joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fdc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64997b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0xd40
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44fdfd
push eax
call fcn.00483380
jmp 0x44fdff
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x774], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x774]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x774]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x459010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e2b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
lea edi, [esp + 0xc]
mov ebx, ecx
call fcn.00519520
mov dword [esp + 0x30], 0
cmp dword [esi + 0x290], 0xffffffff
je 0x4590a8
cmp dword [esi + 0x88], 0
jle 0x4590a8
mov edi, dword [esp + 0x24]
cmp edi, 0x10
mov dword [esi + 0x318], ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
jae 0x459068
lea ecx, [esp + 0x10]
lea edx, [esi + 0x298]
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x459070
mov eax, dword [esi + 0x294]
mov ecx, dword [esi + 0x88]
add eax, 0x65
cmp ecx, eax
jge 0x459093
mov eax, ecx
cmp edi, 0x10
mov dword [esi + 0x88], eax
jb 0x4591c8
push ebx
jmp 0x4591c0
mov edi, esi
call fcn.00458fc0
mov ecx, dword [esp + 0x10]
mov edi, 0x10
cmp dword [esp + 0x24], edi
jae 0x4590c2
lea ecx, [esp + 0x10]
lea edx, [esi + 4]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4590c5
cmp ebx, 6
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x290], 0xffffffff
je 0x459190
cmp ebx, 0xc
je 0x459190
cmp ebx, 0x11
je 0x459190
cmp ebx, 0xb
je 0x459190
cmp ebx, 0xa
jne 0x45911b
mov dword [esi + 0x88], 0x1f4
jmp 0x45919a
cmp ebx, 7
je 0x45910c
cmp ebx, 9
je 0x45910c
cmp ebx, 0xd
je 0x45910c
cmp ebx, 1
je 0x45910c
cmp ebx, 3
je 0x45910c
cmp ebx, 4
je 0x45910c
cmp ebx, 8
je 0x459184
cmp ebx, 2
je 0x459184
cmp ebx, 5
je 0x459184
cmp ebx, 0xe
jne 0x459159
mov dword [esi + 0x88], 0xfa
jmp 0x45919a
cmp ebx, 0xf
jne 0x459174
mov dword [esi + 0x88], 0x2ee
mov dword [esi + 0x290], 0x62
jmp 0x45919a
cmp ebx, edi
jne 0x45919a
mov dword [esi + 0x88], 0x2ee
jmp 0x45919a
mov dword [esi + 0x88], 0x2710
jmp 0x45919a
mov dword [esi + 0x88], 0x5dc
cmp dword [esi + 0x290], 0xffffffff
je 0x4591a9
push esi
call fcn.004591e0
cmp dword [esp + 0x24], edi
mov eax, dword [esi + 0x88]
mov dword [esi + 0x84], eax
jb 0x4591c8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret
Function at 0x52edb0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [esp + 0x10]
call fcn.00532140
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], 0
jmp 0x52ede0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
lea esi, [esp + 0xc]
call fcn.0041c950
test al, al
je 0x52ee7c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov esi, dword [esp + 0xc]
cmp edx, dword [esi + 0x1c]
jne 0x52ede0
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.00467ef0
mov ecx, dword [esp + 0x10]
cmp edi, ecx
jge 0x52ee24
mov edx, dword [esp + 0x18]
lea eax, [ebx + edi]
add edx, ecx
jmp 0x52ee2f
mov eax, dword [esp + 0x18]
add eax, ecx
mov ecx, edi
lea edx, [ebx + edi]
cmp eax, ecx
jg 0x52ee37
sub eax, ecx
jmp 0x52ee43
cmp eax, edx
jg 0x52ee3f
sub eax, ecx
jmp 0x52ee43
sub edx, ecx
mov eax, edx
