joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10150bb5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10150d58
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10150d2d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10150d2d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10150cdc
jg 0x10150c0e
test eax, eax
je 0x10150cd2
push 1
push 0x1000
call fcn.10147ff7
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10150c34
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x10150cc9
push 0x8000
push ebx
call fcn.10150aaf
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10150c60
jg 0x10150c5b
cmp ecx, 0x1000
jb 0x10150c60
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10142716
add esp, 0x10
cmp eax, 0xffffffff
je 0x10150ca5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10150c5b
jl 0x10150c8c
test ecx, ecx
jne 0x10150c4d
push dword [ebp - 0xc]
push ebx
call fcn.10150aaf
push esi
call fcn.10148054
add esp, 0xc
xor edi, edi
jmp 0x10150d3e
cmp byte [edi + 0x24], 0
je 0x10150cbc
cmp dword [edi + 0x20], 5
jne 0x10150cbc
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10150cc7
mov edi, dword [edi + 0x18]
jmp 0x10150cc9
xor edi, edi
push esi
call fcn.10148054
pop ecx
jmp 0x10150d3e
test ecx, ecx
jg 0x10150c9e
jl 0x10150cdc
test eax, eax
jae 0x10150c9e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1013efda
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10150cff
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10150c9e
jmp 0x10150d36
push ebx
call fcn.1014bb45
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10150c9e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x10150d3e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10150d3b
mov edi, dword [edi + 0x18]
jmp 0x10150d3e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1013efda
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10154ad3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10154ade
Function at 0x10157925
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.101570b9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1015706e
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
dec dword [ecx - 0x6737b]
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al

Function at 0x10157968
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx - 0x6737b]
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0

Function at 0x10157f85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10157087
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
invalid
Function at 0x1015d2f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1015d525
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x1015d445
cmp dword [edi + 0x30], 0
je 0x1015d326
cmp dword [esi + 0x234], 2
jl 0x1015d326
push esi
call fcn.1019dd2c
add esp, 4
cmp dword [edi + 0x10], 0
je 0x1015d335
push esi
call fcn.10168ab0
add esp, 4
cmp dword [edi + 0x3c], 0
je 0x1015d351
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x5c]
test ecx, ecx
je 0x1015d351
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov dword [edi + 0x28], 0
lea eax, [edi + 0x24]
push eax
call fcn.10127460
add esp, 4
lea eax, [edi + 0x50]
push eax
call sym.ffmpeg.dll_av_frame_free
add esp, 4
lea eax, [edi + 0x4c]
push eax
call sym.ffmpeg.dll_av_packet_free
add esp, 4
mov eax, dword [edi + 0x20]
test eax, eax
je 0x1015d3bc
lea ebx, [edi + 0x20]
push eax
call fcn.1005de60
add esp, 4
test eax, eax
je 0x1015d3b3
push dword [edi + 0x1c]
call sym.ffmpeg.dll_av_packet_unref
add esp, 4
push 1
push dword [edi + 0x1c]
push dword [edi + 0x20]
call fcn.1005de80
add esp, 0xc
mov eax, dword [edi + 0x20]
jmp 0x1015d386
push ebx
call fcn.1005df80
add esp, 4
lea ebx, [esi + 0x1c]
lea eax, [edi + 0x1c]
push eax
call sym.ffmpeg.dll_av_packet_free
add esp, 4
lea eax, [edi + 0x14]
push eax
call sym.ffmpeg.dll_av_packet_free
add esp, 4
lea eax, [edi + 0x34]
push eax
call sym.ffmpeg.dll_av_frame_free
add esp, 4
lea eax, [edi + 0x38]
push eax
call sym.ffmpeg.dll_av_frame_free
add esp, 4
lea eax, [edi + 0xc]
push eax
call fcn.10127400
add esp, 4
mov eax, dword [esi + 0x1d8]
test eax, eax
je 0x1015d418
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x1015d418
call dword [section..00cfg]
push esi
call ecx
add esp, 4
lea eax, [edi + 0x44]
push eax
call fcn.10127460
add esp, 4
lea eax, [edi + 0x18]
push eax
call fcn.1003b870
add esp, 4
add edi, 0x78
push edi
call fcn.1005a510
add esp, 4
push ebx
call fcn.10127460
add esp, 4
cmp dword [esi + 0x2d0], 0
jle 0x1015d46f
xor edi, edi
xor ebx, ebx
mov eax, dword [esi + 0x2cc]
add eax, edi
push eax
call fcn.10127460
add esp, 4
inc ebx
add edi, 0xc
cmp ebx, dword [esi + 0x2d0]
jl 0x1015d452
lea eax, [esi + 0x2cc]
push eax
call fcn.10127460
add esp, 4
mov dword [esi + 0x2d0], 0
lea eax, [esi + 0x2d4]
push eax
call fcn.10127400
add esp, 4
lea eax, [esi + 0x2e8]
push eax
call fcn.10127400
add esp, 4
lea edi, [esi + 0x18]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1015d4c6
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1015d4c6
cmp dword [ecx + 0x2c], 0
je 0x1015d4c6
push eax
call fcn.10061870
add esp, 4
push esi
call fcn.10061870
add esp, 4
push edi
call fcn.10127460
add esp, 4
push dword [esi + 0xc]
call fcn.10040d70
add esp, 4
test eax, eax
je 0x1015d4fc
lea eax, [esi + 0x44]
push eax
call fcn.10127460
add esp, 4
mov dword [esi + 0x48], 0
jmp 0x1015d51a
push dword [esi + 0xc]
call fcn.10040da0
add esp, 4
test eax, eax
je 0x1015d51a
lea eax, [esi + 0x264]
push eax
call fcn.10127460
add esp, 4
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x23c], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10175f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
lea eax, [ecx - 0x80000000]
xor esi, esi
or eax, ebx
mov eax, dword [ebp + 0x1c]
je 0x10175f33
cmp ebx, eax
mov eax, ecx
sbb eax, edx
jge 0x10175f33
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov edi, dword [edx + 0x84]
test edi, edi
je 0x10175f9a
cmp dword [edx + 0x1c0], 0
mov eax, dword [edx + 0x88]
je 0x10175f66
mov edx, dword [eax + edi*4 - 4]
mov dword [ebp - 0x10], edi
mov edi, dword [edx + 4]
cmp dword [edx], ecx
sbb edi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x10]
jl 0x10175fa3
mov dword [ebp - 0x14], eax
xor edx, edx
mov eax, edi
xor edi, edi
mov ecx, dword [ebp - 0x14]
mov esi, dword [ecx + edx*4]
mov ebx, dword [esi + 4]
xor ebx, dword [ebp + 0x10]
mov ecx, dword [esi]
xor ecx, dword [ebp + 0xc]
or ecx, ebx
cmove edi, esi
inc edx
cmp eax, edx
jne 0x10175f6f
test edi, edi
mov ebx, dword [ebp + 0x24]
