joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003cdf
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x1003d1d
push 3
push 1
push 0x10
push eax
push 0xffffffffffffffff
push dword [0x1006304]
call fcn.01003bc2
add esp, 0x18
push 0x1006920
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebp
ret 4

Function at 0x100403f
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x10044e8
call fcn.010041f4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1006f60
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1003de7
cmp eax, esi
jne 0x1003dda
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1003dea
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003dc1
xor esi, esi
inc esi
mov eax, dword [0x1006f5c]
cmp eax, esi
jne 0x1003dfd
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003e2c
mov eax, dword [0x1006f5c]
test eax, eax
jne 0x1003e26
mov dword [0x1006f5c], esi
push 0x1001210
push 0x1001204
call fcn.01003d26
pop ecx
pop ecx
test eax, eax
je 0x1003e2c
jmp 0x1003f54
mov dword [0x1006350], esi
mov eax, dword [0x1006f5c]
cmp eax, esi
jne 0x1003e50
push 0x1001200
push 0x10011f8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006f5c], 2
test ebx, ebx
jne 0x1003e5c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006f64], 0
je 0x1003e80
push 0x1006f64
call fcn.0100416b
pop ecx
test eax, eax
je 0x1003e80
push 0
push 2
push 0
call dword [0x1006f64]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1003edc
test al, al
je 0x1003e9a
cmp dword [ebp - 0x1c], 0
jne 0x1003edc
mov al, byte [esi]
test al, al
je 0x1003eaa
cmp al, 0x20
ja 0x1003eaa
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1003e9a
test byte [ebp - 0x3c], 1
je 0x1003eb6
movzx eax, word [ebp - 0x38]
jmp 0x1003eb9
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x100634c], eax
cmp dword [0x1006340], 0
jne 0x1003f30
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1003eeb
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1003efe
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1003e87
cmp dword [0x1006350], 0
jne 0x1003f3f
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100634c]
jmp 0x1003f60
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01004239
ret
call fcn.0100433e
jmp 0x1003d87
Function at 0x10040e0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x10040f3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10040ef
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x1004120
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100415f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1004155
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1004161
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1004145
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1008660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x1008689
cmp ah, bh
mov esi, dword [edx + 0x24]
xchg al, ah
sub eax, eax
mov ah, bl
test al, bl
nop
mov edi, dword [edx + 0x1c]
jmp 0x1008709
ret
mov eax, dword [ebx + 0x3c]
jmp 0x100cd2c
pop ecx
and edi, 0x760856e5
mov edi, eax
add ecx, 1
lea edi, [edi]
and edi, 0x2cfae00d
dec edi
inc edi
xchg edi, edi
or edi, esi
nop
lodsd eax, dword [esi]
not ebp
not ebp
nop
cmp ecx, dword [edx + 0x18]
jmp 0x100cdd5
test ecx, 0xcbec9f9e
and al, ah
mov edx, 0x62fa83ce
sub ch, 3
aas
ret 4
and dh, al
xchg dl, dh
add esi, ebx
movzx eax, word [esi + ecx*2]
test dl, bh
add edi, ebx
not dl
cld
mov esi, dword [edi + eax*4]
lea ecx, [eax - 0xfad2c6d]
mov ch, 0x8b
dec ch
add esi, ebx
jmp 0x10086cd
lea edx, [edx]
xchg esp, ecx
xchg esp, ecx
movzx eax, byte [edi]
stc
sub dword [esp], eax
xor ah, 0
lea ecx, [ecx]
xor ch, dh
xor ch, dh
not bl
not bl
nop
not ah
not ah
sub edi, 0xffffffff
pop eax
jmp 0x1008895
nop
nop
mov esi, esi
test byte [edi], 0xff
nop
jne 0x10089dc
xor eax, 0xcd1199d2
lea eax, [eax]
not bh
not bh
sub eax, dword [esp + 4]
jmp 0x1008616
not edi
not edi
push eax
imul eax, eax, 0x10
nop
xchg dword [esp], eax
clc
sub dword [esp], eax
jmp 0x1008852
sbb edx, ecx
inc edi
mov ch, al
xchg cl, ch
wait
cld
sub edi, edi
xchg edi, ecx
not cl
cld
test edx, 0xb3ee3713
nop
xor dl, dh
mov dl, 0x5f
mov edx, ebx
mov edx, dword [eax + ebx + 0x78]
mov ch, 0x4f
or ah, 0xe8
xor eax, 0x40
lea edx, [edx + ebx]
mov esi, dword [edx + 0x20]
lea eax, [esi]
push 0xffffffffffffffff
lea esi, [ebx + esi]
jmp 0x1008680
lea edi, [eax + ebx]
not cl
not cl
je 0x100865f
mov eax, 0
jmp 0x10089d8
Function at 0xc1bba0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x651000]
push edi
jmp 0xc1bbba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc1bbc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc1bbb0
mov eax, 1
add ebx, ebx
jne 0xc1bbd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc1bbe4
jne 0xc1bc03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc1bc03
dec eax
add ebx, ebx
jne 0xc1bbf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xc1bbc8
add ebx, ebx
jne 0xc1bbff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xc1bc55
xor ecx, ecx
sub eax, 3
jb 0xc1bc1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc1bc8a
sar eax, 1
mov ebp, eax
jmp 0xc1bc26
add ebx, ebx
jne 0xc1bc26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc1bbf4
inc ecx
add ebx, ebx
jne 0xc1bc34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc1bbf4
add ebx, ebx
jne 0xc1bc41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc1bc36
jne 0xc1bc52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc1bc36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc1bc74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc1bc66
jmp 0xc1bbb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc1bc74
add edi, ecx
jmp 0xc1bbb6
pop esi
mov edi, esi
mov ecx, 0x8f41
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc1bc92
cmp byte [edi], 0x26
jne 0xc1bc92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc1bc97
lea edi, [esi + 0x810000]
mov eax, dword [edi]
or eax, eax
je 0xc1bd0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x81b820]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x81b9a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc1bcc4
mov ecx, edi
jns 0xc1bcf3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x81b9b0]
or eax, eax
je 0xc1bd09
mov dword [ebx], eax
add ebx, 4
jmp 0xc1bce1
call dword [esi + 0x81b9ac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xc1bd40
cmp al, 0xef
ja 0xc1bd33
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xc1bd15
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xc1bd22
mov ebp, dword [esi + 0x81b9b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc1bd74
sub esp, 0xffffff80
jmp 0x5070fa
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6a
nop
nop
sub eax, 0x403d10
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10007082
pop dword [ebp - 0x10]
mov eax, 0x8a165d30
add eax, 0x85ea1352
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3a2f9
push 0
mov eax, 0x8a40fc97
sub eax, 0x7a3fbc33
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x34a6fbe2
sub ecx, 0x34a6af42
xor edi, edi
add edi, eax
mov edx, 0x3eba0bdb
add edx, 0xd1477a25
add edx, dword [ebp - 0x10]
mov esi, 0xff3d0efe
xor dword [ebp - 0xc], 0x22285f28
mov ebx, dword [edx]
mov dword [ebp - 4], 0x3735bce5
add ebx, esi
mov dword [edi], ebx
xor dword [ebp - 4], 0xef2dabc6
add edi, 4
add edx, 0xc6e56c2d
sub edx, 0xc6e56c29
loop 0x100070dd
add eax, 0x82dfc8cd
sub eax, 0x82dea37a
mov ebx, eax
add eax, 0xd881c2d
add eax, 0xf277e3d8
mov ecx, 0x1244a2e3
add ecx, 0xfdbb5d1d
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100040c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov ecx, dword [ebp + 0x18]
and edi, 0x800fffff
invalid
Function at 0x100119a1
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
movzx ebx, byte [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
dec ebx
push edi
mov edi, dword [ebp + 0xc]
or ebx, 0xdfdfdfdf
shr edi, 2
lea edx, [eax + edi*4]
mov dword [ebp + 0x10], edx
test edi, edi
je 0x10011a35
mov ecx, edx
lea eax, [edi*4 + 0x20202020]
and ecx, 3
sub edx, eax
mov dword [ebp + 0x14], ecx
add edx, 2
jmp 0x100119e1
test ecx, ecx
jne 0x100119ea
mov eax, dword [edx - 2]
jmp 0x10011a0b
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 2]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 0x14]
and eax, ebx
add edx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xa
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
sub edi, 1
jne 0x100119e1
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, edi
and eax, 3
sub eax, 1
je 0x10011a5e
sub eax, 1
je 0x10011a55
sub eax, 1
jne 0x10011a76
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, edi
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xa
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret
Function at 0x10011aa1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x40
mov eax, dword [ebp + 8]
movaps xmm3, xmmword [0x1005d180]
movups xmm4, xmmword [edx]
push esi
movups xmm5, xmmword [edx + 0x10]
mov esi, dword [eax]
movups xmm6, xmmword [edx + 0x20]
push edi
movups xmm7, xmmword [edx + 0x30]
add edx, 0x40
cmp esi, 0xffffffff
jne 0x10011ad8
movaps xmm2, xmmword [0x1005d170]
jmp 0x10011b1b
xor edi, edi
mov ecx, 0x5b358fd3
test esi, esi
je 0x10011b00
mov eax, esi
sar eax, 0x1f
and eax, ecx
xor edi, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
add esi, esi
jne 0x10011ae3
xor eax, eax
movd xmm0, edi
xorps xmm2, xmm2
movd xmm1, eax
punpckldq xmm1, xmm0
punpckldq xmm2, xmm1
pclmulqdq xmm2, xmm3, 0x11
mov eax, dword [ebp + 0x10]
pxor xmm2, xmm7
test eax, eax
jle 0x10011b9a
lea edx, [edx + 0x40]
movaps xmm1, xmm4
movups xmm0, xmmword [edx - 0x40]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm4, xmm3, 0x20
pxor xmm4, xmm1
movaps xmm1, xmm5
pxor xmm4, xmm0
movups xmm0, xmmword [edx - 0x30]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm5, xmm3, 0x20
pxor xmm5, xmm1
movaps xmm1, xmm6
pxor xmm5, xmm0
movups xmm0, xmmword [edx - 0x20]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm6, xmm3, 0x20
pxor xmm6, xmm1
movaps xmm1, xmm2
pxor xmm6, xmm0
movups xmm0, xmmword [edx - 0x10]
pclmulqdq xmm2, xmm3, 0x20
pclmulqdq xmm1, xmm3, 0x11
pxor xmm2, xmm1
pxor xmm2, xmm0
sub eax, 1
jne 0x10011b26
xor eax, eax
xor edi, edi
movups xmmword [ebp - 0x40], xmm4
movups xmmword [ebp - 0x30], xmm5
movups xmmword [ebp - 0x20], xmm6
movups xmmword [ebp - 0x10], xmm2
lea ecx, [ecx + 0x20]
xor eax, dword [ebp + edi*4 - 0x40]
inc edi
movzx ecx, al
shr eax, 8
mov esi, dword [ecx*4 + 0x1005bd70]
movzx ecx, al
shr eax, 8
mov edx, eax
shr edx, 8
xor esi, dword [ecx*4 + 0x1005b970]
movzx ecx, al
mov eax, dword [edx*4 + 0x1005b170]
xor eax, dword [ecx*4 + 0x1005b570]
xor eax, esi
cmp edi, 0x10
jl 0x10011bb1
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10011c01
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [ecx]
push edi
mov edi, dword [ebp + 0x14]
cmp esi, 7
jle 0x30213cc1
test bl, 3
je 0x10011c39
movzx edx, byte [ebx]
dec esi
movzx ecx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edi + edx*4]
test bl, 3
jne 0x10011c24
mov ecx, esi
and ecx, 0xfffffff8
add ebx, ecx
sub esi, ecx
neg ecx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ecx
je 0x10011cbe
mov esi, ecx
xor eax, dword [esi + ebx]
movzx ecx, al
shr eax, 8
mov edx, dword [edi + ecx*4 + 0x20200c20]
movzx ecx, al
shr eax, 8
xor edx, dword [edi + ecx*4 + 0x20200820]
movzx ecx, al
shr eax, 8
mov ebx, dword [edi + ecx*4 + 0x20200420]
xor ebx, dword [edi + eax*4]
mov eax, dword [ebp + 0xc]
xor ebx, dword [esi + eax + 4]
xor ebx, edx
movzx eax, bl
shr ebx, 8
mov ecx, dword [edi + eax*4 + 0x20200c20]
movzx eax, bl
shr ebx, 8
xor ecx, dword [edi + eax*4 + 0x20200820]
movzx eax, bl
shr ebx, 8
mov eax, dword [edi + eax*4 + 0x20200420]
xor eax, dword [edi + ebx*4]
mov ebx, dword [ebp + 0xc]
xor eax, ecx
add esi, 8
jne 0x10011c51
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
test esi, esi
jle 0x10011cde
movzx edx, byte [ebx]
lea ebx, [ebx + 1]
movzx ecx, al
dec esi
xor edx, ecx
shr eax, 8
xor eax, dword [edi + edx*4]
test esi, esi
jg 0x10011cc5
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e921
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005423d
mov eax, dword fs:[0x20202020]
push eax
mov dword fs:[0x20202020], esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1200193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1200193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1200193
xor ecx, eax
imul eax, ecx, 0x1200193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.1001ddd1
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x1001e9a9
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[edx], ecx
and byte [eax], ah
and byte [eax], ah
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2008
cmp dword [edi + 8], 0x9249249
je 0x3021ead7
lea eax, [edi + 4]
mov dword [ebp - 0x1c], 0x20202020
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0x20202020
push 0x1c
mov dword [ebp - 0x1c], 0x20202020
call 0x300325d1
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [esi + 8], ecx
xor ecx, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov dword [ebp - 4], 0x20202001
mov ecx, dword [edi + 8]
fld dword [edi]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
lea edx, [ecx + 1]
mov dword [ebp - 0x10], edx
fild dword [ebp - 0x10]
test edx, edx
jns 0x1001ea1e
fadd dword [0x1005af88]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
mov eax, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test eax, eax
jns 0x1001ea34
fadd dword [0x1005af88]
fstp dword [ebp - 0x10]
fdiv dword [ebp - 0x10]
fcompi st(1)
fstp st(0)
ja 0x1001ea45
mov edx, dword [ebp - 0x28]
jmp 0x1001ea6c
push edx
mov ecx, edi
call 0x302237a1
push eax
mov ecx, edi
call 0x30223831
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1001ddd1
mov ecx, dword [edi + 8]
mov edx, dword [eax]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0x20202020
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x1001eaa1
mov dword [ecx + eax*8], esi
jmp 0x1001eab0
cmp edi, edx
jne 0x1001eaaa
mov dword [ecx + eax*8], esi
jmp 0x1001eab4
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1001eab4
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[edx], ecx
and byte [eax], ah
and byte [eax], ah
pop ebx
mov esp, ebp
pop ebp
ret 0x2008
Function at 0x10020991
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0x20
push ebx
push esi
push edi
lea esi, [ecx + 0x20200414]
mov dword [ebp - 0xc], 0x20202020
mov dword [ebp - 0x10], 0x20202020
je 0x30222a91
mov dword [ebp - 8], 0x20202020
mov dword [ebp - 4], 0x20202020
mov eax, dword [esi]
xor edx, edx
shl eax, 0x10
shr eax, 0xa
mov dword [ebp - 0x14], eax
mov eax, 0x20012020
div dword [esi - 4]
mov edi, dword [esi + 0x1c]
xor edx, edx
mov ebx, eax
mov ecx, dword [esi + 0x1c]
mov eax, 0x20012020
imul ebx, dword [esi]
div dword [esi - 4]
push 0x20
push dword [ebp - 0x14]
imul eax, dword [esi]
push ebx
push edi
sub eax, ecx
push eax
push 0x20
push dword [esi - 4]
push dword [ebp - 4]
push 0x1005f7b0
push dword [ebp + 8]
call fcn.10012ab1
mov eax, dword [esi]
lea esi, [esi + 0x38]
mov edi, dword [ebp - 8]
xor edx, edx
shl eax, 0x10
add esp, 0x28
add edi, eax
mov ecx, dword [esi - 0x1c]
mov eax, 0x20012020
mov ebx, dword [ebp - 0xc]
div dword [esi - 0x3c]
xor edx, edx
mov dword [ebp - 8], edi
imul eax, dword [esi - 0x38]
sub eax, ecx
mov ecx, dword [esi - 0x1c]
imul eax, dword [esi - 0x3c]
add ebx, eax
mov eax, 0x20012020
div dword [esi - 0x3c]
mov dword [ebp - 0xc], ebx
imul eax, dword [esi - 0x38]
sub eax, ecx
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
cmp eax, 0x26
jl 0x100209c6
shr ebx, 0xa
push ebx
shr edi, 0xa
push edi
push ecx
push 0x1005f804
push dword [ebp + 8]
call fcn.10012ab1
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2004
Function at 0x10020b91
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0x20
push ebx
push esi
push edi
lea esi, [ecx + 0x20204014]
mov dword [ebp - 0xc], 0x20202020
mov dword [ebp - 0x10], 0x20202020
je 0x30222c91
mov dword [ebp - 8], 0x20202020
mov dword [ebp - 4], 0x20202020
mov eax, dword [esi]
xor edx, edx
shl eax, 0x10
shr eax, 0xa
mov dword [ebp - 0x14], eax
mov eax, 0x20012020
div dword [esi - 4]
mov edi, dword [esi + 0x1c]
xor edx, edx
mov ebx, eax
mov ecx, dword [esi + 0x1c]
mov eax, 0x20012020
imul ebx, dword [esi]
div dword [esi - 4]
push 0x20
push dword [ebp - 0x14]
imul eax, dword [esi]
push ebx
push edi
sub eax, ecx
push eax
push 0x20
push dword [esi - 4]
push dword [ebp - 4]
push 0x1005f7b0
push dword [ebp + 8]
call fcn.10010ab1
mov eax, dword [esi]
lea esi, [esi + 0x38]
mov edi, dword [ebp - 8]
xor edx, edx
shl eax, 0x10
add esp, 0x28
add edi, eax
mov ecx, dword [esi - 0x1c]
mov eax, 0x20012020
mov ebx, dword [ebp - 0xc]
div dword [esi - 0x3c]
xor edx, edx
mov dword [ebp - 8], edi
imul eax, dword [esi - 0x38]
sub eax, ecx
mov ecx, dword [esi - 0x1c]
imul eax, dword [esi - 0x3c]
add ebx, eax
mov eax, 0x20012020
div dword [esi - 0x3c]
mov dword [ebp - 0xc], ebx
imul eax, dword [esi - 0x38]
sub eax, ecx
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
cmp eax, 0x3a
jl 0x10020bc6
shr ebx, 0xa
push ebx
shr edi, 0xa
push edi
push ecx
push 0x1005f804
push dword [ebp + 8]
call fcn.10010ab1
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2004