joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497bb3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4f5cf0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x497bf6
cmp word [esi], dx
jne 0x497bf6
or byte [edi + eax + 0x28], 4
jmp 0x497bfb
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x497d4e
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x497d2e
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x497c3d
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x497c73
cmp eax, edx
jae 0x497c7f
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x497c15
jmp 0x497d4e
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x497d2a
cmp dword [ebp - 0x14], 0
je 0x497d2a
mov eax, dword [ebx*4 + 0x4f5cf0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x497d02
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x497ccb
mov word [esi], cx
jmp 0x497cfe
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4f5cf0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4f5cf0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4f5cf0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x497d4e
pop ebx
cmp word [ebp - 4], bx
jne 0x497d13
cmp esi, dword [ebp + 0xc]
jne 0x497d13
mov word [esi], bx
jmp 0x497d4b
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004019b5
add esp, 0x10
cmp word [ebp - 4], bx
je 0x497d4e
push 0xd
jmp 0x497d47
mov ecx, dword [ebx*4 + 0x4f5cf0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x497d45
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x497d4e
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49fe47
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4f2140]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49fe92
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a0309
test al, al
jne 0x49fe8c
sub edx, 2
cmp edx, edi
jne 0x49fe72
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49feb4
lea eax, [edi + 2]
cmp edx, eax
je 0x49feb4
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049fa40
add esp, 0x10
jmp 0x49ffae
push esi
lea ecx, [ebp - 0x255]
call fcn.004a0309
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49fef7
push dword [ebp - 0x25c]
jmp 0x49fea4
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49ff34
cmp word [ebp - 0x226], 0
je 0x49ff55
cmp word [ebp - 0x226], ax
jne 0x49ff34
cmp word [ebp - 0x224], 0
je 0x49ff55
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049fa40
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49ffa1
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x49ff0e
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x49ff89
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x49ffae
push 0x49f428
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004058d5
add esp, 0x10
jmp 0x49ff7e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040320b
leave
ret
Function at 0x9aa0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009aa200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9aa0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9aa0c2
add dl, dl
jne 0x9aa0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9aa134
xor eax, eax
add dl, dl
jne 0x9aa0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9aa1d5
add dl, dl
jne 0x9aa0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9aa108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9aa113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9aa11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9aa12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9aa0cd
mov eax, 1
add dl, dl
jne 0x9aa142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9aa14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9aa139
sub eax, ebx
mov ebx, 1
jne 0x9aa180
mov ecx, 1
add dl, dl
jne 0x9aa166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9aa171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9aa15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9aa0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9aa197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9aa1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9aa18e
cmp eax, 0x7d00
jae 0x9aa1c5
cmp eax, 0x500
jb 0x9aa1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9aa0cd
cmp eax, 0x7f
ja 0x9aa1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9aa0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9aa1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9aa0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x12cc4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x1c6044], 0x8088405
inc edx
mov dword [0x1c6044], edx
mul edx
mov eax, edx
ret

Function at 0x284d4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x284da
ret
Function at 0x7e304
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x7e332
mov eax, ebx
call fcn.0007eda8
cmp dword [ebx + 0x3c], 0
je 0x7e32b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x7e3a3
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x7e395
cmp dword [ebx + 8], 0
je 0x7e354
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x7e366
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x7e395
cmp dword [ebx + 8], 0
je 0x7e347
cmp eax, 3
je 0x7e379
dec eax
jne 0x7e347
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x7e347
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x7e347
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x7e3c1
cmp dword [ebx + 0x10], 0xcc
je 0x7e3c1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0007e3cc
pop ebx
ret

Function at 0x9c0a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
test edx, edx
jne 0x9c0ad
xor eax, eax
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x9c19d
xor ebx, ebx
sub ecx, 8
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
cmp ecx, 8
mov eax, ebx
jae 0x9c0b9
test ecx, ecx
je 0x9c1bf
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1bf708]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x9c1a1
xor eax, 0xffffffff
pop ebx
ret
Function at 0x9c320
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
xor edx, edx
mov dword [esp], edx
mov ecx, dword [eax + 0x4c]
xor edx, edx
mov dl, byte [ecx]
mov esi, ecx
inc esi
mov ebx, dword [eax + 0x50]
inc ebx
mov edi, dword [eax + 0x48]
dec edi
cmp edx, 4
ja case.default.0x9c347
jmp dword [edx*4 + 0x9c34e]
mov eax, dword [eax + 0x54]
add eax, 7
test eax, eax
jns 0x9c374
add eax, 7
sar eax, 3
mov dword [esp + 4], eax
mov eax, esi
add eax, dword [esp + 4]
mov edx, dword [esp + 4]
cmp edi, edx
jle case.0x9c347.0
mov cl, byte [esi]
add cl, byte [eax]
and cl, 0xff
mov byte [eax], cl
inc eax
inc esi
inc edx
cmp edi, edx
jg 0x9c38d
jmp case.0x9c347.0
xor edx, edx
mov eax, esi
mov ecx, ebx
cmp edi, edx
jle case.0x9c347.0
mov bl, byte [ecx]
add bl, byte [eax]
and bl, 0xff
mov byte [eax], bl
inc eax
inc ecx
inc edx
cmp edi, edx
jg 0x9c3b0
jmp case.0x9c347.0
mov eax, dword [eax + 0x54]
add eax, 7
test eax, eax
jns 0x9c3d2
add eax, 7
sar eax, 3
mov dword [esp + 4], eax
xor edx, edx
mov eax, esi
mov ecx, ebx
cmp edx, dword [esp + 4]
jge 0x9c3fb
xor ebx, ebx
mov bl, byte [ecx]
shr ebx, 1
add bl, byte [eax]
and bl, 0xff
mov byte [eax], bl
inc edx
inc eax
inc ecx
cmp edx, dword [esp + 4]
jl 0x9c3e5
cmp edi, edx
jle case.0x9c347.0
xor ebx, ebx
mov bl, byte [ecx]
movzx ebp, byte [esi]
add ebx, ebp
shr ebx, 1
add bl, byte [eax]
and bl, 0xff
mov byte [eax], bl
inc edx
inc eax
inc esi
inc ecx
cmp edi, edx
jg 0x9c403
jmp case.0x9c347.0
mov eax, dword [eax + 0x54]
add eax, 7
test eax, eax
jns 0x9c42f
add eax, 7
sar eax, 3
mov dword [esp + 4], eax
xor edx, edx
mov eax, esi
mov ecx, ebx
sub esi, dword [esp + 4]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 4]
sub dword [esp + 0x1c], ebx
cmp edi, edx
jle case.0x9c347.0
xor ebx, ebx
mov bl, byte [ecx]
mov dword [esp + 0xc], ebx
cmp edx, dword [esp + 4]
jl 0x9c477
mov ebx, dword [esp + 0x1c]
movzx ebx, byte [ebx]
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov bl, byte [esi]
mov dword [esp + 8], ebx
jmp 0x9c483
xor ebx, ebx
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov dword [esp + 8], ebx
mov ebp, dword [esp + 8]
add ebp, dword [esp + 0xc]
sub ebp, dword [esp + 0x10]
mov ebx, ebp
sub ebx, dword [esp + 8]
mov dword [esp + 0x14], ebx
mov ebx, ebp
sub ebx, dword [esp + 0xc]
mov dword [esp + 0x18], ebx
sub ebp, dword [esp + 0x10]
cmp dword [esp + 0x14], 0
jge 0x9c4b2
neg dword [esp + 0x14]
cmp dword [esp + 0x18], 0
jge 0x9c4bd
neg dword [esp + 0x18]
test ebp, ebp
jge 0x9c4c3
neg ebp
mov ebx, dword [esp + 0x14]
cmp ebx, dword [esp + 0x18]
jg 0x9c4d9
cmp ebp, dword [esp + 0x14]
jl 0x9c4d9
mov ebp, dword [esp + 8]
jmp 0x9c4e9
cmp ebp, dword [esp + 0x18]
jl 0x9c4e5
mov ebp, dword [esp + 0xc]
jmp 0x9c4e9
mov ebp, dword [esp + 0x10]
mov ebx, ebp
add bl, byte [eax]
and bl, 0xff
mov byte [eax], bl
inc eax
inc ecx
inc esi
inc dword [esp + 0x1c]
inc edx
cmp edi, edx
jg 0x9c454
jmp case.0x9c347.0
mov dword [esp], 0xffffffff
mov eax, dword [esp]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xbd000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
call fcn.00012794
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xbd0ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebx + 0x40]
sar edi, 1
jns 0xbd031
adc edi, 0
dec edi
test edi, edi
jl 0xbd0a4
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00067380
push eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00017620
mov edx, dword [ebx + 0x40]
dec edx
sub edx, esi
mov eax, ebx
call fcn.00067380
push eax
mov edx, esi
mov eax, ebx
call fcn.00067380
push eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00017620
mov edx, dword [ebx + 0x40]
dec edx
sub edx, esi
mov eax, ebx
call fcn.00067380
push eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov edx, dword [ebp - 4]
pop eax
call fcn.00017620
inc esi
dec edi
jne 0xbd039
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xbd0c1
mov eax, dword [ebp - 4]
call fcn.000127ac
ret
Function at 0xbfcd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [esp]
lea esi, [eax + 0x488]
lea edi, [ebx + 0x488]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp]
call fcn.000c00f4
push eax
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [esp + 4]
mov edx, dword [eax + 0x7c]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x68]
mov eax, dword [esp]
lea esi, [eax + 0x85]
lea edi, [ebx + 0x85]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
call fcn.00067e28
mov edi, dword [ebx + 0x40]
dec edi
test edi, edi
jl 0xbfd64
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [esp]
call fcn.00067380
push eax
mov edx, esi
mov eax, ebx
call fcn.00067380
push eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00017620
inc esi
dec edi
jne 0xbfd3a
mov eax, ebx
mov edx, dword [0xbb378]
call fcn.0001317c
test al, al
je 0xbfe10
mov eax, dword [esp]
mov edx, dword [0xbb378]
call fcn.0001317c
test al, al
jne 0xbfda0
mov eax, dword [ebx + 0x4c8]
call fcn.00013004
xor eax, eax
mov dword [ebx + 0x4c8], eax
jmp 0xbfe10
mov esi, dword [esp]
cmp dword [esi + 0x4c8], 0
jne 0xbfdc1
mov eax, dword [ebx + 0x4c8]
call fcn.00013004
xor eax, eax
mov dword [ebx + 0x4c8], eax
jmp 0xbfe10
mov eax, ebx
call fcn.000c0764
mov eax, dword [esi + 0x4c8]
mov edi, dword [eax + 0x40]
dec edi
test edi, edi
jl 0xbfe10
inc edi
xor ebp, ebp
mov eax, dword [esi + 0x4c8]
mov edx, ebp
call fcn.00067380
push eax
mov eax, dword [ebx + 0x4c8]
mov edx, ebp
call fcn.00067380
push eax
mov eax, dword [esi + 0x4c8]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00017620
inc ebp
dec edi
jne 0xbfdd9
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xbfe18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.000c0110
push eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x7c]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x68]
push esi
lea edi, [esi + 0x85]
lea esi, [ebx + 0x85]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, esi
call fcn.00067e28
push ebx
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.000bcbbc
cmp dword [ebx + 0x4c8], 0
jne 0xbfe7b
mov eax, dword [esi + 0x4c8]
call fcn.00013004
xor eax, eax
mov dword [esi + 0x4c8], eax
jmp 0xbfeca
mov eax, esi
call fcn.000c0764
mov eax, dword [ebx + 0x4c8]
mov ebp, dword [eax + 0x40]
dec ebp
test ebp, ebp
jl 0xbfeca
inc ebp
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x4c8]
call fcn.00067380
push eax
mov edx, edi
mov eax, dword [esi + 0x4c8]
call fcn.00067380
push eax
mov eax, dword [ebx + 0x4c8]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00017620
inc edi
dec ebp
jne 0xbfe93
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xc07d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, esi
call fcn.000c0764
mov eax, dword [esi + 0x4c8]
mov edi, dword [eax + 0x40]
dec edi
test edi, edi
jl 0xc0823
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, ebp
call fcn.00067380
push eax
mov edx, ebx
mov eax, dword [esi + 0x4c8]
call fcn.00067380
push eax
mov eax, dword [esi + 0x4c8]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00017620
inc ebx
dec edi
jne 0xc07f0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xc0880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
cmp dword [ebx + 0x4c8], 0
je 0xc08c3
mov esi, dword [ebx + 0x40]
dec esi
test esi, esi
jl 0xc08c3
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x4c8]
call fcn.00067380
push eax
mov eax, dword [ebx + 0x4c8]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov cl, 0xff
pop eax
call fcn.00017628
inc edi
dec esi
jne 0xc0899
pop edi
pop esi
pop ebx
ret

Function at 0xc4c18
Capabilities:
Encode data using xor

Disassembly:
push edi
cmp eax, 1
sbb eax, 0
xor ecx, ecx
mov edx, eax
shl eax, 0xd
xor edx, eax
mov eax, edx
shr edx, 0x11
xor eax, edx
mov edx, eax
shl edx, 5
xor eax, edx
mov dword [ecx*4 + 0x1c04b8], eax
inc ecx
cmp ecx, 5
jb 0xc4c21
mov edi, 0x13
call fcn.000c4b98
fstp st(0)
dec edi
jne 0xc4c48
pop edi
ret
Function at 0xd3438
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffcc
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp dword [eax + 0x4c8], 0
je 0xd34dd
lea eax, [esp + 4]
push eax
mov ecx, 8
mov edx, 8
mov eax, 8
call fcn.000648b8
mov eax, dword [esp]
lea esi, [esp + 4]
lea edi, [eax + 0x488]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
push 8
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x40]
mov edx, dword [eax + 0x7c]
mov eax, dword [esp + 4]
mov esi, dword [eax]
call dword [esi + 0x68]
mov eax, dword [ebx + 0x14]
mov edi, dword [eax + 0x40]
dec edi
test edi, edi
jl 0xd34dd
inc edi
xor esi, esi
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x4c8]
mov edx, esi
call fcn.00067380
push eax
mov edx, esi
mov eax, dword [esp + 4]
call fcn.00067380
push eax
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x4c8]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00017620
inc esi
dec edi
jne 0xd34a2
add esp, 0x34
pop edi
pop esi
pop ebx
ret

Function at 0xd9a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
test dl, dl
je 0xd9a13
add esp, 0xfffffff0
call fcn.00013304
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00012fd4
mov edx, dword [ebp - 4]
mov eax, ebx
mov dword [edx + 4], eax
mov eax, dword [eax + 0x10]
add eax, 0x40
push eax
call fcn.00016ac0
xor edx, edx
push ebp
push 0xd9ae8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.000d9bd0
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
call fcn.000da4c8
mov ebx, eax
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov edx, 0x20
call fcn.00017634
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebx + 0x10]
mov dword [eax], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x24]
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], 1
mov eax, dword [ebp - 4]
call fcn.000d9bd0
cmp dword [eax + 0x18], 0
je 0xd9ac8
push 0x20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.000d9bd0
mov eax, dword [eax + 0x18]
push eax
call fcn.00063e3c
test eax, eax
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd9aef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x10]
add eax, 0x40
push eax
call fcn.00016c80
ret
Function at 0xfa708
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
xor eax, eax
cmp dword [ebx + 0x20], 0
je 0xfa86a
movzx edx, dx
movzx edx, word [ebx + edx*2 + 0x24]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xffff
je 0xfa86a
mov eax, dword [ebx + 0x20024]
call fcn.00015308
cmp eax, dword [ebp - 4]
jle 0xfa764
mov eax, dword [ebp - 4]
add eax, eax
mov edx, dword [ebx + 0x20024]
mov edi, dword [edx + eax*8 + 0x1c]
mov edx, dword [ebx + 0x20024]
sub edi, dword [edx + eax*8 + 0xc]
jmp 0xfa77d
mov eax, dword [ebx + 0x20]
call fcn.0002303c
mov edi, eax
mov eax, dword [ebp - 4]
add eax, eax
mov edx, dword [ebx + 0x20024]
sub edi, dword [edx + eax*8 + 0xc]
mov eax, dword [ebp - 4]
add eax, eax
mov edx, dword [ebx + 0x20024]
lea eax, [edx + eax*8]
movzx edx, word [eax]
mov dword [esi], edx
movzx edx, word [eax + 2]
mov dword [esi + 4], edx
movsx edx, word [eax + 4]
mov dword [esi + 8], edx
movsx edx, word [eax + 6]
mov dword [esi + 0xc], edx
mov dx, word [eax + 8]
mov word [esi + 0x10], dx
mov ax, word [eax + 0xa]
mov word [esi + 0x12], ax
mov eax, dword [ebp - 4]
add eax, eax
mov edx, dword [ebx + 0x20024]
mov edx, dword [edx + eax*8 + 0xc]
add edx, dword [ebx + 0x20028]
mov eax, dword [ebx + 0x20]
call fcn.00023030
mov dl, 1
mov eax, dword [0xc5748]
call fcn.000c6ee8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xfa861
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x20]
call fcn.00023020
cdq
push edx
push eax
mov eax, edi
cdq
push edx
push eax
mov edx, dword [ebx + 0x20]
mov eax, dword [ebp - 8]
call fcn.000c6f2c
push 8
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
imul ecx, eax
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
call fcn.00067338
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xfa868
mov eax, dword [ebp - 8]
call fcn.00013004
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4