joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100201f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10090730]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov ebx, edi
and ebx, 0x8000000f
mov esi, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov dword [eax], edi
jns 0x10020228
dec ebx
or ebx, 0xfffffff0
inc ebx
lea edx, [ebp - 0x14]
mov al, 0x7a
push edx
sub edi, ebx
mov word [ebp - 0x14], 0x7a4c
mov byte [ebp - 0x12], al
mov dword [ebp - 0x11], 0x55353138
mov dword [ebp - 0xd], 0x51484a38
mov dword [ebp - 9], 0x63513761
mov byte [ebp - 5], 0x47
call fcn.1001eed0
test edi, edi
jle 0x1002026e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push edi
add eax, 8
push eax
push ecx
mov eax, esi
call fcn.10020050
test ebx, ebx
jne 0x10020280
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
jmp 0x1002033e
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x18]
lea ecx, [edi + 0x10]
push ebx
add eax, edi
mov dword [edx + 4], ecx
push eax
lea ecx, [ebp - 0x14]
push ecx
mov byte [ebp - 0x14], 0
call fcn.100434e0
add esp, 0xc
cmp byte [esi + 4], 0
jne 0x100202d3
push 0x10092868
lea ecx, [ebp - 0x10]
call fcn.100432de
push 0x10087558
lea edx, [ebp - 0x10]
push edx
call fcn.10043d3c
xor edx, edx
mov eax, 0x10
div dword [esi + 0x3cc]
test edx, edx
je 0x100202ff
push 0x1009286c
lea ecx, [ebp - 0x10]
call fcn.100432de
push 0x10087558
lea eax, [ebp - 0x10]
push eax
call fcn.10043d3c
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
lea ebx, [ebp - 0x14]
lea edi, [ecx + edi + 8]
test eax, eax
je 0x1002033e
push edi
mov ecx, ebx
call fcn.1001fad0
mov eax, dword [esi + 0x3cc]
add ebx, eax
add edi, eax
xor edx, edx
mov eax, 0x10
div dword [esi + 0x3cc]
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, eax
jb 0x10020314
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x20]
add eax, 8
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x2fffffff
pop ebx
call fcn.100444a1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10020370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10090730]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
test eax, eax
jne 0x100203be
mov al, 0x7a
lea ecx, [ebp - 0x14]
mov word [ebp - 0x14], 0x7a4c
mov byte [ebp - 0x12], al
mov dword [ebp - 0x11], 0x55353138
mov dword [ebp - 0xd], 0x51484a38
mov dword [ebp - 9], 0x63513761
mov byte [ebp - 5], 0x47
push ecx
jmp 0x100203bf
push eax
call fcn.1001eed0
mov edx, dword [edi + 4]
push edx
push ebx
lea eax, [edi + 8]
push eax
mov eax, esi
call fcn.100200f0
mov ecx, dword [edi]
mov edx, dword [ebp - 0x18]
mov dword [edx], ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x2fffffff
pop ebx
call fcn.100444a1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100245a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x100245e4
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x100245c8
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x1002460d
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
je 0x1002460d
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec edi
mov byte [eax + esi - 1], dl
jne 0x10024600
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10024620
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
mov eax, ebp
shr eax, 2
xor ecx, ecx
xor edx, edx
test eax, eax
je 0x1002465a
mov edx, edi
sub esi, edi
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esi + edx]
xor ebx, dword [edx]
add edx, 4
or ecx, ebx
dec eax
jne 0x10024644
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
pop ebx
lea eax, [edx*4]
sub ebp, eax
jne 0x10024671
pop edi
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebp
pop ecx
ret
add esi, eax
add edi, eax
mov eax, ecx
mov edx, ecx
shr edx, 0x10
shr eax, 0x18
or al, dl
mov edx, ecx
shr edx, 8
or al, dl
or cl, al
test ebp, ebp
je 0x1002469f
mov eax, edi
sub esi, edi
mov edi, ebp
mov dl, byte [eax + esi]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x10024694
pop edi
xor eax, eax
test cl, cl
pop esi
sete al
pop ebp
pop ecx
ret
Function at 0x100276c0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov edi, dword [ebx + 0x64]
mov ecx, 0x12
mov esi, 0x10070268
push 0x1000
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x1074]
xor ebp, ebp
push 0x100702b0
push eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
call fcn.100434e0
mov edi, dword [esp + 0x30]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x2c]
add esp, 0xc
mov esi, 2
lea esp, [esp]
xor edx, edx
lea eax, [esi - 2]
div edi
lea eax, [esi - 1]
movzx ecx, byte [edx + ebp]
xor edx, edx
div edi
shl ecx, 8
mov eax, esi
movzx edx, byte [edx + ebp]
or ecx, edx
xor edx, edx
div edi
shl ecx, 8
movzx eax, byte [edx + ebp]
or ecx, eax
xor edx, edx
lea eax, [esi + 1]
div edi
mov eax, dword [ebx + 0x64]
shl ecx, 8
add esi, 4
movzx edx, byte [edx + ebp]
or ecx, edx
mov edx, dword [esp + 0x10]
xor dword [eax + edx], ecx
add edx, 4
mov dword [esp + 0x10], edx
cmp edx, 0x48
jb 0x10027710
mov ecx, dword [ebx + 0x64]
push ecx
lea eax, [esp + 0x18]
mov ecx, ebx
call fcn.10027870
xor esi, esi
mov eax, dword [ebx + 0x64]
lea edx, [esi + eax + 8]
push edx
add eax, esi
mov ecx, ebx
call fcn.10027870
add esi, 8
cmp esi, 0x40
jb 0x10027774
mov eax, dword [ebx + 0x1074]
push eax
mov eax, dword [ebx + 0x64]
add eax, 0x40
mov ecx, ebx
call fcn.10027870
xor esi, esi
mov eax, dword [ebx + 0x1074]
lea ecx, [esi + eax + 8]
push ecx
add eax, esi
mov ecx, ebx
call fcn.10027870
add esi, 8
cmp esi, 0xff8
jb 0x100277a3
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x1c]
lea ecx, [ebx + 4]
call eax
test al, al
jne 0x1002785a
mov eax, dword [ebx + 0x64]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax]
mov dword [eax], edx
mov dword [eax + 0x44], ecx
mov eax, dword [ebx + 0x64]
mov edx, dword [eax + 0x40]
mov ecx, dword [eax + 4]
mov dword [eax + 4], edx
mov dword [eax + 0x40], ecx
mov eax, dword [ebx + 0x64]
mov edx, dword [eax + 0x3c]
mov ecx, dword [eax + 8]
mov dword [eax + 8], edx
mov dword [eax + 0x3c], ecx
mov eax, dword [ebx + 0x64]
mov edx, dword [eax + 0x38]
mov ecx, dword [eax + 0xc]
mov dword [eax + 0xc], edx
mov dword [eax + 0x38], ecx
mov eax, dword [ebx + 0x64]
mov edx, dword [eax + 0x34]
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x10], edx
mov dword [eax + 0x34], ecx
mov eax, dword [ebx + 0x64]
mov edx, dword [eax + 0x30]
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x14], edx
mov dword [eax + 0x30], ecx
mov eax, dword [ebx + 0x64]
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x18]
mov dword [eax + 0x18], edx
mov dword [eax + 0x2c], ecx
mov eax, dword [ebx + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x28]
mov dword [eax + 0x1c], edx
mov dword [eax + 0x28], ecx
mov ebx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x24], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x10027f80
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov edx, dword [edx + 4]
sub esp, 0xc
push esi
push edi
mov edi, dword [ecx + 0x2c]
xor esi, esi
bswap eax
bswap edx
test edi, edi
je 0x10028001
mov ecx, dword [ecx + 0x28]
push ebx
mov ebx, dword [ecx + 4]
mov dword [esp + 0xc], ebx
mov ebx, dword [ecx]
mov dword [esp + 0x1c], ebx
mov ebx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
lea ebx, [ebx]
mov ecx, edx
shl ecx, 4
add ecx, dword [esp + 0x1c]
mov ebx, edx
shr ebx, 5
add ebx, dword [esp + 0xc]
sub esi, 0x61c88647
xor ecx, ebx
lea ebx, [esi + edx]
xor ecx, ebx
add eax, ecx
mov ecx, eax
shr ecx, 5
add ecx, dword [esp + 0x10]
mov ebx, eax
shl ebx, 4
add ebx, dword [esp + 0x14]
xor ecx, ebx
lea ebx, [esi + eax]
xor ecx, ebx
add edx, ecx
cmp esi, edi
jne 0x10027fc0
pop ebx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1002800d
mov esi, dword [ecx]
jmp 0x1002800f
xor esi, esi
bswap eax
xor eax, esi
mov esi, dword [esp + 0x20]
mov dword [esi], eax
test ecx, ecx
je 0x10028035
lea eax, [ecx + 4]
test eax, eax
je 0x10028035
mov eax, dword [eax]
bswap edx
xor edx, eax
pop edi
mov dword [esi + 4], edx
pop esi
add esp, 0xc
ret 0xc
xor eax, eax
bswap edx
xor edx, eax
pop edi
mov dword [esi + 4], edx
pop esi
add esp, 0xc
ret 0xc

Function at 0x10028050
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
push esi
mov esi, dword [ecx + 0x2c]
bswap eax
bswap edx
test esi, esi
je 0x100280bd
mov ecx, dword [ecx + 0x28]
push ebx
mov ebx, dword [ecx + 0xc]
push ebp
push edi
mov edi, dword [ecx + 8]
mov dword [esp + 0x18], ebx
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [esp + 0x10], ecx
nop
mov ecx, eax
shr ecx, 5
add ecx, dword [esp + 0x18]
mov ebp, eax
shl ebp, 4
add ebp, edi
xor ecx, ebp
lea ebp, [esi + eax]
xor ecx, ebp
sub edx, ecx
mov ecx, edx
shl ecx, 4
add ecx, dword [esp + 0x10]
mov ebp, edx
shr ebp, 5
add ebp, ebx
xor ecx, ebp
lea ebp, [esi + edx]
xor ecx, ebp
sub eax, ecx
add esi, 0x61c88647
jne 0x10028080
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x100280c9
mov esi, dword [ecx]
jmp 0x100280cb
xor esi, esi
bswap eax
xor eax, esi
mov esi, dword [esp + 0x14]
mov dword [esi], eax
test ecx, ecx
je 0x100280ee
lea eax, [ecx + 4]
test eax, eax
je 0x100280ee
mov eax, dword [eax]
bswap edx
xor edx, eax
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0xc
xor eax, eax
bswap edx
xor edx, eax
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0xc
Function at 0x10028490
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [eax + 8]
push ebp
mov ebp, dword [eax + 4]
mov edx, ecx
mov ecx, dword [eax]
mov eax, dword [eax + 0xc]
push esi
mov esi, dword [edx + 0x18]
mov edx, dword [edx + 0xc]
push edi
mov edi, dword [esi]
add edi, ebp
mov ebp, dword [esi + 4]
add ebp, eax
add esi, 8
mov dword [esp + 0x1c], ebx
test edx, edx
je 0x10028516
mov dword [esp + 0x10], edx
jmp 0x100284d0
lea edx, [edi + edi + 1]
imul edx, edi
lea eax, [ebp + ebp + 1]
imul eax, ebp
rol edx, 5
rol eax, 5
mov ebx, edx
xor ebx, ecx
mov cl, al
xor eax, dword [esp + 0x1c]
rol ebx, cl
mov cl, dl
rol eax, cl
mov dword [esp + 0x1c], ebp
mov ebp, dword [esi]
mov dword [esp + 0x14], edi
add eax, dword [esi + 4]
mov ecx, dword [esp + 0x14]
add ebp, ebx
add esi, 8
dec dword [esp + 0x10]
mov edi, eax
jne 0x100284d0
mov ebx, dword [esp + 0x1c]
add ebx, dword [esi + 4]
mov esi, dword [esi]
mov eax, dword [esp + 0x20]
add esi, ecx
test eax, eax
je 0x10028529
mov ecx, dword [eax]
jmp 0x1002852b
xor ecx, ecx
mov edx, dword [esp + 0x24]
xor ecx, esi
mov dword [edx], ecx
lea ecx, [edx + 4]
test eax, eax
je 0x10028543
add eax, 4
je 0x10028543
mov edx, dword [eax]
jmp 0x10028545
xor edx, edx
xor edx, edi
mov dword [ecx], edx
test eax, eax
je 0x10028556
add eax, 4
je 0x10028556
mov edx, dword [eax]
jmp 0x10028558
xor edx, edx
xor edx, ebx
mov dword [ecx + 4], edx
test eax, eax
je 0x10028577
add eax, 4
je 0x10028577
mov eax, dword [eax]
pop edi
pop esi
xor eax, ebp
pop ebp
mov dword [ecx + 8], eax
pop ebx
add esp, 8
ret 0xc
pop edi
xor eax, eax
pop esi
xor eax, ebp
pop ebp
mov dword [ecx + 8], eax
pop ebx
add esp, 8
ret 0xc
Function at 0x10028590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
push ebx
push ebp
lea ebx, [edx + eax*4 - 8]
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0xc]
push esi
mov esi, dword [eax]
sub esi, dword [ebx]
push edi
mov edi, dword [eax + 8]
mov eax, dword [ecx + 0xc]
sub edi, dword [ebx + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], edx
test eax, eax
je 0x10028609
mov dword [esp + 0x10], eax
mov ecx, esi
mov esi, ebp
sub esi, dword [ebx - 8]
mov ebp, edi
mov edi, dword [esp + 0x1c]
sub edi, dword [ebx - 4]
lea edx, [ecx + ecx + 1]
imul edx, ecx
lea eax, [ebp + ebp + 1]
imul eax, ebp
sub ebx, 8
rol eax, 5
rol edx, 5
mov dword [esp + 0x1c], ecx
mov cl, dl
ror edi, cl
mov cl, al
xor edi, eax
ror esi, cl
xor esi, edx
dec dword [esp + 0x10]
jne 0x100285c8
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
sub ebp, dword [ecx + 4]
sub ebx, dword [ecx]
test eax, eax
je 0x10028621
mov edx, dword [eax]
jmp 0x10028623
xor edx, edx
mov ecx, dword [esp + 0x24]
xor edx, esi
mov dword [ecx], edx
test eax, eax
je 0x10028638
add eax, 4
je 0x10028638
mov edx, dword [eax]
jmp 0x1002863a
xor edx, edx
xor edx, ebx
mov dword [ecx + 4], edx
test eax, eax
je 0x1002864c
add eax, 4
je 0x1002864c
mov edx, dword [eax]
jmp 0x1002864e
xor edx, edx
xor edx, edi
mov dword [ecx + 8], edx
test eax, eax
je 0x1002866d
add eax, 4
je 0x1002866d
mov eax, dword [eax]
pop edi
pop esi
xor eax, ebp
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 8
ret 0xc
pop edi
xor eax, eax
pop esi
xor eax, ebp
pop ebp
mov dword [ecx + 0xc], eax
pop ebx
add esp, 8
ret 0xc
Function at 0x10028910
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
push ebx
mov ebx, dword [ecx + 0xc]
push esi
mov esi, dword [ecx + 0x18]
push edi
mov edi, dword [eax + 4]
mov eax, dword [esi]
add eax, edx
mov edx, dword [esi + 4]
add edx, edi
xor edi, edi
test ebx, ebx
je 0x1002894b
push ebp
xor eax, edx
mov cl, dl
rol eax, cl
inc edi
add eax, dword [esi + edi*8]
xor edx, eax
mov cl, al
rol edx, cl
add edx, dword [esi + edi*8 + 4]
cmp edi, ebx
jb 0x10028932
pop ebp
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10028957
mov ecx, dword [esi]
jmp 0x10028959
xor ecx, ecx
mov edi, dword [esp + 0x18]
xor ecx, eax
mov dword [edi], ecx
test esi, esi
je 0x10028979
lea eax, [esi + 4]
test eax, eax
je 0x10028979
mov eax, dword [eax]
xor eax, edx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
ret 0xc
xor eax, eax
xor eax, edx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x10028990
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x18]
lea esi, [ecx + eax*4]
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x100289c8
push ebx
mov ebx, ecx
sub edx, dword [esi - 4]
sub esi, 8
mov cl, al
ror edx, cl
xor edx, eax
sub eax, dword [esi]
mov cl, dl
ror eax, cl
xor eax, edx
dec ebx
jne 0x100289b0
pop ebx
mov edi, dword [edi + 0x18]
mov esi, dword [esp + 0x10]
sub edx, dword [edi + 4]
sub eax, dword [edi]
test esi, esi
je 0x100289dc
mov ecx, dword [esi]
jmp 0x100289de
xor ecx, ecx
mov edi, dword [esp + 0x14]
xor ecx, eax
mov dword [edi], ecx
test esi, esi
je 0x100289fd
lea eax, [esi + 4]
test eax, eax
je 0x100289fd
mov eax, dword [eax]
xor eax, edx
mov dword [edi + 4], eax
pop edi
pop esi
ret 0xc
xor eax, eax
xor eax, edx
mov dword [edi + 4], eax
pop edi
pop esi
ret 0xc
Function at 0x10028e40
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov ecx, dword [eax + 0x8c]
push edi
add ecx, 8
mov edi, 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx - 8]
add ecx, 0x10
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x1006fa68]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x1006fc68]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x1006fe68]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x10070068]
mov eax, dword [ecx - 0x14]
xor edx, ebx
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x1006fb68]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x1006fd68]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x1006ff68]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x10070168]
xor edx, ebx
mov eax, edx
ror eax, 4
xor eax, dword [ecx - 0x10]
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x1006fa68]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x1006fc68]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x1006fe68]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x10070068]
mov eax, dword [ecx - 0xc]
xor esi, ebx
xor eax, edx
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x1006fb68]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x1006fd68]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x1006ff68]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x10070168]
xor esi, ebx
dec edi
jne 0x10028e62
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
mov edx, dword [esp + 0x1c]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x10029d40
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x10029d50
movzx edx, byte [esi + 0x1006f840]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x100ac890], edx
mov dword [esi*8 + 0x100ac894], eax
inc esi
cmp esi, 0x100
jl 0x10029d50
mov dword [0x100ad098], edi
mov dword [0x100ad09c], edi
mov dword [0x100ad090], edi
mov dword [0x100ad094], edi
pop edi
pop esi
mov byte [0x100ad459], 1
pop ebx
ret

Function at 0x10029dd0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x1006f940]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x100ac088], edx
mov dword [eax*8 + 0x100ac08c], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x10029de0
pop edi
pop esi
pop ebp
mov byte [0x100ad45a], 1
pop ebx
add esp, 0x10
ret
Function at 0x10032410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060e48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10090730]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.100444da
add esp, 4
cmp eax, ebx
je 0x10032506
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 0x18]
push 8
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call fcn.100444da
add esp, 4
cmp eax, ebx
je 0x100324e2
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [esi + 0x40], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov byte [esi + 0x30], bl
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov word [esi + 0x7c], 1
mov byte [esi + 0x7e], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call fcn.100432de
push 0x10087258
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
call fcn.10043d3c
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], ebx
call fcn.100432de
push 0x10087258
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x30], vtable.std::bad_alloc.0
call fcn.10043d3c
int3
Function at 0x1003b990
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
lea eax, [ebp - 0x58]
push 0
push eax
mov dword [ebp - 4], 0
call fcn.10043bc0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x58]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
push 0
mov dword [ebp - 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x1003ba0f
mov ecx, dword [ebp - 0x14]
push esi
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x10]
push edx
call esi
pop esi
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret