joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007b820
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push edi
xor edi, edi
mov esi, 0x10458100
push edi
push str.socket_main__d
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.1005f880
xor eax, eax
add esp, 0x10
mov dword [edi*4 + 0x104580fc], eax
push eax
mov dword [edi*4 + 0x104580f8], eax
mov dword [esi], eax
push eax
mov dword [esi + 4], eax
push eax
mov dword [esi + 8], eax
call ebx
mov dword [edi*4 + 0x1045810c], eax
test eax, eax
je 0x1007b8c2
push edi
lea ecx, [ebp - 0x88]
push 0x1007b030
push ecx
call fcn.10063770
add esp, 0xc
test eax, eax
je 0x1007b8c2
mov dword [edi*4 + 0x104580f8], eax
add esi, 0xc
inc edi
cmp esi, 0x1045810c
jl 0x1007b843
push 0
push 0
push 0
call ebx
mov dword [0x1045b914], eax
test eax, eax
jne 0x1007b8c9
mov edi, 0x2791
jmp 0x1007b940
lea edx, [ebp - 0x218]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
push 0x80
mov edi, 0x1045839c
mov dword [0x104583a8], eax
mov dword [0x104583ac], eax
mov dword [0x104583b0], eax
mov dword [0x1045839c], eax
mov dword [0x104583a0], eax
mov dword [0x104583a4], eax
call fcn.10060da0
add esp, 4
push 0
push 0
push 0
call ebx
mov dword [0x104580f4], eax
test eax, eax
jne 0x1007b925
mov edi, 0x2791
jmp 0x1007b940
push 0
mov esi, 0x10458110
call fcn.10088570
mov edi, eax
add esp, 4
test edi, edi
je 0x1007b9cd
mov edi, edi
mov eax, dword [0x104580f8]
test eax, eax
je 0x1007b95e
push eax
call fcn.100638c0
add esp, 4
xor eax, eax
mov dword [0x104580fc], eax
mov dword [0x104580f8], eax
mov eax, dword [0x1045810c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1007b97a
push eax
call esi
mov dword [0x1045810c], 0
push 0x1045839c
call fcn.10060ff0
mov eax, dword [0x104580f4]
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x1007b99b
push eax
call esi
mov dword [0x104580f4], ebx
push 0x10458110
call fcn.10088840
mov eax, dword [0x1045b914]
add esp, 4
cmp eax, ebx
je 0x1007b9e5
push eax
call esi
mov dword [0x1045b914], ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1045b8f0]
push str.MSPSOCKET
push eax
call fcn.10061b60
add esp, 8
mov dword [0x1045b910], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1007c970
Capabilities:
Create thread

Disassembly:
push 0x14
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [0x1045b91c], eax
test eax, eax
jne 0x1007c98a
mov eax, 0x2775
ret
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
xor eax, eax
cmp eax, 0x104583b4
je 0x1007c9bb
mov dword [0x104583b4], eax
mov dword [0x104583b8], eax
mov dword [0x104583bc], eax
mov dword [0x104583c0], eax
mov dword [0x104583c4], eax
mov dword [0x104583c8], eax
xor eax, eax
push edi
push 0x40
mov edi, 0x104583cc
mov dword [0x104583cc], eax
mov dword [0x104583d0], eax
mov dword [0x104583d4], eax
call fcn.10060da0
add esp, 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [0x1045b91c]
mov dword [ecx], eax
pop edi
test eax, eax
jne 0x1007ca0f
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov dword [0x1045b91c], 0
mov eax, 0x2791
ret
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [0x1045b91c]
mov dword [ecx + 4], eax
test eax, eax
jne 0x1007ca3f
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1045b91c]
test eax, eax
je 0x1007c9ff
push eax
jmp 0x1007c9f6
push 0
push 0
push ecx
push 0x1007c2b0
push 0
push 0
mov dword [ecx + 8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x1007ca90
mov edx, dword [0x1045b91c]
mov eax, dword [edx]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [0x1045b91c]
mov edx, dword [ecx + 4]
push edx
call esi
mov eax, dword [0x1045b91c]
pop esi
test eax, eax
je 0x1007c9ff
push eax
jmp 0x1007c9f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1045b8f0]
push str.MSPADNS
push eax
call fcn.10061b60
mov dword [0x1045b918], eax
add esp, 8
xor eax, eax
ret
Function at 0x1007fc40
Capabilities:
Parse credit card information

Disassembly:
add ecx, 0xfffffffe
cmp ecx, 8
ja case.default.0x1007fc4c
jmp dword [ecx*4 + 0x1007fd64]
cmp al, 0x40
jne 0x1007fc5d
mov eax, 4
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x1007fc6c
cmp cl, 0x7a
jbe 0x1007fcbc
cmp al, 0x30
jl 0x1007fc74
cmp al, 0x39
jle 0x1007fcbc
cmp al, 0x2d
je 0x1007fcbc
cmp al, 0x5f
je 0x1007fcbc
cmp al, 0x2e
je 0x1007fcbc
cmp al, 0x21
je 0x1007fcbc
cmp al, 0x7e
je 0x1007fcbc
cmp al, 0x2a
je 0x1007fcbc
cmp al, 0x27
je 0x1007fcbc
cmp al, 0x28
je 0x1007fcbc
cmp al, 0x29
je 0x1007fcbc
cmp al, 0x25
je 0x1007fcbc
cmp al, 0x3b
je 0x1007fcbc
cmp al, 0x3a
je 0x1007fcbc
cmp al, 0x26
je 0x1007fcbc
cmp al, 0x3d
je 0x1007fcbc
cmp al, 0x2b
je 0x1007fcbc
cmp al, 0x24
je 0x1007fcbc
cmp al, 0x2c
jne case.default.0x1007fc4c
mov eax, 3
ret
cmp al, 0x5b
jne 0x1007fccc
mov eax, 5
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x1007fcdb
cmp cl, 0x7a
jbe 0x1007fcef
cmp al, 0x30
jl 0x1007fce3
cmp al, 0x39
jle 0x1007fcef
cmp al, 0x2e
je 0x1007fcef
cmp al, 0x2d
je 0x1007fcef
cmp al, 0x5f
jne case.default.0x1007fc4c
mov eax, 6
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x1007fd04
cmp cl, 0x7a
jbe 0x1007fcef
cmp al, 0x30
jl 0x1007fd0c
cmp al, 0x39
jle 0x1007fcef
cmp al, 0x2e
je 0x1007fcef
cmp al, 0x2d
je 0x1007fcef
cmp al, 0x5f
je 0x1007fcef
cmp al, 0x3a
jne case.default.0x1007fc4c
mov eax, 9
ret
cmp al, 0x5d
jne case.0x1007fc4c.5
mov eax, 8
ret
cmp al, 0x30
jl 0x1007fd34
cmp al, 0x39
jle 0x1007fd4b
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x1007fd43
cmp cl, 0x66
jbe 0x1007fd4b
cmp al, 0x3a
je 0x1007fd4b
cmp al, 0x2e
jne case.default.0x1007fc4c
mov eax, 7
ret
sub al, 0x30
cmp al, 9
mov eax, 0xa
jbe 0x1007fd61
mov eax, 1
ret
Function at 0x100840b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x100840c3
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x1008413d
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call sub.MSVCR100.dll_memcpy
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x10084111
sub eax, edi
jmp 0x10084113
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x10084102
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x10084130
sub eax, edi
jmp 0x10084132
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x10084121
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x1008426a
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x10084163
mov ebx, ecx
test ebx, ebx
je 0x100841b7
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x10084184
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
call fcn.10095830
jmp 0x1008419c
cmp eax, 2
jne 0x100841a5
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x10084196
xor eax, eax
jmp 0x100841a2
push ebx
call fcn.10095ab0
mov edx, dword [ebp - 8]
add esp, 4
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call sub.MSVCR100.dll_memcpy
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x100841df
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x100841f3
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x100840c0
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x1008426a
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x10084239
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x1008421a
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
add ebx, edi
pop edi
mov dword [esi + 0x16c0], ebx
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x1008426a
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x10084253
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009e310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea ecx, [ebp - 0x208]
mov edi, 0x200
mov dword [ebp - 0x218], ecx
mov ecx, edi
lea esi, [ebp - 0x218]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], edi
call fcn.1006bce0
push ebx
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fread]
add dword [ebp - 0x210], eax
add esp, 0x10
cmp eax, edi
jb 0x1009e3a7
cmp edi, 0x3fffffff
ja 0x1009e382
add edi, edi
mov ecx, edi
lea esi, [ebp - 0x218]
call fcn.1006bce0
push ebx
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fread]
add dword [ebp - 0x210], eax
add esp, 0x10
cmp eax, edi
jae 0x1009e378
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x218]
mov esi, dword [ebp - 0x20c]
push edx
push eax
push esi
call fcn.1005e3a0
lea ecx, [ebp - 0x208]
add esp, 0xc
cmp dword [ebp - 0x218], ecx
je 0x1009e3f9
mov ecx, dword [esi + 8]
lea eax, [ecx - 8]
cmp eax, ecx
jae 0x1009e3f5
lea ecx, [eax - 8]
nop
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
add eax, 8
add ecx, 8
cmp eax, dword [esi + 8]
jb 0x1009e3e0
add dword [esi + 8], 0xfffffff8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret

Function at 0x1009e410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x218], ecx
mov ecx, edi
lea esi, [ebp - 0x218]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0x200
call fcn.1006bce0
push ebx
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fread]
mov edx, dword [ebp - 0x218]
mov esi, dword [ebp - 0x20c]
mov edi, eax
mov eax, dword [ebp - 0x210]
add eax, edi
push eax
push edx
push esi
mov dword [ebp - 0x210], eax
call fcn.1005e3a0
lea eax, [ebp - 0x208]
add esp, 0x1c
cmp dword [ebp - 0x218], eax
je 0x1009e4c9
mov ecx, dword [esi + 8]
lea eax, [ecx - 8]
cmp eax, ecx
jae 0x1009e4c5
lea ecx, [eax - 8]
mov edi, edi
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
add eax, 8
add ecx, 8
cmp eax, dword [esi + 8]
jb 0x1009e4b0
add dword [esi + 8], 0xfffffff8
mov ecx, dword [ebp - 4]
xor eax, eax
cmp eax, edi
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1009e9f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 8]
push edi
mov edi, eax
mov eax, dword [esi + 0x10]
sub ebx, dword [eax]
mov dword [esp + 0x38], 1
sub ebx, 8
sar ebx, 3
sub ebx, edi
je 0x1009ea6a
push edi
push esi
dec ebx
call fcn.1005d6f0
add esp, 8
cmp eax, 3
jne 0x1009ea76
cmp dword [esp + 0x38], 0
je 0x1009ea57
push 0
push edi
push esi
call fcn.1005db60
fstp qword [esp + 4]
mov ecx, dword [ebp + 8]
add esp, 4
push 0x1043bbe4
push ecx
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 0x10
test eax, eax
jg 0x1009eaab
mov dword [esp + 0x38], 0
inc edi
test ebx, ebx
jne 0x1009ea1a
cmp dword [esp + 0x38], ebx
je 0x1009eac0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x3c]
push edx
push edi
push esi
call fcn.1005de70
add esp, 0xc
test eax, eax
je 0x1009eab5
cmp dword [esp + 0x38], 0
je 0x1009ea57
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x3c]
push ecx
push edx
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, dword [esp + 0x3c]
jne 0x1009ea57
mov dword [esp + 0x38], 1
jmp 0x1009ea5f
mov eax, dword [str.string]
push eax
call fcn.1006b320
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
mov ecx, dword [esi + 8]
mov dword [ecx + 4], 0x7ff7a500
mov edi, 8
add dword [esi + 8], edi
push eax
mov dword [esp + 0x40], eax
call dword [sym.imp.MSVCR100.dll_strerror]
add esp, 4
push eax
push esi
call fcn.1005e410
fild dword [esp + 0x44]
mov edx, dword [esi + 8]
add esp, 8
fstp qword [edx]
add dword [esi + 8], edi
lea eax, [edi - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a8d70
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov eax, dword [ecx + 0x3c]
mov dword [eax + 0x214], 0x67452301
mov dword [eax + 0x218], 0xefcdab89
mov dword [eax + 0x21c], 0x98badcfe
mov dword [eax + 0x220], 0x10325476
xor edx, edx
mov dword [eax + 0x20c], edx
mov dword [eax + 0x210], edx
mov eax, dword [ecx + 0x3c]
mov dword [eax + 0x264], edx
mov dword [eax + 0x268], edx
mov dword [eax + 0x26c], 0x67452301
mov dword [eax + 0x270], 0xefcdab89
mov dword [eax + 0x274], 0x98badcfe
mov dword [eax + 0x278], 0x10325476
mov dword [eax + 0x27c], 0xc3d2e1f0
mov eax, dword [ecx + 0x3c]
mov dword [eax + 0x2c0], edx
mov dword [eax + 0x2c4], edx
mov dword [eax + 0x2c8], 0x6a09e667
mov dword [eax + 0x2cc], 0xbb67ae85
mov dword [eax + 0x2d0], 0x3c6ef372
mov dword [eax + 0x2d4], 0xa54ff53a
mov dword [eax + 0x2d8], 0x510e527f
mov dword [eax + 0x2dc], 0x9b05688c
mov dword [eax + 0x2e0], 0x1f83d9ab
mov dword [eax + 0x2e4], 0x5be0cd19
mov dword [eax + 0x328], edx
mov eax, dword [ecx + 0x3c]
add eax, 0x330
lea ecx, [edx + 1]
jmp fcn.100b3bb0

Function at 0x100a9a10
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push esi
push 0x898
push 0
push edi
call sub.MSVCR100.dll_memset
push 0x58
lea ebx, [edi + 0x20c]
push 0
push ebx
call sub.MSVCR100.dll_memset
push 0x5c
lea esi, [edi + 0x264]
push 0
push esi
call sub.MSVCR100.dll_memset
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov edx, 0x98badcfe
mov dword [ebx + 0x10], edx
mov ecx, 0x10325476
mov dword [ebx + 0x14], ecx
push 0x6c
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], 0xc3d2e1f0
push eax
lea esi, [edi + 0x2c0]
push esi
call sub.MSVCR100.dll_memset
xor ebx, ebx
push 0xd8
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
mov dword [esi + 0x68], ebx
lea esi, [edi + 0x330]
push ebx
push esi
call sub.MSVCR100.dll_memset
lea ecx, [ebx + 1]
mov eax, esi
call fcn.100b3bb0
push 0x7c
lea eax, [edi + 8]
push ebx
push eax
mov dword [edi + 0x408], 0x100a8e60
mov dword [edi], 2
call sub.MSVCR100.dll_memset
add esp, 0x48
push 0x134
lea ecx, [edi + 0x84]
push ebx
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
pop esi
mov dword [edi + 0x1c8], 3
pop ebx
ret
Function at 0x100ae1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x32c
mov eax, dword [0x10415990]
xor eax, esp
mov dword [esp + 0x328], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [esp + 0x10], eax
mov esi, ecx
cmp ebx, 0x180
jbe 0x100ae1fb
mov eax, 0xffffffc8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
push 0x1a0
lea ecx, [esp + 0x194]
push 0
push ecx
call sub.MSVCR100.dll_memset
push 0x118
lea edx, [esp + 0x28]
push 0
push edx
call sub.MSVCR100.dll_memset
mov eax, ebx
shr eax, 0x18
push ebx
mov byte [esp + 0x1bc], al
mov ecx, ebx
mov edx, ebx
lea eax, [esp + 0x1c4]
shr ecx, 0x10
shr edx, 8
push esi
push eax
mov byte [esp + 0x1c5], cl
mov byte [esp + 0x1c6], dl
mov byte [esp + 0x1c7], bl
mov byte [esp + 0x1cb], 0x30
call sub.MSVCR100.dll_memcpy
lea esi, [ebx + 0x19]
add esp, 0x24
mov byte [esp + ebx + 0x1a8], 0x80
mov dword [esp + 0x14], esi
xor eax, eax
jmp 0x100ae280
mov byte [esp + eax + 0x170], al
inc eax
cmp eax, 0x20
jl 0x100ae280
lea ecx, [esp + 0x170]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, pe_nt_image_headers32
call fcn.100cabf0
add esp, 8
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
test esi, esi
je 0x100ae324
lea edi, [esp + 0x190]
lea eax, [esp + 0x130]
sub edi, eax
jmp 0x100ae2e0
xor ecx, ecx
lea eax, [esp + ecx + 0x130]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, 0x10
jl 0x100ae2e2
add edi, 0x10
mov eax, 0x10
cmp esi, 0x10
jae 0x100ae303
mov eax, esi
sub esi, eax
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.100cb390
add esp, 8
test esi, esi
jne 0x100ae2e0
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x138]
inc byte [esp + 0x193]
mov dword [esp + ebx + 0x140], edx
mov edx, dword [esp + 0x13c]
mov dword [esp + ebx + 0x144], eax
mov dword [esp + ebx + 0x148], ecx
mov dword [esp + ebx + 0x14c], edx
add ebx, 0x10
cmp ebx, 0x30
jl 0x100ae2a9
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov eax, pe_nt_image_headers32
call fcn.100cabf0
mov esi, dword [esp + 0x18]
add esp, 8
mov edi, 3
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, edx
call fcn.100cb390
mov ecx, dword [esp + 0x168]
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x170]
mov dword [esi], ecx
mov ecx, dword [esp + 0x174]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
add esp, 8
add esi, 0x10
dec edi
jne 0x100ae392
mov eax, 0x118
lea ecx, [esp + 0x18]
nop
mov byte [ecx], 0
inc ecx
dec eax
jne 0x100ae3e0
mov ecx, dword [esp + 0x334]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x100ae400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x30
lea ebx, [ebp - 0x34]
mov eax, ebx
push 0
push eax
call sub.MSVCR100.dll_memset
mov ecx, 1
add esp, 0xc
sub ecx, edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 3
jmp 0x100ae439
mov ecx, dword [ebp - 0x3c]
lea eax, [edi + 0xf]
lea esp, [esp]
inc byte [eax]
jne 0x100ae44c
dec eax
lea edx, [ecx + eax]
test edx, edx
jg 0x100ae440
lea eax, [edi + 0x20]
push ebx
push eax
mov ecx, edi
call fcn.100cb390
add esp, 8
add ebx, 0x10
dec dword [ebp - 0x38]
jne 0x100ae436
mov edx, esi
lea eax, [ebp - 0x34]
xor ecx, ecx
sub edx, eax
lea esp, [esp]
lea eax, [ebp + ecx - 0x34]
movzx ebx, byte [edx + eax]
xor byte [eax], bl
movzx ebx, byte [esi + ecx + 1]
xor byte [eax + 1], bl
movzx ebx, byte [esi + ecx + 2]
xor byte [eax + 2], bl
movzx ebx, byte [esi + ecx + 3]
xor byte [eax + 3], bl
movzx ebx, byte [esi + ecx + 4]
xor byte [eax + 4], bl
movzx ebx, byte [esi + ecx + 5]
xor byte [eax + 5], bl
add ecx, 6
cmp ecx, 0x30
jl 0x100ae470
lea ecx, [ebp - 0x34]
push ecx
lea eax, [edi + 0x20]
push eax
mov eax, pe_nt_image_headers32
call fcn.100cabf0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi], edx
mov edx, dword [ebp - 8]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov dword [edi + 0xc], edx
xor eax, eax
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x100b0b90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test esi, esi
je 0x100b0c97
mov eax, dword [esi]
test eax, eax
je 0x100b0c97
cmp dword [esi + 8], 0
je 0x100b0c97
push edi
mov edi, dword [ebp + 0xc]
cmp edi, dword [eax + 0xc]
jbe 0x100b0bfc
mov ecx, dword [esi + 4]
mov edx, dword [eax + 0x10]
push ecx
call edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [eax + 0x14]
push edi
push ebx
push ecx
call edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 0x44]
push ecx
push edx
call eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
add esp, 0x18
mov dword [ebp + 0xc], ecx
lea ebx, [ebp - 0x44]
mov eax, dword [eax + 0xc]
mov edi, dword [esi + 8]
push eax
lea edx, [edi + eax]
push 0x36
push edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edx
call sub.MSVCR100.dll_memset
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x48]
push ecx
push 0x5c
push edx
call sub.MSVCR100.dll_memset
add esp, 0x18
cmp dword [ebp + 0xc], 0
jbe 0x100b0c53
mov edx, dword [ebp + 0xc]
mov ecx, edi
mov edi, dword [ebp - 0x48]
sub ecx, ebx
mov eax, ebx
sub edi, ebx
lea esp, [esp]
movzx ebx, byte [eax]
xor byte [ecx + eax], bl
movzx ebx, byte [eax]
xor byte [edi + eax], bl
inc eax
dec edx
jne 0x100b0c40
mov edi, dword [ebp - 0x4c]
mov eax, 0x40
lea ecx, [ebp - 0x44]
jmp 0x100b0c60
mov byte [ecx], 0
inc ecx
dec eax
jne 0x100b0c60
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [eax + 0x10]
push ecx
call edx
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x14]
push ecx
push edi
push edx
call eax
add esp, 0x10
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0xffffaf00
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x100b1660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
push 0x40
mov edi, ecx
lea ecx, [ebp - 0x44]
push 0
push ecx
mov dword [ebp - 0x50], eax
call sub.MSVCR100.dll_memset
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x48], 0
test eax, eax
jne 0x100b169b
xor al, al
jmp 0x100b169e
mov al, byte [eax + 8]
movzx ebx, al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], ebx
test eax, eax
je 0x100b173d
jmp 0x100b16b4
mov ebx, dword [ebp - 0x4c]
cmp eax, ebx
jae 0x100b16ba
mov ebx, eax
mov eax, dword [esi]
test eax, eax
je 0x100b1714
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x10]
push edx
call eax
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x100b1714
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x50]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [eax + 0x14]
push ecx
call edx
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x100b1714
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x14]
push 4
lea ecx, [ebp - 0x48]
push ecx
push edx
call eax
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x100b1714
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 0x44]
push ecx
push edx
call eax
add esp, 8
xor eax, eax
test ebx, ebx
je 0x100b172c
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x44]
xor byte [edi], cl
inc eax
inc edi
cmp eax, ebx
jb 0x100b1720
mov eax, dword [ebp + 8]
inc byte [ebp - 0x45]
sub eax, ebx
mov dword [ebp + 8], eax
jne 0x100b16b1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret