joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x10191a60
jmp 0x10059340
push 0xffffffffffffffff
push 0x1015b324
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, ecx
mov cl, byte [esp + 3]
mov dword [esp + 4], eax
mov byte [eax], cl
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dl, byte [esp + 3]
mov dword [esp + 0x10], ecx
mov byte [eax + 0x10], dl
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dl, byte [esp + 3]
mov byte [esp + 0x10], 1
mov byte [eax + 0x20], dl
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dl, byte [esp + 3]
mov byte [esp + 0x10], 2
mov byte [eax + 0x30], dl
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dl, byte [esp + 3]
mov byte [esp + 0x10], 3
mov byte [eax + 0x40], dl
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], 0xffffffff
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10059da0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015b40f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push ebp
mov byte [0x1018c73d], 0x78
mov ecx, dword [eax + 8]
xor ebp, ebp
push esi
cmp ecx, ebp
push edi
mov dword [esp + 0x38], ebp
jne 0x10059e2f
mov esi, dword [esp + 0x4c]
mov cl, byte [esp + 0x50]
push ebp
mov byte [esi], cl
mov ecx, esi
call fcn.1000bc70
push 0x101913e8
call fcn.1013c2c2
add esp, 4
mov ebx, 1
mov edi, eax
mov ecx, esi
push ebx
push edi
call fcn.1000c010
test al, al
je 0x10059e26
mov eax, dword [esi + 4]
push edi
push 0x101913e8
push eax
call fcn.100017d0
mov edx, dword [esi + 4]
mov dword [esi + 8], edi
add esp, 0xc
mov word [edx + edi*2], bp
lea eax, [edx + edi*2]
mov dword [esp + 0x38], ebx
jmp 0x10059fb8
mov al, byte [0x101978c4]
mov ebx, 1
test bl, al
mov word [esp + 0x10], 0x75
mov word [esp + 0x12], 0x72
jne 0x10059eaa
or al, bl
push 6
mov byte [0x101978c4], al
call fcn.1013c2df
add esp, 4
mov dword [0x101978c8], eax
xor esi, esi
mov di, word [esp + esi + 0x10]
push 0x78
mov eax, edi
mov ecx, 0x101978c8
and eax, 0xffff
push eax
call fcn.100a8ee0
mov ecx, dword [0x101978c8]
add eax, 0x78
xor eax, edi
mov word [esi + ecx], ax
add esi, 2
cmp esi, 4
jb 0x10059e63
mov edx, dword [0x101978c8]
push 0x10059fe0
mov word [edx + 4], bp
call fcn.1013c36b
add esp, 4
mov eax, 3
mov word [esp + 0x24], 0x62
mov word [esp + 0x28], ax
mov word [esp + 0x2a], ax
mov eax, 0x17
mov word [esp + 0x26], 0x37
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov word [esp + 0x30], ax
mov al, byte [0x101978cc]
test bl, al
mov word [esp + 0x32], 0x48
mov word [esp + 0x34], 0x1a
jne 0x10059f5b
or al, bl
push 0x14
mov byte [0x101978cc], al
call fcn.1013c2df
add esp, 4
mov dword [0x101978d0], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x24]
push edi
mov eax, ebp
mov ecx, 0x101978d0
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x101978d0]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x101978d0]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x12
jb 0x10059f0f
push 0x10059fd0
mov word [eax + 0x12], 0
call fcn.1013c36b
add esp, 4
mov edx, dword [esp + 0x50]
mov eax, dword [0x101978d0]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.1000cdb0
mov edx, dword [0x101978c8]
mov esi, dword [esp + 0x58]
push edx
push eax
push esi
mov dword [esp + 0x5c], ebx
call fcn.1000cf10
mov ecx, dword [esp + 0x30]
add esp, 0x18
test ecx, ecx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x44], 0
je 0x10059fb8
mov al, byte [ecx - 1]
test al, al
je 0x10059fac
cmp al, 0xff
je 0x10059fac
dec al
mov byte [ecx - 1], al
jmp 0x10059fb8
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x1005f6e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015bc95
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], esi
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x14], ebx
je 0x1005f7eb
push ebp
push edi
mov edi, dword [esp + 0x28]
push ebx
mov ecx, esi
mov al, byte [edi]
mov byte [esi], al
call fcn.1000bc70
mov ecx, dword [0x1016a210]
push ecx
push ebx
push edi
mov ecx, esi
call fcn.1000ba60
mov dl, byte [edi + 0x10]
lea ebp, [edi + 0x10]
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], 1
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x1016a210]
push eax
push ebx
push ebp
call fcn.1000ba60
mov dl, byte [edi + 0x20]
lea ebp, [edi + 0x20]
lea ecx, [esi + 0x20]
mov byte [esp + 0x1c], 2
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x1016a210]
push eax
push ebx
push ebp
call fcn.1000ba60
mov cl, byte [edi + 0x30]
lea ebp, [esi + 0x30]
mov byte [esp + 0x1c], 3
push ebx
mov byte [ebp], cl
mov ecx, ebp
call fcn.1000bc70
mov edx, dword [0x1016a210]
lea eax, [edi + 0x30]
push edx
push ebx
push eax
mov ecx, ebp
call fcn.1000ba60
mov al, byte [edi + 0x40]
add edi, 0x40
lea ecx, [esi + 0x40]
mov byte [esp + 0x1c], 4
mov byte [ecx], al
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov edx, dword [0x1016a210]
push edx
push ebx
push edi
call fcn.1000ba60
pop edi
pop ebp
mov byte [esp + 0x14], bl
pop esi
mov dword [esp + 0x10], 0xffffffff
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], 0xffffffff
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100605b0
Capabilities:
Encode data using xor
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1015bdb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov al, byte [0x1018c76f]
mov cl, 0xea
imul cl
push ebx
push esi
push 0x27
push 0xffffffffffffff91
push eax
call fcn.1006f400
add esp, 8
push eax
call fcn.1006f400
mov byte [0x1018c76e], al
mov ecx, 4
mov eax, 0x10
mov word [esp + 0x30], cx
mov word [esp + 0x32], ax
mov word [esp + 0x34], ax
mov word [esp + 0x36], ax
mov word [esp + 0x3e], cx
mov cl, byte [0x10197854]
mov al, 1
add esp, 8
xor ebx, ebx
test al, cl
mov word [esp + 0x1c], 0x44
mov word [esp + 0x1e], 0x15
mov word [esp + 0x20], 0x12
mov word [esp + 0x22], 0x18
mov word [esp + 0x24], 0x34
mov word [esp + 0x26], 0x2e
mov word [esp + 0x30], 0x3a
mov word [esp + 0x32], 0x2b
mov word [esp + 0x34], 0x1d
mov word [esp + 0x38], 8
jne 0x100606d2
push ebp
push edi
or cl, al
push 0x20
mov byte [0x10197854], cl
call fcn.1013c2df
add esp, 4
mov dword [0x10197858], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x24]
push edi
mov edx, ebp
mov ecx, 0x10197858
and edx, 0xffff
push edx
call fcn.1004a650
mov ecx, dword [0x10197858]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10197858]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x1e
jb 0x10060685
push 0x10061d20
mov word [eax + 0x1e], bx
call fcn.1013c36b
add esp, 4
pop edi
pop ebp
mov esi, dword [0x10197858]
mov dl, byte [esp + 0xb]
push esi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0xc]
push eax
push esi
call fcn.1000bf40
mov ecx, dword [0x10191a54]
lea eax, [esp + 0xc]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x4c], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10067e70
mov ecx, dword [esp + 0x10]
mov esi, eax
cmp ecx, ebx
mov dword [esp + 0x44], 0xffffffff
je 0x1006074d
mov al, byte [ecx - 1]
cmp al, bl
je 0x10060741
cmp al, 0xff
je 0x10060741
dec al
mov byte [ecx - 1], al
jmp 0x1006074d
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov al, byte [0x1018c76d]
push ebx
inc al
mov byte [0x1018c76d], al
call fcn.1013c3ac
mov ecx, dword [esp + 0x40]
add esp, 4
cmp eax, esi
mov dword fs:[0], ecx
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 0x40
ret
Function at 0x10063c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov al, byte [0x101977f4]
push ebx
push ebp
push esi
test al, 1
push edi
mov byte [esp + 0x20], 0xda
mov byte [esp + 0x21], 0xd8
mov byte [esp + 0x22], 0x58
mov byte [esp + 0x23], 8
mov byte [esp + 0x24], 0x39
mov byte [esp + 0x25], 0x4b
mov byte [esp + 0x26], 0x31
mov byte [esp + 0x27], 0x21
mov byte [esp + 0x28], 0x23
mov byte [esp + 0x29], 0x11
mov byte [esp + 0x2a], 0xb
mov byte [esp + 0x2b], 0xa5
mov byte [esp + 0x14], 0xb1
mov byte [esp + 0x15], 0xbd
mov byte [esp + 0x16], 0x2a
mov byte [esp + 0x17], 0x66
mov byte [esp + 0x18], 0x5c
mov byte [esp + 0x19], 0x27
mov byte [esp + 0x1a], 2
mov byte [esp + 0x1b], 0x13
mov byte [esp + 0x1c], 0xd
mov byte [esp + 0x1d], 0x75
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x1f], 0xc9
jne 0x10063da5
mov bl, al
push 0xd
or bl, 1
mov byte [0x101977f4], bl
call fcn.1013c2df
add esp, 4
mov dword [0x101977f8], eax
xor edi, edi
mov bl, byte [esp + edi + 0x14]
movsx eax, byte [esp + edi + 0x20]
movsx esi, bl
test esi, esi
jne 0x10063d4d
mov esi, 8
cdq
idiv esi
mov ecx, edx
test ecx, ecx
je 0x10063d78
mov eax, ecx
cdq
mov ebp, eax
mov eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebp
jge 0x10063d6d
lea esi, [ebp + 0xc]
mov eax, ecx
cdq
idiv esi
mov ecx, eax
test ecx, ecx
jne 0x10063d6d
mov al, byte [esp + edi + 0x20]
xor bl, al
mov eax, dword [0x101977f8]
or bl, cl
mov byte [edi + eax], bl
inc edi
cmp edi, 0xc
jb 0x10063d38
mov ecx, dword [0x101977f8]
push 0x10063ec0
mov byte [ecx + 0xc], 0
call fcn.1013c36b
add esp, 4
mov al, byte [0x101977fc]
mov edx, dword [0x101977f8]
test al, 1
mov dword [esp + 0x10], edx
mov byte [esp + 0x14], 0x4a
mov byte [esp + 0x15], 0x67
mov byte [esp + 0x16], 0x34
mov byte [esp + 0x17], 0x13
mov byte [esp + 0x18], 0x93
mov byte [esp + 0x19], 0xcd
mov byte [esp + 0x1a], 0xb6
mov byte [esp + 0x1b], 0x28
mov byte [esp + 0x20], 0x19
mov byte [esp + 0x21], 2
mov byte [esp + 0x22], 0x40
mov byte [esp + 0x23], 0x56
mov byte [esp + 0x24], 0xe5
mov byte [esp + 0x25], 0xa8
mov byte [esp + 0x26], 0xd8
mov byte [esp + 0x27], 0x5c
jne 0x10063e95
mov bl, al
push 9
or bl, 1
mov byte [0x101977fc], bl
call fcn.1013c2df
add esp, 4
mov dword [0x10197800], eax
xor edi, edi
mov bl, byte [esp + edi + 0x20]
movsx eax, byte [esp + edi + 0x14]
movsx esi, bl
test esi, esi
jne 0x10063e3d
mov esi, 8
cdq
idiv esi
mov ecx, edx
test ecx, ecx
je 0x10063e68
mov eax, ecx
cdq
mov ebp, eax
mov eax, esi
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ebp
jge 0x10063e5d
lea esi, [ebp + 0xc]
mov eax, ecx
cdq
idiv esi
mov ecx, eax
test ecx, ecx
jne 0x10063e5d
mov al, byte [esp + edi + 0x14]
xor bl, al
mov eax, dword [0x10197800]
or bl, cl
mov byte [edi + eax], bl
inc edi
cmp edi, 8
jb 0x10063e28
mov ecx, dword [0x10197800]
push 0x10063ed0
mov byte [ecx + 8], 0
call fcn.1013c36b
add esp, 4
mov edx, dword [esp + 0x10]
mov esi, dword [0x10197800]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x30]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10064ed0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015bf88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov eax, 0x22d
push ebp
cdq
idiv dword [0x1018c79c]
mov eax, dword [0x1018c798]
xor ebp, ebp
push esi
push edi
mov word [esp + 0x1c], 0x5e
mov word [esp + 0x1e], 0xf
mov word [esp + 0x22], 0x29
mov word [esp + 0x28], bp
mov word [esp + 0x2e], 0x2d
mov word [esp + 0x30], 0x3c
mov word [esp + 0x32], 2
mov word [esp + 0x34], 2
mov word [esp + 0x36], 0xb
mov word [esp + 0x38], 0xd
mov word [esp + 0x3c], 0x2b
mov word [esp + 0x40], 4
mov word [esp + 0x42], 8
mov word [esp + 0x44], 0xa
mov word [esp + 0x46], 0x1a
mov word [esp + 0x48], 1
mov cl, byte [edx + eax]
mov eax, 0x17
mov word [esp + 0x20], ax
mov word [esp + 0x26], ax
mov eax, 0x1d
mov byte [0x1018c7c0], cl
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], ax
mov word [esp + 0x3e], ax
mov al, byte [0x1019779c]
mov ecx, 0x3a
test al, 1
mov word [esp + 0x24], cx
mov word [esp + 0x3a], cx
jne 0x1006501c
or al, 1
push 0x30
mov byte [0x1019779c], al
call fcn.1013c2df
add esp, 4
mov dword [0x101977a0], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x1c]
push edi
mov edx, ebp
mov ecx, 0x101977a0
and edx, 0xffff
push edx
call fcn.1004a650
mov ecx, dword [0x101977a0]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x101977a0]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x2e
jb 0x10064fcd
push 0x10067770
mov word [eax + 0x2e], 0
call fcn.1013c36b
add esp, 4
xor ebp, ebp
mov edi, dword [0x101977a0]
mov dl, byte [esp + 0x5c]
push edi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x1006506c
mov eax, dword [esp + 0x10]
push esi
push edi
push eax
call fcn.100017d0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [ecx + esi*2], bp
mov edx, dword [esp + 0x5c]
mov ecx, dword [0x10191a54]
lea eax, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x5c], ebp
call fcn.10058e60
mov ecx, eax
call fcn.10067f30
mov ecx, dword [esp + 0x10]
pop edi
pop esi
cmp ecx, ebp
mov dword [esp + 0x4c], 0xffffffff
pop ebp
je 0x100650ca
mov al, byte [ecx - 1]
test al, al
je 0x100650be
cmp al, 0xff
je 0x100650be
dec al
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x10067c50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015c287
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov al, byte [0x10197744]
push ebx
mov ebx, 1
push esi
test bl, al
mov dword [esp + 0x4c], 0
mov byte [0x1018c7f1], 0x48
mov word [esp + 0xa], 0x6a
jne 0x10067cb3
or al, bl
push 0x47
mov byte [0x10197744], al
lea eax, [esp + 0xe]
push eax
mov ecx, 0x10197748
call fcn.1000b9b0
push 0x10067da0
call fcn.1013c36b
add esp, 4
mov ecx, dword [0x10197748]
push ecx
mov ecx, dword [0x10191a54]
call fcn.10058e50
mov ecx, eax
call fcn.1002db80
lea edx, [esp + 0x40]
push eax
push edx
call fcn.1000cf10
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x38]
push ecx
push eax
push edx
mov dword [esp + 0x70], ebx
call fcn.1000d050
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x78], 2
call fcn.10021700
add esp, 0x20
push 5
push eax
mov ecx, 0x10191620
mov byte [esp + 0x60], 3
call fcn.10050390
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.10021a90
add esp, 0xc
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0x5c], 7
call fcn.1000ba10
push ebx
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 6
call fcn.1000bc70
push ebx
lea ecx, [esp + 0x40]
mov byte [esp + 0x5c], 5
call fcn.1000bc70
mov esi, dword [esp + 0x60]
mov dl, byte [esp + 0xc]
mov byte [0x1018c7f0], 0x47
push 0
mov ecx, esi
mov byte [esi], dl
call fcn.1000bc70
mov eax, dword [0x1016a210]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
mov ecx, esi
call fcn.1000ba60
mov dword [esp + 0x4c], ebx
push ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c], 0
call fcn.1000bc70
mov ecx, dword [esp + 0x50]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret

Function at 0x10067e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015c308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [0x1018c7f0]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x28]
push edi
push 0
lea edx, [esp + 0x10]
push ecx
push edx
mov byte [0x1018c7f1], al
call fcn.10067c50
add esp, 0xc
mov ebx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push ebx
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.100efb00
mov cl, byte [0x1018c7f0]
mov edi, eax
mov byte [0x1018c7f1], cl
call fcn.100ef6f0
test eax, eax
je 0x10067eeb
lea edx, [esp + 0xc]
push ebx
push edx
lea ecx, [esi + 4]
call fcn.100ee120
mov edi, eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
test ecx, ecx
je 0x10067f19
mov al, byte [ecx - 1]
test al, al
je 0x10067f0d
cmp al, 0xff
je 0x10067f0d
dec al
mov byte [ecx - 1], al
jmp 0x10067f19
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x10067f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015c328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [0x1018c7f0], 0x96
call fcn.10067c50
add esp, 0xc
mov edi, dword [esp + 0x30]
lea edx, [esp + 0xc]
push edi
push edx
lea ecx, [esi + 4]
mov dword [esp + 0x2c], 0
call fcn.100ee140
lea eax, [esp + 0xc]
push edi
push eax
mov ecx, esi
call fcn.100efbb0
mov ecx, dword [esp + 0x10]
mov bl, al
test ecx, ecx
mov dword [esp + 0x24], 0xffffffff
je 0x10067fbf
mov al, byte [ecx - 1]
test al, al
je 0x10067fb3
cmp al, 0xff
je 0x10067fb3
dec al
mov byte [ecx - 1], al
jmp 0x10067fbf
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x1c]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x10068200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015c390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebx
mov bl, byte [0x1018c7f1]
push esi
inc bl
mov esi, ecx
mov byte [0x1018c7f1], bl
xor ebx, ebx
push ebx
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.10067c50
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x44], ebx
call fcn.10067db0
add esp, 0x14
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x38], 1
call fcn.100efe90
mov ecx, dword [esp + 0xc]
mov dl, al
cmp ecx, ebx
mov byte [esp + 0x38], dl
mov byte [esp + 0x30], bl
je 0x10068298
mov al, byte [ecx - 1]
cmp al, bl
je 0x10068288
cmp al, 0xff
je 0x10068288
dec al
mov byte [ecx - 1], al
jmp 0x10068298
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
mov dl, byte [esp + 0x3c]
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
cmp ecx, ebx
mov dword [esp + 0x30], 0xffffffff
je 0x100682c4
mov al, byte [ecx - 1]
cmp al, bl
je 0x100682d9
cmp al, 0xff
je 0x100682d9
dec al
mov byte [ecx - 1], al
pop esi
mov al, dl
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
mov ecx, dword [esp + 0x2c]
mov al, byte [esp + 0x3c]
add esp, 4
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x2c
ret 8
Function at 0x10069680
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015c547
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov al, byte [esp + 0x60]
push ebx
push esi
push edi
xor ebx, ebx
push 0x101913e8
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x20], al
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x1c]
push eax
push 0x101913e8
call fcn.1000bf40
mov eax, 0xeb
mov ecx, 0xec
mov word [esp + 0x2c], ax
mov word [esp + 0x44], ax
mov word [esp + 0x48], ax
mov word [esp + 0x52], ax
mov al, byte [0x10197dcc]
mov word [esp + 0x2e], cx
mov word [esp + 0x36], cx
mov ecx, 0xe3
mov edi, 0xee
mov esi, 0xdd
mov edx, 0xe4
mov dword [esp + 0x64], 1
test al, 1
mov word [esp + 0x30], 0xf6
mov word [esp + 0x32], 0xe7
mov word [esp + 0x34], 0xf0
mov word [esp + 0x38], cx
mov word [esp + 0x3a], di
mov word [esp + 0x3c], si
mov word [esp + 0x3e], cx
mov word [esp + 0x40], dx
mov word [esp + 0x42], dx
mov word [esp + 0x46], di
mov word [esp + 0x4a], cx
mov word [esp + 0x4c], 0xf6
mov word [esp + 0x4e], 0xe7
mov word [esp + 0x50], si
mov word [esp + 0x54], 0xe6
jne 0x100697d9
or al, 1
push 0x2c
mov byte [0x10197dcc], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197dd0], eax
xor esi, esi
mov di, word [esp + esi + 0x2c]
push 0x82
mov ecx, edi
and ecx, 0xffff
push ecx
mov ecx, 0x10197dd0
call fcn.100a8ee0
mov edx, dword [0x10197dd0]
add eax, 0x82
xor eax, edi
mov word [esi + edx], ax
add esi, 2
cmp esi, 0x2a
jb 0x1006978d
mov eax, dword [0x10197dd0]
push 0x10043b70
mov word [eax + 0x2a], bx
call fcn.1013c36b
add esp, 4
mov esi, dword [0x10197dd0]
mov cl, byte [esp + 0x6c]
push esi
mov byte [esp + 0x10], cl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0xc]
push eax
push esi
call fcn.1000bf40
mov esi, dword [esp + 0x6c]
mov ecx, dword [0x10191a54]
lea edx, [esp + 0x1c]
lea eax, [esp + 0xc]
push edx
push eax
push esi
mov byte [esp + 0x70], 2
call fcn.10058e60
mov ecx, eax
call fcn.10067fe0
mov dword [esp + 0x58], 1
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x64], 1
cmp ecx, ebx
je 0x10069860
mov al, byte [ecx - 1]
cmp al, bl
je 0x10069854
cmp al, 0xff
je 0x10069854
dec al
mov byte [ecx - 1], al
jmp 0x10069860
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp ecx, ebx
mov byte [esp + 0x64], bl
je 0x100698a8
mov al, byte [ecx - 1]
cmp al, bl
je 0x1006989c
cmp al, 0xff
je 0x1006989c
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
add esp, 0x5c
ret
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x5c
ret