joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10443c71
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dx
mov word [esp + 0x1e], di
stc
mov edx, eax
lea esp, [esp + 0x10]
jmp 0x10443c0d
xchg dx, ax
lea eax, [esi*4]
mov dl, al
lea esi, reloc.MSVCRT.dll_strncpy
add esp, 0x15
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x10443b8e
mov si, word [esp + 0xd]
rdtsc
xchg word [esp + 4], ax
push di
lea eax, [eax + ebp]
rdtsc
jmp 0x10443ba4
mov ax, 0xc7ee
cmp si, sp
push dx
bsf dx, sp
lea eax, [ecx + ebx]
jmp 0x10443c3a
lea esp, [esp + 0x52]
xchg esi, eax
rdtsc
mov dl, 0x78
not ah
setne ah
jmp 0x10443bdf
bswap edx
mov word [esp + 4], dx
push dword [esp + 4]
sub esp, 0x1c
push dword [esp + 0xe]
sub esp, 0x1a
jmp 0x10443bf5
mov edx, eax
mov dword [esp], ebp
bt ax, cx
cld
mov edx, edi
jmp 0x10443c4d
mov esi, ecx
push word [esp + 1]
lea esp, [esp]
mov dh, bl
xchg dword [esp], eax
dec ah
jmp 0x10443c24
mov dx, 0x5f47
bswap eax
cmc
add esp, 3
rcl al, 5
cld
jmp 0x10443c9d
btc dx, dx
jmp 0x10443bca
lea esi, [eax + edi]
and esi, 0xbe264a48
neg dl
xchg byte [esp], al
lea edx, [edx + ebx]
btr ax, ax
jmp 0x10443cca
xchg edx, esi
rdtsc
setp dh
rdtsc
rdtsc
or ah, 0x96
jmp 0x10443c7a
mov dx, word [esp]
neg eax
dec esi
not si
not eax
btr eax, edx
jmp 0x10443cdb
mov esi, dword [esp]
lea eax, [eax + edx]
inc si
bsr si, cx
cld
bswap esi
jmp 0x10443cad
bt edx, eax
xchg byte [esp], dl
mov dx, word [esp]
lea esp, [esp]
mov eax, dword [esp]
bswap esi
jmp 0x10443d85
bswap esi
mov ax, word [esp]
bswap eax
xchg byte [esp], ah
call fcn.10443d30

Function at 0x10443ed4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10443f17
push di
rdtsc
inc dx
xchg edx, esi
push word [esp + 7]
mov dl, dh
jmp 0x10443f58
pop dx
add si, 0x7c6f
lea esp, [esp + 1]
lea edx, [esi + edi]
setbe ah
cmc
jmp 0x10443f01
bt eax, eax
shr esi, cl
mov byte [esp + 2], ah
mov esi, ecx
setns al
neg al
jmp 0x10443fb1
mov si, dx
pop word [esp + 5]
bsf eax, esp
std
rdtsc
lea edx, [edi*4]
jmp 0x10443f42
pop word [esp + 2]
mov dl, ch
push word [esp + 5]
jmp 0x104441c3
push dword [esp + 4]
sub esp, 0x1d
mov al, byte [esp + 0xa]
xchg word [esp + 0x10], dx
mov dl, 0xda
jmp 0x10443f9b
seto dh
std
mov dword [esp + 0xb], edi
cmc
bts si, sp
call fcn.10444016
setbe byte [ecx]
shl byte [esi + 0x2b], 0xf0
sub si, ax
xor ax, bp
lea esi, reloc.MSVCRT.dll_strncpy
btr edx, ecx
lea esp, [esp + 0x1a]
shr esi, 0
jmp 0x10443fd2
sub esp, 4
mov esi, dword [esp + 0x18]
mov word [esp + 0x12], cx
stc
xchg edx, eax
push word [esp + 0x20]
jmp 0x10443fe8
mov esi, 0x2f39ab00
setp al
lea esp, [esp + 0x10]
btc ax, sp
dec ax
mov edx, dword [esp + 0x26]
jmp 0x104440eb
mov si, word [esp + 2]
push word [esp + 0xd]
mov ax, cx
sub esp, 7
push dword [esp + 0x15]
push word [esp + 8]
jmp 0x1044413c
Function at 0x10443fcd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, bx
mov byte [esp + 3], al
inc eax
setp dh
pop edx
btr si, bp
jmp 0x10443e66
lea edx, reloc.MSVCRT.dll_strncpy
cld
setno dh
lea edx, [ecx + esi]
neg ax
push word [esp + 1]
jmp 0x10443e1b
clc
lea esi, [eax*4]
lea esp, [esp + 2]
add esp, 0
mov eax, ebx
dec dl
jmp 0x10443e72
xchg al, dh
inc ax
std
dec eax
inc al
rdtsc
jmp 0x10443e49
mov al, dl
mov si, dx
bswap esi
rol edx, 1
dec ax
lea esi, [ebp*4]
jmp 0x10443f84
lea esp, [esp]
pop word [esp]
sub esp, 2
mov ah, al
mov esi, 0x91d7e67f
xchg dx, ax
jmp 0x10443e32
lea esi, reloc.MSVCRT.dll_strncpy
cld
add esp, 0
add ah, cl
lea esp, [esp]
jmp 0x10443f32
mov dx, cx
rdtsc
setl al
lea esi, [edx + edi]
add esp, 0
mov byte [esp], ch
jmp 0x10443eab
stc
push word [esp + 2]
push si
bsf edx, esi
pop word [esp]
mov dword [esp], edx
call fcn.10443ed4
mov byte [esp], ch
push ebp
xchg dl, ah
mov al, 0xf8
xchg dword [esp], edx
mov dword [esp], ecx
jmp 0x10443eea
mov si, word [esp]
btc esi, ecx
mov dl, byte [esp]
lea esp, [esp]
lea esp, [esp]
mov al, dh
jmp 0x10443ec1
jmp 0x10443e96