jne 0x10175fd5
xor eax, eax
xor esi, esi
mov edx, dword [ebp + 8]
jmp 0x10175f9d
xor eax, eax
inc eax
mov dword [edx + 0x1c0], eax
push 0x28
call fcn.100602f0
add esp, 4
test eax, eax
je 0x10175f29
mov edi, eax
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0x84]
add ecx, 0x88
push edi
push eax
push ecx
call fcn.10194be0
add esp, 0xc
test eax, eax
js 0x1017601e
mov esi, dword [ebp + 0x14]
lea eax, [edi + 0x20]
push 0
push dword [ebp + 0x2c]
push str.title
push eax
call sym.ffmpeg.dll_av_dict_set
add esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov dword [edi + 8], esi
mov eax, dword [ebp + 0x18]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [edi + 0x1c], eax
mov dword [edi + 0x18], ebx
mov esi, edi
jmp 0x10175f29
push edi
call sym.ffmpeg.dll_av_free
add esp, 4
jmp 0x10175f29
Function at 0x1018f480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x1018f51a
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
add dword [ebp - 0x10], edi
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [esi + 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1018f4ec
mov ecx, edi
sub ecx, eax
add ecx, 0x10
mov edx, dword [ebp - 0x10]
cmp ecx, edx
cmova ecx, edx
mov edx, eax
sub edx, edi
add edx, ecx
and edx, 0xf
mov dword [esi + 0x20], edx
cmp edi, ecx
jae 0x1018f4e5
add eax, dword [ebp - 0x14]
mov dl, byte [eax]
inc eax
xor dl, byte [edi]
inc edi
mov byte [ebx], dl
inc ebx
cmp edi, ecx
jb 0x1018f4d8
cmp edi, dword [ebp - 0x10]
jb 0x1018f4af
jmp 0x1018f51a
xor eax, eax
push eax
push eax
push 1
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.1018e310
add esp, 0x18
mov eax, 0xf
inc byte [esi + eax]
jne 0x1018f515
lea ecx, [eax - 1]
cmp eax, 8
mov eax, ecx
ja 0x1018f506
mov eax, dword [esi + 0x20]
jmp 0x1018f4b6
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10190360
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x14]
xor esi, esi
cmp ecx, 0x3ffffffe
ja 0x10190460
lea eax, [ecx + 2]
mov edx, 0xaaaaaaab
mul edx
and edx, 0xfffffffe
lea eax, [edx + edx]
inc eax
cmp eax, dword [ebp + 0xc]
jg 0x10190460
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp ecx, 4
jb 0x101903f4
mov edx, ecx
mov edi, esi
mov ecx, dword [eax]
bswap ecx
mov ebx, ecx
shr ebx, 0x1a
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], bl
mov ebx, ecx
shr ebx, 0x14
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], bl
mov ebx, ecx
shr ebx, 0xe
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], bl
add eax, 3
shr ecx, 8
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 3], cl
lea ecx, [edx - 3]
add edi, 4
cmp edx, 6
mov edx, ecx
ja 0x101903a0
jmp 0x101903fa
mov edi, esi
test ecx, ecx
je 0x1019043a
xor ebx, ebx
xor edx, edx
mov esi, edx
shl esi, 8
movzx edx, byte [eax + ebx]
or edx, esi
inc ebx
cmp ecx, ebx
jne 0x101903fe
shl ecx, 3
test ecx, ecx
jle 0x10190437
shl edx, 6
mov esi, dword [ebp + 8]
mov eax, edx
shr eax, cl
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], al
inc edi
lea eax, [ecx - 6]
cmp ecx, 6
mov ecx, eax
ja 0x1019041b
jmp 0x1019043a
mov esi, dword [ebp + 8]
mov eax, edi
sub eax, esi
test al, 3
je 0x1019045d
mov ebx, edi
not ebx
add ebx, esi
and ebx, 3
lea eax, [ebx + 1]
push eax
push 0x3d
push edi
call fcn.10132b90
add esp, 0xc
add edi, ebx
inc edi
mov byte [edi], 0
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10192200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
lea edx, [ecx - 0x21]
mov eax, 0xffffffea
cmp edx, 0xffffffe7
jb 0x1019222a
mov esi, dword [ebp + 0x14]
xor edx, edx
mov edi, esi
shrd edi, edx, cl
test cl, 0x20
cmovne edi, edx
test edi, edi
je 0x1019222f
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x18]
cmp edx, 0x1000
je 0x10192242
cmp edx, 0x404
jne 0x1019222a
neg cl
mov edi, esi
shl edi, cl
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], 0
je 0x101922da
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, esi
xor ecx, edx
mov edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, esi
xor ecx, edx
mov edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, esi
xor ecx, edx
mov edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, esi
xor ecx, edx
mov edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, esi
xor ecx, edx
mov edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, esi
xor ecx, edx
mov edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, esi
xor ecx, edx
mov edx, ecx
shr edx, 1
and ecx, 1
neg ecx
and ecx, esi
xor ecx, edx
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], ecx
inc eax
add ebx, 0x2000000
cmp eax, 0x100
jne 0x1019224c
jmp 0x1019232e
movsx ecx, al
sar ecx, 7
and ecx, edi
xor ecx, ebx
lea edx, [ecx + ecx]
sar ecx, 0x1f
and ecx, edi
xor ecx, edx
lea edx, [ecx + ecx]
sar ecx, 0x1f
and ecx, edi
xor ecx, edx
lea edx, [ecx + ecx]
sar ecx, 0x1f
and ecx, edi
xor ecx, edx
lea edx, [ecx + ecx]
sar ecx, 0x1f
and ecx, edi
xor ecx, edx
lea edx, [ecx + ecx]
sar ecx, 0x1f
and ecx, edi
xor ecx, edx
lea edx, [ecx + ecx]
sar ecx, 0x1f
and ecx, edi
xor ecx, edx
lea edx, [ecx + ecx]
sar ecx, 0x1f
and ecx, edi
xor ecx, edx
bswap ecx
jmp 0x101922c0
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x400], 1
xor eax, eax
cmp dword [ebp + 0x18], 0x1000
jb 0x1019222a
mov ecx, 0xfffffc00
mov edx, 0xff
mov esi, dword [ebx + ecx + 0x400]
mov edi, esi
shr edi, 8
and esi, edx
xor edi, dword [ebx + esi*4]
mov dword [ebx + ecx + 0x800], edi
mov esi, edi
shr esi, 8
and edi, edx
xor esi, dword [ebx + edi*4]
mov dword [ebx + ecx + 0xc00], esi
mov edi, esi
shr edi, 8
and esi, edx
xor edi, dword [ebx + esi*4]
mov dword [ebx + ecx + 0x1000], edi
add ecx, 4
jne 0x10192354
jmp 0x1019222a
Function at 0x10192680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea edi, [ecx + eax]
cmp dword [edx + 0x400], 0
mov dword [ebp - 0x10], edi
je 0x101926d2
mov eax, ebx
mov edx, dword [ebp - 0x10]
cmp ecx, edx
jae 0x101926ca
sub edx, ecx
mov dword [ebp - 0x10], edx
xor edi, edi
mov esi, dword [ebp + 8]
movzx edx, al
movzx ebx, byte [ecx + edi]
xor ebx, edx
shr eax, 8
xor eax, dword [esi + ebx*4]
inc edi
cmp dword [ebp - 0x10], edi
jne 0x101926b5
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
test cl, 3
je 0x101926f9
test eax, eax
jle 0x101926f9
lea eax, [ecx + 1]
movzx esi, bl
movzx edx, byte [ecx]
xor edx, esi
shr ebx, 8
mov esi, dword [ebp + 8]
xor ebx, dword [esi + edx*4]
inc ecx
test al, 3
je 0x101926f9
inc eax
cmp ecx, edi
jb 0x101926de
lea edx, [edi - 3]
cmp ecx, edx
jae 0x101926a2
xor ebx, dword [ecx]
mov edi, edx
mov edx, ebx
mov esi, 0xff
and edx, esi
mov eax, ebx
shr eax, 8
and eax, esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4 + 0x800]
xor eax, dword [esi + edx*4 + 0xc00]
mov edx, ebx
shr edx, 0xe
and edx, 0x3fc
xor eax, dword [esi + edx + 0x400]
mov edx, edi
add ecx, 4
shr ebx, 0x18
xor eax, dword [esi + ebx*4]
mov ebx, eax
cmp ecx, edx
jb 0x10192700
jmp 0x101926a4
Function at 0x101972c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov eax, dword [0x10305014]
xor eax, ebp
mov dword [esp + 0xa8], eax
xor eax, eax
dec eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov dword [esp + 0x20], eax
movdqa xmmword [esp + 0x10], xmm0
cmp dword [0x102d7ba0], 0x79
jae 0x101974a1
mov eax, dword [0x103c8c1c]
mov dword [esp + 0xc], eax
mov eax, dword [0x103c8c18]
mov dword [esp + 8], eax
lfence
rdtsc
xor dword [0x103c8c54], eax
lfence
rdtsc
xor dword [0x103c8cc4], edx
xor edi, edi
xor ebx, ebx
mov dword [esp + 4], 0
call fcn.10143bd9
lea ecx, [edi + ebx*2]
mov ebx, eax
sub ebx, edi
cmp ecx, eax
jge 0x101973fa
mov edi, ebx
sub edi, 0xc46031b9
cmovb edi, ebx
mov ecx, dword [0x103c8c1c]
mov esi, dword [0x103c8c18]
add esi, 1
adc ecx, 0
mov edx, esi
and edx, 0x1ff
add dword [edx*4 + 0x103c8c20], edi
mov dword [0x103c8c18], esi
mov dword [0x103c8c1c], ecx
mov edx, eax
sub edx, dword [esp + 4]
cmp edx, 0x1f
jl 0x1019742c
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
or edx, edi
setne dl
sub esi, dword [esp + 8]
sbb ecx, edi
mov edi, 4
cmp edi, esi
mov edi, 0
sbb edi, ecx
setb dh
test dl, dh
jne 0x10197440
mov edx, 0x40
cmp edx, esi
mov edx, 0
sbb edx, ecx
jae 0x1019742c
jmp 0x10197440
mov ecx, dword [0x103c8c18]
mov edx, 0x1ff
and ecx, edx
imul edx, dword [ecx*4 + 0x103c8c20], 0x19660d
mov edi, ebx
sub edi, 0xc46031b9
cmovb edi, ebx
add edx, edi
add edx, 0x3c6ef35f
mov dword [ecx*4 + 0x103c8c20], edx
mov ecx, dword [esp + 4]
test ecx, ecx
cmove ecx, eax
mov dword [esp + 4], ecx
mov edi, eax
jmp 0x1019736d
lfence
rdtsc
add dword [0x103c8ddc], eax
lea esi, [esp + 0x30]
push 0xa0
push esi
call fcn.101977ef
add esp, 8
push 0x800
push 0x103c8c20
push esi
call fcn.1019b060
add esp, 0xc
lea edi, [esp + 0x10]
push edi
push esi
call fcn.1019b120
add esp, 8
mov eax, dword [edi]
mov esi, dword [edi + 0x10]
bswap eax
bswap esi
add esi, eax
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.10130483
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.1014029d
int3
Function at 0x1019b2d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [ebp + 0x18]
test esi, esi
js 0x1019b47a
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
jne 0x1019b306
call fcn.1018f560
cmp eax, 0xf
mov ecx, 0xf
cmovl ecx, eax
inc ecx
xor esi, esi
inc esi
cmp eax, 2
cmovge esi, ecx
cmp ebx, 1
mov dword [ebp - 0x18], esi
sbb esi, 0
push 0x34
call fcn.100602f0
add esp, 4
mov dword [edi], eax
mov edi, 0xfffffff4
test eax, eax
je 0x1019b43c
mov edx, eax
test esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], eax
je 0x1019b34c
push 0x20
push esi
call fcn.10060400
mov edx, dword [ebp - 0x10]
add esp, 8
mov dword [edx], eax
test eax, eax
je 0x1019b446
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x28], ecx
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], ebx
mov edi, dword [ebp - 0x18]
mov dword [edx + 4], edi
xor esi, esi
mov dword [edx + 0x24], esi
lea eax, [edx + 0x18]
xorps xmm0, xmm0
movups xmmword [edx + 8], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], esi
cmp dword [ebp - 0x1c], 0
jle 0x1019b43c
xor ebx, ebx
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], ebx
shl ebx, 5
lea edx, [ecx + ebx]
mov dword [ebp - 0x28], edx
lea edi, [ecx + ebx]
add edi, 4
mov dword [edi - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov eax, dword [ebp - 0x14]
lea esi, [eax + ebx]
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push edi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
xor eax, eax
mov dword [esi + 0x14], eax
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + ebx]
add edx, 0xc
mov dword [ebp - 0x24], edx
mov dword [edx + 4], 0x1019b480
mov ecx, dword [ebp - 0x28]
mov dword [edx + 8], ecx
push eax
push eax
push edx
push 0x10169eb0
push eax
push eax
call fcn.1013b08a
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
test eax, eax
je 0x1019b453
mov eax, dword [ebp - 0x14]
add ebx, eax
add ebx, 0x1c
cmp dword [ebx], 0
jne 0x1019b422
push 0
push 0xffffffffffffffff
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
jmp 0x1019b40f
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ebx, dword [ebp - 0x20]
inc ebx
cmp ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
jne 0x1019b396
mov edi, dword [ebp - 0x18]
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebp + 8]
call fcn.10127460
add esp, 4
jmp 0x1019b43c
cmp dword [ebp + 0x14], 1
mov ecx, dword [ebp - 0x20]
adc ecx, 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push dword [ebp + 8]
call fcn.1019b580
add esp, 4
xor edi, edi
dec edi
jmp 0x1019b43c
call fcn.1014029d
int3
Function at 0x101a5dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xb1b5c]
mov ecx, dword [edi + 0xb1304]
xor edx, edx
cmp eax, 2
sete dl
cmp eax, 3
lea eax, [ecx + 0x58]
lea edx, [ecx + edx*4 + 0x50]
cmove edx, eax
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x5ff0]
mov dword [ebp - 0x18], eax
cmp dword [edi + 0xb1b58], 0
je 0x101a5eb3
mov eax, dword [esi + 0x5848]
test eax, 0x7fffffff
je 0x101a5eb9
mov eax, dword [ecx + 0x50]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x5ff8]
mov edi, dword [eax + 0x50]
xor ebx, ebx
lea eax, [ebx + 0x10]
mov ecx, esi
mov edx, dword [ebp - 0x10]
push eax
push edi
call fcn.101a5ef0
add esp, 8
mov dword [esi + ebx*4 + 0x52c8], eax
inc ebx
mov eax, dword [esi + 0x5848]
lea ecx, [eax + eax]
cmp ebx, ecx
jb 0x101a5e3d
test eax, 0x7fffffff
mov ecx, dword [ebp + 8]
je 0x101a5eb9
mov eax, dword [ecx + 0xb1304]
mov ecx, dword [esi + 0x5ff8]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x54]
xor ebx, ebx
lea eax, [ebx + 0x10]
mov ecx, esi
mov edx, dword [ebp - 0x10]
push eax
push edi
call fcn.101a5ef0
add esp, 8
mov ecx, ebx
xor ecx, 1
mov dword [esi + ecx*4 + 0x5348], eax
inc ebx
mov eax, dword [esi + 0x5848]
lea ecx, [eax + eax]
cmp ebx, ecx
jb 0x101a5e85
jmp 0x101a5eb9
mov eax, dword [esi + 0x5848]
test eax, eax
mov ebx, dword [ebp - 0x14]
je 0x101a5ee2
xor edi, edi
mov ecx, esi
mov edx, ebx
push edi
push dword [ebp - 0x18]
call fcn.101a5ef0
add esp, 8
mov dword [esi + edi*4 + 0x5248], eax
inc edi
cmp edi, dword [esi + 0x5848]
jb 0x101a5ec2
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret