joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x1009ebc0]
xor eax, eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x18], 0x6379457f
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x757074
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x10022256
mov byte [ebp - 0x10], 0xe
mov al, 0x60
xor al, byte [ebp - 0x10]
mov bl, 0x62
mov ah, bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov dl, 0x6a
mov bh, ah
mov byte [ebp - 1], ah
xor bl, al
mov byte [ebp - 6], 0
xor ah, al
mov byte [ebp - 0x11], 0
xor bh, al
mov byte [ebp - 0xb], ah
mov dh, dl
mov byte [ebp - 0xc], bl
xor dl, al
mov byte [ebp - 8], bh
xor dh, al
mov byte [ebp - 0xd], dl
mov cl, 0x7a
mov byte [ebp - 9], dh
xor cl, al
mov byte [ebp - 6], 0
mov ch, 0x20
mov byte [ebp - 0xe], cl
xor ch, al
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0xf]
mov byte [ebp - 0xa], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x100222df
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x11
test esi, esi
jne 0x100222fe
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call edi
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10022310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1002234e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10022352
cmp edx, esi
jne 0x10022337
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10022372
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10022376
cmp edx, esi
jne 0x1002235b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10022396
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002239a
cmp edx, esi
jne 0x1002237f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087b90
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [str._a_JZBJG_JNK]
xor eax, eax
movups xmmword [ebp - 0x44], xmm0
mov cl, byte [ebp - 0x44]
xor byte [ebp + eax - 0x43], cl
inc eax
cmp eax, 0xe
jb 0x10022488
mov byte [ebp - 0x28], 0x58
mov al, 0x36
xor al, byte [ebp - 0x28]
mov bl, 0x34
mov ah, bl
mov byte [ebp - 0x27], al
mov al, byte [ebp - 0x28]
mov dl, 0x3c
mov bh, ah
mov byte [ebp - 0x15], ah
xor bl, al
mov byte [ebp - 0x1e], 0
xor ah, al
mov byte [ebp - 0x35], 0
xor bh, al
mov byte [ebp - 0x23], ah
mov dh, dl
mov byte [ebp - 0x24], bl
xor dl, al
mov byte [ebp - 0x20], bh
xor dh, al
mov byte [ebp - 0x25], dl
mov cl, 0x2c
mov byte [ebp - 0x21], dh
xor cl, al
mov byte [ebp - 0x1e], 0
mov ch, 0x76
mov byte [ebp - 0x26], cl
xor ch, al
mov al, byte [ebp - 0x15]
xor al, byte [ebp - 0x28]
mov byte [ebp - 0x1f], al
lea eax, [ebp - 0x43]
push eax
lea eax, [ebp - 0x27]
mov byte [ebp - 0x22], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0xd78dd4
mov edi, eax
call fcn.10019420
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10022600
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
call edi
test eax, eax
jns 0x10022598
movaps xmm0, xmmword [0x1009dea0]
xor ecx, ecx
movups xmmword [ebp - 0x44], xmm0
mov word [ebp - 0x34], 0x531c
mov byte [ebp - 0x32], 0
nop
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x11
jb 0x10022550
lea eax, [ebp - 0x43]
mov byte [ebp - 0x32], 0
push eax
lea ecx, [ebp - 0x5c]
call fcn.10002870
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.1001ce90
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x10022598
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.10002650
cmp dword [ebp - 0x14], 0
jbe 0x100225f9
movaps xmm0, xmmword [0x1009e060]
xor ecx, ecx
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x2b2a2b21
mov word [ebp - 0x1c], 0x6e
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x14
jb 0x100225b8
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x1b], 0
push eax
lea ecx, [ebp - 0x74]
call fcn.10002870
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 1
call fcn.1001ce90
mov eax, dword [ebp - 0x60]
cmp eax, 0x10
jb 0x100225f9
inc eax
lea ecx, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
call fcn.10002650
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x10022c90
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov byte [ebp - 0x18], 0x69
mov al, 7
xor al, byte [ebp - 0x18]
mov bl, 5
mov ah, bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x18]
mov dl, 0xd
mov bh, ah
mov byte [ebp - 9], ah
mov dh, dl
mov byte [ebp - 0xe], 0
xor dl, al
mov byte [ebp - 0xe], 0
xor bl, al
mov byte [ebp - 0x15], dl
xor ah, al
mov byte [ebp - 0x14], bl
xor dh, al
mov byte [ebp - 0x13], ah
xor bh, al
mov byte [ebp - 0x11], dh
mov cl, 0x1d
mov byte [ebp - 0x10], bh
xor cl, al
mov ch, 0x47
xor ch, al
mov byte [ebp - 0x16], cl
mov al, byte [ebp - 9]
xor al, byte [ebp - 0x18]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x17]
push eax
mov byte [ebp - 0x12], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmmword [0x1009de80]
mov edx, eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x15100b
xor ecx, ecx
pop ebx
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x12
jb 0x10022d16
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x19], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ecx
mov edx, 0x10022720
mov ecx, eax
call fcn.10063760
add esp, 4
mov dword [0x100aa934], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0x40
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x100247c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087d28
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x100a7078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [0x100aa964], eax
test edx, edx
je 0x100248af
cmp dword [ebp + 0xc], 1
jne 0x100248af
mov eax, dword [esi + 4]
test eax, eax
je 0x1002489b
cmp edx, eax
jne 0x1002489b
cmp byte [0x100aa8c2], 0
sete al
xor ecx, ecx
mov byte [0x100aa8c2], al
test al, al
je 0x10024856
movaps xmm0, xmmword [0x1009de40]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x14
nop
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x10024840
mov byte [ebp - 0x23], 0
lea eax, [ebp - 0x33]
jmp 0x10024879
movaps xmm0, xmmword [0x1009dfc0]
movups xmmword [ebp - 0x20], xmm0
mov byte [ebp - 0x10], 0
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xf
jb 0x10024865
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x1f]
push eax
lea ecx, [ebp - 0x4c]
call fcn.10002870
mov dword [ebp - 4], 0
lea edx, [ebp - 0x4c]
mov ecx, dword [esi]
call fcn.10019110
lea ecx, [ebp - 0x4c]
call fcn.10002220
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10024ae0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087d58
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
or eax, 0xffffffff
mov byte [ebp - 0x20], 0
push dword [ebp - 0x20]
mov dword [esi + 0x38], eax
lea ecx, [ebp - 0x1c]
mov word [esi + 0x3c], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
movq qword [ebp - 0x1c], xmm0
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 0
push eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [ebp - 0x2c], 0x350
mov dword [ebp - 0x28], 0x140
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10023220
sub esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
mov ecx, esp
push eax
call fcn.10023180
mov ecx, 0xd78d54
call fcn.10019460
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 0xc
mov dword [esi], eax
push 4
push 0x4de1e6
call ebx
test eax, eax
jne 0x10024c08
mov edx, 0x10025dd0
mov ecx, 0x4de1e6
call fcn.1001cbf0
mov eax, dword [esi]
test eax, eax
je 0x10024c74
push 4
push eax
call ebx
test eax, eax
jne 0x10024c74
mov ecx, esi
call fcn.10024cb0
cmp dword [0x100aa974], 0
jne 0x10024c61
mov edi, dword [esi]
test edi, edi
je 0x10024c49
push 4
push edi
call ebx
test eax, eax
jne 0x10024c49
push 4
lea eax, [edi + 0x64]
push eax
call ebx
test eax, eax
jne 0x10024c49
mov edi, dword [edi]
add edi, 0x64
jmp 0x10024c4b
xor edi, edi
mov eax, dword [edi]
push 4
push eax
mov dword [0x100aa974], eax
call ebx
test eax, eax
jne 0x10024c61
mov dword [edi], 0x10025e00
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10024c90
mov ecx, dword [ebp - 0x14]
sub ecx, eax
sar ecx, 2
push ecx
push eax
jmp 0x10024c8b
mov ecx, dword [ebp - 0x1c]
mov dword [esi], 0
test ecx, ecx
je 0x10024c90
mov eax, dword [ebp - 0x14]
sub eax, ecx
sar eax, 2
push eax
push ecx
call fcn.10010d60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x10028f10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087c48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push dword [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x28]
movq qword [ebp - 0x1c], xmm0
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], 0x1ec
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.10023220
sub esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
mov ecx, esp
push eax
call fcn.10023180
mov ecx, 0xd78d54
call fcn.10019460
mov dword [esi], eax
add esp, 0xc
mov dword [esi + 0x24], 0
mov dword [esi + 4], 0
mov dword [esi + 0x28], 0
push 4
push eax
mov dword [esi + 8], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x20], 0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10029042
mov eax, dword [ebp - 0x1c]
mov dword [esi], 0
test eax, eax
je 0x100290c4
mov ecx, dword [ebp - 0x14]
sub ecx, eax
sar ecx, 2
push ecx
push eax
jmp 0x100290bf
mov ecx, esi
call fcn.100290e0
call fcn.100665a0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10066a70
push 0x10029350
push 0x100aa9bc
call fcn.100662b0
call fcn.10066600
push 4
push 0x62ed60
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100290ae
mov dword [0x100aa9bc], 0x62ed60
call fcn.100665a0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10066a70
push 0x10029350
push 0x100aa9bc
call fcn.10065e20
call fcn.10066600
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100290c4
mov eax, dword [ebp - 0x14]
sub eax, ecx
sar eax, 2
push eax
push ecx
call fcn.10010d60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x1002eef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088190
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
mov eax, dword [0x100a7078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
test eax, eax
je 0x1002f0be
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.1002f500
movaps xmm0, xmmword [0x1009e430]
xor ecx, ecx
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x4e4e255e
mov dword [ebp - 0x34], 0x234e4e44
mov byte [ebp - 0x30], 0
nop
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x17
jb 0x1002ef60
cmp byte [ebp - 0x47], 0
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jne 0x1002ef8d
xor ecx, ecx
jmp 0x1002ef9c
lea ecx, [ebp - 0x47]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002ef93
sub ecx, edx
push ecx
lea eax, [ebp - 0x47]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10002770
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
mov ecx, dword [esi + 0xc]
call fcn.10019110
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x1002efd1
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.10002650
cmp dword [ebp + 0x1c], 0
jne 0x1002f04d
mov byte [ebp - 0x20], 0x5f
mov al, 0xc
xor al, byte [ebp - 0x20]
mov cl, 0x36
xor cl, byte [ebp - 0x20]
mov dl, 0x3a
mov byte [ebp - 0x1f], al
mov ah, dl
mov byte [ebp - 0x1e], cl
mov ch, 0x7f
mov cl, byte [ebp - 0x20]
mov dh, 0x1c
mov byte [ebp - 0x11], 0x3e
xor ah, cl
mov al, byte [ebp - 0x11]
xor ch, cl
xor al, cl
mov byte [ebp - 0x12], 0x31
mov byte [ebp - 0x17], al
mov bl, 0x38
mov al, byte [ebp - 0x12]
mov bh, 0x33
xor al, cl
mov byte [ebp - 0x1b], ah
mov byte [ebp - 0x16], al
xor dl, cl
xor bl, cl
mov byte [ebp - 0x1a], ch
xor dh, cl
mov byte [ebp - 0x15], 0
xor bh, cl
mov byte [ebp - 0x1d], dl
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x1c], bl
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x19], dh
mov byte [ebp - 0x18], bh
mov byte [ebp - 0x15], 0
call fcn.10002870
mov byte [ebp - 4], 2
lea edx, [ebp - 0x48]
jmp 0x1002f0a1
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1009e4b0]
cmovae eax, dword [ebp + 0xc]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x64
nop dword [eax]
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x10
jb 0x1002f070
sub esp, 0x18
mov byte [ebp - 0x17], 0
lea eax, [ebp - 0x27]
mov ecx, esp
push eax
call fcn.10002870
lea eax, [ebp - 0x48]
push eax
call fcn.1000d830
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10019110
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x1002f0be
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.10002650
mov eax, dword [ebp + 0x20]
cmp eax, 0x10
jb 0x1002f0d3
inc eax
lea ecx, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.10002650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1002f330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088218
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x100a7078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ax, word [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0
mov word [esi + 0x28], ax
jne 0x1002f422
mov bh, 0x78
mov byte [ebp - 0x24], 0x19
mov byte [ebp - 0x12], bh
mov al, 0x70
xor al, byte [ebp - 0x24]
mov cl, 0x7c
mov byte [ebp - 0x11], 0x4a
mov bl, cl
mov bh, byte [ebp - 0x11]
mov dl, 0x7e
xor bh, byte [ebp - 0x24]
mov ah, 0x39
mov byte [ebp - 0x11], bh
mov ch, 0x5a
mov byte [ebp - 0x22], al
mov dh, 0x75
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x23], bh
xor cl, al
mov bh, byte [ebp - 0x12]
xor dl, al
xor bl, al
mov byte [ebp - 0x13], 0x77
xor ah, al
mov byte [ebp - 0x19], 0
xor ch, al
mov byte [ebp - 0x21], cl
xor dh, al
mov byte [ebp - 0x20], dl
xor bh, al
mov byte [ebp - 0x1f], bl
mov al, byte [ebp - 0x13]
xor al, byte [ebp - 0x24]
cmp byte [ebp - 0x11], 0
mov byte [ebp - 0x1e], ah
mov byte [ebp - 0x1d], ch
mov byte [ebp - 0x1c], dh
mov byte [ebp - 0x1b], bh
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x1002f3fa
xor ecx, ecx
jmp 0x1002f409
lea ecx, [ebp - 0x23]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002f400
sub ecx, edx
push ecx
lea eax, [ebp - 0x23]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002770
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
jmp 0x1002f4ab
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x1009e080]
cmovae eax, dword [ebp + 0xc]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 5
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x10
jb 0x1002f441
sub esp, 0x18
mov byte [ebp - 0x17], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x1002f46f
mov eax, dword [edx]
jmp 0x1002f471
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x27], 0
jne 0x1002f47e
xor ecx, ecx
jmp 0x1002f48d
lea ecx, [ebp - 0x27]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002f484
sub ecx, edi
push ecx
lea eax, [ebp - 0x27]
mov ecx, edx
push eax
call fcn.10002770
lea eax, [ebp - 0x40]
push eax
call fcn.1000d830
add esp, 0x20
mov byte [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10019110
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x1002f4c8
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10002650
mov eax, dword [ebp + 0x20]
cmp eax, 0x10
jb 0x1002f4dd
inc eax
lea ecx, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.10002650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1002fa70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
movaps xmm0, xmmword [0x1009e7f0]
push esi
mov esi, ecx
mov dword [esp + 0x2c], 0x7d674b71
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x30], 0x60756160
xor ecx, ecx
mov dword [esp + 0x34], 0x7a7b7d
mov al, byte [esp + 0x1c]
xor byte [esp + ecx + 0x1d], al
inc ecx
cmp ecx, 0x1a
jb 0x1002faa2
cmp byte [esp + 0x1d], 0
mov byte [esp + 0x37], 0
mov dword [esp + 0x18], 0xf
mov dword [esp + 0x14], 0
mov byte [esp + 4], 0
jne 0x1002fad5
xor ecx, ecx
jmp 0x1002fae9
lea ecx, [esp + 0x1d]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002fae0
sub ecx, edx
push ecx
lea eax, [esp + 0x21]
push eax
lea ecx, [esp + 0xc]
call fcn.10002770
mov ecx, dword [esi]
lea edx, [esp + 4]
call fcn.100186d0
mov dword [esi + 4], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x10
jb 0x1002fb1e
inc eax
lea ecx, [esp + 4]
push eax
push dword [esp + 8]
call fcn.10002650
mov esi, dword [esi]
test esi, esi
je 0x1002fb3b
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1002fb3b
push 0x14
mov ecx, esi
call dword [0x1009d364]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10033fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
movaps xmm0, xmmword [0x1009dbf0]
xor edx, edx
push esi
mov esi, ecx
movups xmmword [esp + 8], xmm0
nop word [eax + eax]
mov al, byte [esp + 8]
xor byte [esp + edx + 9], al
inc edx
cmp edx, 0xe
jb 0x10033fd0
cmp byte [esp + 9], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
jne 0x10034003
xor ecx, ecx
jmp 0x10034019
lea ecx, [esp + 9]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10034010
sub ecx, edx
push ecx
lea eax, [esp + 0xd]
push eax
lea ecx, [esp + 0x20]
call fcn.10002770
mov ecx, dword [esi]
lea edx, [esp + 0x18]
call fcn.100186d0
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0x10
jb 0x1003404e
inc eax
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x1c]
call fcn.10002650
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10036f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
movaps xmm0, xmmword [0x1009eb40]
xor edx, edx
push esi
mov esi, ecx
mov byte [esp + 0x14], 0
movups xmmword [esp + 4], xmm0
nop
mov al, byte [esp + 4]
xor byte [esp + edx + 5], al
inc edx
cmp edx, 0xf
jb 0x10036f40
cmp byte [esp + 5], 0
mov byte [esp + 0x14], 0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
jne 0x10036f73
xor ecx, ecx
jmp 0x10036f89
lea ecx, [esp + 5]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10036f80
sub ecx, edx
push ecx
lea eax, [esp + 9]
push eax
lea ecx, [esp + 0x20]
call fcn.10002770
mov ecx, dword [esi + 4]
lea edx, [esp + 0x18]
call fcn.100186d0
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0x10
jb 0x10036fbe
inc eax
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x1c]
call fcn.10002650
pop esi
mov esp, ebp
pop ebp
ret