joyce8/EMBER2024-capa huggingface dataset:
Function at 0x603b70
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x648201
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x603bad
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.0063eafa
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.0063de42
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.005fc950
lea ecx, [esp + 8]
call fcn.0063ed69
lea ecx, [esp + 0x30]
call fcn.0063dfa6
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.0063de42
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.005fcdc0
lea ecx, [esp + 0x74]
call fcn.0063dfa6
lea ecx, [esp + 8]
call fcn.0063ed6a
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.005fa560
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.005fc860
mov ecx, esi
call fcn.005fd400
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.005fc860
mov ecx, esi
call fcn.005fd400
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.005fc860
mov ecx, esi
call fcn.005fd400
mov ecx, dword [edi + 0x5c]
call fcn.005f9d40
push eax
mov ecx, esi
call fcn.005f9d50
mov ecx, dword [edi + 0x5c]
call fcn.005fa300
push eax
mov ecx, esi
call fcn.005fa2a0
mov ecx, dword [edi + 0x5c]
call fcn.005fa420
push eax
mov ecx, esi
call fcn.005fa3d0
mov ecx, dword [edi + 0x5c]
push 0
call fcn.005f9620
push eax
mov ecx, esi
call fcn.005f9630
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.0063df1e
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.0063df1e
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0063eb83
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x6053f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x648427
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.00634f45
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.00634f45
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.00605f10
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x605f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x648500
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00640b07
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x605f93
xor al, al
jmp 0x6060bf
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x605fb5
xor al, al
jmp 0x6060bf
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x605fc8
xor al, al
jmp 0x6060bf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x605fdc
xor al, al
jmp 0x6060bf
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.0063500a
test eax, eax
jne 0x606010
xor al, al
jmp 0x6060bf
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0xbd4a4c
mov dword [esp + 0x20], ebp
call fcn.00640b07
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.0063daf7
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.0063db4e
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x6060a4
mov ax, word [ebx]
test ax, ax
je 0x606096
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.006060e0
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x60607a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0063db4e
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x6065e0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.0063f1a7
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x606626
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.00625288
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0xbf5308
push ecx
call fcn.0062745e
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x609570
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0xbf54fc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x609583
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x6095c4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0xbf55a4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x6095f6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x6095fa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x6095eb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x609618
mov bl, byte [esp + ecx + 0x4c]
jmp 0x60961c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x60960d
xor ecx, ecx
mov eax, 0xbf550c
xor ebx, ebx
mov bl, byte [ecx + 0xbf55b4]
cmp byte [esp + ebx + 0x14], 0
je 0x609647
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0xbf55cc]
cmp byte [esp + ebx + 0x14], 0
je 0x60965e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x60962e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x6095b7
lea edx, [esp + 0x84]
push edx
call fcn.006096a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x610420
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xc3b618]
xor edx, edx
cmp eax, edx
jne 0x610446
xor eax, eax
mov byte [eax + 0xc3b518], al
inc eax
cmp eax, 0x100
jl 0x61042e
mov dword [0xc3b618], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xc3b518
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x6104d7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x6104aa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x610478
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x610550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x6105a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x61058a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x616f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64877e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00617850
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xbd598c
call fcn.00636a1e
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x616fc3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00636a1e
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x616fbc
push 0
mov ecx, eax
call fcn.0060e060
mov dword [esi + 0xc], eax
jmp 0x616fc5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x616fc5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6390bd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6390f5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00637138
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00637110
jmp 0x639101
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x63a8b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x63a8f6
call fcn.00640b07
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x63a8f6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x63a8ed
xor eax, eax
jmp 0x63a8fe
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0063a904
pop edi
pop esi
pop ebx
ret 4

Function at 0x641037
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x641065
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x641083
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00640f9d
jmp 0x641083
mov eax, dword [esi + 0x14]
test eax, eax
je 0x641083
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00640f9d
test edi, edi
mov eax, edi
jne 0x64106d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0xc5a905
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
mov si, cx
push ecx
movzx ecx, si
bswap esi
push edx
cmovge si, sp
push ebx
push ebp
cmovg si, cx
bswap cx
movzx ecx, dx
pushfd
cmovns ebp, ebx
push eax
rdtsc
mov ebp, ebp
push edi
movsx dx, ch
rdtsc
mov edx, 0
movzx ax, al
not bh
cbw
push edx
mov edi, dword [esp + 0x28]
xchg ebp, ebp
dec esi
inc edi
cbw
not edi
mov si, bx
lea edi, [edi + 0x49424d1a]
neg bl
xor edi, 0x5ea202f7
btr bp, 0xf2
adc si, 0x1251
add edi, 0x6de4000a
rcr ch, cl
btr ax, 0xe
mov bx, 0x7735
rol edi, 1
adc ecx, eax
lea edi, [edi + edx]
neg bp
test cx, 0x863
mov ebp, esp
btc eax, esi
bts esi, eax
sub esp, 0xc0
btc eax, eax
rcr al, cl
bts ebx, edx
mov ebx, edi
and si, bp
mov ecx, 0
cmp bp, ax
jmp 0xd0e705
add eax, 0xbf62c96
stc
clc
ror eax, 1
clc
test ecx, edi
xor ebx, eax
add esi, eax
jmp 0xd9c73c
lea esi, [0xcee5aa]
nop
rol al, 0xd2
rcr al, cl
mov eax, dword [edi]
cmp ch, 0xf0
stc
cmc
lea edi, [edi + 4]
stc
cmp esp, 0x23f27115
xor eax, ebx
clc
cmp bp, 0x7b27
xor eax, 0x75d06b22
test ecx, 0x304b4165
bswap eax
cmp edi, 0x459f5c8a
add eax, 0x14da3cc7
rol eax, 3
cmc
jmp 0xcb3544
sub ebx, ecx
jmp 0xcee5aa
push esi
ret
Function at 0xdfa968
Capabilities:
Link many functions at runtime

Disassembly:
mov ecx, edi
jmp 0xd2a7e1
ret 4
mov dword [esp + 0x34], esi
jmp 0xd9bef7
mov ebp, 0xbeaa84
movzx dx, cl
setge dl
call fcn.00625288
lea esp, [esp + 4]
sbb cl, ah
ror ch, 0x66
and eax, 0xffff
cmovs cx, cx
setl ch
mov ecx, 0x16ff24a4
mov ecx, dword [edi + 0x150]
movzx esi, si
xchg esi, esi
push ebp
mov esi, 0x76a22080
cmovbe esi, esi
mov dword [esp + 0x10], eax
mov esi, dword [ecx + ebx*4]
push esi
jmp 0xc972b1
push eax
jmp 0xd8ae2e
jne 0xc74d47
push esi
setnp ch
movsx ecx, ax
mov cl, 0x9d
lea ecx, [esp + 0x30]
jmp 0xd8603a
mov dword [esp + 0x34], ebx
call fcn.00599ce0
jmp 0x599997
jne 0xccf2c3
mov eax, dword [edi + 0x164]
or si, 0x69dc
test ch, 0x43
bt esi, esp
mov ecx, dword [esp + 0x2c]
neg si
and esi, 0x1ca31e41
sbb si, sp
mov esi, dword [eax + ecx*4]
test edi, 0x695b3b66
cmp byte [esi], 0x23
jmp 0xda486e
call fcn.00625288
lea esp, [esp + 4]
and eax, 0xffff
jmp 0xe0f97e
jne 0xd35d31
mov eax, dword [edi + 0x164]
mov eax, dword [eax + ebx*4]
stc
test eax, 0x1acb7922
mov dword [esp + 0x10], eax
cmp byte [eax], 0x23
jmp 0xdb526d
call fcn.005998e0
pop edi
rcl cl, 0x81
btc ax, bp
add ecx, ebp
mov eax, ebx
pop esi
bts ecx, esi
and cx, 0xed8
test cx, cx
pop ebx
mov ecx, dword [esp + 0x10]
cmp bh, bh
mov dword fs:[0], ecx
cmc
test di, 0x368a
add esp, 0x1c
jmp 0xc8e28f
test eax, eax
jmp 0xccf293
push edx
jmp 0xd11892
je 0xdd1bf8
mov esi, dword [edi + 0x1cc]
cmp sp, cx
btc eax, esp
add eax, eax
mov eax, dword [esi - 8]
cmp edx, ebx
jmp 0xd36021
push eax
movzx eax, si
mov eax, dword [edi + 0x1c8]
jmp 0xcb75cd
push 0xbeaeb8
push ecx
jmp 0xd92d81
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
clc
test ebx, ebx
jmp 0xcc2f75
call fcn.005a33a0
add esp, 0xc
cmovge cx, ax
mov eax, dword [eax]
mov cl, 0x1b
setle ch
xchg ecx, ecx
push ebx
push ebx
push ebx
movzx cx, ah
mov cx, ax
movzx ecx, cx
push eax
mov ecx, edi
jmp 0xcc3115
call fcn.00581640
add esp, 4
test si, dx
stc
test eax, eax
jne 0xcaf5df
push 0x3a
jmp 0xd44082
jne 0xdc1292
lea edx, [esi + 1]
jmp 0xd5204f
jne 0xcaf800
inc eax
jmp 0xdea289
mov eax, esi
jmp 0xd7a355
mov ebx, dword [esp + 0x2c]
ror edx, cl
mov edx, dword [edi + 0x18c]
movzx eax, sp
bsr ax, ax
rcl al, cl
mov eax, dword [edx + ebx*4]
test eax, ecx
test eax, eax
jmp 0xd26bae
push eax
jmp 0xcaf7e1
mov eax, dword fs:[0]
cmp edi, eax
push 0xffffffffffffffff
test bp, cx
jmp 0xe21420
jmp 0xd7a355
push 0x643e90
test sp, 0x7660
push eax
mov dword fs:[0], esp
inc eax
lea esp, [esp - 0x10]
push ebx
cbw
and ax, di
push esi
bsr eax, ebp
not eax
push edi
btr di, 0x7a
mov edi, ecx
test ax, 0x4623
mov eax, dword [edi + 0x1c8]
cmc
test eax, eax
jmp 0xd69e0f
Function at 0x101882bb
Capabilities:
Encode data using xor

Disassembly:
call 0x10188234
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x10188264
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x10188280
xor edx, 0
jmp 0x1018828b
xor edx, edx
jmp 0x101882a2
jmp 0x101882ae
xor eax, eax
push 0x8427d7c0
call 0x101882bb
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x101882f7
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x101882d0
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1018830e
add eax, 0
jno 0x10188313
add esi, 0
ret 0x10

Function at 0x1018907c
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x1018909e
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x10189240
cmp edi, dword [ebp + 0x10]
jb 0x10189240
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10188b68
inc edi
jmp 0x10189127
jmp 0x10189134
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10188b68
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10188b68
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x10189188
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1018916c
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.101891b6
add dword [eax], 0x39
jle 0x10189192
sub al, 0xf5
mov ch, al
call fcn.101891cb
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10
Function at 0x1018aea3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x1018aeb9
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x1018aeca
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.1018af0b
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx

Function at 0x1018d277
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x1018d1c0
add ebx, 0
push ecx
call 0x1018d1d5
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x6bf263ec
sub ebx, dword [0x6bf45c2b]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x6bf45c1b
call fcn.10188c9f
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.101881ad
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x1018d333
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x1018d333
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x1018d2ea
mov eax, 1
lock xchg dword [0x6bf45c27], eax
push 0x3dd1fc71
call 0x1018d277
push esi
add esp, 8
cmp eax, 0
jne 0x1018d260
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x1018d286
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x1018d29b
cmp ecx, edx
cmp eax, 0
je 0x1018d2c0
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x1018d2aa
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.1018d2d9
dec eax
loope 0x1018d2dc
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x6bf45c27], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x1018d310
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x1018d325
jmp 0x1018d330
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x1018d21e