joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007280
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086076
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100a7078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10067966
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10063d97
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10008a10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008628a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.10063fe6
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10008ad0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.10069ecd
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x100a5d90
push eax
call fcn.1006a45a
push edi
push esi
call fcn.10063e9a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c5c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push esi
push edi
test eax, eax
jne 0x1000c5de
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000c681
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x28
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000c681
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000c681
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000c681
push ecx
mov ecx, dword [ebp - 0x18]
mov edx, str.SeDebugPrivilege
call fcn.1000c550
add esp, 4
test al, al
je 0x1000c681
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.10067955
mov esp, ebp
pop ebp
ret

Function at 0x1000c6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000c70e
movaps xmm0, xmmword [0x1009e980]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x71
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x1000c6e0
lea eax, [ebp - 0xc]
mov byte [ebp - 0x23], 0
push eax
lea eax, [ebp - 0x33]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1000c71e
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x20]
test eax, eax
je 0x1000c708
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x1000c770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ecx + 0x14]
sub edx, dword [ecx + 0x10]
push esi
mov esi, dword [ecx + 8]
lea eax, [esi + 1]
cmp eax, edx
jbe 0x1000c785
xor dl, dl
jmp 0x1000c78b
mov eax, dword [ecx + 0x10]
mov dl, byte [esi + eax]
lea eax, [esi + 1]
mov dword [ecx + 8], eax
movzx eax, dl
cmp eax, 0x13
ja case.0x1000c79d.2
jmp dword [eax*4 + 0x1000c908]
pop esi
jmp fcn.1000c960
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0x3c]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.1002ed10
pop esi
ret
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0x70]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.1003cbf0
pop esi
ret
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0x74]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.10041b90
pop esi
ret
pop esi
jmp 0x1004fd20
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0x78]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.10046810
pop esi
ret
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0x7c]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.10048b20
pop esi
ret
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0x80]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.1004c790
pop esi
ret
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0x94]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.1005c980
pop esi
ret
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0xa0]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.10061fc0
pop esi
ret
pop esi
jmp fcn.1000ccc0
pop esi
jmp fcn.1000ce80
pop esi
jmp fcn.1000d040
pop esi
jmp fcn.1000d130
cmp dword [0x100aa818], 0
je case.0x1000c79d.2
push ecx
call fcn.1001f920
pop esi
ret
pop esi
jmp fcn.1000d430
mov eax, dword [0x100aa814]
test eax, eax
je case.0x1000c79d.2
mov eax, dword [eax + 0x84]
test eax, eax
je case.0x1000c79d.2
push ecx
mov ecx, eax
call fcn.1004df00
pop esi
ret
push ecx
push esi
mov esi, dword [0x100aa814]
mov edx, ecx
push edi
test esi, esi
je 0x1004fdb3
mov edi, dword [edx + 8]
mov ecx, dword [edx + 0x14]
sub ecx, dword [edx + 0x10]
lea eax, [edi + 1]
cmp eax, ecx
jbe 0x1004fd47
xor cl, cl
jmp 0x1004fd4d
mov eax, dword [edx + 0x10]
mov cl, byte [edi + eax]
lea eax, [edi + 1]
mov dword [edx + 8], eax
cmp cl, 1
jne 0x1004fd6c
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x1004fdb3
push edx
call fcn.10053d80
pop edi
pop esi
pop ecx
ret
cmp cl, 2
jne 0x1004fd85
mov ecx, dword [esi + 0x88]
test ecx, ecx
je 0x1004fdb3
push edx
call fcn.1004fdc0
pop edi
pop esi
pop ecx
ret
cmp cl, 3
jne 0x1004fd9e
mov ecx, dword [esi + 0x8c]
test ecx, ecx
je 0x1004fdb3
push edx
call fcn.10051970
pop edi
pop esi
pop ecx
ret
cmp cl, 4
jne 0x1004fdb3
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x1004fdb3
push edx
call fcn.10053f30
pop edi
pop esi
pop ecx
ret
Function at 0x10011990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x100a7078]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
dec eax
push edi
mov edi, dword [ebp + 8]
cmp eax, 8
ja case.default.0x100119b9
jmp dword [eax*4 + 0x10011b3c]
push 0
lea eax, [esp + 0x10]
push eax
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10067955
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10067955
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10067955
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x10097d58
mov ecx, esi
call fcn.1000d730
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x10011aae
push 0x20
push eax
mov ecx, esi
call fcn.10009000
cmp dword [esi + 0x14], 0x10
jb 0x10011a75
mov esi, dword [esi]
push 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10067955
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10067955
mov esp, ebp
pop ebp
ret 0xc
push 0x90
push str.c:usersmonsterdesktopdreamsoft_v1924dreamsoftN3Base_N3TableBase.hpp
push 0x10097d58
sub esp, 0x18
mov ecx, esp
push str.ERROR____s_n_s:__d_n_n
call fcn.10002870
lea eax, [esp + 0x38]
push eax
call fcn.1000d830
add esp, 0x28
lea eax, [esp + 0x14]
cmp dword [esp + 0x28], 0x10
cmovae eax, dword [esp + 0x14]
push 0
push str._ASSERTT_n
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x28]
cmp eax, 0x10
jb 0x10011b24
inc eax
lea ecx, [esp + 0x14]
push eax
push dword [esp + 0x18]
call fcn.10002650
mov ecx, dword [esp + 0x2c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10067955
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100132c0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push 0
push 0
push 0
push 0x1000f640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.10018000
call fcn.100665a0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10066a70
push 0x10012b10
push 0x100aa83c
call fcn.100662b0
call fcn.10066600
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x919fd0
call edi
test eax, eax
jne 0x10013342
mov dword [0x100aa83c], 0x919fd0
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10012b10
push 0x100aa83c
call fcn.10065e20
call fcn.10066600
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10012b40
push 0x100aa838
call fcn.100662b0
call fcn.10066600
mov eax, dword [sym.imp.WS2_32.dll_connect]
push 4
push eax
mov dword [0x100aa838], eax
call edi
test eax, eax
jne 0x10013397
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10012b40
push 0x100aa838
call fcn.10065e20
call fcn.10066600
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10012e20
push 0x100aa834
call fcn.100662b0
call fcn.10066600
mov eax, dword [sym.imp.WS2_32.dll_WSAConnect]
push 4
push eax
mov dword [0x100aa834], eax
call edi
test eax, eax
jne 0x100133ec
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10012e20
push 0x100aa834
call fcn.10065e20
call fcn.10066600
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10013130
push 0x100aa830
call fcn.100662b0
call fcn.10066600
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
push 4
push eax
mov dword [0x100aa830], eax
call edi
test eax, eax
jne 0x10013441
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10013130
push 0x100aa830
call fcn.10065e20
call fcn.10066600
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10013160
push 0x100aa82c
call fcn.100662b0
call fcn.10066600
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 4
push eax
mov dword [0x100aa82c], eax
call edi
test eax, eax
jne 0x10013496
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10013160
push 0x100aa82c
call fcn.10065e20
call fcn.10066600
pop edi
pop esi
pop ecx
ret
Function at 0x10015650
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087168
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 4], 0
push 2
mov dword [ebp - 0x150], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10015771
sub esp, 0x18
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x12c], 0
jne 0x100156d4
xor eax, eax
jmp 0x100156e9
lea eax, [ebp - 0x12c]
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100156e0
sub eax, esi
push eax
lea eax, [ebp - 0x12c]
mov ecx, edx
push eax
call fcn.10002770
lea ecx, [ebp - 0x28]
call fcn.10015470
mov esi, dword [ebp - 0x14]
lea ecx, [ebp + 8]
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
add esp, 0x18
cmp dword [ebp + 0x1c], 0x10
cmovae ecx, dword [ebp + 8]
cmp esi, 0x10
cmovae eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10015740
test dl, dl
je 0x1001573c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10015740
add eax, 2
add ecx, 2
test dl, dl
jne 0x10015720
xor eax, eax
jmp 0x10015745
sbb eax, eax
or eax, 1
test eax, eax
je 0x100157ad
cmp esi, 0x10
jb 0x1001575b
lea eax, [esi + 1]
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.10002650
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x100156b1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x1001578f
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.10002650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x148]
cmp eax, 0x10
jb 0x1001577a
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10002650
jmp 0x1001577a
Function at 0x100157e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1009e860]
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x34], 0x49737274
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0x7c786f75
mov word [ebp - 0x2c], 0x79
mov cl, byte [ebp - 0x44]
xor byte [ebp + eax - 0x43], cl
inc eax
cmp eax, 0x18
jb 0x10015814
push ebx
mov byte [ebp - 0x28], 0x14
mov al, 0x7a
xor al, byte [ebp - 0x28]
mov bl, 0x78
mov ah, bl
mov byte [ebp - 0x27], al
mov al, byte [ebp - 0x28]
mov dl, 0x70
mov bh, ah
mov byte [ebp - 0x19], ah
xor bl, al
mov byte [ebp - 0x1e], 0
xor ah, al
mov byte [ebp - 0x2b], 0
xor bh, al
mov byte [ebp - 0x23], ah
mov dh, dl
mov byte [ebp - 0x24], bl
xor dl, al
mov byte [ebp - 0x20], bh
xor dh, al
mov byte [ebp - 0x25], dl
mov cl, 0x60
mov byte [ebp - 0x21], dh
xor cl, al
mov byte [ebp - 0x1e], 0
mov ch, 0x3a
mov byte [ebp - 0x26], cl
xor ch, al
mov al, byte [ebp - 0x19]
xor al, byte [ebp - 0x28]
mov byte [ebp - 0x1f], al
lea eax, [ebp - 0x43]
push eax
lea eax, [ebp - 0x27]
mov byte [ebp - 0x22], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
jne 0x100158a3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
push 0
push 0x14
lea ecx, [ebp - 0x18]
push ecx
push 0
push esi
call eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
test eax, eax
pop esi
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x100158d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1009e7b0]
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x24], 0x457f7e78
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0x70746379
mov word [ebp - 0x1c], 0x75
mov cl, byte [ebp - 0x34]
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 0x18
jb 0x10015904
push ebx
mov byte [ebp - 0x18], 0xe
mov al, 0x60
xor al, byte [ebp - 0x18]
mov bl, 0x62
mov ah, bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x18]
mov dl, 0x6a
mov bh, ah
mov byte [ebp - 9], ah
xor bl, al
mov byte [ebp - 0xe], 0
xor ah, al
mov byte [ebp - 0x1b], 0
xor bh, al
mov byte [ebp - 0x13], ah
mov dh, dl
mov byte [ebp - 0x14], bl
xor dl, al
mov byte [ebp - 0x10], bh
xor dh, al
mov byte [ebp - 0x15], dl
mov cl, 0x7a
mov byte [ebp - 0x11], dh
xor cl, al
mov byte [ebp - 0xe], 0
mov ch, 0x20
mov byte [ebp - 0x16], cl
xor ch, al
mov al, byte [ebp - 9]
xor al, byte [ebp - 0x18]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x33]
push eax
lea eax, [ebp - 0x17]
mov byte [ebp - 0x12], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
test eax, eax
jne 0x10015993
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
push 0
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 9
push esi
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.10067955
mov esp, ebp
pop ebp
ret

Function at 0x10015c50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
mov dword [0x100a79fc], edx
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x100a79fc], edx
inc eax
cmp eax, 0x270
jl 0x10015c61
mov dword [0x100a79f8], 0x270
pop ebp
ret 8

Function at 0x10015d80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
nop dword [eax]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x10015d90
pop esi
ret
Function at 0x10015dd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
sub ecx, 1
jne 0x10015de0
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub edi, 1
jne 0x10015e22
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret
Function at 0x10016730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087278
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp dword [0x100aa814], 0
je 0x100168b2
cmp byte [0x100aa87d], 0
je 0x100168b2
mov eax, dword [edi]
cmp dword [eax + 0x18], 0x10
lea esi, [eax + 4]
jb 0x1001678a
mov esi, dword [eax + 4]
movaps xmm0, xmmword [0x1009ea50]
xor ecx, ecx
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x28], 0x71
nop dword [eax]
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x10
jb 0x100167a0
sub esp, 0x18
mov byte [ebp - 0x27], 0
lea eax, [ebp - 0x37]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.10002870
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
push esi
call fcn.10002870
mov dword [ebp - 4], 0xffffffff
call fcn.10015f40
add esp, 0x30
test al, al
je 0x100168b2
mov ecx, dword [0x100aa814]
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x100168a2
push edi
push ebx
mov ecx, eax
call fcn.10034c70
mov ecx, dword [0x100aa814]
cmp dword [ecx + 0x60], 0
je 0x1001685b
xor bl, bl
xor esi, esi
mov byte [ebp - 0x14], bl
cmp bl, 4
jae 0x1001684e
mov eax, dword [ecx + 0x5c]
movq xmm0, qword [eax + esi + 4]
mov eax, dword [eax + esi + 0xc]
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], eax
test al, al
je 0x1001684e
push dword [ebp - 0x20]
mov ecx, dword [ecx + 0x60]
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x18]
call fcn.10036550
mov ecx, dword [0x100aa814]
inc bl
add esi, 0xc
mov byte [ebp - 0x14], bl
cmp bl, 4
jb 0x1001681d
cmp dword [ecx + 0x64], 0
je 0x100168a2
xor bl, bl
mov byte [ebp - 0x14], bl
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x24]
mov ecx, dword [ecx + 0x5c]
push esi
push eax
call fcn.10035040
cmp byte [ebp - 0x1c], 0
je 0x10016892
push dword [ebp - 0x20]
mov ecx, dword [0x100aa814]
push esi
push edi
push dword [ebp - 0x18]
mov ecx, dword [ecx + 0x64]
call fcn.10036a90
mov ecx, dword [0x100aa814]
inc bl
mov byte [ebp - 0x14], bl
cmp bl, 8
jb 0x10016866
mov ecx, dword [ecx + 0x58]
test ecx, ecx
je 0x100168b2
push edi
push dword [ebp - 0x18]
call fcn.10034670
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret