joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afed4
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.004b3348
xor al, 1
je 0x4aff0f
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00449b40
push eax
mov eax, ebx
call fcn.0040962c
lea eax, [esp + 8]
call fcn.00449dbc
lea eax, [esp + 8]
call fcn.004b3348
xor al, 1
jne 0x4afee4
pop ebx
ret 8

Function at 0x4b089c
Capabilities:
Resume thread

Disassembly:
sub esp, 0x38
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
mov dword [esp], 8
call fcn.004b8988
mov ecx, eax
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
mov edx, dword [esp + 0x28]
mov dword [ecx + 4], edx
mov dword [esp + 0x2c], 0
cmp byte [0x50efc8], 0
jne 0x4b0920
lea ebx, [esp + 0x2c]
mov esi, 0x4b0a18
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call fcn.004bc72c
test eax, eax
mov dword [esp + 0x34], eax
jne 0x4b0934
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x38
xor eax, eax
ret 0x14
mov edx, 0x50efac
push edx
call sub.KERNEL32.DLL_EnterCriticalSection
inc dword [0x50ef98]
mov eax, dword [0x50ef98]
lea ecx, [eax + eax*2]
lea ecx, [ecx*4]
mov dword [esp + 4], ecx
mov ebx, dword [0x50ef9c]
mov dword [esp], ebx
call fcn.004b920c
mov dword [0x50ef9c], eax
mov edx, dword [0x50ef98]
lea edi, [edx + edx*2]
lea edi, [edi*4]
add edi, eax
mov esi, dword [esp + 0x2c]
mov dword [edi - 0xc], esi
mov ecx, dword [0x50ef98]
lea ebx, [ecx + ecx*2]
lea ebx, [ebx*4]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
add ebx, dword [0x50ef9c]
mov dword [ebx - 8], eax
mov dword [ebx - 4], edx
push dword [esp + 0x34]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x4b09d5
mov edx, 0x5021f0
mov esi, 0x15
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.0049b348
push dword [esp + 0x34]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp + 0x40]
or eax, dword [esp + 0x3c]
je 0x4b09ed
call fcn.004b4ac0
mov ecx, dword [esp + 0x2c]
mov ebx, 0x50efac
mov dword [esp + 0x30], ecx
push ebx
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x38
ret 0x14

Function at 0x4b1ff8
Capabilities:
Terminate thread

Disassembly:
push eax
push eax
mov dword [esp], ebx
push dword [esp + 4]
push 0
push 0x10004a
call sub.KERNEL32.DLL_OpenThread
mov ebx, eax
test eax, eax
jne 0x4b201a
mov ebx, dword [esp]
add esp, 8
ret
cmp byte [0x50efc8], 0
je 0x4b2035
push 1
push ebx
call sub.KERNEL32.DLL_TerminateThread
push 0xa
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
jmp 0x4b203d
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov ebx, dword [esp]
add esp, 8
ret
Function at 0x4b2ddc
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.004a42e0
xor al, 1
je 0x4b2e13
lea eax, [esp + 8]
call fcn.004a4344
push eax
mov eax, ebx
call fcn.00412030
lea eax, [esp + 8]
call fcn.004a4304
lea eax, [esp + 8]
call fcn.004a42e0
xor al, 1
jne 0x4b2dec
pop ebx
ret 0x1c
Function at 0x4b4f60
Capabilities:
Resume thread

Disassembly:
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], esi
mov ecx, dword [edi + 0xc]
push ecx
call sub.KERNEL32.DLL_GetCurrentThreadId
pop ecx
cmp ecx, eax
je 0x4b4fbf
push dword [edi + 8]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x4b4fbf
mov eax, edi
call fcn.0049210c
xor al, 1
je 0x4b4fb2
mov eax, edi
call fcn.00492390
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x10
ret
mov edx, 0x509fb0
push edx
push 0x17
call fcn.0049b348
movsx ebx, byte [edi + 0x4c]
xor bl, 1
je 0x4b4fd0
mov esi, dword [edi + 0x48]
mov ecx, dword [esi]
mov dword [esi + 4], ecx
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0xc]
mov ecx, 8
xor eax, eax
add edi, 0x54
rep stosd dword es:[edi], eax
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x10
ret
Function at 0x4b6304
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.0048ce60
xor al, 1
je 0x4b632b
inc ebx
lea eax, [esp + 8]
call fcn.0048ce7c
lea eax, [esp + 8]
call fcn.0048ce60
xor al, 1
jne 0x4b6314
mov eax, ebx
pop ebx
ret 0x44
Function at 0x4b6e34
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.0048ce60
xor al, 1
je 0x4b6e6b
lea eax, [esp + 8]
call fcn.0048ce70
push eax
mov eax, ebx
call fcn.00412030
lea eax, [esp + 8]
call fcn.0048ce7c
lea eax, [esp + 8]
call fcn.0048ce60
xor al, 1
jne 0x4b6e44
pop ebx
ret 0x44

Function at 0x4b8e10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x50a2d4
push 0x4bd8e4
push edx
mov dword fs:[0], esp
sub esp, 8
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
jmp 0x4b8e5e
call fcn.004bde20
mov eax, esp
mov dword [0x510744], eax
call fcn.004bdf78
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x51074c], eax
call fcn.004bd89c
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x510748], eax
call fcn.004b8c0c
call fcn.004bde60
call fcn.004bdb2c
call fcn.004bb670
push 0
push dword [0x50b1b0]
push dword [0x50acf9]
push dword [0x50acf5]
call fcn.00407370
add esp, 0x10
push eax
call fcn.004bba48
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bc39c
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
je 0x4bc3f9
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x4bc3f9
lea ecx, [edi + 1]
push ecx
call fcn.004b8988
add esp, 4
mov ebx, eax
test eax, eax
je 0x4bc3f9
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
jne 0x4bc3e6
push ebx
call fcn.004b86e8
xor ebx, ebx
add esp, 4
jmp 0x4bc3f9
push ebx
push esi
call fcn.004c0ed4
add esp, 4
push eax
call fcn.004bc2ac
add esp, 8
pop edi
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4bc72c
Capabilities:
Create thread
Resume thread

Disassembly:
push eax
push eax
push ebx
push esi
push edi
mov dword [0x50b99c], 1
push 0x50b9a4
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
xor ebx, ebx
mov eax, dword [0x510740]
cmp dword [eax + ebx*4], 0
je 0x4bc75c
inc ebx
cmp ebx, 0x400
jb 0x4bc748
cmp ebx, 0x400
jne 0x4bc772
push 0xb
call fcn.004bd8b8
xor ebx, ebx
jmp 0x4bc80b
push 1
push 0x2a8
call fcn.004ba190
add esp, 8
mov esi, eax
test eax, eax
jne 0x4bc792
push 0xc
call fcn.004bd8b8
xor ebx, ebx
jmp 0x4bc80b
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x28]
or edx, 4
push ecx
push edx
push dword [esp + 0x2c]
push 0x4bc820
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test eax, eax
jne 0x4bc7d1
push esi
call fcn.004b86e8
call fcn.004c016c
xor ebx, ebx
add esp, 4
jmp 0x4bc80b
test dword [esp + 0x28], 4
mov ecx, dword [0x510740]
mov dword [ecx + ebx*4], esi
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0x1c], edi
jne 0x4bc809
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ebx, edi
push 0x50b9a4
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4c0210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0x3c
jae 0x4c025a
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x4c0256
test byte [ebx + 0x50a2e0], 0x10
jne 0x4c026b
mov edx, dword [ebp + 0xc]
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x50a31c]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x4c025a
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x4c0251
push 9
call fcn.004bd8b8
mov eax, 0xffffffff
jmp 0x4c0251
push esi
push edi
mov edi, dword [ebp + 0xc]
and byte [ebx + 0x50a2e0], 0xfe
cld
push ds
pop es
mov edx, edi
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x50a31c]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x4c0349
mov eax, dword [ebp - 8]
add edx, eax
cmp eax, ecx
je 0x4c02ae
or byte [ebx + 0x50a2e0], 1
mov ecx, eax
or ecx, ecx
je 0x4c03f0
push edi
mov al, 0x1a
repne scasb al, byte es:[edi]
je 0x4c0318
pop edi
mov ecx, edx
sub ecx, edi
mov al, 0xd
xor esi, esi
repne scasb al, byte es:[edi]
jne 0x4c03f0
cmp edi, edx
jae 0x4c035d
cmp byte [edi], 0xa
jne 0x4c02c6
mov esi, edi
mov dword [ebp - 4], edi
dec dword [ebp - 4]
mov ecx, edx
sub ecx, edi
mov al, 0xd
repne scasb al, byte es:[edi]
jne 0x4c03ba
cmp edi, edx
jae 0x4c035d
cmp byte [edi], 0xa
jne 0x4c02e9
mov ecx, edi
dec ecx
sub ecx, esi
mov eax, edi
mov edi, dword [ebp - 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], edi
mov edi, eax
inc esi
jmp 0x4c02e3
dec edi
test byte [ebx + 0x50a2e0], 8
jne 0x4c033b
sub edx, edi
push 1
push 0
push edx
push dword [ebx*4 + 0x50a31c]
call sub.KERNEL32.DLL_SetFilePointer
cmp ax, 0xffff
je 0x4c0349
or byte [ebx + 0x50a2e0], 1
mov edx, edi
jmp 0x4c02bd
push 9
call fcn.004bd8b8
mov eax, 0xffffffff
jmp 0x4c03f5
test byte [ebx + 0x50a2e0], 1
jne 0x4c03ba
dec edx
mov ecx, 1
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x50a31c]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x4c0349
mov eax, dword [ebp - 8]
or eax, eax
je 0x4c03b3
cmp byte [edi - 1], 0xa
je 0x4c03ba
mov byte [edi - 1], 0xd
push 1
push 0
push 0xffffffffffffffff
push dword [ebx*4 + 0x50a31c]
call sub.KERNEL32.DLL_SetFilePointer
cmp ax, 0xffff
je 0x4c0349
jmp 0x4c03ba
or byte [ebx + 0x50a2e0], 1
cmp esi, 0
je 0x4c03f0
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebx + 0x50a2e0], 8
jne 0x4c03f0
mov ecx, esi
sub ecx, edi
je 0x4c03f0
test byte [ebx + 0x50a2e0], 1
je 0x4c027a
mov eax, edi
sub eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4269d9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426a18
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426a18
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426a18
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426a18
cmp dword [ecx + 0x74], 0xe
jbe 0x426a18
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438dc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438ded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438ded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001226
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
mov dword [0x100c6938], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x100c6934], ebx
push edi
push ebx
mov dword [0x100c6930], eax
mov dword [0x100c693c], ebx
mov dword [0x100c6940], eax
mov dword [0x100c6944], ebx
mov dword [0x100c6948], ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov esi, eax
mov dword [0x100c695c], edx
mov eax, 0x55555555
mov dword [0x100c6958], esi
xor edi, edi
mov dword [0x100c7cd8], eax
pop ecx
mov dword [0x100c7cdc], eax
inc edi
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, esi
push eax
push ecx
call fcn.10045230
mov esi, eax
mov eax, 0x138
add esi, edi
mov dword [edi*8 + 0x100c6958], esi
adc edx, ebx
mov dword [edi*8 + 0x100c695c], edx
inc edi
cmp edi, eax
jb 0x10001284
movaps xmm0, xmmword [0x1004cb30]
pop edi
pop esi
mov dword [0x100c6950], eax
mov eax, 0x100c6930
movups xmmword [0x100c7ce0], xmm0
pop ebx
ret 0x10

Function at 0x100012dc
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 4], 0
je 0x100012fa
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 3
jb 0x100012e7
pop ebx
mov byte [edx + 4], 0
mov eax, edx
ret

Function at 0x100012fd
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 6], 0
je 0x1000131b
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 5
jb 0x10001308
pop ebx
mov byte [edx + 6], 0
mov eax, edx
ret

Function at 0x1000131e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 5], 0
je 0x1000133c
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 4
jb 0x10001329
pop ebx
mov byte [edx + 5], 0
mov eax, edx
ret

Function at 0x1000133f
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 8], 0
je 0x1000135d
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 7
jb 0x1000134a
pop ebx
mov byte [edx + 8], 0
mov eax, edx
ret

Function at 0x10001360
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xe], 0
je 0x1000137e
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x1000136b
pop ebx
mov byte [edx + 0xe], 0
mov eax, edx
ret

Function at 0x10001381
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 7], 0
je 0x1000139f
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 6
jb 0x1000138c
pop ebx
mov byte [edx + 7], 0
mov eax, edx
ret

Function at 0x100013a2
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x12], 0
je 0x100013c0
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x100013ad
pop ebx
mov byte [edx + 0x12], 0
mov eax, edx
ret
Function at 0x100013c3
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x16], 0
je 0x100013e1
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x15
jb 0x100013ce
pop ebx
mov byte [edx + 0x16], 0
mov eax, edx
ret

Function at 0x100013e4
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 3], 0
je 0x10001402
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 2
jb 0x100013ef
pop ebx
mov byte [edx + 3], 0
mov eax, edx
ret

Function at 0x10001405
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 9], 0
je 0x10001423
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7e]
xor byte [ecx], al
inc ebx
cmp ebx, 8
jb 0x10001410
pop ebx
mov byte [edx + 9], 0
mov eax, edx
ret

Function at 0x10001426
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x10001443
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7e]
xor byte [ecx], al
inc edx
cmp edx, 8
jb 0x10001431
mov byte [esi + 9], 0
pop esi
ret

Function at 0x10001445
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x10001462
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7e]
xor byte [ecx], al
inc edx
cmp edx, 0x15
jb 0x10001450
mov byte [esi + 0x16], 0
pop esi
ret

Function at 0x10001464
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x10001481
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7e]
xor byte [ecx], al
inc edx
cmp edx, 0x11
jb 0x1000146f
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x10001483
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x100014a0
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7e]
xor byte [ecx], al
inc edx
cmp edx, 6
jb 0x1000148e
mov byte [esi + 7], 0
pop esi
ret

Function at 0x100014a2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x100014bf
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7e]
xor byte [ecx], al
inc edx
cmp edx, 0xd
jb 0x100014ad
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x100014c1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x100014de
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7e]
xor byte [ecx], al
inc edx
cmp edx, 7
jb 0x100014cc
mov byte [esi + 8], 0
pop esi
ret

Function at 0x100014e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x100014fd
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7e]
xor byte [ecx], al
inc edx
cmp edx, 4
jb 0x100014eb
mov byte [esi + 5], 0
pop esi
ret

Function at 0x100014ff
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x1000151c
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7e]
xor byte [ecx], al
inc edx
cmp edx, 5
jb 0x1000150a
mov byte [esi + 6], 0
pop esi
ret
Function at 0x1000151e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xc], 0
je 0x1000153c
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xb
jb 0x10001529
pop ebx
mov byte [edx + 0xc], 0
mov eax, edx
ret

Function at 0x1000153f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x1000155c
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0xb
jb 0x1000154a
mov byte [esi + 0xc], 0
pop esi
ret

Function at 0x1000155e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xd], 0
je 0x1000157c
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x10001569
pop ebx
mov byte [edx + 0xd], 0
mov eax, edx
ret

Function at 0x1000157f
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xa], 0
je 0x1000159d
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx + 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 9
jb 0x1000158a
pop ebx
mov byte [edx + 0xa], 0
mov eax, edx
ret

Function at 0x100015a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x100015bd
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x19
jb 0x100015ab
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x100015bf
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x100015dc
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 9
jb 0x100015ca
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x100015de
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x100015fb
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx + 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0xc
jb 0x100015e9
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x1000312f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1000313d
pop esi
mov eax, edx
pop ebp
ret 4

Function at 0x10003156
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ecx + 0x14], 0xf
mov edi, dword [ecx + 0x10]
jbe 0x10003169
mov ecx, dword [ecx]
xor esi, esi
mov edx, 0x811c9dc5
test edi, edi
je 0x10003185
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x10003174
pop edi
mov eax, edx
pop esi
pop ebp
ret 4
Function at 0x10003631
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x1000368a
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp - 4]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003662
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x10003689
lea eax, [ebp - 4]
mov esi, 0xf8
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003689
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
pop edi
pop esi
leave
ret

Function at 0x1000368d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x100036c7
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100036cb
cmp edx, esi
jne 0x100036b0
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x100036eb
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100036ef
cmp edx, esi
jne 0x100036d4
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1000370f
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003713
cmp edx, esi
jne 0x100036f8
popfd
popal
pop edi
pop esi
pop ebx
leave
ret