joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411adb
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x411a34
cmp dword [eax + 0xc], ebx
je 0x411ad7
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0041148f
dec esi
inc esi
invalid
adc al, 0x8b
mov ebp, 0xffffff78
mov eax, dword [ebp - 0x44]
jmp 0x411a26
call fcn.0041148f
mov dword [ebx + ebp*2], edi
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x411b43
add eax, esi
cmp dword [eax], ebx
je 0x411b43
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x411b3e
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x411b28
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x411b30
cmp edx, ebx
jne 0x411c7e
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
enter 0x4d39, 8
jb 0x411aff
add eax, dword [eax + 4]
jmp 0x411aec
mov dword [ebp + 0xc], ebx
jmp 0x411b4e
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x411b66
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x411b84
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x411be2
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x411bc9
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x411bd2
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x411bdc
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x411bbe
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x411b48
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x411c2f
dec eax
je 0x411c26
sub eax, 3
je 0x411c1d
mov dword [ebp - 4], 0x40
jmp 0x411c4c
mov dword [ebp - 4], 4
jmp 0x411c32
mov dword [ebp - 4], 0x20
jmp 0x411c32
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x411c7e
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x411bfe
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0041148f
inc ebx
xlatb
test eax, 0x1475ff41
push 1
push esi
call edi
mov eax, esi
jmp 0x411c8a
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411b38
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x411a34
cmp dword [eax + 0xc], ebx
je 0x411ad7
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0041148f
dec esi
inc esi
invalid
adc al, 0x8b
mov ebp, 0xffffff78
mov eax, dword [ebp - 0x44]
jmp 0x411a26
call fcn.0041148f
mov dword [ebx + ebp*2], edi
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x411b43
add eax, esi
cmp dword [eax], ebx
je 0x411b43
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x411b3e
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x411b28
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x411b30
cmp edx, ebx
jne 0x411c7e
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
enter 0x4d39, 8
jb 0x411aff
add eax, dword [eax + 4]
jmp 0x411aec
mov dword [ebp + 0xc], ebx
jmp 0x411b4e
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x411b66
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x411b84
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x411be2
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x411bc9
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x411bd2
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x411bdc
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x411bbe
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x411b48
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x411c2f
dec eax
je 0x411c26
sub eax, 3
je 0x411c1d
mov dword [ebp - 4], 0x40
jmp 0x411c4c
mov dword [ebp - 4], 4
jmp 0x411c32
mov dword [ebp - 4], 0x20
jmp 0x411c32
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x411c7e
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x411bfe
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0041148f
inc ebx
xlatb
test eax, 0x1475ff41
push 1
push esi
call edi
mov eax, esi
jmp 0x411c8a
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41290a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0041148f
stc
pop ebx
test ecx, 0xf8d4858d
invalid

Function at 0x40897e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
call fcn.004089b3
mov ebx, 0x2978397d
sub ebx, 0xd23daf9b
xor dword [edx], esi
or ebx, ebx
sub eax, 0xc7f4d0b1
add edx, 1
sub eax, eax
cmp edx, ecx
jne fcn.0040897e
sub esp, 4
mov dword [esp], ebx
pop eax
or eax, eax
ret
Function at 0x401e30
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x210]
push esi
mov esi, dword [esp + 0x21c]
push edi
mov edi, dword [esp + 0x214]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x230]
mov word [esp + 0x20], cx
lea ecx, [esp + 0x20]
push ecx
push edx
push eax
mov dword [esp + 0x28], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test esi, esi
je 0x401e95
mov dword [esi], eax
test eax, eax
jne 0x401eac
push 0xffffffffffffffff
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const___int_]
add esp, 0xc
jmp 0x401ebf
mov ecx, dword [sym.imp.QtCore4.dll_struct_QString::Data_QString::shared_null]
mov dword [edi], ecx
mov edx, ecx
mov eax, 1
lock xadd dword [edx], eax
mov ecx, dword [esp + 0x20c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00402e06
add esp, 0x208
ret

Function at 0x401ee0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, 9
xor eax, eax
cmp cx, word [esp]
sete al
add esp, 0x24
ret

Function at 0x401f20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x403848
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ecx, ecx
mov edi, 0x7d0
xor ebp, ebp
mov eax, edi
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x18], ebp
neg ecx
or ecx, eax
push ecx
call fcn.00402df4
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push esi
push ebp
push ebp
push ebp
mov dword [esp + 0x38], ebp
mov ebp, dword [esp + 0x44]
xor eax, eax
mov dword [esp + 0x28], edi
push ebp
mov word [esi], ax
call ebx
cmp eax, 0xea
jne 0x401ff0
lea ecx, [ecx]
add edi, 0x1000
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x14], edi
neg ecx
or ecx, eax
push ecx
call fcn.00402df4
add esp, 4
cmp esi, eax
je 0x401fd8
push esi
mov esi, eax
mov dword [esp + 0x1c], esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
lea ecx, [esp + 0x14]
push ecx
xor eax, eax
push esi
push eax
push eax
push eax
push ebp
mov word [esi], ax
call ebx
cmp eax, 0xea
je 0x401fa0
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x401ffa
mov dword [ecx], eax
mov edi, dword [esp + 0x2c]
push 0xffffffffffffffff
push esi
push edi
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const___int_]
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 0x10
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x402330
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4038f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor edi, edi
xor ecx, ecx
mov dword [esp + 0x1c], edi
mov eax, 0x7d0
mov dword [esp + 0x14], eax
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x18], edi
neg ecx
or ecx, eax
push ecx
call fcn.00402df4
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov ebp, dword [esp + 0x34]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
push edi
lea edx, [esp + 0x24]
push edx
push esi
mov dword [esp + 0x40], edi
mov edi, dword [esp + 0x50]
push edi
xor eax, eax
push ebp
mov word [esi], ax
call ebx
cmp eax, 0xea
jne 0x402405
xor ecx, ecx
mov eax, 0x7fff
mov dword [esp + 0x14], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402df4
add esp, 4
cmp esi, eax
je 0x4023ee
push esi
mov esi, eax
mov dword [esp + 0x20], esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
xor eax, eax
push eax
push eax
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
push esi
push edi
push ebp
mov word [esi], ax
call ebx
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x40240f
mov dword [ecx], eax
mov eax, dword [esp + 0x40]
test eax, eax
je 0x40241d
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov edi, dword [esp + 0x30]
push 0xffffffffffffffff
push esi
push edi
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_unsigned_short_int_const___int_]
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 0x10
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x402e06
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x402e10
repz ret
jmp fcn.0040317e

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x100012e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
xorps xmm0, xmm0
mov esi, edx
mov edi, ecx
mov ecx, 0x20
lea eax, [esp + 0x20]
xor edx, edx
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
nop dword [eax + eax]
test dl, 1
jne 0x10001361
lea ebx, [eax + ecx]
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
xor ecx, ecx
test al, al
mov dl, 1
mov eax, ebx
jne 0x10001310
call sub.KERNEL32.dll_GetProcessHeap
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10001416
mov ebx, eax
mov dword [eax], reloc.XINPUT1_3.dll_Ordinal_4
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
jmp 0x100013f0
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x38], eax
mov dword [edi], edx
mov edx, dword [esp + 0x18]
mov dword [edi + 4], ebx
mov dword [edi + 8], esi
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0x1c]
mov dword [edi + 0xc], edx
mov edx, dword [esp + 0x14]
mov dword [edi + 0x10], edx
mov edx, dword [esp + 0x10]
mov dword [edi + 0x14], edx
mov edx, dword [esp + 0xc]
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
add eax, 0xffffff00
mov dword [edi + 0x40], 0
mov edx, esi
adc ecx, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov ecx, edi
call fcn.10004600
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 4
call fcn.100067d0
ud2
Function at 0x10005de0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
call sub.KERNEL32.dll_GetProcessHeap
push 0x400
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10006032
mov ecx, esp
mov edx, 0x400
mov dword [esp], eax
mov dword [esp + 4], 0x400
mov dword [esp + 8], 0
call fcn.10116f60
mov esi, dword [esp + 8]
mov eax, dword [esp]
add eax, esi
push 0x400
push 0x103651dc
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 0x400
cmp dword [0x10410764], 0
mov dword [esp + 8], esi
je 0x10005e62
mov esi, dword [0x10410760]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 8]
movq xmm0, qword [esp]
xor edx, edx
mov dword [esp], 0
test eax, eax
mov dword [0x10410768], eax
movq qword [0x10410760], xmm0
je 0x10005f2f
mov ecx, dword [0x10410760]
cmp eax, 0x20
jb 0x10005f39
lea esi, [eax - 1]
cmp esi, 4
mov esi, 0
jae 0x10005f40
movdqu xmm1, xmmword [esp]
mov esi, eax
lea edx, [ecx + 0x10]
pxor xmm0, xmm0
pxor xmm2, xmm2
and esi, 0xffffffe0
mov edi, esi
movdqu xmm4, xmmword [edx - 0x10]
movdqu xmm5, xmmword [edx]
add edx, 0x20
add edi, 0xffffffe0
pxor xmm1, xmm4
pxor xmm3, xmm5
pxor xmm0, xmm4
pxor xmm2, xmm5
jne 0x10005ec0
pxor xmm2, xmm0
movdqu xmmword [esp], xmm1
cmp eax, esi
movdqu xmmword [esp + 0x10], xmm3
pshufd xmm0, xmm2, 0x4e
pxor xmm0, xmm2
pshufd xmm1, xmm0, 0xe5
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
pxor xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
pxor xmm1, xmm0
movd edx, xmm1
jne 0x10005f40
mov al, byte [esp]
xor esi, esi
xor ecx, ecx
xor ebx, ebx
jmp 0x10005f6a
xor esi, esi
xor ecx, ecx
xor ebx, ebx
xor eax, eax
jmp 0x10005f6a
xor esi, esi
nop dword [eax + eax]
movzx ebx, byte [ecx + esi]
lea edi, [esi + 1]
and esi, 3
xor byte [esp + esi], bl
xor dl, bl
cmp eax, edi
mov esi, edi
jne 0x10005f40
mov cl, byte [esp + 2]
mov al, byte [esp]
mov bl, byte [esp + 1]
mov edi, ecx
mov cl, byte [esp + 3]
mov esi, ecx
mov ecx, edi
xor al, dl
xor bl, dl
xor cl, dl
mov byte [esp], al
mov eax, esi
mov byte [esp + 1], bl
mov byte [esp + 2], cl
xor al, dl
mov byte [esp + 3], al
mov edi, dword [esp]
call sub.KERNEL32.dll_GetProcessHeap
push 0x2800000
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10006043
mov esi, eax
push 0x2800000
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0xfd800000
mov ecx, edi
nop dword [eax]
mov edx, ecx
mov dword [esi + eax + 0x2800000], ecx
shl edx, 0xd
xor edx, ecx
mov ebx, edx
shr ebx, 0x11
xor ebx, edx
mov ecx, ebx
shl ecx, 5
xor ecx, ebx
add eax, 4
jne 0x10005fc0
test dword [0x10410774], 0x3fffffff
je 0x10006001
mov ebx, dword [0x10410770]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov dword [0x1041076c], 0xa00000
mov dword [0x10410770], esi
mov dword [0x10410774], 0xa00000
mov dword [0x10410778], 0xa00000
mov dword [0x1041077c], edi
add esp, 0xc
pop esi
pop edi
pop ebx
ret
mov ecx, 0x400
mov edx, 1
call fcn.100067d0
ud2
mov ecx, 0x2800000
mov edx, 4
call fcn.100067d0
ud2
Function at 0x1000cd20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov byte [esp + 0xc], 0x30
mov dword [esp + 8], 0x30303030
mov dword [esp + 4], 0x30303030
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
test edi, edi
mov esi, dword [ecx + 0x10]
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], esi
je 0x1000cdb8
mov ebx, dword [ebp + 0x10]
test esi, esi
mov ecx, 9
mov dword [esp + 0x34], edx
cmovne ecx, eax
xor esi, esi
nop dword [eax + eax]
cmp ecx, esi
je 0x1000cdbc
test ebx, ebx
je 0x1000cf28
cmp esi, 9
je 0x1000cf41
mov eax, edi
xor edx, edx
div ebx
add al, 0x30
mov edi, edx
mov edx, 0xcccccccd
mov byte [esp + esi + 4], al
mov eax, ebx
inc esi
mul edx
mov ebx, edx
shr ebx, 3
test edi, edi
jne 0x1000cd80
jmp 0x1000ce25
xor esi, esi
jmp 0x1000ce25
lea eax, [ebx + ebx*4]
cmp edi, eax
jb 0x1000ce23
test ecx, ecx
je 0x1000ce0e
lea edx, [ecx - 1]
mov al, 1
xor esi, esi
mov edi, 0x30
nop word [eax + eax]
movzx ebx, byte [esp + edx + 4]
movzx eax, al
mov bh, bl
inc bh
cmp bl, 0x39
movzx ebx, bh
cmovb eax, esi
cmovae ebx, edi
mov byte [esp + edx + 4], bl
add edx, 0xffffffff
setb bl
test al, 1
je 0x1000ce0a
test bl, bl
jne 0x1000cde0
test al, 1
je 0x1000ce23
mov eax, dword [esp + 0x34]
mov edx, dword [ebp + 8]
add eax, 1
adc edx, 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov esi, ecx
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov eax, 9
cmp edx, 9
cmovb eax, edx
test ecx, ecx
cmove eax, esi
test eax, eax
je 0x1000cecf
cmp eax, 0xa
jae 0x1000cf5a
test ecx, ecx
lea ecx, [esp + 4]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], eax
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x18]
cmove edx, esi
mov dword [esp + 0x44], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x48], fcn.1000cf70
mov dword [esp + 0x40], edx
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x50], 0x100093b0
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0x10008520
mov eax, dword [ecx + 0x18]
mov edx, dword [ecx + 0x1c]
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], 0x10367598
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0x103675a8
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 3
jmp 0x1000cf11
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], fcn.1000cf70
mov eax, dword [ecx + 0x18]
mov edx, dword [ecx + 0x1c]
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], 0x103c99f8
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 1
lea esi, [esp + 0x1c]
mov ecx, eax
push esi
call fcn.10009910
add esp, 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x10366f30
mov edx, 0x19
push 0x103675e8
call fcn.10008540
add esp, 4
ud2
mov ecx, 9
mov edx, 9
push 0x103675f8
call fcn.10008590
add esp, 4
ud2
mov ecx, eax
mov edx, 9
push 0x10367588
call fcn.10008b80
add esp, 4
ud2
Function at 0x1000f490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x7c0
mov dword [esp + 8], edx
mov dword [esp + 0x11c], ecx
movsd qword [esp + 0x120], xmm0
mov eax, dword [esp + 0x124]
mov edi, dword [esp + 0x120]
mov esi, eax
mov edx, eax
lea ebx, [edi + edi]
and esi, 0xfffff
shr edx, 0x14
mov ecx, esi
shld ecx, edi, 1
and dx, 0x7ff
mov dword [esp + 0xc], edx
lea edx, [esi + 0x100000]
cmovne ebx, edi
cmove edx, ecx
mov ecx, eax
and ecx, 0x7fffffff
or ecx, edi
call fcn.1000f4fb

Function at 0x10011480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x178
mov dword [esp + 0x154], ecx
lea ebx, [ecx + 0x40]
mov dword [esp + 0x128], ecx
call fcn.100114a5