joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bc820
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
mov ebx, edx
mov ecx, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x28]
movzx esi, word [ecx]
mov eax, esi
mov dword [esp + 0x14], ebx
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [esp + 0x10], ebp
mov edx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [esp + 0x28], eax
movzx eax, word [ecx + 0x10]
mov esi, dword [esp + 0x28]
shr eax, 4
mov dword [esp + 0x1c], edx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x100bc8b8
lea ebx, [ebp + 4]
mov esi, ecx
mov ebp, dword [esp + 0x14]
nop word [eax + eax]
push edi
push ebx
mov ecx, esi
call fcn.100be7c0
mov edx, dword [esp + 0x18]
lea eax, [ebx + 0x20]
push edi
push eax
lea ecx, [esi + 0x10]
call fcn.100be7c0
mov edx, dword [esp + 0x1c]
add ebx, 0x440
add esi, 0x20
sub ebp, 1
jne 0x100bc880
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
cmp ebx, 0x10
jbe 0x100bc992
lea eax, [ebp + 0x44]
add ebx, 0xfffffff1
mov dword [esp + 0x18], eax
movzx eax, word [ecx + 0x10]
xor eax, 0x7f0
shr ebx, 1
shr eax, 4
lea ebp, [ebx + 0x180]
add esi, dword [edi + eax*4]
lea ebp, [ecx + ebp*2]
mov dword [esp + 0x28], esi
nop dword [eax]
dec ebx
lea ebp, [ebp - 2]
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [esp + 0x24]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x100bc902
movzx ecx, word [ebp]
mov ebx, dword [esp + 0x1c]
mov eax, ecx
mov edx, dword [esp + 0x18]
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [esp + 0x28]
mov dword [edx + ebx*8 + 4], eax
test ebx, ebx
jne 0x100bc8f0
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ebx, [eax*4 - 0x40]
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x100bc992
add esi, 0x484
lea edi, [eax - 1]
push ebx
push edx
push esi
call fcn.100cf690
mov edx, dword [esp + 0x24]
add esp, 0xc
add esi, 0x440
sub edi, 1
jne 0x100bc978
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x100bcb10
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
or edx, 0x100
mov esi, edx
shr edx, 1
and esi, 1
neg esi
shr esi, 4
movzx ecx, word [edi + edx*2]
and esi, 0x7f
shr ecx, 4
xor ecx, esi
add eax, dword [ebx + ecx*4]
cmp edx, 2
jae 0x100bcb21
pop edi
pop esi
pop ebx
ret 4
Function at 0x100bcb50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [esp + 0x18]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x100bcb63
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 8
Function at 0x100bdd50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movaps xmm0, xmmword [0x100f0000]
push ebx
push esi
mov esi, ecx
mov ebx, 0x400
push edi
mov edi, 0xc
mov dword [esi + 0x2c], 0
lea edx, [esi + 0x1e54]
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x38], 1
mov eax, dword [esi + 0x78]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x201c]
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
movups xmmword [esi + 0x1e1c], xmm0
movups xmmword [esi + 0x1e2c], xmm0
mov ecx, 0x10
nop word [eax + eax]
mov word [eax - 0x180], bx
mov word [eax], bx
add eax, 2
sub ecx, 1
jne 0x100bde00
mov word [edx - 0x18], bx
mov word [edx], bx
mov word [edx + 0x18], bx
mov word [edx + 0x30], bx
add edx, 2
sub edi, 1
jne 0x100bddf1
mov eax, 0x4000400
lea edi, [esi + 0x219c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x239c]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x94]
mov eax, 0x300
add ecx, dword [esi + 0x98]
shl eax, cl
test eax, eax
je 0x100bde72
mov edi, dword [esi + 0x50]
mov ecx, eax
shr ecx, 1
mov eax, 0x4000400
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, 0x4000400
lea edi, [esi + 0x249c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x269c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esi + 0x289c]
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2a9c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0xbca4]
mov dword [esi + 0x18], 0
mov ecx, 0x800
mov dword [eax], 0x40000000
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x100bdec4
mov dword [esi + 0x34], ecx
mov eax, 1
mov ecx, dword [esi + 0x9c]
mov edx, 0x100
shl eax, cl
mov ecx, dword [esi + 0x94]
dec eax
mov dword [esi + 0x4c], eax
mov eax, edx
shr eax, cl
mov ecx, dword [esi + 0x98]
shl edx, cl
sub edx, eax
pop edi
mov dword [esi + 0x48], edx
pop esi
pop ebx
ret

Function at 0x100be7c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, ebx
mov dword [esp + 0xc], edx
mov edx, ecx
push esi
push edi
mov dword [esp + 0x10], edx
mov edi, ebx
mov esi, ebx
shr esi, 2
shr edi, 1
mov eax, edi
and eax, 1
movzx ecx, word [edx + esi*2 + 4]
neg eax
shr eax, 4
neg esi
and eax, 0x7f
shr ecx, 4
xor ecx, eax
and esi, 0x7f0
movzx eax, word [edx + 2]
xor esi, eax
mov eax, dword [esp + 0x10]
shr esi, 4
mov edx, dword [ebp + ecx*4]
movzx ecx, word [eax + edi*2 + 8]
add edx, dword [ebp + esi*4]
mov eax, ecx
add edx, dword [esp + 0x14]
xor ecx, 0x7f0
mov esi, dword [esp + 0x1c]
shr eax, 4
shr ecx, 4
mov eax, dword [ebp + eax*4]
add eax, edx
mov dword [esi + ebx*4], eax
mov eax, dword [ebp + ecx*4]
add eax, edx
mov edx, dword [esp + 0x10]
mov dword [esi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 8
jb 0x100be7d7
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x100bf4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, 0x20
mov eax, dword [edi + 4]
cmp eax, ecx
mov dword [edi + 0x78], 0
cmova eax, ecx
mov dword [edi + 0x7c], 0
mov dword [edi + 0x54], eax
mov eax, dword [edi]
mov dword [edi + 0x30], 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 1
mov dword [edi + 0x70], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x90], 0xffffffff
mov dword [edi + 0x94], 0xffffffff
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x58], 0
cmp eax, dword [edi + 0x20]
je 0x100bf5c6
lea ebx, [edi + 0xd0]
mov ebp, ecx
nop
mov edx, dword [ebx]
test edx, edx
je 0x100bf5a5
mov dword [ebx], 0
nop dword [eax]
mov eax, dword [ebx - 8]
mov esi, dword [edx]
mov eax, dword [eax + 0x14]
mov ecx, eax
mov eax, dword [eax + 4]
call eax
mov edx, esi
test esi, esi
jne 0x100bf590
add ebx, 0x28
sub ebp, 1
jne 0x100bf580
mov edx, dword [edi + 0x5c]
test edx, edx
je 0x100bf5c1
mov eax, dword [edi + 0x14]
mov ecx, eax
mov eax, dword [eax + 4]
call eax
mov dword [edi + 0x5c], ebp
mov eax, dword [edi]
mov dword [edi + 0x20], eax
mov eax, dword [edi + 0x10]
mov dword [edi + 0x98], eax
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea eax, [ecx + 5]
lea eax, [eax + eax*4]
lea ebx, [edi + eax*8]
lea eax, [ecx + 1]
mov dword [edi + 0x58], eax
lea ecx, [ebx + 0x20]
cmp dword [ebx + 0x20], 0
je 0x100bf631
call fcn.100c6560
jmp 0x100bf636
call fcn.100c64b0
mov esi, eax
test esi, esi
jne 0x100bf68e
cmp dword [ebx + 0x1c], eax
lea ecx, [ebx + 0x1c]
je 0x100bf64b
call fcn.100c6560
jmp 0x100bf650
call fcn.100c64b0
mov esi, eax
test esi, esi
jne 0x100bf68e
lea ecx, [ebx + 0x20]
call fcn.100c6590
mov esi, eax
test esi, esi
jne 0x100bf68e
lea ecx, [ebx + 0x1c]
call fcn.100c6590
mov esi, eax
test esi, esi
jne 0x100bf68e
push ebx
call fcn.100c08b0
mov esi, eax
test esi, esi
je 0x100bf6a0
mov ecx, edi
mov dword [edi + 0x44], 0
call fcn.100bf460
test esi, esi
jle 0x100bf699
movzx esi, si
or esi, 0x80070000
test esi, esi
je 0x100bf6a0
mov dword [edi + 0x40], esi
cmp dword [edi + 0x38], 0
jne 0x100bf6b9
cmp dword [edi + 0x40], 0
jne 0x100bf6b9
cmp dword [edi + 0x3c], 0
jne 0x100bf6b9
mov dword [edi + 0x44], 0
xor eax, eax
cmp dword [edi + 0x44], eax
pop edi
cmovne esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x100c42b0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x18]
and esi, 0xf
mov dword [edi + esi*4 + 0x20], SysReAllocStringLen
inc esi
cmp esi, 0xe
je 0x100c42ee
nop dword [eax + eax]
and esi, 0xf
jne 0x100c42e0
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.100c44b0
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x100c42d0
mov ecx, dword [edi + 0x18]
lea edx, [edi + 0x20]
mov eax, dword [edi + 0x1c]
shld eax, ecx, 5
push ebx
shl ecx, 5
mov dword [edi + 0x5c], ecx
mov ecx, edi
mov dword [edi + 0x58], eax
call fcn.100c44b0
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
pop edi
pop esi
pop ebx
ret

Function at 0x100c43f0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
xor edx, edx
mov esi, dword [edi + 0x18]
and esi, 0x3f
mov ecx, esi
shr esi, 2
and ecx, 3
je 0x100c440d
mov edx, dword [edi + esi*4 + 0x20]
shl ecx, 3
mov eax, SysReAllocStringLen
shr eax, cl
or eax, edx
mov dword [edi + esi*4 + 0x20], eax
inc esi
cmp esi, 0xe
je 0x100c4441
and esi, 0xf
jne 0x100c4433
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.100c44b0
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x100c4423
mov ecx, dword [edi + 0x18]
lea edx, [edi + 0x20]
mov eax, dword [edi + 0x1c]
shld eax, ecx, 3
push edi
shl ecx, 3
mov dword [edi + 0x5c], ecx
mov ecx, edi
mov dword [edi + 0x58], eax
call fcn.100c44b0
xor ecx, ecx
mov eax, dword [edi + ecx*4]
lea ebx, [ebx + 4]
bswap eax
inc ecx
mov dword [ebx - 4], eax
cmp ecx, 5
jb 0x100c4461
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x100c4c00
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
ret
Function at 0x100c5590
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x20]
and esi, 0x3f
mov byte [esi + edi + 0x28], 0x80
inc esi
cmp esi, 0x38
je 0x100c55bf
and esi, 0x3f
jne 0x100c55b4
mov ecx, edi
call fcn.100c5740
mov byte [edi + esi + 0x28], 0
inc esi
cmp esi, 0x38
jne 0x100c55a8
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
shld eax, ecx, 3
shl ecx, 3
bswap ecx
bswap eax
mov dword [edi + 0x64], ecx
mov ecx, edi
mov dword [edi + 0x60], eax
call fcn.100c5740
xor edx, edx
nop
mov ecx, dword [edi + edx*4 + 4]
lea ebx, [ebx + 8]
mov eax, dword [edi + edx*4]
add edx, 2
bswap eax
mov dword [ebx - 8], eax
bswap ecx
mov dword [ebx - 4], ecx
cmp edx, 8
jb 0x100c55e0
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
pop edi
pop esi
pop ebx
ret

Function at 0x100c5650
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
ret
Function at 0x100c66f0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
push 0
push dword [esp + 0x14]
push edx
push 0
push 0
call fcn.100d2c5f
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x100c6719
xor eax, eax
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
pop ecx
ret 4

Function at 0x100c67c0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], edx
sub edx, 1
je 0x100c67e8
sub edx, 3
je 0x100c67d9
sub edx, 6
jne 0x100c67ef
add ecx, 0x10
jmp fcn.100c5650
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 0xc], 0xffffffff
ret
mov dword [ecx + 4], 0xffffffff
ret
Function at 0x100cc790
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov ebp, ecx
xor ecx, ecx
lea ebx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [esp + 0x10], ebx
shr eax, 1
add eax, 3
mov dword [ebp], eax
add ebp, 0x10
test edi, edi
je 0x100cc7ce
nop dword [eax]
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebp + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x100cc7c0
cmp ecx, ebx
jae 0x100cc8b6
mov eax, ecx
sub eax, edi
push esi
lea esi, [eax*4]
add esi, ebp
mov dword [esp + 0x1c], esi
xor edx, edx
mov ebx, dword [ebp + ecx*4 - 4]
mov eax, ecx
div edi
mov dword [esp + 0x10], eax
test edx, edx
jne 0x100cc84e
movzx edx, bl
movzx esi, byte [edx + str.cw]
mov edx, ebx
shr edx, 0x18
shl esi, 8
movzx eax, byte [edx + str.cw]
or esi, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
shl esi, 8
shr ebx, 8
movzx eax, byte [eax + str.cw]
or esi, eax
movzx eax, bl
shl esi, 8
movzx ebx, byte [eax + str.cw]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax + 0x100f0258]
xor ebx, eax
or ebx, esi
mov esi, dword [esp + 0x1c]
jmp 0x100cc89b
cmp edi, 6
jbe 0x100cc89b
cmp edx, 4
jne 0x100cc89b
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
or ebx, edx
mov eax, dword [esi]
add esi, 4
xor eax, ebx
mov dword [esp + 0x1c], esi
mov dword [ebp + ecx*4], eax
inc ecx
cmp ecx, dword [esp + 0x14]
jb 0x100cc7e8
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x348cfeff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x348cff0e
pop dword [ebp - 0x44]
mov eax, 0x348cff0e
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3720c
push 0
mov eax, 0xdecbb3dd
add eax, 0x55bd5d7b
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x4a019cc3
sub ecx, 0x4a0152f1
mov edi, eax
mov esi, 0xc1293885
sub esi, 0x8c9bd885
add esi, dword [ebp - 0x44]
mov ebx, 0xba60a259
add ebx, 0xf27fe5ef
mov dword [ebp - 0x20], 0x27299869
mov edx, dword [esi]
sub dword [ebp - 0x24], 0x5e23ca3d
sub edx, ebx
sub dword [ebp - 0x34], 0x217c7f30
mov dword [edi], edx
xor dword [ebp - 0x2c], 0x41f009f2
add edi, 0xec5f2386
add edi, 0x13a0dc7e
add esi, 0xd6121bfd
add esi, 0x29ede407
loop 0x348cff68
add eax, 0xa7d456f0
sub eax, 0xa7d33cd5
mov ebx, eax
add eax, 0x836b4de5
sub eax, 0x836b4de0
mov ecx, 0x34890000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x401443
pop dword [ebp - 0x20]
mov eax, 0x401443
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xe50f3da4
add dword [ebp - 0x30], 0x694307a7
mov dword [ebp - 0x2c], 0x174c436
add dword [ebp - 0x2c], 0x30be880f
mov dword [ebp - 0x28], 0xf88913fc
add dword [ebp - 0x28], 0x53c33032
mov dword [ebp - 0x24], 0x9c171484
sub dword [ebp - 0x24], 0x9c171484
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x17bf76e6
add dword [ebp - 0x30], 0x5cb2f270
mov dword [ebp - 0x2c], 0x6122c5c2
add dword [ebp - 0x2c], 0xe0499bb3
mov dword [ebp - 0x28], 0x940ce584
sub dword [ebp - 0x28], 0x309d7918
mov dword [ebp - 0x24], 0x1502070d
add dword [ebp - 0x24], 0xeafdf8f3
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x9c357c4c
sub eax, 0x9bf4fbd0
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39e95
push 0
call eax
mov ecx, 0x575e1d58
add ecx, 0xa8a230cc
xor edx, edx
add edx, eax
mov esi, 0x451400
add esi, dword [ebp - 0x20]
mov ebx, 0x8832bac
add ebx, 0x22388f1a
sub dword [ebp - 4], 0xc3f4df02
mov edi, dword [esi]
xor dword [ebp - 8], 0x1d5b5be8
add edi, ebx
sub dword [ebp - 0x18], ebx
mov dword [edx], edi
xor dword [ebp - 0x18], 0xa38d0daa
add edx, 0x927721b8
add edx, 0x6d88de4c
add esi, 0x4b33025c
sub esi, 0x4b330258
loop 0x401557
add eax, 0x1cf96aa2
sub eax, 0x1cf83f3f
xor ebx, ebx
add ebx, eax
add eax, 0xd5f69dc1
sub eax, 0xd5f69dbc
mov ecx, 0xbaf2b9e4
add ecx, 0x454d461c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10008bf4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x1000deef
call fcn.1000c808
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x10008dc8
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.1000cfcd
add esp, 0xc
test eax, eax
js 0x10008dc2
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x10008c90
push esi
call fcn.100055f7
pop ecx
test al, al
je 0x10008c90
mov eax, esi
call fcn.1000c873
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x10008c9c
push esi
lea ecx, [ebp - 0x428]
call fcn.1000cfcd
push 3
push esi
push edi
push eax
call fcn.1000cfcd
test eax, eax
je 0x10008dc2
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x10008cd0
call fcn.10005825
mov esi, eax
jmp 0x10008da7
push dword [ebp - 0x424]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x10008cf3
call fcn.10005825
jmp 0x10008d9e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x10008ce9
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x420], esi
cmp eax, esi
jae 0x10008d23
mov esi, 0x8007000e
jmp 0x10008da0
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000cfcd
mov dword [ebp - 4], 1
jmp 0x10008d62
cmp dword [ebp - 0x418], 0
je 0x10008d1c
push esi
push dword [ebp - 0x424]
push esi
push dword [ebp - 0x418]
call fcn.1000cfcd
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1000cfcd
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10008de2
lea ecx, [ebp - 0x418]
call fcn.10008e4b
jmp 0x10008de2
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x10008ddd
lea ecx, [ebp - 0x418]
call fcn.10008e4b
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.1000575f
mov eax, esi
lea esp, [ebp - 0x444]
call fcn.1000c861
ret 0x10
Function at 0x1d389a8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1d389b2
pushal
call 0x1d389b8
pop ebp
sub ebp, 0x10
sub ebp, 0x19389a8
jmp 0x1d389ce
mov eax, 0x19389a8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ad
mov edx, 0x9100f9fc
lodsd eax, dword [esi]
add eax, 0xfcba0000
stc
add byte [ecx + 0x49401030], dl
xor byte [eax], dl
inc eax
dec ecx
jne 0x1d389e5
jmp 0x1d389f8
ja 0x1d38a2b
ja 0x1d38a71
sar ah, 0xfc
cld
jge 0x1d38a3f
add al, 0xfc
cld
cld
push dword [ecx]
inc esp
idiv ah
cld
cld
inc esi
aam 0xfc
cld
cld
or ebx, dword [esi]
push dword [edi + esi*2]
jge 0x1d38a09
invalid
cld
cld
cld
invalid
xchg esp, eax
mov ebx, 0xfdfdbfa0
rcr al, 1
xchg esp, eax
pop ebp
xlatb
mov edx, dword [ecx + edi*8]
cld
cld
cld
adc eax, 0xfcfcfcc8
cld
cld
cld
jno 0x1d389dc
fadd dword [eax]
jne 0x1d38a18
fdiv dword [edi + 0x10]
ja 0x1d38ac6
hlt
fdivr st(0)
invalid
out 0xfc, al
cld
cld
jl 0x1d38ad3
adc eax, 0xfced78f3
cld
cld
lcall 0x78f3, 0xd903077d
jmp 0xbfd087db