecx, [edi + eax]
push ecx
push edx
call fcn.100a8830
add esp, 0xc
mov eax, dword [eax]
mov dword [esp + 0x18], 1
push eax
push esi
push str.XORALGDefault__ret__dst__lu____s__r_n
push str.DataProc
push 1
push 0x1030a1dc
call fcn.100a4680
add esp, 0x18
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], 0xffffffff
call fcn.1008ec90
add edi, esi
cmp edi, ebp
jl 0x1000497f
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x10006290
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x102f39f0
jmp 0x1004ee30
push 0xffffffffffffffff
push 0x1025d429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1009c500
lea ecx, [esi + 0x10]
mov dword [esp + 0x10], 0
call fcn.1009ca00
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 1
call fcn.1004e1d0
lea ecx, [esi + 0x64]
mov byte [esp + 0x10], 2
call fcn.1004e590
mov ecx, esi
mov byte [esp + 0x10], 3
call fcn.1004f070
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1000a770
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x102584a2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1026c87c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebx, [esi + 4]
mov dword [ebx], eax
mov ecx, dword [0x1026c87c]
lea ebp, [esi + 8]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebp], ecx
mov edx, dword [0x1026c87c]
mov dword [esi + 0xc], edx
mov eax, dword [0x1026c87c]
mov dword [esi + 0x18], eax
mov ecx, dword [0x1026c87c]
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 4
call fcn.100945b0
push 0x102f440c
lea ecx, [esi + 0x18]
mov byte [esp + 0x20], 5
mov dword [esi], 0x10269a90
mov dword [esi + 0x1c], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.1008ef10
push 0x102f440c
mov ecx, ebx
call fcn.1008ef10
push 0x102f440c
lea ecx, [esi + 0xc]
call fcn.1008ef10
push 0x102f440c
mov ecx, ebp
mov dword [esi + 0x1c], edi
call fcn.1008ef10
push 0x102f440c
lea ecx, [esi + 0x30]
call fcn.1008ef10
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], 0xea60
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1000a880
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x102584f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x10269a90
mov dword [esp + 0x10], 5
call fcn.1000ad00
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 4
call fcn.100945c0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 3
call fcn.1008ec90
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 2
call fcn.1008ec90
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 1
call fcn.1008ec90
lea ecx, [esi + 8]
mov byte [esp + 0x10], 0
call fcn.1008ec90
lea ecx, [esi + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.1008ec90
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret