joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a50d
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
test eax, eax
push ebx
push esi
push edi
jne 0x40a52f
movzx eax, byte [ebp + 8]
imul eax, eax, 0x14
mov edi, dword [eax + 0x4284e0]
mov dword [ebp - 4], edi
jmp 0x40a534
mov dword [ebp - 4], eax
mov edi, eax
movzx esi, byte [ebp + 8]
imul esi, esi, 0x14
xor ebx, ebx
inc ebx
test dword [esi + 0x4284e4], edi
je 0x40a597
cmp edi, ebx
jne 0x40a57b
cmp dword [0x4284d4], ebx
jne 0x40a59b
mov eax, dword [esi + 0x4284d8]
test eax, eax
je 0x40a59b
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push eax
call dword [ecx + 0xa0]
test eax, eax
jge 0x40a593
and dword [esi + 0x4284d8], 0
and dword [esi + 0x4284e4], 0xfffffffe
cmp edi, 2
jne 0x40a597
xor eax, eax
cmp dword [esi + 0x4284dc], eax
jne 0x40a593
and dword [esi + 0x4284e4], 0xfffffffd
jmp 0x40a5d4
mov eax, ebx
jmp 0x40a608
cmp edi, ebx
jne 0x40a5cd
lea edi, [esi + 0x4284d8]
mov eax, edi
call fcn.0040a1fa
cmp dword [0x4284d4], ebx
mov dword [ebp - 8], eax
jne 0x40a5c7
test eax, eax
je 0x40a5c7
mov edi, dword [edi]
mov eax, dword [edi]
push edi
call dword [eax + 4]
or dword [esi + 0x4284e4], ebx
jmp 0x40a605
and dword [edi], 0
mov edi, dword [ebp - 4]
cmp edi, 2
jne 0x40a605
xor eax, eax
push eax
push eax
push eax
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 0x4284dc], eax
je 0x40a605
push 4
lea ecx, [ebp + 8]
push ecx
push 0x41
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
or dword [esi + 0x4284e4], 2
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ac64
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
push 0x80000001
call edi
test eax, eax
jne 0x40aca4
push dword [ebp + 8]
lea esi, [ebp - 4]
push 0x41a648
call fcn.004069bd
test eax, eax
pop ecx
pop ecx
jne 0x40acd2
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push ebx
push 0x80000002
call edi
test eax, eax
je 0x40acc0
xor eax, eax
jmp 0x40acd2
push dword [ebp + 8]
lea esi, [ebp - 4]
push 0x41a648
call fcn.004069bd
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..pdata
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6e8525b2
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x5f457d06
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401748
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x403868
call fcn.00401e50
push 1
call fcn.0040191e
pop ecx
test al, al
jne 0x4015f9
push 7
call fcn.00401c3e
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004018e9
mov byte [ebp - 0x24], al
mov eax, dword [0x4043c4]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4015f2
test eax, eax
jne 0x401663
mov dword [0x4043c4], ecx
push 0x40310c
push 0x403100
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x401646
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401742
push 0x4030fc
push 0x4030f4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4043c4], 2
jmp 0x401668
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00401a8b
pop ecx
call fcn.00401c32
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x401698
push esi
call fcn.00401a01
pop ecx
test al, al
je 0x401698
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00401e49
call esi
call fcn.00401c38
mov esi, eax
cmp dword [esi], edi
je 0x4016b6
push esi
call fcn.00401a01
pop ecx
test al, al
je 0x4016b6
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov edi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
push eax
push edi
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.00401d5a
test al, al
jne 0x4016e6
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4016ef
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.00401aa8
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x401742
call fcn.00401e96
ret
call fcn.00401b6f
jmp 0x4015da

Function at 0x40979c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
xor ecx, ecx
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ecx
jbe 0x409806
nop dword [eax]
lea eax, [ebx + 1]
movzx ebx, al
mov dl, byte [ebx + edi]
movzx eax, dl
add eax, ecx
movzx ecx, al
mov dword [ebp - 8], ecx
movzx eax, byte [ecx + edi]
mov byte [ebx + edi], al
mov byte [ecx + edi], dl
movzx ecx, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x4097f3
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov ecx, dword [ebp - 4]
xor byte [esi + ecx], al
inc esi
mov ecx, dword [ebp - 8]
cmp esi, dword [ebp + 8]
jb 0x4097bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0a60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov eax, ecx
mov ebx, dword [esp + 0x10]
cdq
and edx, 7
push ebp
add eax, edx
and ecx, 7
sar eax, 3
push esi
mov esi, dword [esp + 0x10]
test eax, eax
mov ebp, ecx
jle 0x4c0aab
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.004bb900
xor ecx, ecx
and eax, 0xff
mov cl, bh
xor edx, edx
xor eax, ecx
mov dh, bl
mov ebx, dword [eax*4 + 0x4cb274]
xor ebx, edx
dec edi
jne 0x4c0a86
pop edi
test ebp, ebp
jle 0x4c0ad7
push 1
mov ecx, esi
call fcn.004bb900
mov ecx, ebx
and ebx, 0x7fff
shr ecx, 0xf
and ecx, 1
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x4c0ad4
xor ebx, 0x8005
dec ebp
jne 0x4c0aaf
pop esi
mov eax, ebx
pop ebp
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
sub byte [esi + ebx], 0x68
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x2d
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x97
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xf8
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x21
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0xef
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x3b
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x22
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x1d
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x90
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xdf
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x2c
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xfe
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x35
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb9
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3a5a6323
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x709a6666
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40f090
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4421b0]
jne 0x40f09a
repz ret
jmp fcn.004158a0
Function at 0x42b7b0
Capabilities:
Create directory
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1278
call fcn.0040fca0
cmp dword [0x8dd51c], 0x37
jne 0x42b8c1
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x1260]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
push 0
push 0
lea ecx, [ebp - 0x9c8]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push str.moripo_hojidodigim
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push str.yuwalepalubabejuzoduxedoxebika_puriy
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1278], 0
xor edx, edx
mov dword [ebp - 0x1274], edx
mov dword [ebp - 0x1270], edx
mov dword [ebp - 0x126c], edx
mov dword [ebp - 0x1268], edx
lea eax, [ebp - 0x1278]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileGather]
push 0
lea ecx, [ebp - 0x11c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push str.lifozikiwewapat_tipedupime_zus
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0
push 0
lea eax, [ebp - 0x8a8]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call dword [sym.imp.KERNEL32.dll_GetACP]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
push str.Wiyomogeputud
push 0
push str.Notonolugon_dorefironat_yolupixire_fexotodu_lirinohaz
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 4], 0
mov eax, dword [0x8ddc18]
add dword [ebp - 4], eax
mov eax, 0x8c456
add dword [ebp - 4], eax
mov ecx, dword [0x8dc858]
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
add edx, dword [ebp + 8]
mov al, byte [edx]
mov byte [ecx], al
mov esp, ebp
pop ebp
ret 4
Function at 0x42be50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [0x8dd51c], 0x516
jne 0x42be70
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFix]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
jmp 0x42be91
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x42becd
cmp dword [0x8dd51c], 0x29
jne 0x42beaa
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*4]
push ecx
call fcn.0042bbc0
jmp 0x42be88
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001fe0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 0x14]
push ebx
mov ecx, eax
push esi
neg ecx
sbb ecx, ecx
xor edx, edx
and ecx, 0x40000000
push edi
add ecx, 0x80000000
mov esi, eax
test eax, eax
setne dl
inc edx
mov edi, edx
mov edx, eax
neg edx
sbb edx, edx
add edx, 3
neg esi
sbb esi, esi
and esi, 2
add esi, 2
neg eax
sbb eax, eax
and al, 0xfe
add eax, 4
mov ebx, eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10002030
mov edx, 3
mov eax, dword [esp + 0x10]
push 0
push 0x80
push edx
push 0
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x10002058
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [esp + 0x20]
push 0
push ecx
push 0
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, dword [esp + 0x18]
test eax, eax
mov dword [esi], eax
jne 0x10002084
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [edx], eax
jne 0x100020b5
mov eax, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [edi]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [edi]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop edi
pop esi
pop ebx
ret

Function at 0x10002110
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push 0x40
push edi
push esi
call fcn.100020f0
add esp, 0xc
cmp word [esi], 0x5a4d
je 0x10002135
pop edi
mov eax, 0xea61
pop esi
ret
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x10002144
pop edi
mov eax, 0xea62
pop esi
ret
mov esi, dword [esp + 0x14]
add eax, edi
push 0xf8
push eax
push esi
call fcn.100020f0
mov eax, dword [esi]
add esp, 0xc
cmp eax, 0x4550
je 0x1000216a
pop edi
mov eax, 0xea62
pop esi
ret
cmp word [esi + 4], 0x14c
je 0x1000217a
pop edi
mov eax, 0xea65
pop esi
ret
test byte [esi + 0x17], 0x10
je 0x10002188
pop edi
mov eax, 0xea66
pop esi
ret
mov edx, dword [esi + 0x74]
mov eax, 0x10
cmp eax, edx
pop edi
sbb eax, eax
pop esi
and eax, 0xea67
ret
Function at 0x10002240
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push esi
push edi
xor edi, edi
lea esi, [eax + 0x1e]
push 0xa
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.100020f0
mov al, byte [esp + 0x14]
add esp, 0xc
cmp al, 0x54
jne 0x10002276
mov al, byte [esp + 9]
cmp al, 0x44
je 0x10002281
cmp al, 0x64
je 0x10002285
cmp al, 0x53
je 0x10002281
inc edi
add esi, 0xa
cmp edi, 3
jl 0x1000224e
jmp 0x100022c2
cmp al, 0x64
jne 0x1000229b
xor eax, eax
mov dl, byte [esp + 0x11]
mov cl, byte [esp + eax + 0xa]
xor cl, dl
mov byte [esp + eax + 0xa], cl
inc eax
cmp eax, 7
jl 0x10002287
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0xa]
mov ecx, dword [esp + 0x1c]
xor edx, 0x198931
xor eax, 0x19611225
and edx, 0xffffff
mov dword [ecx], eax
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [eax], edx
cmp edi, 3
pop edi
pop esi
jne 0x100022dd
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx], 0
mov dword [edx], 0
xor eax, eax
add esp, 0xc
ret

Function at 0x100022f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
lea edx, [eax + 0x1f]
mov al, byte [edx - 1]
lea ecx, [edx - 1]
cmp al, 0x54
jne 0x10002312
mov al, byte [edx]
cmp al, 0x44
je 0x1000231f
cmp al, 0x64
je 0x1000231f
cmp al, 0x53
je 0x1000231f
inc esi
add edx, 0xa
cmp esi, 3
jl 0x100022fa
xor eax, eax
pop esi
ret
mov esi, dword [esp + 0xc]
mov dl, byte [ecx + 9]
push edi
mov edi, dword [esp + 0x14]
sub esi, edi
lea eax, [ecx + 6]
xor esi, 0x198931
pop edi
mov dword [eax], esi
mov byte [ecx + 9], dl
cmp byte [ecx + 1], 0x64
jne 0x1000231b
mov esi, 0xfffffffe
push ebx
sub esi, ecx
mov dl, byte [ecx + 9]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
lea edx, [esi + eax]
cmp edx, 7
jl 0x1000234a
pop ebx
xor eax, eax
pop esi
ret
Function at 0x10002d38
Capabilities:
Parse pe header

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.1000f49d
mov esi, dword [esp + 0x14]
push edi
push 1
push 0x40
push esi
call fcn.1000461a
add esp, 0x14
cmp eax, 1
je 0x10002d62
mov eax, 0xea63
jmp 0x10002dd9
cmp word [esi], 0x5a4d
je 0x10002d70
mov eax, 0xea61
jmp 0x10002dd9
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x10002d7e
mov eax, 0xea62
jmp 0x10002dd9
push 0
push eax
push edi
call fcn.1000f261
mov esi, dword [esp + 0x20]
push edi
push 1
push 0xf8
push esi
call fcn.1000461a
add esp, 0x1c
cmp eax, 1
je 0x10002da8
mov eax, 0xea64
jmp 0x10002dd9
cmp dword [esi], 0x4550
jne 0x10002d77
cmp word [esi + 4], 0x14c
je 0x10002dbf
mov eax, 0xea65
jmp 0x10002dd9
test byte [esi + 0x17], 0x10
je 0x10002dcc
mov eax, 0xea66
jmp 0x10002dd9
push 0x10
pop eax
cmp eax, dword [esi + 0x74]
sbb eax, eax
and eax, 0xea67
pop edi
pop esi
ret
Function at 0x1000530e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x10], 0
je 0x10005331
mov ecx, dword [ebp + 0x14]
shl ecx, 8
or ecx, dword [ebp + 0x18]
shl ecx, 8
or ecx, dword [ebp + 0x1c]
mov dword [0x1003d394], ecx
jmp 0x1000534f
lea eax, [ebp - 8]
mov dword [0x1003d284], eax
call fcn.10009dc1
mov ecx, dword [ebp - 8]
test eax, eax
mov dword [0x1003d394], ecx
jne 0x100053e9
push ebx
push esi
push edi
push 1
mov dword [0x1003d39c], ecx
call fcn.10005240
push 2
push 0
push dword [ebp + 8]
mov bl, al
mov eax, dword [0x1003d394]
mov dword [0x1003d39c], eax
call fcn.1000f261
push dword [ebp + 8]
call fcn.1000f31a
push dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
call fcn.1000f49d
mov edi, str.Goldensof
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x1c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
xor byte [ebp + eax - 0x1c], bl
inc eax
cmp eax, 9
jl 0x100053b4
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x13], bl
push 0xa
push 1
push eax
call fcn.1000f5ab
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
call fcn.100044de
add esp, 0x24
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000696e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.1000fb00
mov ecx, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
cmp word [ecx + 6], si
push edi
jbe 0x10006a9c
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + 0x24]
test dl, 0x20
je 0x10006a9c
test edx, 0x40000000
je 0x10006a9c
cmp dword [ecx + 0x7c], esi
je 0x100069c7
mov ecx, dword [ecx + 0x78]
mov edx, dword [eax + 0xc]
cmp ecx, edx
jbe 0x100069c7
mov edi, dword [eax + 8]
add edi, edx
cmp ecx, edi
jae 0x100069c7
xor eax, eax
jmp 0x10006a9f
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0x10]
cmp edx, ecx
mov dword [ebp + 0x10], edx
jbe 0x100069d7
mov dword [ebp + 0x10], ecx
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp + 8]
push esi
push eax
push ebx
mov dword [ebp + 0x14], eax
call fcn.1000f261
add esp, 0xc
cmp dword [ebp + 0x10], esi
je 0x10006a9c
mov edi, 0x1000
cmp dword [ebp + 0x10], edi
push ebx
jbe 0x10006a3c
push edi
lea eax, [ebp - 0x1000]
push 1
push eax
call fcn.1000461a
mov esi, eax
add esp, 0x10
xor ecx, ecx
lea eax, [esi - 3]
test eax, eax
jle 0x10006a2d
mov edx, dword [ebp + 0x1c]
xor dword [ebp + ecx - 0x1000], edx
add ecx, 4
cmp ecx, eax
jl 0x10006a1c
push 0
push dword [ebp + 0x14]
push ebx
call fcn.1000f261
push ebx
push edi
jmp 0x10006a7b
push dword [ebp + 0x10]
lea eax, [ebp - 0x1000]
push 1
push eax
call fcn.1000461a
mov esi, eax
add esp, 0x10
xor ecx, ecx
lea eax, [esi - 3]
test eax, eax
jle 0x10006a6c
mov edx, dword [ebp + 0x1c]
xor dword [ebp + ecx - 0x1000], edx
add ecx, 4
cmp ecx, eax
jl 0x10006a5b
push 0
push dword [ebp + 0x14]
push ebx
call fcn.1000f261
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x1000]
push 1
push eax
call fcn.100046a0
sub dword [ebp + 0x10], esi
add dword [ebp + 0x14], esi
add esp, 0x1c
cmp dword [ebp + 0x10], 0
jne 0x100069f9
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret