joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1029c0f3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
call fcn.10001077
mov dword [esp + 0x3c], eax
xor eax, eax
mov ecx, dword [esp + 0x3c]
cmp ecx, 0
mov dword [esp + 0x38], eax
je 0x1029c1bc
jmp 0x1029c2a1
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.1029dbef
mov ecx, 0x2e
lea edx, [0x1029c07e]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x70], esi
mov dword [0x102a7af8], 0x508
mov dword [esp + 0x80], 0x1de600
mov esi, dword [0x102a7ae0]
mov dword [esp + 0x8c], esi
mov esi, dword [0x102a7ae4]
mov dword [esp + 0x50], esi
mov esi, dword [0x102a7ae8]
mov dword [esp + 0x6c], esi
mov esi, dword [0x102a7aec]
mov dword [esp + 0x54], esi
mov esi, dword [0x102a7af0]
mov dword [esp + 0x64], esi
mov dword [0x102a7af4], 0x3ae
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
jmp 0x1029c1f3
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x24], ecx
je 0x1029c230
jmp 0x1029c20a
lea eax, [esp + 0x50]
mov dword [0x102a7af8], 0x1500
mov dword [0x102a7af4], 0x45c
mov dword [esp + 0x20], eax
call fcn.1029d1db
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
je 0x1029c125
jmp 0x1029c299
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
cmp word [eax], 0x5a4d
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], ecx
je 0x1029c1a6
mov eax, dword [esp + 0x28]
add eax, 0xfffff000
mov dword [esp + 0x14], eax
mov eax, 0xfffffc34
mov ecx, dword [esp + 0x14]
and ecx, 0xfffff000
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
jmp 0x1029c1f3
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x18]
mov dword [0x102a7af4], ecx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x5c], edx
mov esi, dword [esp + 0x24]
mov edi, dword [edx + esi + 0x50]
add eax, 0x18
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
mov dword [0x102a7af8], 0xfffff448
mov esi, dword [esp + 0x48]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1029c639
mov ecx, esp
lea edx, [esp + 0x50]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x1029c639
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 1
lea esi, [ebp - 0x24]
mov dword [0x102a7af4], 0xffffeb5d
mov byte [ebp - 0x24], 0x56
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edx
jmp 0x1029c673
mov eax, dword [ebp - 0x38]
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x102a00d2]
mov dl, byte [eax + str.q5a_]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
jne 0x1029c673
mov dword [0x102a7af4], 0xfffe5182
mov dword [0x102a7af8], 0x15f9
call fcn.1029d7b8
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.1029c818
cmp eax, 0
sete cl
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x3d], cl
xor eax, eax
mov cl, byte [ebp - 0x3d]
test cl, 1
mov dword [ebp - 0x38], eax
jne 0x1029c66a
jmp 0x1029c6de
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x102a7af4], 0x1eb
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.1029c318
mov eax, dword [ebp - 0x44]
mov word [eax], 0x5a4d
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov dword [0x102a7af8], 0xb52
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x54], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x48], ecx
mov dword [0x102a7af4], 0x25e3
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x1029c66a
mov eax, dword [ebp - 0x44]
add eax, 0x22af
mov dword [0x102a7af4], 0x258c
mov dword [ebp - 0x38], eax
jmp 0x1029c66a
Function at 0x1029d1db
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [0x102a7af4], 0x1c6a
mov dword [ebp - 4], 0
mov dword [0x102a7af8], 0x2f2
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x102a7af4], 0xb29
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1029d260
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1029d260
jmp 0x1029d276
mov dword [0x102a7af8], 0xa81
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1029d2ed
jmp 0x1029d304
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jne 0x1029d225
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x1029d304
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1029d304
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff5
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2], 0x61
jne 0x1029d304
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff6
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x64
jne 0x1029d304
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x25], dl
mov al, byte [ebp - 0x25]
test al, 1
jne 0x1029d23e
jmp 0x1029d304
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
je 0x1029d31a
mov eax, dword [0x102a7af8]
add eax, 0xfffff6b5
mov dword [0x102a7af8], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1029d31a
mov eax, dword [ebp - 0x2c]
add esp, 0x2c
pop ebp
ret
Function at 0x1029d479
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov dword [0x102a7af4], 0x242
mov dword [ebp - 0x10], eax
call fcn.1029c4e6
xor ecx, ecx
mov edx, dword [0x102a7af4]
mov esi, eax
mov edi, dword [eax + 0x3c]
mov ebx, esi
add ebx, edi
mov edi, dword [eax + edi]
cmp edi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
je 0x1029d4c8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffffc697
mov dword [0x102a7af8], ecx
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [ebp - 0x1c]
add esi, 0xffffd5ad
mov dword [0x102a7af4], esi
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
je 0x1029d622
jmp 0x1029d552
mov al, byte [ebp - 0x35]
test al, 1
jne 0x1029d5fd
jmp 0x1029d5bc
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x20]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x35], cl
je 0x1029d517
jmp 0x1029d58b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + ecx + 0x24]
mov dword [ebp - 0x4c], edx
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov esi, dword [ebp - 0x2c]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edx
jmp 0x1029d527
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x35]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x1029d527
jmp 0x1029d517
mov eax, dword [ebp - 0x5c]
add eax, 2
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov edx, dword [ebp - 0x30]
cmp ecx, edx
setb bl
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x65], bl
xor eax, eax
mov cl, byte [ebp - 0x65]
test cl, 1
mov edx, dword [ebp - 0x60]
mov esi, dword [ebp - 0x64]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x34], eax
jne 0x1029d56f
jmp 0x1029d622
mov eax, dword [ebp - 0x5c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x102a7af4], 0x238b
mov edx, dword [ebp - 0x20]
add edx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1029d62d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x102a7afc], 0
mov dword [0x102a7b00], 0
mov dword [0x102a7b0c], 0
mov dword [0x102a7af4], 0x145d
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, 0x145d
mov edx, dword [ebp - 0x10]
cmp edx, 0
mov esi, eax
mov edi, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
jne 0x1029d6ca
mov dword [0x102a7af8], 0x2692
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x102a7af4]
mov ecx, dword [0x102a7afc]
mov edx, dword [0x102a7b00]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
mov ebx, ecx
add ebx, 0x21fe
mov dword [0x102a7af4], ebx
add edx, 1
mov dword [ebp - 0x34], eax
mov eax, edx
cdq
idiv edi
mov dword [0x102a7afc], edx
add ecx, 0x3191
mov dword [0x102a7af8], ecx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x102a7b00], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x102a7b04], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x102a7af8], 0x2b4
mov cl, byte [0x102a7b04]
mov edx, dword [0x102a7b00]
mov byte [edi + edx], cl
mov edx, dword [0x102a7afc]
movzx edx, byte [edi + edx]
mov ebx, dword [0x102a7b00]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x102a7af8], 0xdf3
and ebx, 0xff
mov dword [0x102a7b0c], ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x34]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x30], edx
je 0x1029d698
jmp 0x1029d6aa
Function at 0x1029df8c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [0x102a7af4]
add edi, 0xffffe7eb
mov dword [0x102a7af4], edi
mov dword [0x102a7b00], 0
mov byte [0x102a7b04], 0
mov dword [0x102a7af8], 0x4dd
mov dword [0x102a7afc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
Function at 0x9bde1c
Capabilities:
Parse pe header

Disassembly:
mov eax, 8
call fcn.00a873cc
mov eax, dword [esp + 0x10]
dec eax
jne 0x9bdefa
mov eax, dword [0x10121d34]
test eax, eax
jne 0x9bded3
push esi
push 0x100cc558
mov dword [0x10121d34], 1
call dword [0x100cc0bc]
add esp, 4
test eax, eax
je 0x9bdebf
mov dl, byte [eax]
xor ecx, ecx
cmp dl, 0x7e
push edi
sete cl
mov edi, ecx
lea edx, [esp + 8]
push edx
push 0x100cc550
lea esi, [edi + eax]
push esi
call dword [0x100cc0b8]
add esp, 0xc
test eax, eax
jne 0x9bde9b
push eax
push eax
push esi
call dword [0x100cc0b4]
add esp, 0xc
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x9bdea3
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
test edi, edi
pop edi
je 0x9bdec4
call fcn.009c0a1c
mov ecx, dword [esp + 4]
mov esi, dword [esp + 8]
not ecx
not esi
and eax, ecx
and edx, esi
jmp 0x9bdec4
call fcn.009c0a1c
or ah, 4
mov dword [0x1012407c], edx
mov dword [0x10124078], eax
pop esi
mov ecx, dword [esp + 0xc]
cmp word [ecx], 0x5a4d
jne 0x9bdefa
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x9bdefa
cmp ecx, dword [eax + 0x34]
je 0x9bdefa
mov dword [0x10121d38], 1
mov eax, 1
add esp, 8
ret 0xc
Function at 0x9c8fa0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.00a873cc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x9c8f67
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x9c8f79
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x9c911f
push esi
call fcn.00a2b54c
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x9c8faf
push 0x100ccb5c
push 0x68
push 0x100ccb44
call fcn.009be11c
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x9c900c
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.00a226fc
add esp, 0xc
test eax, eax
je 0x9c9112
mov eax, dword [esp + 0x98]
push ebp
push eax
push edi
call fcn.00a228ac
add esp, 0xc
test eax, eax
je 0x9c9112
lea esi, [ebx + 0x4c]
lea ecx, [ebx + 0x50]
push esi
push ecx
push edi
call fcn.00a229dc
add esp, 0xc
test eax, eax
je 0x9c9112
jmp 0x9c904b
test ebp, ebp
jl 0x9c9018
cmp ebp, 0x80
jle 0x9c902c
push 0x100ccb1c
push 0x75
push 0x100ccb44
call fcn.009be11c
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x4c]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x9c9070
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x50]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x9c9079
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x1c]
push ebp
push esi
push edi
call fcn.00a226fc
add esp, 0xc
test eax, eax
je 0x9c9112
push esi
call fcn.00a2b54c
lea edx, [esp + 0x14]
push eax
push edx
push edi
call fcn.00a228ac
add esp, 0x10
test eax, eax
je 0x9c9112
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x9c90c0
lea edi, [ebx + 0x34]
push ebp
push esi
push edi
call fcn.00a226fc
add esp, 0xc
test eax, eax
je 0x9c9112
push esi
call fcn.00a2b54c
lea edx, [esp + 0x14]
push eax
push edx
push edi
call fcn.00a228ac
add esp, 0x10
test eax, eax
je 0x9c9112
lea eax, [ebx + 0x1c]
add ebx, 4
push eax
push ebx
call fcn.00a22a7c
add esp, 8
test eax, eax
jne 0x9c9128
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x9c90fe
jmp 0x9c9077
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x80
ret
Function at 0x9e4e1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.00a873cc
mov eax, dword [ebp + 0x20]
push ebx
push esi
push edi
mov ecx, dword [eax]
test ecx, ecx
mov dword [ebp - 4], ecx
je 0x9e4e69
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x9e4e69
mov edx, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov dl, byte [ecx + edx]
mov al, byte [esi]
xor dl, al
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
mov edx, dword [ebp + 0x10]
inc eax
inc esi
dec edx
inc ecx
and ecx, 0xf
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], esi
mov dword [ebp + 0x10], edx
mov dword [ebp - 4], ecx
jne 0x9e4e38
mov esi, dword [ebp + 0x18]
mov eax, dword [esi + 0xc]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x18]
bswap eax
mov ebx, eax
mov eax, dword [ebp + 0x10]
cmp eax, 0x10
jb 0x9e4ef9
mov edi, dword [ebp + 0x10]
shr edi, 4
add ebx, edi
cmp ebx, edi
mov dword [ebp + 0x18], ebx
jae 0x9e4e97
sub edi, ebx
xor ebx, ebx
mov dword [ebp + 0x18], ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push ecx
push edi
push edx
push eax
call dword [ebp + 0x24]
add esp, 0x14
mov eax, dword [ebp + 0x18]
bswap eax
test ebx, ebx
mov dword [esi + 0xc], eax
jne 0x9e4ed6
mov cl, byte [esi + 0xb]
mov eax, 0xb
inc cl
mov byte [esi + 0xb], cl
jne 0x9e4ed6
test eax, eax
je 0x9e4ed6
mov cl, byte [eax + esi - 1]
dec eax
inc cl
mov byte [eax + esi], cl
je 0x9e4ec6
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
shl edi, 4
sub eax, edi
add ecx, edi
add edx, edi
cmp eax, 0x10
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
jae 0x9e4e81
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x9e4f8a
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x14]
mov edx, edi
xor ecx, ecx
push esi
push eax
mov dword [edx], ecx
push 1
push edi
push edi
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
call dword [ebp + 0x24]
add esp, 0x14
inc ebx
mov dword [ebp + 0x18], ebx
mov eax, dword [ebp + 0x18]
bswap eax
test ebx, ebx
mov dword [esi + 0xc], eax
jne 0x9e4f54
mov cl, byte [esi + 0xb]
mov eax, 0xb
inc cl
mov byte [esi + 0xb], cl
jne 0x9e4f54
test eax, eax
je 0x9e4f54
mov cl, byte [eax + esi - 1]
dec eax
inc cl
mov byte [eax + esi], cl
je 0x9e4f44
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
dec ecx
sub esi, edi
sub edx, edi
inc ecx
lea eax, [ebx + edi]
add ebx, ecx
mov dword [ebp - 4], ebx
mov bl, byte [esi + eax]
xor bl, byte [eax]
inc eax
dec ecx
mov byte [edx + eax - 1], bl
jne 0x9e4f6e
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x20]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x9e620c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00a873cc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov ebx, dword [esi + 0x160]
mov dword [esi], eax
mov dword [esi + 8], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
cmp edi, 0xc
mov dword [ebp - 4], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
jne 0x9e6284
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov edi, 1
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov byte [esi + 0xf], 1
mov dword [ecx + 8], eax
jmp 0x9e6397
cmp edi, 0x10
mov dword [ebp - 0xc], edi
jb 0x9e62cd
mov eax, edi
shr eax, 4
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
mov eax, esi
sub ecx, esi
mov edx, 0x10
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x9e62a0
mov ebx, dword [ebp - 4]
lea ecx, [esi + 0x60]
push ecx
push esi
call ebx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add esp, 8
add edx, 0x10
sub edi, 0x10
dec eax
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
jne 0x9e6294
xor eax, eax
cmp edi, eax
je 0x9e62ed
jbe 0x9e62e3
mov ecx, dword [ebp + 0xc]
mov eax, esi
sub ecx, esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec edi
jne 0x9e62da
lea eax, [esi + 0x60]
push eax
push esi
call ebx
add esp, 8
mov eax, dword [ebp - 0xc]
mov ecx, 3
xor edx, edx
call fcn.00a8747c
mov edi, edx
mov dl, byte [esi + 8]
mov ecx, edi
mov ebx, eax
mov al, byte [esi + 9]
mov dword [ebp - 8], edi
shr ecx, 0x18
xor dl, cl
mov cl, byte [esi + 0xa]
mov byte [esi + 8], dl
mov edx, edi
shr edx, 0x10
xor al, dl
mov dl, byte [esi + 0xb]
mov byte [esi + 9], al
mov eax, edi
shr eax, 8
xor cl, al
mov eax, ebx
mov byte [esi + 0xa], cl
mov cl, byte [ebp - 8]
xor dl, cl
mov ecx, 0x18
mov byte [esi + 0xb], dl
mov edx, edi
call fcn.00a8741c
mov cl, byte [esi + 0xc]
mov edx, edi
xor cl, al
mov eax, ebx
mov byte [esi + 0xc], cl
mov ecx, 0x10
call fcn.00a8741c
mov dl, byte [esi + 0xd]
mov ecx, 8
xor dl, al
mov eax, ebx
mov byte [esi + 0xd], dl
mov edx, edi
call fcn.00a8741c
mov cl, byte [esi + 0xe]
lea edx, [esi + 0x60]
xor cl, al
mov al, byte [esi + 0xf]
xor al, bl
push edx
push esi
mov byte [esi + 0xe], cl
mov byte [esi + 0xf], al
call dword [ebp - 4]
mov eax, dword [esi + 0xc]
add esp, 8
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
bswap eax
mov edi, eax
mov ecx, dword [esi + 0x174]
lea edx, [esi + 0x20]
push ecx
push edx
push esi
call dword [esi + 0x170]
add esp, 0xc
inc edi
mov dword [ebp + 0xc], edi
mov eax, dword [ebp + 0xc]
bswap eax
mov dword [esi + 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e0b
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x1001e68
call fcn.01001e84
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1001e5a
cmp ecx, 0xffffffff
je 0x1001e5a
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x1001e53
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x1001e53
cmp edx, 0x10000000
jae 0x1001e53
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x1005401
mov dword [ebp - 4], 0xfffffffe
call fcn.01001bf9
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x3b44682a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x315162b6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219