joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403e59
pop dword [ebp - 0x30]
mov eax, 0x403e59
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x38db264
sub dword [ebp - 0x40], 0xb53b6d19
mov dword [ebp - 0x3c], 0x84ea255f
sub dword [ebp - 0x3c], 0x52b6d91a
mov dword [ebp - 0x38], 0x1fea6632
add dword [ebp - 0x38], 0x2c61ddfc
mov dword [ebp - 0x34], 0x82aa7a27
add dword [ebp - 0x34], 0x7d5585d9
lea eax, [ebp - 0x40]
push eax
mov eax, 0x55acdb25
add eax, 0xaa93953f
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xf8cf2061
add dword [ebp - 0x40], 0x7ba348f5
mov dword [ebp - 0x3c], 0x92c8a153
sub dword [ebp - 0x3c], 0x515c3fde
mov dword [ebp - 0x38], 0xbd5f90fa
add dword [ebp - 0x38], 0xa60fdb72
mov dword [ebp - 0x34], 0x5a80d12b
sub dword [ebp - 0x34], 0x5a80d12b
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x387b5
push 0
call eax
mov ecx, 0x4ef0
xor esi, esi
add esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x30]
mov ebx, 0x3be26803
add ebx, 0xd756d559
xor dword [ebp - 0x24], 0x31ef7cbf
mov edi, dword [edx]
add edi, ebx
add dword [ebp - 0x10], 0x7dc31537
mov dword [esi], edi
mov dword [ebp - 0x14], 0x41556a48
add esi, 4
add edx, 0x82b4deb8
add edx, 0x7d4b214c
loop 0x403f67
add eax, 0x12e93
mov ebx, eax
add eax, 0xd595ba8d
sub eax, 0xd595ba88
mov ecx, 0x9cca1b05
add ecx, 0x6375e4fb
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x1001d1b
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001294
jmp 0x1001da8
lea eax, [ebp - 0xc]
push eax
push 0x1001280
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1001d69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001258
jmp 0x1001da8
mov eax, dword [ebp - 0xc]
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1001db4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001230
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
pop ecx
xor eax, eax
leave
ret
xor eax, eax
inc eax
leave
ret

Function at 0x19df740
Capabilities:
Encode data using xor

Disassembly:
jmp 0x19df74a
pushal
call 0x19df750
pop ebp
sub ebp, 0x10
sub ebp, 0x15df740
jmp 0x19df766
mov eax, 0x15df740
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0xeb9c0bd4
xor byte [eax], dl
inc eax
dec ecx
jne 0x19df77d
jmp 0x19df790
pop edi
sbb dword [edi + 0x5d], ebx
call 0x5772cc6d
adc eax, 0xd4d4d42c
xlatb
sbb dword [ecx + edx*8 - 0x2c], ebp
aam 0xd4
outsb dx, byte [esi]
cld
aam 0xd4
aam 0x23
xlatb
sbb al, 0x5f
push ebp
fcom st(4)
aam 0xd4
xlatb
adc dword [ecx + ebx*2 + 0x5d28f0b0], eax
sal al, 1
mov esp, 0xd4f5fe30
mov esp, 0xd5e81888
aad 0xf8
invalid
Function at 0x417536
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x425661
call fcn.0041de82
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x41755f
cmp dword [0x458fa4], edi
je 0x417649
push 2
pop ebx
jmp 0x417579
cmp edi, 1
jne 0x417649
mov eax, ebx
call fcn.00418427
test al, al
je 0x417649
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.00418449
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x41762b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4175c0
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov esi, eax
call fcn.00417c20
test eax, eax
je 0x41765d
push 0x1c049f
push 0
call fcn.0041ad61
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x428098], 0
push ebx
mov ecx, 0x458fb8
call fcn.0041ad61
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.00417d37
mov esi, eax
test esi, esi
je 0x4175ac
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.0041846a
inc edi
cmp edi, 2
jl 0x417547
mov eax, esi
call fcn.0041df5a
ret 0x18
push ebx
mov ecx, 0x458fb8
call fcn.0041ad61
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x41763d
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x417698
cmp dword [ebp - 0x20], 3
jne 0x417693
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x417693
and cl, 0xf
cmp cl, 4
je 0x417698
push 2
pop esi
jmp 0x41763d
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.0041846a
xor eax, eax
jmp 0x417655
Function at 0x417b21
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x4256d2
call fcn.0041de82
mov esi, dword [ebp + 8]
cmp esi, dword [0x458fac]
jne 0x417b3f
xor al, al
jmp 0x417c18
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x417b50
xor ecx, ecx
cmp dword [0x458fa4], ecx
jmp 0x417b5b
mov eax, esi
call fcn.00418427
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x417b38
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.00418449
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x417bd9
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x417b8f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.00417c20
test eax, eax
je 0x417bfe
push 0x1c04c2
xor ebx, ebx
push ebx
call fcn.0041ad61
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x458fb8
mov dword [eax + 0x428098], ebx
call fcn.0041ad61
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.00417d37
mov ebx, eax
test ebx, ebx
je 0x417b83
jmp 0x417c0b
push dword [ebp + 8]
mov ecx, 0x458fb8
call fcn.0041ad61
lea ecx, [ebp + 0xf]
call fcn.0041846a
test ebx, ebx
sete al
call fcn.0041df5a
ret 8
Function at 0x41848b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x425728
call fcn.0041de82
mov esi, dword [ebp + 8]
cmp esi, dword [0x458fac]
jne 0x4184a9
xor eax, eax
jmp 0x41860e
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x4184cc
cmp dword [0x458fa4], ebx
je 0x4185ce
push 2
pop edi
jmp 0x4184e6
cmp ebx, 1
jne 0x4185ce
mov eax, esi
call fcn.00418427
test al, al
je 0x4185ce
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.00418449
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x418591
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x41851a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x418546
cmp dword [ebp - 0x1c], 1
je 0x418543
cmp dword [ebp - 0x1c], 2
jne 0x418546
push 2
pop edi
mov eax, edi
call fcn.00417c20
test eax, eax
je 0x4185ae
push 0x1c0496
xor edi, edi
push edi
call fcn.0041ad61
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x458fb8
mov dword [eax + 0x428098], edi
call fcn.0041ad61
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.00417d37
mov edi, eax
test edi, edi
je 0x41850e
jmp 0x4185bf
push dword [ebp - 0x10]
mov ecx, 0x458fb8
call fcn.0041ad61
test edi, edi
je 0x4185da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.0041846a
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x4184b4
jmp 0x4185e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.0041846a
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x418604
cmp dword [ebp - 0x1c], 2
je 0x4185fc
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x41860c
push ecx
call fcn.0041ad61
jmp 0x41860a
push esi
call fcn.0041ad61
mov ecx, eax
mov eax, ecx
call fcn.0041df5a
ret 4
Function at 0x41dddf
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x425fd0
call fcn.0041e44f
xor ebx, ebx
cmp dword [0x45af28], ebx
jne 0x41dbbd
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x45af1c
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x41dbf7
cmp eax, esi
jne 0x41dbea
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x41dbfa
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x41dbd1
xor esi, esi
inc esi
mov eax, dword [0x45af18]
cmp eax, esi
jne 0x41dc0d
push 0x1f
call sub.msvcr100.dll__amsg_exit
pop ecx
jmp 0x41dc48
mov eax, dword [0x45af18]
test eax, eax
jne 0x41dc42
mov dword [0x45af18], esi
push 0x401348
push 0x401334
call sub.msvcr100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41dc48
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41dd1f
mov dword [0x4598a8], esi
mov eax, dword [0x45af18]
cmp eax, esi
jne 0x41dc6c
push 0x401330
push 0x401308
call sub.msvcr100.dll__initterm
pop ecx
pop ecx
mov dword [0x45af18], 2
cmp dword [ebp - 0x1c], ebx
jne 0x41dc79
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x45af2c], ebx
je 0x41dc9a
push 0x45af2c
call fcn.0041ad61
pop ecx
test eax, eax
je 0x41dc9a
push ebx
push 2
push ebx
call dword [0x45af2c]
mov eax, dword [0x459890]
mov ecx, dword [sym.imp.msvcr100.dll___initenv]
mov dword [ecx], eax
push dword [0x459890]
push dword [0x459894]
push dword [0x45988c]
call fcn.0041ad61
add esp, 0xc
mov dword [0x4598a4], eax
cmp dword [0x459898], ebx
jne 0x41dd05
push eax
call dword [sym.imp.msvcr100.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcr100.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x4598a8], ebx
jne 0x41dd13
call dword [sym.imp.msvcr100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4598a4]
call fcn.0041e494
ret
call fcn.0041ad61
jmp 0x41db9c
Function at 0x1000ac68
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [0x100fdd04]
push ebx
push ebp
movzx eax, word [eax + 0xda6]
imul eax, eax, 0x586
push esi
mov esi, dword [0x100fdd28]
movzx ebp, word [0x100fdd40]
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
movzx eax, byte [0x100fdd1c]
mov dword [esp + 0x14], eax
mov eax, esi
div dword [ecx + 0x4200]
mov eax, dword [0x100fdd54]
inc esi
movzx ecx, word [0x100fdd44]
mov dword [0x100fdd28], esi
push edi
mov edi, dword [eax + 0x2d7c]
mov eax, dword [esp + 0x30]
or edi, 0x5ad
inc dword [0x100fdd0c]
movzx ebx, dl
mov dword [esp + 0x10], ebp
mov eax, dword [eax + 0x52c4]
mov dword [esp + 0x30], eax
cmp ecx, dword [ebp + ebx*4 + 0x88]
mov ebp, dword [esp + 0x40]
jne 0x1000ad3a
mov edx, 0x1ae5
imul esi, eax, 6
movzx eax, byte [edx]
xor edx, edx
mov dword [esp + 0x24], 0x1c22
div dword [esp + 0x24]
add edx, ecx
or dword [0x100fdd30], edx
mov edx, 0x1ae5
movzx eax, word [esi + ebp + 0x20]
mov dword [0x100fdd08], eax
mov eax, dword [esp + 0x10]
mov byte [edi + ecx + 7], 0
inc ecx
cmp ecx, dword [eax + ebx*4 + 0x88]
je 0x1000acff
mov ecx, dword [0x100fdd30]
mov ebx, dword [esp + 0x28]
movzx esi, byte [ecx + edi]
jmp 0x1000ad64
mov byte [ecx + edi], 0xea
mov eax, esi
xor edx, edx
mov ecx, dword [0x100fdd30]
div dword [0x100fdd08]
inc esi
mov dword [0x100fdd08], eax
imul eax, ecx, 0xc
inc ecx
cmp esi, dword [eax + ebx]
mov dword [0x100fdd30], ecx
jae 0x1000ad4a
movzx ecx, byte [0x100fdd02]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
pop edi
movzx eax, word [eax + 0x3e3c]
and eax, 0xfcc
xor dword [ecx*4 + 0x1b39], eax
mov ecx, 0x1367
mov eax, dword [esp + 0x2c]
or word [ebp + eax*2], cx
mov eax, dword [esp + 0x14]
movzx ecx, ax
movzx eax, word [0x100fdd34]
mov dword [edx + ecx*8], eax
mov eax, 0x7be
imul esi, dword [0x100fdd30], 6
sub eax, ecx
sub eax, dword [0x100fdd48]
xor edx, edx
mov dword [0x100fdd48], eax
mov eax, dword [0x100fdd10]
mov eax, dword [eax + ecx*4 + 0x98]
mov ecx, dword [esp + 0x18]
sub eax, dword [ecx + 0x3c18]
movzx ecx, word [ebp + 0x30b2]
imul eax, ecx
movzx ecx, word [esi + ebp]
div ecx
mov word [esi + ebp], ax
mov eax, dword [esp + 0x34]
pop esi
pop ebp
and eax, 0xd94
pop ebx
add esp, 0x10
ret
Function at 0x1000b13a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
add dword [esp + 0x18], 0xfffff9c4
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebx, 0x2c27
push edi
mov edi, dword [esp + 0x24]
cmp dword [esi + 0x48], 0x20d0
lea ebp, [edi - 0x29eb]
jae 0x1000b181
mov ecx, dword [0x100e4da4]
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0xe0]
add dword [ecx + 0xb0], eax
jmp 0x1000b18b
mov dword [esi + 0xc4], 0xd13e2
lea eax, [edi - 0x883]
cmp ebp, eax
je 0x1000b2a8
lea eax, [edi + 0x23c]
cmp dword [esp + 0x28], eax
jge 0x1000b1bd
mov edx, dword [0x100e4da4]
mov eax, dword [edx + 0x50]
add eax, 0xbec5
mov dword [0x100fdcdc], eax
jmp 0x1000b2ae
mov ecx, dword [0x100fdc34]
lea eax, [edi - 0xa72]
imul eax, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
add eax, ebx
cmp ecx, eax
jge 0x1000b2a8
mov edx, dword [0x100e4da4]
mov eax, dword [esi + 0x70]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x24]
sub eax, ebp
cmp dword [esp + 0x20], eax
je 0x1000b291
mov ecx, dword [esi + 0xa4]
or edi, 0x24b6
and edi, ebp
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], edi
and dword [esp + 0x2c], ebx
mov eax, ebx
sub eax, dword [0x100fdc54]
push edx
push dword [esp + 0x30]
imul ecx, ecx, 0x1c62
or eax, 0x29eb
push edi
push eax
push ecx
call sym.phy968jx3.dll_ZOT1
mov ebx, eax
add esp, 0x14
mov eax, dword [esi + 0xa4]
mov ecx, eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
sub ecx, eax
add ecx, ebp
or dword [esi + 0xb0], ecx
mov edx, dword [0x100e4da4]
mov ecx, dword [edx + 0x98]
sub ecx, 0xf8f
and ecx, 0x2b17
xor eax, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], eax
add ecx, 4
mov eax, dword [esi + 0x24]
sub eax, ebp
mov dword [esp + 0x20], ecx
cmp ecx, eax
mov ecx, dword [esp + 0x2c]
jne 0x1000b210
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add ecx, 4
add eax, ebx
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x1000b1e4
jmp 0x1000b2ae
mov edx, dword [0x100e4da4]
lea eax, [edi - 0xd89]
cmp dword [esp + 0x28], eax
jle 0x1000b2fc
mov eax, dword [esi + 0xe0]
add eax, 0x4b2f1
cmp dword [0x100fdc60], 0xbe7
mov dword [0x100fdcf4], eax
jb 0x1000b2eb
mov eax, dword [edx]
add eax, dword [0x100fdcd0]
xor eax, 0x1846c
add dword [esi + 0xf4], eax
jmp 0x1000b2fc
mov eax, dword [edx + 0x84]
sub eax, 0x36c64
xor dword [esi + 0xd8], eax
lea eax, [edi + 0x771]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1000b30a
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 8]
add eax, 0xffffda1b
push ebx
push ebp
mov ebp, dword [esp + 0x18]
lea ebx, [ecx - 0x10a]
push esi
mov dword [esp + 0x18], eax
lea esi, [ecx - 0x63c]
push edi
lea eax, [ebx - 0x4f8]
add ebp, 0xfffffa35
lea edi, [edx + 0x14ed]
mov dword [esp + 0x10], edi
cmp esi, eax
je 0x1000b55b
lea ecx, [edx - 0x2168]
lea eax, [edx + 0x834]
cmp ecx, eax
jg 0x1000b55b
lea eax, [ebp + 0x450]
cmp ebx, eax
je 0x1000b4ae
mov esi, dword [esp + 0x28]
cmp dword [esi + 0xd8], 0xfbd9
ja 0x1000b3a0
mov eax, dword [0x100e4da4]
mov ecx, dword [eax + 0xb0]
sub ecx, dword [esi + 0x60]
xor ecx, dword [eax + 0xe0]
mov dword [esi + 0xf4], ecx
jmp 0x1000b3b9
mov eax, dword [esi + 0xac]
add eax, dword [esi + 0x10]
add eax, dword [0x100fdc14]
xor eax, 0x545a4e36
mov dword [0x100fdcfc], eax
xor edx, edx
mov eax, dword [0x100e4da4]
mov eax, dword [eax + 0xb0]
dec eax
or dword [esi + 0x34], eax
mov eax, dword [esi + 0xd8]
add eax, dword [0x100fdcf4]
xor eax, dword [0x100fdcd8]
mov ecx, dword [0x100e4da4]
xor eax, 0x88a68
mov dword [0x100fdcd8], eax
mov eax, dword [ecx + 0xa4]
xor eax, dword [ecx + 0x34]
xor eax, 0x313ee
sub dword [ecx], eax
mov ecx, dword [0x100e4da4]
mov eax, dword [esi + 0x7c]
sub eax, 0xd79d24
add dword [ecx + 0xa4], eax
mov ecx, dword [esi + 0x90]
mov eax, dword [esi + 0x5c]
xor dword [ecx + edx], eax
add edx, 4
mov eax, dword [0x100fdca0]
add dword [esi + 0x5c], eax
mov eax, dword [esi + 0xd0]
sub eax, 0x11f6f7
or dword [0x100fdcdc], eax
mov eax, dword [esi + 0xf4]
xor eax, 0x4b304
sub dword [esi + 0xdc], eax
mov eax, dword [0x100e4da4]
mov eax, dword [eax + 0x9c]
add eax, 0xffe9c538
add eax, dword [esi + 0xdc]
xor dword [esi + 0xb0], eax
cmp edx, 0x70174
jl 0x1000b3bb
mov ecx, dword [esi + 0x90]
xor edi, 0x709
mov dword [esi + 0x80], ecx
mov eax, dword [0x100e4da4]
mov eax, dword [eax + 0x8c]
add eax, dword [esi + 0xd4]
push eax
push dword [0x100fdcc8]
push dword [esi + 0xfc]
call ecx
mov dword [esi + 0xc4], eax
jmp 0x1000b55b
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 0xf0]
xor eax, edi
and eax, dword [0x100fdc24]
cmp edi, eax
jbe 0x1000b51d
mov eax, dword [ecx + 0xa8]
xor eax, dword [ecx + 0xcc]
mov ebx, dword [0x100fdcd0]
xor eax, ebp
cmp ebx, eax
je 0x1000b51d
mov edx, dword [0x100fdcbc]
mov edi, dword [esp + 0x1c]
mov esi, dword [ecx + 0xcc]
xor edx, ebp
xor edx, edi
and esi, 0x2c27
xor edx, dword [ecx + 0x84]
inc ebx
mov dword [0x100fdcbc], edx
mov eax, dword [ecx + 0xa8]
xor eax, dword [ecx + 0xcc]
xor eax, ebp
cmp ebx, eax
jne 0x1000b4e6
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [0x100e4da4]
imul eax, dword [eax + 0xcc], 0x299c
push eax
lea eax, [edx - 0x1070]
xor eax, 0x2b98
push eax
mov eax, dword [ecx + 0x84]
or eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [0x100fdc68]
and eax, edi
or dword [0x100fdcb0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [edi - 0xd3b]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000b9d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
movzx eax, byte [0x100fdd1c]
movzx edx, word [0x100fdd00]
add eax, 0x673
mov cx, word [0x100fdd38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov eax, dword [eax]
mov bl, cl
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x34]
xor edx, dword [esi + eax*8]
inc dword [0x100fdd08]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], edx
movzx edx, byte [0x100fdd02]
mov ebp, dword [esp + 0x10]
imul edx, dword [eax + 0x5240]
inc cx
movzx eax, word [0x100fdd34]
mov dword [esp + 0x1c], eax
mov word [0x100fdd38], cx
mov eax, dword [esi + 0x2ff4]
mov esi, dword [esp + 0x30]
and eax, 0x516
inc dword [edi]
mov ecx, dword [edi]
mov dword [esp + 0x18], eax
mov eax, dword [0x100fdd30]
movzx eax, byte [eax + eax + 0x1eb0]
sub eax, 0x3d
and eax, ebp
xor dword [esi + ecx*4], eax
mov al, byte [0x100fdd02]
mov esi, dword [esp + 0x14]
inc al
mov byte [0x100fdd02], al
movzx ecx, al
mov eax, dword [0x100fdd04]
mov eax, dword [eax + ebp*4]
mov dword [esi + ecx*4], eax
mov ecx, ebp
mov eax, dword [0x100fdd54]
mov bh, cl
mov esi, dword [esp + 0x28]
or bh, 0x3d
mov edx, dword [eax + edx*8]
movzx eax, bl
cmp edx, eax
jge 0x1000bae5
mov esi, dword [esp + 0x2c]
lea ecx, [ecx*8]
add ecx, dword [esp + 0x30]
mov ebp, 0x19b5
movzx eax, word [ebp]
dec bl
mov al, byte [esi + eax*4]
or al, byte [ecx]
movzx eax, al
imul eax, eax, 0xd6
or al, bl
or byte [0x100fdd03], al
inc word [ebp]
mov eax, dword [edi]
xor dword [edi + eax*4], edx
inc edx
movzx eax, bl
cmp edx, eax
jl 0x1000bab4
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ecx, 0xffff
mov edx, dword [esp + 0x2c]
dec bl
mov ebp, dword [esp + 0x30]
add word [eax], cx
mov ax, word [eax]
movzx ecx, ax
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
mov eax, dword [edx + eax*4]
cmp eax, dword [edi + ecx*8]
je 0x1000bb2b
inc dword [esi]
mov ecx, dword [esi]
mov eax, dword [0x100fdd04]
mov edx, dword [ebp]
mov eax, dword [eax + ecx*4 + 0x84]
mov ecx, dword [esp + 0x1c]
cmp eax, dword [ecx + edx*8]
je 0x1000bb69
mov eax, dword [0x100fdd28]
mov edi, 0xf00
sub eax, dword [0x100fdd3c]
mov ecx, dword [0x100fdd14]
sub eax, edi
mov ebp, dword [esp + 0x10]
movzx edi, ax
mov eax, dword [0x100fdd10]
add dword [eax + ecx*8], 0x19ef
mov eax, dword [0x100fdd04]
lea ecx, [eax + ebp*8]
movzx eax, byte [0x100fdd1c]
and dword [ecx], eax
jmp 0x1000bb72
mov ebp, dword [esp + 0x10]
mov edi, 0xf00
movzx eax, byte [0x100fdd02]
lea ecx, [esi + eax*4]
movzx eax, bh
or eax, ebp
cdq
idiv dword [ecx]
mov dword [ecx], edx
mov eax, dword [esi]
mov edx, dword [esp + 0x24]
movzx ecx, bl
sub ecx, dword [edx + eax*4]
dec bh
mov edx, dword [esp + 0x38]
mov dword [esi + ebp*4], ecx
movzx ecx, bh
movzx eax, di
mov eax, dword [edx + eax*8]
and eax, dword [edx + ecx*4]
mov edx, dword [esp + 0x14]
and eax, 0xfc4
or eax, dword [edx + ecx*4]
xor edx, edx
div dword [0x100fdd2c]
mov al, byte [0x100fdd02]
mov ecx, dword [0x100fdd54]
inc al
mov dword [0x100fdd2c], edx
mov byte [0x100fdd02], al
movzx edx, al
lea eax, [edi - 1]
pop edi
pop esi
movzx eax, ax
xor eax, dword [ecx + edx*8]
pop ebp
pop ebx
add esp, 0x10
ret