joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101afb94
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101af787

Function at 0x101afb9f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101af911

Function at 0x101b7464
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101b6e2c

Function at 0x101c1054
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101c0f28

Function at 0x101c42a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101deefb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x102445d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
lea esi, [edi + 0x18]
mov dword [edi], vtable.MFOutputBitstream.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov word [edi + 0x14], 0
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
push 8
lfence
call fcn.10165483
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
lea eax, [edi + 0x30]
mov byte [edi + 0x2c], 0
mov dword [ebp - 0x10], eax
lea esi, [eax + 8]
mov dword [eax], vtable.MFSampleExtradataTransport.0
mov dword [eax + 4], 1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x18
lfence
call fcn.10165483
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x40], 0
mov byte [edi + 0x44], 0
movsd qword [edi + 0x48], xmm0
mov dword [edi + 0x50], 0
mov word [edi + 0x54], 0
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101c61a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x101c61c6
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.1018b257
push dword [esi + 4]
call fcn.101862c6
add esp, 0x14
pop esi
pop ebp
ret 8
Function at 0x401a6c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 8
call fcn.00406858
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x401ab3
cmp dword [ebp + 0x14], 0
je 0x401ab3
xor eax, eax
jmp 0x401ab8
mov eax, 1
test eax, eax
je 0x401aec
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_GetCursorPos]
nop
nop
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov dword [ebp + 8], eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00406ff0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401b21
push ebx
call fcn.00406852
add esp, 4
pop eax
mov dword [ebp - 8], eax
push dword [ebp + 0x10]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
nop
nop
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
call fcn.00401b9e
push eax
push 0x100
push 0xd
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
mov eax, dword [ebp - 8]
test eax, eax
je 0x401b75
push eax
mov ebx, eax
call fcn.00401a01
inc eax
push eax
call fcn.00406858
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x401b7a
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.00406852
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401b97
push ebx
call fcn.00406852
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404e1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x404e63
cmp ebx, 0x20
je 0x404e63
cmp ebx, 0xffffffe0
je 0x404e63
jne 0x404e6c
add eax, 1
cmp esi, eax
je 0x404e79
jne 0x404e48
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x404e7d
jne 0x404e44
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x404e91
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x404f52
test ecx, ecx
je 0x404f52
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x404f52
test ebx, ebx
je 0x404f52
mov ebx, eax
add ebx, edx
je 0x404f52
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x404f52
cmp dword [edx + eax + 0x14], 0
je 0x404f52
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x404f52
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x404f42
test dl, dl
je 0x404f3e
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x404f42
add edi, 2
add esi, 2
test dl, dl
jne 0x404f22
xor eax, eax
jmp 0x404f47
sbb eax, eax
or eax, 1
test eax, eax
je 0x404f5e
inc ebp
cmp ebp, dword [esp + 4]
jb 0x404f0f
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x405ebf
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x405eed
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x405ee4
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x405edc
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x405f0e
mov esp, ebp
pop ebp
ret

Function at 0x405f12
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x405f7e
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x405fab
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x405f9a
xor ecx, eax
xor edx, ebx
dec edi
jne 0x405f8b
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x405fd1
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x405f72
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x405ffd
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4073d0
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.00406a50
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x407427
push ebx
push edi
call fcn.00406af0
push esi
mov ebx, esi
call fcn.00406a50
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x4073fe
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4074c0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.00407ee0
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call dword [0x430fec]
add esp, 8
test ebp, ebp
je 0x40758a
test eax, eax
je 0x40758a
inc eax
push ebx
push eax
call fcn.00408217
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004081f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40752c
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407566
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407579
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call fcn.004081e1
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x4075a0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x407621
je 0x407612
cmp eax, 0x80000101
ja 0x40760b
je 0x407612
cmp eax, 0x80000004
je 0x4075ec
cmp eax, 0x80000005
jne 0x407636
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x407683
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x407683
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call dword [0x430fec]
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x407683
cmp eax, 0x80000201
jne 0x407636
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x407683
cmp eax, 0x80000401
je 0x40766e
cmp eax, 0x80000501
je 0x407656
cmp eax, 0x80000601
je 0x40763e
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.00408118
mov dword [esp + 0xc], eax
jmp 0x40767f
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.00408118
mov dword [esp + 0xc], eax
jmp 0x40767f
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.00407ee0
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call dword [0x430fec]
add esp, 8
test esi, esi
je 0x40775c
test eax, eax
je 0x40775c
inc eax
push edi
push eax
call fcn.00408217
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004081f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4076fe
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x407752
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x407747
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.004081e1
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x4077d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4077ee
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4077e3
pop esi
ret
Function at 0x45bc25
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xee
xlatb
and ebx, dword [eax]
fxam
xor al, byte fs:[ecx + 0xc]
xor al, byte [ecx + 0xc]
jl 0x45bc28
salc
adc byte [ecx], bl

Function at 0x47ba31
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xb208d834
push ebp
sbb eax, dword [ecx]
push ebp
popfd
in al, 0xea
movsd dword es:[edi], dword [esi]
and cl, ch
cwde
and dword [eax + eax + 0x38bd047d], esi
mov dl, 0x99
cdq
dec esp
and eax, 0xc0c2fe6d
ror byte [esp - 0x2d6d3a00], 1
call 0x62417fcf
popal
popal
xor dword [ecx + 2], 0xffffffa1
popfd
test dword [edi - 0x18], ebx
sub dword [edi + edi], edx
sahf
std
dec esp
push 0xed45e4cb
xchg ebp, ecx
scasd eax, dword es:[edi]
out dx, eax
pushal
mov eax, 0xd7461cec
cmp al, 0xef
or ebp, dword ds:[esp - 0x16b3f3f4]
mov al, byte [0x38560dce]
push ds
push eax
jns 0x47ba1f
jb 0x47ba07
or al, 0x88
adc al, 0x79
mov ebp, 0x7ef09fd2
loop fcn.0047ba31
dec edx
add al, 0x1c
mov ebx, 0x991ccdfb
in al, 0xac
fmul qword [ecx - 0x1e]
test dword [eax + eax*8 + 0x1dbf6d2c], eax
xchg edx, ecx
xor ebx, dword [ebp + 0x51]
rcl dword [ecx], 0xcf
aaa
int3

Function at 0x4bad51
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c5398
cmp edx, dword [eax]
je 0x4bad73
add eax, 8
inc ecx
cmp eax, 0x4c5428
jl 0x4bad64
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c5398]
jne 0x4baea1
mov eax, dword [0x4c9d24]
cmp eax, 1
je 0x4bae7b
test eax, eax
jne 0x4bada4
cmp dword [0x4c52c0], 1
je 0x4bae7b
cmp edx, 0xfc
je 0x4baea1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baddb
lea eax, [ebp - 0x1a4]
push 0x4c0d58
push eax
call fcn.004bb730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbbc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bae1e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbbc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0d54
push edi
call fcn.004bda90
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0d38
push eax
call fcn.004bb730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb740
lea eax, [ebp - 0xa0]
push 0x4c0d34
push eax
call fcn.004bb740
push dword [esi + 0x4c539c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb740
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0d0c
push eax
call fcn.004bda04
add esp, 0x2c
pop edi
jmp 0x4baea1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c539c]
push 0
push eax
push dword [esi]
call fcn.004bbbc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x71d04d
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov dword [esp], eax
mov dword [esp], esi
push eax
mov eax, 0x12c9d342
mov dword [esp + 4], eax
pop eax
mov dword [esp], ecx
add ecx, 0x5edf7824
add ecx, 0x7f37040e
add ecx, eax
sub ecx, 0x7f37040e
push esi
push edx
mov dword [esp], 0x5edf7824
pop esi
sub ecx, esi
pop esi
mov ecx, dword [esp]
push ecx
mov ecx, esp
add ecx, 4
push edi
push 4
pop edi
add ecx, 0x7b7d4295
add ecx, edi
sub ecx, 0x7b7d4295
pop edi
xchg dword [esp], ecx
pop esp
push dword [0x4c5038]
mov ecx, dword [esp]
push edx
mov edx, esp
push ebx
mov ebx, 0x67dfb9e6
shr ebx, 4
neg ebx
add ebx, 0x6ede0bba
xor ebx, 0x68601018
add edx, ebx
pop ebx
add edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
jmp fcn.007728f1
xor eax, eax
push esi
mov dword [esp], eax
mov dword [esp], 0x636b0a18
mov dword [esp], ecx
mov dword [esp], 0x237a3b5e
mov dword [esp], edx
push ebp
mov dword [esp], 0x7ae8bae4
mov dword [esp], ebx
mov dword [esp], 0x5100c87
mov dword [esp], ecx
pop edx
mov edx, dword [esp]
push 0x15752cc3
mov dword [esp], edx
mov edx, esp
push ebx
mov ebx, 0x2feaa36e
not ebx
not ebx
sub ebx, 0x7fbe1bfd
xor ebx, 0xb02c8775
sub edx, 0x7feccd29
add edx, ebx
add edx, 0x7feccd29
pop ebx
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0x71cfaa
xor edi, dword [esp]
xor dword [esp], edi
cmp al, 0x24
xor edi, dword [esp]
mov esp, dword [esp]
push 0x75ab91e7
mov dword [esp], ecx
mov dword [esp], eax
mov dword [esp], edx
pop dword [0x4c5030]
jmp 0x603444
push edi
push esp
pop edi
add edi, 4
sub edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
mov dword [esp], esi
mov dword [esp], eax
push 0xb89be9e
mov dword [esp], ebx
push dword [esp]
mov eax, dword [esp]
add esp, 4
add esp, 4
mov eax, dword [esp]
push 0x663c7ed6
mov dword [esp], ecx
mov dword [esp], ebp
push esp
pop ebp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
mov al, byte [0x4c5043]
push ecx
mov ecx, esp
push esi
mov esi, 4
add ecx, esi
pop esi
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], edx
mov dword [esp], 0x3894119f
mov dword [esp], eax
push 0x13669b6d
mov dword [esp], ebx
mov eax, dword [esp]
sub esp, 4
mov dword [esp], eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
push dword [esp]
push dword [esp]
pop eax
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x5c6094
Function at 0x933a6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.0094eadc
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x973a32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.0094eadc
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x973a32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 4]
xor eax, 0x12476359
mov dword [ebp + 4], eax
push eax
mov eax, dword [ebp]
xor eax, 0x97815643
mov dword [ebp], eax
push eax
mov ebx, dword [ebp - 4]
call fcn.00933a4d
mov eax, 0
cmp eax, ecx
jl 0x933b05
push 0x20b
push 0x4011022
push 1
call fcn.0094eaf4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.00933a4d
mov eax, 0
cmp eax, ecx
jl 0x933b38
push 0x234
push 0x4011022
push 1
call fcn.0094eaf4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x933b4e
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x933b76
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x933b70
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x933b8f
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.0094f9d0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x933beb
push ebx
call fcn.0094ead6
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x933c00
push eax
pushfd
mov eax, dword [esp + 8]
xor eax, 0x97815643
mov dword [ebp], eax
mov eax, dword [esp + 0xc]
xor eax, 0x12476359
mov dword [ebp + 4], eax
xchg dword [esp + 4], eax
popfd
pop eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0094ead6
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.0094ead6
add esp, 4
mov esp, ebp
pop ebp
ret 0xc