cmp eax, 0x14
jl 0x52ede0
mov ecx, dword [ebp + 8]
push 1
push esi
call fcn.0052e4c0
test al, al
je 0x52ede0
mov eax, dword [esi + 0x24]
cmp eax, 0x15
je 0x52ede0
cmp eax, 0x2e
je 0x52ede0
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov edi, dword [ebp + 8]
push 1
push ecx
push edx
call fcn.0052e920
jmp 0x52ee7f
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x52eee6
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x52eec2
cmp eax, 0x3e
je 0x52eec2
cmp eax, 0x3f
je 0x52eec2
cmp eax, 0x40
je 0x52eec2
cmp eax, 0x41
je 0x52eec2
cmp eax, 0x42
je 0x52eec2
cmp eax, 0x43
je 0x52eec2
cmp eax, 0x44
je 0x52eec2
cmp eax, 0x45
je 0x52eec2
cmp eax, 0x46
jne 0x52eee6
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x160]
push ecx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x52eee6
mov edx, dword [edi + 4]
mov ecx, dword [edx + 0x160]
push ecx
call fcn.0042ba30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5b18b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6411b3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
lea esi, [edi + 0x28]
mov dword [edi], vtable.Sexy::BetaSupport.0
call fcn.005ad110
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov eax, 0xf
mov dword [edi + 0x1e8], eax
mov dword [edi + 0x1e4], ebx
mov byte [edi + 0x1d4], bl
mov dword [edi + 0x204], eax
mov dword [edi + 0x200], ebx
mov byte [edi + 0x1f0], bl
mov dword [edi + 0x220], eax
mov dword [edi + 0x21c], ebx
mov byte [edi + 0x20c], bl
mov dword [edi + 0x23c], eax
mov dword [edi + 0x238], ebx
mov byte [edi + 0x228], bl
mov byte [esp + 0x1c], 4
call fcn.005c2930
mov dword [edi + 0x248], eax
mov cl, 1
mov byte [eax + 0x49], cl
mov eax, dword [edi + 0x248]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x248]
mov dword [eax], eax
mov eax, dword [edi + 0x248]
mov dword [eax + 8], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x24c], ebx
mov dword [edi + 4], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov byte [edi + 0x1cc], bl
mov byte [edi + 0x1cd], cl
mov dword [edi + 0x18], ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x48
push 0x60
push 8
mov dword [esp + 0x30], eax
call ebp
push str.Tahoma
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
neg eax
push ebx
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0x48
push 0x60
push 8
mov dword [edi + 8], eax
call ebp
push str.Arial
push ebx
push ebx
push ebx
push ebx
push ebx
neg eax
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0x48
push 0x60
push 0xa
mov dword [edi + 0xc], eax
call ebp
push str.Tahoma
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2bc
push ebx
push ebx
neg eax
push ebx
push eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov ecx, dword [esp + 0x24]
push ecx
push esi
mov dword [edi + 0x10], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov byte [edi + 0x240], bl
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x5c7b20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x63f998
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x20], ebx
lea edi, [esi + 0xc]
mov dword [esi], vtable.Sexy::DSoundInstance.0
mov dword [esi + 4], eax
mov byte [esi + 0x12], bl
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov dword [esi + 8], ecx
mov dword [edi], ebx
fld qword [0x65b8f8]
lea ebp, [esi + 0x30]
fst qword [esi + 0x18]
fstp qword [esi + 0x28]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp], 0xac44
je 0x5c7c41
mov eax, dword [eax + 0x3094]
mov edx, dword [eax]
push edi
push ecx
push eax
mov eax, dword [edx + 0x14]
call eax
cmp eax, ebx
je 0x5c7c36
cmp eax, 0x8878000a
jg 0x5c7c00
je 0x5c7bec
cmp eax, 0x8007000e
je 0x5c7bd8
cmp eax, 0x80070057
jne 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_INVALIDPARAM
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_OUTOFMEMORY
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_ALLOCATED
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
cmp eax, 0x88780032
je 0x5c7c22
cmp eax, 0x887800aa
jne 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_UNINITIALIZED
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_INVALIDCALL
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x20]
push ebp
push edi
call edx
mov eax, esi
call fcn.005c7ce0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x5c7fb0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x404
mov eax, dword [0x699fe8]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [esp + 0x408], 0
mov eax, dword [esp + 0x40c]
jne 0x5c8003
push eax
lea eax, [esp + 4]
push str._s_function_not_found_in_samp.dll
push eax
call fcn.0061d4e6
add esp, 0xc
push 0x10
push str.Error
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0061dd92
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0061efd1
add esp, 0x404
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x5a73427f
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x24331b2c
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40dbc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x78b5b], al
inc dword [eax]
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.0040c049
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.0040bfaa
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x40dfb1
test dword [ebx], ebp
clc
invalid
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.0040c039
jg 0x40df4d
add ch, byte [eax - 1]
mov ch, pe_nt_image_headers32
cld
invalid
Function at 0x10001180
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x88
mov dl, byte [0x100139bc]
push ebx
push ebp
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], dl
mov byte [esp + 0x14], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x15]
mov esi, dword [esp + 0x9c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x55]
mov byte [esp + 0x54], dl
rep stosd dword es:[edi], eax
mov ebx, 1
lea eax, [ebx - 1]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov cl, al
mov al, byte [eax + esi]
inc cl
shl cl, 3
sub cl, bl
shr al, cl
and al, 1
mov byte [esp + ebx + 0x54], al
inc ebx
cmp ebx, 0x41
jl 0x100011d3
xor eax, eax
movsx esi, byte [eax + str.91__]
lea ecx, [eax + 1]
cmp ecx, 0x1d
jge 0x10001214
mov dl, byte [esp + esi + 0x54]
mov byte [esp + eax + 0x35], dl
jmp 0x1000121c
mov al, byte [esp + esi + 0x54]
mov byte [esp + ecx - 8], al
mov eax, ecx
lea ecx, [eax + 1]
cmp ecx, 0x39
jl 0x100011fb
mov eax, 0x100100b0
mov edx, 1
dec eax
mov ebp, 0x100136a9
mov dword [esp + 0x10], eax
jmp 0x10001240
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cl, byte [eax + edx]
mov al, byte [esp + 0x35]
mov edi, ecx
mov cl, byte [esp + 0x36]
mov byte [esp + 0x51], al
mov al, byte [esp + 0x15]
mov byte [esp + 0x52], cl
mov cl, byte [esp + 0x16]
mov byte [esp + 0x31], al
mov byte [esp + 0x32], cl
lea esi, [esp + edi + 0x15]
xor eax, eax
lea ecx, [esp + eax + 0x35]
inc esi
inc eax
mov bl, byte [ecx + edi]
mov byte [ecx], bl
mov cl, byte [esi - 1]
mov byte [esp + eax + 0x14], cl
lea ecx, [eax + 1]
cmp ecx, 0x1d
jl 0x1000126d
xor eax, eax
lea ecx, [eax + 1]
cmp ecx, 0x1d
jge 0x10001297
mov bl, byte [esp + eax + 0x35]
jmp 0x1000129b
mov bl, byte [esp + ecx - 8]
mov byte [esp + eax + 0x55], bl
mov eax, ecx
lea ecx, [eax + 1]
cmp ecx, 0x39
jl 0x10001289
mov ecx, 0x1001007c
mov eax, 1
dec ecx
xor ebx, ebx
mov bl, byte [ecx + eax]
inc eax
cmp eax, 0x31
mov bl, byte [esp + ebx + 0x54]
mov byte [eax + ebp - 1], bl
jl 0x100012b4
add ebp, 0x31
inc edx
cmp ebp, 0x100139b9
jl 0x1000123c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret

Function at 0x100012f0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, str.:2_
mov esi, 1
dec edi
xor ebx, ebx
mov bl, byte [edi + esi]
lea eax, [ebx - 1]
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x14]
sar eax, 3
mov cl, al
mov al, byte [eax + edx]
inc cl
shl cl, 3
sub cl, bl
shr al, cl
and al, 1
mov byte [esi + ebp], al
inc esi
cmp esi, 0x41
jl 0x10001303
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10001340
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
mov ecx, ebp
xor eax, eax
push esi
push edi
mov dword [ecx], eax
mov edi, 1
xor esi, esi
mov dword [esp + 0x18], 0x40
mov dword [ecx + 4], eax
mov eax, esi
cdq
and edx, 7
add eax, edx
movsx edx, byte [esi + 0x10010108]
sar eax, 3
mov dl, byte [edx + ebx]
lea ecx, [eax*8 + 8]
sub ecx, edi
shl dl, cl
mov cl, byte [eax + ebp]
add cl, dl
inc edi
mov byte [eax + ebp], cl
mov eax, dword [esp + 0x18]
inc esi
dec eax
mov dword [esp + 0x18], eax
jne 0x10001364
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x100013a0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
sub esp, 0xb8
mov eax, 1
push esi
mov esi, dword [esp + 0xc0]
push edi
lea edi, [esp + 0x38]
sub edi, esi
cmp eax, 0x21
jge 0x100013ca
mov dl, byte [eax + esi]
lea ecx, [eax + esi]
mov byte [edi + ecx], dl
jmp 0x100013d1
mov cl, byte [eax + esi]
mov byte [esp + eax - 0xc], cl
inc eax
cmp eax, 0x41
jl 0x100013ba
push ebx
push ebp
mov ebp, 0x1001014c
mov edi, 0x100136a9
dec ebp
mov eax, 1
xor edx, edx
mov dl, byte [eax + ebp]
inc eax
cmp eax, 0x31
mov cl, byte [esp + edx + 0x1c]
mov byte [eax + esi - 1], cl
jl 0x100013e9
mov ecx, 1
mov dl, byte [edi + ecx]
mov bl, byte [ecx + esi]
xor bl, dl
lea edx, [ecx - 1]
mov eax, 0x2aaaaaab
mov byte [ecx + esi], bl
imul edx
mov eax, edx
shr eax, 0x1f
add edx, eax
add edx, ecx
inc ecx
cmp ecx, 0x31
mov byte [esp + edx + 0x8f], bl
jl 0x10001401
mov ecx, 1
lea eax, [esp + 0x95]
xor edx, edx
xor ebx, ebx
mov dl, byte [eax - 5]
mov bl, byte [eax]
add eax, 7
lea edx, [edx + ecx*2]
lea edx, [ebx + edx*2 - 4]
xor ebx, ebx
mov bl, byte [eax - 0xb]
lea edx, [ebx + edx*2]
xor ebx, ebx
mov bl, byte [eax - 0xa]
lea edx, [ebx + edx*2]
xor ebx, ebx
mov bl, byte [eax - 9]
lea edx, [ebx + edx*2]
xor ebx, ebx
mov bl, byte [eax - 8]
inc ecx
cmp ecx, 9
mov dl, byte [ebx + edx*2 + 0x10010180]
mov byte [esp + ecx + 0xf], dl
jl 0x10001438
mov ebx, 1
lea eax, [ebx - 1]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov cl, al
mov al, byte [esp + eax + 0x11]
inc cl
shl cl, 2
sub cl, bl
shr al, cl
and al, 1
mov byte [esp + ebx + 0x64], al
inc ebx
cmp ebx, 0x21
jl 0x1000147e
lea ecx, [esi + 1]
xor eax, eax
mov bl, byte [esp + eax + 0x41]
xor edx, edx
mov dl, byte [eax + 0x10010384]
mov dl, byte [esp + edx + 0x64]
xor dl, bl
inc eax
mov byte [ecx], dl
mov dl, byte [esp + eax + 0x1c]
mov byte [esp + eax + 0x40], dl
mov dl, byte [ecx]
mov byte [esp + eax + 0x1c], dl
lea edx, [eax + 1]
inc ecx
cmp edx, 0x21
jl 0x100014aa
add edi, 0x31
cmp edi, 0x100139b9
jl 0x100013e4
lea edi, [esp + 0x1c]
pop ebp
mov eax, 1
sub edi, esi
pop ebx
cmp eax, 0x21
jge 0x10001501
lea ecx, [eax + esi]
mov dl, byte [ecx + edi]
mov byte [ecx], dl
jmp 0x10001508
mov cl, byte [esp + eax + 0x18]
mov byte [eax + esi], cl
inc eax
cmp eax, 0x41
jl 0x100014f2
pop edi
pop esi
add esp, 0xb8
ret
Function at 0x10001520
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
sub esp, 0xb8
mov eax, 1
push esi
push edi
mov edi, dword [esp + 0xc4]
lea esi, [esp + 0x38]
sub esi, edi
cmp eax, 0x21
jge 0x1000154a
mov dl, byte [eax + edi]
lea ecx, [eax + edi]
mov byte [esi + ecx], dl
jmp 0x10001551
mov cl, byte [eax + edi]
mov byte [esp + eax - 0xc], cl
inc eax
cmp eax, 0x41
jl 0x1000153a
push ebx
push ebp
mov ebp, 0x10013989
mov esi, ebp
xor ecx, ecx
mov al, byte [esi]
xor edx, edx
mov dl, byte [ecx + 0x1001014c]
mov bl, byte [esp + edx + 0x1c]
xor bl, al
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
mov byte [ecx + edi + 1], bl
shr eax, 0x1f
add edx, eax
lea edx, [ecx + edx + 1]
inc ecx
inc esi
lea eax, [ecx + 1]
mov byte [esp + edx + 0x8f], bl
cmp eax, 0x31
jl 0x10001562
mov ecx, 1
lea eax, [esp + 0x95]
xor edx, edx
xor ebx, ebx
mov dl, byte [eax - 5]
mov bl, byte [eax]
add eax, 7
lea edx, [edx + ecx*2]
lea edx, [ebx + edx*2 - 4]
xor ebx, ebx
mov bl, byte [eax - 0xb]
lea edx, [ebx + edx*2]
xor ebx, ebx
mov bl, byte [eax - 0xa]
lea edx, [ebx + edx*2]
xor ebx, ebx
mov bl, byte [eax - 9]
lea edx, [ebx + edx*2]
xor ebx, ebx
mov bl, byte [eax - 8]
inc ecx
cmp ecx, 9
mov dl, byte [ebx + edx*2 + 0x10010180]
mov byte [esp + ecx + 0xf], dl
jl 0x100015a5
mov ebx, 1
lea eax, [ebx - 1]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov cl, al
mov al, byte [esp + eax + 0x11]
inc cl
shl cl, 2
sub cl, bl
shr al, cl
and al, 1
mov byte [esp + ebx + 0x64], al
inc ebx
cmp ebx, 0x21
jl 0x100015eb
lea ecx, [edi + 1]
xor eax, eax
mov bl, byte [esp + eax + 0x41]
xor edx, edx
mov dl, byte [eax + 0x10010384]
mov dl, byte [esp + edx + 0x64]
xor dl, bl
inc eax
mov byte [ecx], dl
mov dl, byte [esp + eax + 0x1c]
mov byte [esp + eax + 0x40], dl
mov dl, byte [ecx]
mov byte [esp + eax + 0x1c], dl
lea edx, [eax + 1]
inc ecx
cmp edx, 0x21
jl 0x10001617
sub ebp, 0x31
cmp ebp, 0x10013679
jg 0x1000155e
lea esi, [esp + 0x1c]
pop ebp
mov eax, 1
sub esi, edi
pop ebx
cmp eax, 0x21
jge 0x1000166e
lea ecx, [eax + edi]
mov dl, byte [ecx + esi]
mov byte [ecx], dl
jmp 0x10001675
mov cl, byte [esp + eax + 0x18]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x41
jl 0x1000165f
pop edi
pop esi
add esp, 0xb8
ret

Function at 0x10001850
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [esp + 0x114]
push edi
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
cmp ebx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], edx
mov byte [esp + 0xc], dl
mov byte [esp + 0xd], bl
jle 0x1000189b
mov ecx, ebx
push esi
mov esi, dword [esp + 0x120]
mov eax, ecx
lea edi, [esp + 0x12]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [esp + 0x114]
lea ecx, [esp + 8]
push edx
push ecx
lea edx, [esp + 0x14]
push 0x101
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100018d0
cmp ebx, 0x101
jne 0x100018d0
pop edi
xor eax, eax
pop ebx
add esp, 0x108
ret
pop edi
mov eax, 1
pop ebx
add esp, 0x108
ret
Function at 0x100018e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
push ebx
push edi
mov ecx, 0x40
mov eax, 0x20202020
lea edi, [esp + 0xc]
mov edx, dword [esp + 0x114]
rep stosd dword es:[edi], eax
xor ebx, ebx
lea ecx, [esp + 0xc]
stosb byte es:[edi], al
lea eax, [esp + 8]
push ebx
push eax
push 0x101
push ecx
push edx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x120], bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx ecx, byte [esp + 0xd]
mov edx, ecx
and ecx, 0xf
sar edx, 4
and edx, 0xf
shl edx, 4
add edx, ecx
cmp edx, ebx
jle 0x1000195a
mov edi, dword [esp + 0x118]
mov ecx, edx
mov ebx, ecx
push esi
lea esi, [esp + 0x12]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
neg eax
sbb eax, eax
pop edi
and eax, edx
pop ebx
add esp, 0x108
ret

Function at 0x10001c00
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x308
push ebp
mov ebp, dword [esp + 0x310]
test ebp, ebp
je 0x10001d93
mov eax, dword [esp + 0x314]
and eax, 0xff
dec eax
je 0x10001c4a
sub eax, 0x10
je 0x10001c43
dec eax
je 0x10001c3c
mov eax, 0xfffffff2
pop ebp
add esp, 0x308
ret 8
mov edx, 1
jmp 0x10001c4c
mov edx, 2
jmp 0x10001c4c
xor edx, edx
push ebx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x215]
mov bl, 0x3a
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x114]
mov byte [esp + 0xc], 0xaa
push eax
push 4
push ebp
mov dword [esp + 0x1c], 0
mov byte [esp + 0x120], bl
mov byte [esp + 0x121], 0x5a
mov byte [esp + 0x122], 0xb
mov byte [esp + 0x123], dl
call fcn.10001850
lea ecx, [esp + 0x20]
push ecx
push ebp
call fcn.100018e0
mov cl, byte [esp + 0x28]
add esp, 0x14
cmp cl, bl
jne 0x10001d7c
cmp byte [esp + 0x15], 0x5a
jne 0x10001d7c
cmp eax, 2
jle 0x10001d09
mov bl, byte [esp + 0x16]
push 0xa
mov byte [esp + 0x10], bl
call fcn.10001970
add esp, 4
jmp 0x10001d66
push esi
lea edx, [esp + 0x18]
mov byte [esp + 0x18], 0
push edx
push ebp
call fcn.100018e0
add esp, 8
test eax, eax
jle 0x10001d40
mov ecx, eax
lea esi, [esp + 0x19]
mov edx, ecx
lea edi, [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [esp + 0x14], eax
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10001d0a
mov bl, byte [esp + 0x218]
push 0xa
mov byte [esp + 0x14], bl
call fcn.10001970
add esp, 4
pop esi
cmp bl, 0xcc
jne 0x10001d7c
pop edi
pop ebx
mov eax, 0xfffffff5
pop ebp
add esp, 0x308
ret 8
mov eax, dword [esp + 0xc]
pop edi
and eax, 0xff
pop ebx
neg eax
pop ebp
add esp, 0x308
ret 8
mov eax, 0xfffffff4
pop ebp
add esp, 0x308
ret 8