Function at 0x10444119
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x1e], ax
inc esi
mov dh, ah
mov al, 0xdb
mov edx, dword [esp + 0x1f]
jmp 0x1044416a
mov eax, dword [esp + 0x22]
mov ax, word [esp + 0x12]
mov dword [esp + 0x13], esp
xchg edx, eax
jmp 0x10444103
inc edx
lea edx, [ecx + edx]
rcl dx, 9
setbe dl
jmp 0x10444196
mov dl, byte [esp + 7]
rcr dh, 1
bt edx, esi
pop dword [esp + 0xc]
not dx
pop dword [esp + 0x18]
jmp 0x10444154
xchg ah, al
push word [esp + 1]
add esp, 7
push dword [esp + 0xe]
jmp 0x1044446a
lea esi, [ebp*4]
mov eax, 0xcad146fc
neg ax
setnp dl
push dword [esp + 0xb]
pop eax
jmp 0x10444180
xchg word [esp], si
lea esp, [esp + 6]
xchg word [esp + 6], si
mov word [esp + 0xc], bp
mov dl, 0x79
pop eax
jmp 0x1044420a
pop word [esp + 0x14]
xchg word [esp + 0x1b], ax
pop esi
pop esi
mov edx, dword [esp + 1]
mov edx, 0xe2c46f10
jmp 0x10444220
mov dword [esp + 0x1a], esi
mov dl, byte [esp + 0xd]
xchg word [esp + 0x15], dx
mov si, word [esp + 7]
mov word [esp], cx
bswap eax
jmp 0x104443a8

Function at 0x10444a3a
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
call fcn.104421b8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x10444a62
mov byte [esp + 5], cl
push dx
push cx
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0x10444a15
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x104421b3
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401443
pop dword [ebp - 0x1c]
mov eax, 0x401443
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x36ac5a0
add dword [ebp - 0x2c], 0x4ae77fab
mov dword [ebp - 0x28], 0xd986c1e9
sub dword [ebp - 0x28], 0xa75375a4
mov dword [ebp - 0x24], 0xd315cc7a
add dword [ebp - 0x24], 0x793677b4
mov dword [ebp - 0x20], 0xe36be6ed
add dword [ebp - 0x20], 0x1c941913
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xab941d3
sub eax, 0xa78c0cf
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x17a5b2f
add dword [ebp - 0x2c], 0x72f80e27
mov dword [ebp - 0x28], 0xd6100992
add dword [ebp - 0x28], 0x6b5c57e3
mov dword [ebp - 0x24], 0x3b207ca1
sub dword [ebp - 0x24], 0xd7b11035
mov dword [ebp - 0x20], 0xb9818986
add dword [ebp - 0x20], 0x467e767a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x1433fbe8
add eax, 0xec0c8518
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b396
push 0
call eax
mov ecx, 0xdbbed1a0
sub ecx, 0xdbbe7de4
mov ebx, eax
mov edi, 0xad898553
add edi, 0x52bd5ead
add edi, dword [ebp - 0x1c]
mov edx, 0x3aa7ae47
add edx, 0xcd6e5510
xor dword [ebp - 0x14], edi
mov esi, dword [edi]
mov dword [ebp - 4], 0x96c9c5cc
add esi, edx
add dword [ebp - 0x14], ecx
mov dword [ebx], esi
add dword [ebp - 0x14], 0x7274abc0
add ebx, 0x50bc9
add ebx, 0xfffaf43b
add edi, 0x684d3439
sub edi, 0x684d3435
loop 0x401560
add eax, 0x784edc33
add eax, 0x87b26590
mov ebx, eax
add eax, 0x8d5ce1c
add eax, 0xf72a31e9
mov ecx, 0xd6da9c98
sub ecx, 0xd69a9c98
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x402594
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025a2
call dword [0x40b004]
or eax, eax
je 0x4025a3
ret
mov al, 1
jmp fcn.00402614

Function at 0x4025ac
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025ba
call dword [0x40b008]
or eax, eax
jne 0x4025bb
ret
mov al, 2
jmp fcn.00402614

Function at 0x4025c4
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025fc
test edx, edx
je 0x4025e6
push eax
mov eax, ecx
call dword [0x40b00c]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402614
mov dword [eax], edx
mov eax, ecx
call dword [0x40b008]
or eax, eax
jne 0x4025df
ret
mov al, 1
jmp fcn.00402614
test edx, edx
je 0x402610
push eax
mov eax, edx
call dword [0x40b004]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x403780
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402614
cmp eax, edx
je 0x4037f0
cmp word [eax], 8
jb 0x4037a5
push eax
push edx
cmp word [eax], 0x100
je 0x40379b
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4037a3
add eax, 8
call fcn.00403198
pop edx
pop eax
cmp word [edx], 8
jae 0x4037bc
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x4037dc
mov edx, dword [edx + 8]
or edx, edx
je 0x4037d3
mov ecx, dword [edx - 8]
inc ecx
jle 0x4037d3
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x403744
ret

Function at 0x404c94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0xe99dd4e9
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00404938
push eax
push esi
push dword [ebp + 8]
call fcn.004048ed
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
Function at 0x405194
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [ecx + 0x56fffffc], edi
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00404938
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004048ed
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00404938
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004048ed
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00404938
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004048ed
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00404928
hlt

Function at 0x405890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
invalid
invalid
movsb byte es:[edi], byte [esi]
Function at 0x40662c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
inc dword [eax]
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.00404938
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00404899
add esp, 0xc
jmp 0x4068a0

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret
Function at 0x10902080
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x109020a8
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esi + ecx*4]
sub edx, esi
mov esi, dword [edx + eax - 4]
xor dword [eax - 4], esi
sub eax, 4
sub ecx, 1
test ecx, ecx
jne 0x10902096
pop esi
ret

Function at 0x1090c200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
mov ebx, ecx
lea eax, [ebp - 0xa8]
push edi
push eax
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x3bc]
push eax
push dword [ebp + 8]
call fcn.1090bcb0
lea edi, [ebx + 0x63c0]
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x1c], edi
lea esi, [ebp - 0x9a]
lea ecx, [ecx]
lea ecx, [ebp - 0xc]
lea eax, [esi - 0xa]
push ecx
push eax
call fcn.1090bea0
mov al, byte [edi - 1]
xor al, byte [ebp - 9]
mov dl, byte [edi + 1]
mov cl, byte [edi - 3]
xor cl, byte [ebp - 0xb]
xor dl, byte [ebp - 7]
mov bl, byte [edi - 4]
mov bh, byte [edi - 2]
xor bl, byte [ebp - 0xc]
mov byte [ebp + 0xb], al
mov al, byte [edi]
xor al, byte [ebp - 8]
xor bh, byte [ebp - 0xa]
movsx edi, al
mov byte [ebp - 1], dl
movsx edx, cl
mov eax, edx
movsx ecx, bl
sar eax, 4
and eax, 0xf
shl ecx, 4
or ecx, eax
shl edx, 8
mov eax, dword [ebp - 0x18]
and ecx, 0xfff
movzx eax, byte [ecx + eax + 0x13bc]
movsx ecx, byte [ebp + 0xb]
mov byte [ebp - 0x10], al
movzx eax, bh
mov ebx, dword [ebp - 0x18]
or edx, eax
and edx, 0xfff
shl ecx, 4
movzx eax, byte [edx + ebx + 0x23bc]
mov byte [ebp - 0xf], al
mov eax, edi
sar eax, 4
and eax, 0xf
shl edi, 8
or ecx, eax
and ecx, 0xfff
movzx eax, byte [ecx + ebx + 0x33bc]
mov ecx, ebx
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 1]
or edi, eax
and edi, 0xfff
movzx eax, byte [edi + ebx + 0x43bc]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1090bdc0
movzx eax, byte [esi - 0xa]
lea esi, [esi + 8]
mov byte [esi - 0xe], al
movzx eax, byte [esi - 0x11]
mov byte [esi - 0xd], al
movzx eax, byte [esi - 0x10]
mov byte [esi - 0xc], al
movzx eax, byte [esi - 0xf]
mov byte [esi - 0xb], al
movzx ecx, byte [esi - 0x16]
mov eax, dword [ebp - 0x14]
xor cl, al
mov byte [esi - 0xa], cl
movzx ecx, byte [esi - 0x15]
xor cl, ah
mov byte [esi - 9], cl
movzx eax, byte [esi - 0x14]
xor al, byte [ebp - 0x12]
mov byte [esi - 8], al
movzx eax, byte [esi - 0x13]
xor al, byte [ebp - 0x11]
mov byte [esi - 7], al
mov edi, dword [ebp - 0x1c]
add edi, 6
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
jne 0x1090c240
movzx eax, byte [ebp - 0x24]
push dword [ebp + 0xc]
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 0x23]
mov byte [ebp - 0xb], al
movzx eax, byte [ebp - 0x22]
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x21]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 0x28]
mov byte [ebp - 8], al
movzx eax, byte [ebp - 0x27]
mov byte [ebp - 7], al
movzx eax, byte [ebp - 0x26]
mov byte [ebp - 6], al
movzx eax, byte [ebp - 0x25]
mov byte [ebp - 5], al
lea eax, [ebx + 0xbbc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1090bcb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1090c3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
mov ebx, ecx
lea eax, [ebp - 0xa8]
push edi
push eax
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x3bc]
push eax
push dword [ebp + 8]
call fcn.1090bcb0
lea edi, [ebx + 0x641a]
mov dword [ebp - 0x20], 0x10
lea esi, [ebp - 0x9a]
mov dword [ebp - 0x1c], edi
lea ecx, [ecx]
lea ecx, [ebp - 0xc]
lea eax, [esi - 0xa]
push ecx
push eax
call fcn.1090bea0
mov al, byte [edi - 1]
xor al, byte [ebp - 9]
mov dl, byte [edi + 1]
mov cl, byte [edi - 3]
xor cl, byte [ebp - 0xb]
xor dl, byte [ebp - 7]
mov bl, byte [edi - 4]
mov bh, byte [edi - 2]
xor bl, byte [ebp - 0xc]
mov byte [ebp + 0xb], al
mov al, byte [edi]
xor al, byte [ebp - 8]
xor bh, byte [ebp - 0xa]
movsx edi, al
mov byte [ebp - 1], dl
movsx edx, cl
mov eax, edx
movsx ecx, bl
sar eax, 4
and eax, 0xf
shl ecx, 4
or ecx, eax
shl edx, 8
mov eax, dword [ebp - 0x18]
and ecx, 0xfff
movzx eax, byte [ecx + eax + 0x13bc]
movsx ecx, byte [ebp + 0xb]
mov byte [ebp - 0x10], al
movzx eax, bh
mov ebx, dword [ebp - 0x18]
or edx, eax
and edx, 0xfff
shl ecx, 4
movzx eax, byte [edx + ebx + 0x23bc]
mov byte [ebp - 0xf], al
mov eax, edi
sar eax, 4
and eax, 0xf
shl edi, 8
or ecx, eax
and ecx, 0xfff
movzx eax, byte [ecx + ebx + 0x33bc]
mov ecx, ebx
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 1]
or edi, eax
and edi, 0xfff
movzx eax, byte [edi + ebx + 0x43bc]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1090bdc0
movzx eax, byte [esi - 0xa]
lea esi, [esi + 8]
mov byte [esi - 0xe], al
movzx eax, byte [esi - 0x11]
mov byte [esi - 0xd], al
movzx eax, byte [esi - 0x10]
mov byte [esi - 0xc], al
movzx eax, byte [esi - 0xf]
mov byte [esi - 0xb], al
movzx ecx, byte [esi - 0x16]
mov eax, dword [ebp - 0x14]
xor cl, al
mov byte [esi - 0xa], cl
movzx ecx, byte [esi - 0x15]
xor cl, ah
mov byte [esi - 9], cl
movzx eax, byte [esi - 0x14]
xor al, byte [ebp - 0x12]
mov byte [esi - 8], al
movzx eax, byte [esi - 0x13]
xor al, byte [ebp - 0x11]
mov byte [esi - 7], al
mov edi, dword [ebp - 0x1c]
sub edi, 6
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
jne 0x1090c400
movzx eax, byte [ebp - 0x24]
push dword [ebp + 0xc]
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 0x23]
mov byte [ebp - 0xb], al
movzx eax, byte [ebp - 0x22]
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x21]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 0x28]
mov byte [ebp - 8], al
movzx eax, byte [ebp - 0x27]
mov byte [ebp - 7], al
movzx eax, byte [ebp - 0x26]
mov byte [ebp - 6], al
movzx eax, byte [ebp - 0x25]
mov byte [ebp - 5], al
lea eax, [ebx + 0xbbc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1090bcb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1090d260
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1092b139
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x1c], edi
call dword [sym.imp.Core.dll_public:_void___thiscall_FArchive::constructor_void_]
mov dword [ebp - 4], 0
mov dword [edi], 0x109340a0
mov byte [ebp - 4], 1
mov dword [edi + 0x1c], 1
mov dword [edi + 0x10], 1
mov dword [edi + 0x40], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x44], 0
mov byte [edi + 0x48], 0xac
mov eax, dword [sym.imp.Core.dll_class_FMalloc__GMalloc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push 0x10935ce8
push 0x458
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x1090d2f9
push 0
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
push eax
push dword [ebp + 0xc]
push esi
mov ecx, ebx
call fcn.1090ccf0
jmp 0x1090d2fb
xor eax, eax
mov dword [edi + 0x3c], eax
test eax, eax
jne 0x1090d30a
mov byte [ebp - 4], al
jmp 0x1090d3c5
mov ebx, 1
cmp dword [ebp + 0x10], 0x18
jbe 0x1090d3b4
xor esi, esi
mov dword [ebp - 0x14], esi
cmp esi, 0xb
jae 0x1090d343
push 2
lea eax, [ebp + 8]
push eax
mov ecx, dword [edi + 0x3c]
call dword [sym.imp.Core.dll_public:_class_FArchive____thiscall_FArchive::ByteOrderSerialize_void___int_]
mov ax, word [ebp + 8]
cmp ax, word [esi*2 + 0x10932ec0]
jne 0x1090d3b4
inc esi
jmp 0x1090d31b
test ebx, ebx
je 0x1090d3b4
push 2
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [edi + 0x3c]
call dword [sym.imp.Core.dll_public:_class_FArchive____thiscall_FArchive::ByteOrderSerialize_void___int_]
push 2
lea eax, [ebp - 0x26]
push eax
mov ecx, dword [edi + 0x3c]
call dword [sym.imp.Core.dll_public:_class_FArchive____thiscall_FArchive::ByteOrderSerialize_void___int_]
push 2
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [edi + 0x3c]
call dword [sym.imp.Core.dll_public:_class_FArchive____thiscall_FArchive::ByteOrderSerialize_void___int_]
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.Core.dll_int___cdecl_appAtoi_wchar_t_const__]
add esp, 4
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 0x1c
cmp eax, 0x6f
jne 0x1090d39c
mov byte [edi + 0x48], 0xac
jmp 0x1090d3be
cmp eax, 0x79
jne 0x1090d3ae
mov ecx, dword [ebp + 0x14]
call fcn.10929530
mov byte [edi + 0x48], al
jmp 0x1090d3be
mov byte [edi + 0x48], 0
jmp 0x1090d3be
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
push 0
call dword [eax + 0x3c]
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10