joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003490
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jae 0x100034b2
cmp dword [esi], ebx
jne 0x100034bb
jmp 0x100034d7
call fcn.10044ee0
cmp dword [esi], ebx
je 0x100034d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x100034e3
cmp edi, 2
jae 0x10003503
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.10044ee0
push dword [esi]
call int.1004b450
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp edi, 2
jb 0x100034d0
mov dword [esi], ebx
mov edi, eax
call fcn.10044ee0
mov eax, edi
jmp 0x100034d0

Function at 0x10003fe0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ecx], 0
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jae 0x10004008
cmp dword [esi], ebx
jne 0x10004011
jmp 0x1000402d
call fcn.10044ee0
cmp dword [esi], ebx
je 0x1000402d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x10004039
cmp edi, 2
jae 0x10004059
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.10044ee0
push dword [esi]
call int.1004b450
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp edi, 2
jb 0x10004026
mov dword [esi], ebx
mov edi, eax
call fcn.10044ee0
mov eax, edi
jmp 0x10004026

Function at 0x10004290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [0x100ea080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x1c]
mov ecx, edx
push eax
call fcn.10002950
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp ebx, esi
je 0x100042ee
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, ebx
call fcn.1001be20
add ebx, 0x10
cmp esi, ebx
jne 0x100042e0
mov esi, dword [ebp - 0x20]
lea eax, [esi + 0x70]
push eax
push 0
push dword [edi + 8]
push dword [edi]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10004316
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10004326
mov byte [esi + 0x9a], 1
lock add dword [esi + 4], 1
mov bl, 1
jmp 0x10004328
xor ebx, ebx
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x10004361
mov esi, dword [ebp - 0x18]
cmp esi, edi
je 0x10004353
nop word cs:[eax + eax]
add esi, 0xfffffff0
mov ecx, esi
call fcn.1001bd90
cmp edi, esi
jne 0x10004340
mov eax, dword [ebp - 0x1c]
jmp 0x10004355
mov eax, edi
mov dword [ebp - 0x18], edi
push eax
call fcn.100a6614
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a6651
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10010960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [0x100ea080]
xor eax, ebp
mov dword [esp + 0x28], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [ecx + 8]
mov ecx, dword [eax + 0x20]
lea eax, [edi + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.100569e0
test eax, eax
je 0x100109c8
mov eax, dword [edi + 0x38]
test eax, eax
jne 0x100109b6
cmp byte [edi + 0x40], 0
jne 0x100109b6
mov eax, dword [edi + 0x44]
test eax, eax
je 0x10010b4b
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x10010a86
movzx eax, byte [esp + 0x10]
cmp byte [esp + 0x12], 0
je 0x100109ed
mov cl, byte [esp + 0x11]
or cl, al
movzx edx, cl
or eax, 4
or edx, 0x24
mov ebx, eax
cmp byte [edi + 0x68], 0
jne 0x10010a05
jmp 0x10010a14
movzx ebx, byte [esp + 0x13]
shl ebx, 4
or ebx, eax
or ebx, 2
mov edx, 0x37
cmp byte [edi + 0x68], 0
je 0x10010a14
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x74]
cmp eax, dword [esp + 0x14]
sbb ecx, 0
jb 0x10010a2f
cmp byte [edi + 0x78], 0
je 0x10010a34
mov eax, dword [edi + 0x80]
mov ecx, dword [edi + 0x84]
cmp eax, dword [esp + 0x18]
sbb ecx, 0
jae 0x10010a34
or ebx, 0x20
jmp 0x10010a60
cmp byte [edi + 0x88], 0
je 0x10010a60
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x94]
mov dword [esp + 4], edx
mov edx, ebx
or edx, 0x20
cmp eax, dword [esp + 0x1c]
sbb ecx, 0
cmovb ebx, edx
mov edx, dword [esp + 4]
mov eax, dword [edi + 0x3c]
mov dword [edi + 0x3c], ebx
test bl, 4
je 0x10010a81
and eax, 4
jne 0x10010a81
mov dword [esp + 4], edx
test byte [0x100e984c], 0x19
jne 0x10010a9d
mov edx, dword [esp + 4]
mov dword [esi + 4], edx
mov dword [esi], ebx
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.100a6651
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, 1
sub eax, dword [edi + 0x30]
mov ecx, eax
sar ecx, 0x1f
add eax, dword [edi + 0x28]
mov dword [esp + 0xc], eax
adc ecx, dword [edi + 0x2c]
mov dword [esp + 8], ecx
call fcn.1004ac90
mov edi, eax
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
lea eax, [esp + 0x20]
push eax
call fcn.1004c120
add esp, 4
push 0x82
push 0
lea eax, [esp + 0x28]
push eax
push edi
push dword [esp + 0x18]
push dword [esp + 0x20]
push 0
push 0
push 0
push str.MessagePipe_peer_closed
push 0x100e984c
push 0x58
call fcn.10052280
add esp, 0x30
cmp byte [0x100e984c], 0
je 0x10010a7d
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
sub esp, 0x10
movq xmm0, qword [esp + 0x30]
movq qword [esp + 8], xmm0
mov dword [esp + 4], str.MessagePipe_peer_closed
mov dword [esp], 0x100e984c
call fcn.100523b0
add esp, 0x10
jmp 0x10010a7d
int3
Function at 0x1001bf40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x100ea080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
mov ebx, esp
call fcn.1004a6f0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x14]
push 3
push 0
push 0
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [ebp - 0x14]
mov dword [ebx], 0
je 0x1001bfc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebx]
add eax, 1
cmp eax, 2
jb 0x1001bfb0
call fcn.10044ee0
push dword [ebx]
call int.1004b450
add esp, 4
mov dword [ebx], 0
lea eax, [esi + 1]
cmp eax, 2
jb 0x1001bfbf
mov dword [ebx], esi
call fcn.10044ee0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.1005c084
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a6651
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1001c8f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x100eac44]
cmp esi, 1
ja 0x1001c956
push 0x100eac44
call fcn.10044b50
add esp, 4
test al, al
je 0x1001c950
mov dword [0x100eac4c], 0
mov dword [0x100eac48], 0
mov esi, 0x100eac48
mov ecx, 0x100eac48
push 0
call fcn.10047bf0
push 0x100eac44
push 0
push 0x100eac48
push 0x100eac44
call fcn.10044c10
add esp, 0x10
jmp 0x1001c956
mov esi, dword [0x100eac44]
mov ecx, esi
pop esi
pop ebp
jmp fcn.10047b70

Function at 0x1001cfc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1001d012
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x1001cffc
call fcn.10044ee0
push dword [esi]
call int.1004b450
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1001d00b
mov dword [esi], ebx
call fcn.10044ee0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1001d020
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10003fe0
Function at 0x1001ed40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
lea ebx, [ebp + 8]
push 0x100cdae4
call fcn.1005bc40
mov dword [esi], 0x100cdae8
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], 0
mov dword [esi + 0x18], eax
mov word [esi + 0x1c], 0x100
mov byte [esi + 0x1e], 1
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
movups xmm0, xmmword [0x100d2878]
movups xmmword [esi + 0x40], xmm0
mov eax, dword [0x100eac68]
mov ecx, dword [0x100ed790]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1001ee11
lock add dword [0x100eac60], 1
mov edi, dword [ebx + 4]
mov dword [ebx + 4], 0
test edi, edi
je 0x1001ee08
mov ecx, edi
call fcn.10002120
push edi
call fcn.100a6614
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
push 0x100eac68
call fcn.100a6697
add esp, 4
cmp dword [0x100eac68], 0xffffffff
jne 0x1001ede2
call fcn.1001f570
push 0x100eac68
call fcn.100a670d
add esp, 4
jmp 0x1001ede2

Function at 0x10023818
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x10023866
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x10023840
cmp edx, 1
je 0x10023887
cmp edx, 2
je 0x1002387e
cmp edx, 3
jne 0x10023892
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x10028c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x100ea080]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.100b9d3d
add esp, 0x10
cmp eax, esi
jne 0x10028d13
cmp ebx, 1
je 0x10028cb5
cmp ebx, 2
mov esi, 0xffffffff
je 0x10028d16
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.100b98eb
add esp, 4
neg eax
sbb esi, esi
jmp 0x10028d16
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a6651
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10028d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10028d54
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.100b9d3d
add esp, 0x14
jmp 0x10028d83
test esi, esi
jle 0x10028d7c
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x10028d7e
inc edi
cmp esi, edi
mov eax, ebx
jne 0x10028d5d
mov edi, esi
jmp 0x10028d7e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10028d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x100ea080]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x19], 0xff
cmp ebx, eax
je 0x10028de4
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x10028ded
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.100b9d3d
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x10028de6
jmp 0x10028e75
xor ebx, ebx
mov esi, ebx
jmp 0x10028e75
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x10028e72
mov ebx, eax
cmp eax, 3
je 0x10028e55
cmp ebx, 1
ja 0x10028e72
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.100b9d3d
add esp, 0x10
cmp eax, esi
jne 0x10028e72
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x10028df8
jmp 0x10028e6a
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.100b9d3d
add esp, 0x10
cmp eax, ebx
jne 0x10028e72
mov ebx, dword [ebp + 8]
jmp 0x10028de6
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a6651
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x10028ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10028ee4
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.100b9d3d
add esp, 0x14
jmp 0x10028f14
test esi, esi
jle 0x10028f0d
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x10028f0f
inc edi
cmp esi, edi
mov eax, ebx
jne 0x10028eed
mov edi, esi
jmp 0x10028f0f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10028f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x100ea080]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x1a], 0xffff
cmp si, 0xffff
je 0x10028f75
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x10028f8d
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.100b9d3d
add esp, 0x10
cmp eax, 1
je 0x10028f77
xor esi, esi
dec esi
jmp 0x10028f77
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a6651
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x10028f70
mov ebx, eax
cmp eax, 3
je 0x10028ff5
cmp ebx, 1
ja 0x10028f70
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.100b9d3d
add esp, 0x10
cmp eax, esi
jne 0x10028f70
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x10028f98
jmp 0x1002900e
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.100b9d3d
add esp, 0x10
cmp eax, ebx
jne 0x10028f70
movzx esi, word [ebp + 8]
jmp 0x10028f77

Function at 0x100291a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x100291cf
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x100291b1
pop esi
pop edi
pop ebp
ret 8

Function at 0x100292e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10029311
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x100292f1
pop esi
pop edi
pop ebp
ret 8
Function at 0x1002f820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, esp
mov dword [esi + 0x78], ebp
lea ecx, [esi + 0x80]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x1003c9f0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x18]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esi + 0x70]
push ebx
call fcn.1002b1f0
add esp, 4
push dword [ebp + 0x18]
lea eax, [esi + 0x18]
push eax
push dword [ebx + 4]
push dword [ebx]
push 0x14
push edi
call fcn.1003ec63
add esp, 0x18
mov dword [esi + 0x14], eax
add eax, esi
add eax, 0x50
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
push eax
push edi
call fcn.1002e436
add esp, 0xc
mov dword [esi + 0xc], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 8]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.10026bf8
lea eax, [esi + 0x80]
mov dword [eax + 8], 0
mov ecx, edi
push 0x100eb168
call fcn.10038528
mov ebx, eax
mov ecx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x1002f906
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x88], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov edi, dword [esi + 0x10]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 0xc]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 0x14]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.10001dd0
add esp, 0x1c
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10033004
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.1003c1d4
mov ebx, eax
test esi, esi
je 0x1003303d
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x1003302a
movzx eax, word [eax]
jmp 0x10033031
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x1003303d
test bl, bl
jne 0x10033043
jmp 0x100330a0
xor esi, esi
test bl, bl
jne 0x10033091
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x10033052
movzx eax, word [eax]
jmp 0x10033057
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x10033082
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x1003307b
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x10033010
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x10033010
mov ecx, edi
call fcn.1003c1d4
mov ebx, eax
test esi, esi
jne 0x100330a9
jmp 0x1003309a
mov ecx, edi
call fcn.1003c1d4
mov ebx, eax
test bl, bl
jne 0x100330c8
jmp 0x100330ce
mov ecx, edi
call fcn.1003c1d4
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x100330b6
movzx eax, word [eax]
jmp 0x100330bd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x100330ce
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x10034500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x1003cb70
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.1000d620
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.10026bf8
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x100eb168
call fcn.10038528
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea ecx, [esi + 0x84]
lea edx, [esi + 3]
mov byte [edx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.10033a30
add esp, 0x2c
test al, al
je 0x10034660
mov ecx, dword [ebp + 0x20]
cmp byte [ecx + 0xb], 0
js 0x100345fa
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
jmp 0x10034606
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [esi + 3], 0
je 0x10034622
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.1003d578
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ebx, [edi - 1]
cmp edx, ebx
jae 0x1003464c
lea ecx, [edx + 1]
cmp ebx, ecx
cmova ecx, ebx
cmp byte [edx], al
jne 0x1003464c
inc edx
cmp ecx, edx
jne 0x10034641
mov edx, ecx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.1003c210
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.100237a0
mov edi, dword [ebp + 8]
test al, al
je 0x10034679
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x10034692
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x100346b4
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c