joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100739f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov cl, 0x44
push esi
mov dword [ebp - 0x114], eax
mov esi, 0x1046adc0
lea eax, [ebp - 0x108]
push edi
mov edi, eax
sub esi, edi
nop
mov byte [eax], cl
lea eax, [eax + 1]
mov cl, byte [esi + eax]
test cl, cl
jne 0x10073a20
mov byte [eax], cl
xor eax, eax
cmp byte [ebp - 0x108], al
je 0x10073a4b
nop dword [eax + eax]
inc eax
cmp byte [ebp + eax - 0x108], 0
jne 0x10073a40
mov cl, byte [edx]
lea eax, [ebp + eax - 0x108]
test cl, cl
je 0x10073a6a
sub edx, eax
nop word [eax + eax]
mov byte [eax], cl
inc eax
mov cl, byte [edx + eax]
test cl, cl
jne 0x10073a60
mov ecx, dword [0x11d0c5b8]
mov byte [eax], 0
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x10073b4b
mov eax, dword [eax + 0xbe28]
test eax, eax
je 0x10073b4b
mov edi, dword [eax + 0x26e0]
test edi, edi
je 0x10073b4b
lea ecx, [ebp - 0x108]
push ebx
xor bl, bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10073ab2
sub ecx, edx
mov edx, 2
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0x10c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10450898
mov esi, eax
add esp, 4
test esi, esi
je 0x10073b36
push dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 4
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x114]
push 0
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmove ebx, ecx
call fcn.10450877
add esp, 4
mov al, bl
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4
Function at 0x100800f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x11d0c5b8]
xor edx, edx
mov eax, dword fs:[0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x48], edx
and edx, 0xfffffffe
push ebx
mov eax, dword [eax + ecx*4]
xor bl, bl
push esi
push edi
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx + 0xbe2c]
mov eax, dword [eax + 0x11cc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x54], edx
xor edx, edx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], 0x35
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], edx
mov byte [ebp - 8], bl
mov dword [ebp - 0x3c], 0x4e564441
mov dword [ebp - 0x38], 0x10002
mov dword [ebp - 0x34], 0x35
mov dword [ebp - 0x30], 0x4e564458
mov dword [ebp - 0x2c], 0x1000109
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 2
mov edi, dword [ecx + 0xbe2c]
mov esi, dword [edi + 0x10b4]
test esi, esi
je 0x10080231
mov eax, dword [edi]
test eax, eax
je 0x10080231
mov ecx, dword [eax + 0xbe28]
test ecx, ecx
je 0x10080231
mov ecx, dword [ecx + 0x14]
test ecx, ecx
je 0x10080231
cmp dword [eax + 0xd45c], 1
jne 0x1008021e
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x1428]
push eax
call esi
mov ecx, dword [edi + 0x10b4]
lea eax, [ebp - 0x58]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0xbe28]
push dword [eax + 0x14]
call ecx
mov ebx, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x44]
movlpd qword [ebp - 0x44], xmm0
push eax
call esi
mov ecx, dword [ebp - 0x44]
sub ecx, dword [edi + 0x1428]
mov eax, dword [ebp - 0x40]
sbb eax, dword [edi + 0x142c]
add dword [edi + 0x1420], ecx
adc dword [edi + 0x1424], eax
jmp 0x10080227
lea eax, [ebp - 0x58]
push eax
push ecx
call esi
mov ebx, eax
test ebx, ebx
jne 0x1008024b
mov bl, byte [ebp - 8]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x1008024b
pop edi
test bl, bl
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x10080260
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x11d0c5b8]
xor edx, edx
mov eax, dword fs:[0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x48], edx
and edx, 0xfffffffe
push edi
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx + 0xbe2c]
mov eax, dword [eax + 0x11cc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov al, byte [ebp + 8]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x4c], 0x35
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0x4e564441
mov dword [ebp - 0x38], 0x10002
mov dword [ebp - 0x34], 0x35
mov dword [ebp - 0x30], 0x4e564458
mov dword [ebp - 0x2c], 0x1000109
mov dword [ebp - 0xc], 1
mov byte [ebp - 8], al
mov edi, dword [ecx + 0xbe2c]
mov edx, dword [edi + 0x10b4]
test edx, edx
je 0x100803a5
mov eax, dword [edi]
test eax, eax
je 0x100803a5
mov ecx, dword [eax + 0xbe28]
test ecx, ecx
je 0x100803a5
mov ecx, dword [ecx + 0x14]
test ecx, ecx
je 0x100803a5
cmp dword [eax + 0xd45c], 1
jne 0x1008039e
lea eax, [edi + 0x1428]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x58]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0xbe28]
push dword [eax + 0x14]
mov eax, dword [edi + 0x10b4]
call eax
lea eax, [ebp - 0x44]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x44]
sub ecx, dword [edi + 0x1428]
mov eax, dword [ebp - 0x40]
sbb eax, dword [edi + 0x142c]
add dword [edi + 0x1420], ecx
adc dword [edi + 0x1424], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x58]
push eax
push ecx
call edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4
Function at 0x100aaf80
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, edx
mov dword [ebp - 8], edx
cdq
and edx, 3
mov dword [ebp - 4], 0x95543787
push ebx
push esi
push edi
lea esi, [edx + eax]
mov edi, 0x8de1c3ac
sar esi, 2
mov edx, 0x2ad7eb25
lea ebx, [ecx + esi*4]
neg esi
je 0x100aafe6
mov ecx, 0x95543787
mov eax, dword [ebx + esi*4]
imul eax, ecx
rol eax, 0xb
imul eax, edx
lea edx, [edx + edx*4]
add edx, 0x6bce6396
xor eax, edi
lea edi, [eax*2 + 0x52dce729]
add edi, eax
lea eax, [ecx + 0x18b29dec]
lea ecx, [eax + eax*4]
add esi, 1
jne 0x100aafb5
mov dword [ebp - 4], ecx
mov esi, dword [ebp - 8]
xor ecx, ecx
mov eax, esi
and eax, 3
sub eax, 1
je 0x100ab00f
sub eax, 1
je 0x100ab006
sub eax, 1
jne 0x100ab029
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx eax, byte [ebx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [ebx]
xor eax, ecx
imul eax, dword [ebp - 4]
rol eax, 0xb
imul eax, edx
xor eax, edi
lea edi, [eax*2 + 0x52dce729]
add edi, eax
xor esi, edi
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100cc5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x8e8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, dword [0x11d0c5b8]
lea ebx, [edi + 0x7c]
mov eax, dword fs:[0x2c]
mov dword [ebp - 4], 0
lea eax, [eax + edx*4]
mov dword [ebp - 0x10], eax
push 0x10
push 0x2d0
call fcn.10434a32
mov esi, eax
add esp, 8
test esi, esi
je 0x100cc7dc
push 0x2c0
push 0
push esi
call fcn.10425c00
mov eax, 0x14
add esp, 0xc
mov word [esi + 0x10], ax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov ecx, dword [edx + 0x10]
cmp dword [ecx + 0x7b30], 0
jne 0x100cc660
mov dword [ecx + 0x7b30], esi
mov eax, dword [ecx + 0x7b2c]
test eax, eax
je 0x100cc66c
mov dword [eax], esi
mov dword [esi], 0
mov eax, dword [edx + 0x10]
mov eax, dword [eax + 0x7b2c]
mov dword [esi + 4], eax
inc dword [ecx + 0x7b34]
mov dword [ecx + 0x7b2c], esi
mov ecx, dword [ebp - 4]
mov dword [ebx], esi
mov dword [esi + 0x2c0], ecx
inc ecx
mov eax, dword [ebx]
mov dword [ebp - 4], ecx
mov dword [eax + 0x2c4], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [eax + 0x2c8], eax
cmp ecx, 6
jl 0x100cc614
cmp byte [ebp + 8], 0
mov dword [edi + 0x20], 0x100cc410
mov dword [edi + 0x28], 0x100cc500
je 0x100cc70a
mov dword [edi + 0x1c], 0x1028b440
mov eax, 0x1028b990
mov dword [edi + 0x24], 0x1028b4d0
mov ecx, 0x1028b8c0
mov edx, 0x1028bb40
mov dword [ebp - 0xc], 0x1028b560
mov esi, 0x1028ba60
mov dword [ebp - 4], 0x1028b7e0
mov ebx, 0x1028b630
mov dword [ebp + 8], 0x1028b700
jmp 0x100cc746
mov dword [edi + 0x1c], 0x100cba40
mov eax, 0x100cb8a0
mov dword [edi + 0x24], 0x100cbad0
mov ecx, 0x100cb6e0
mov edx, 0x100cb520
mov dword [ebp - 0xc], 0x100cb7c0
mov esi, 0x100cb340
mov dword [ebp - 4], 0x100cb600
mov ebx, 0x100cb970
mov dword [ebp + 8], 0x100cb430
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x40], 0x100cbc80
mov dword [edi + 0x44], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x48], 0x100cbed0
mov dword [edi + 0x4c], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x50], 0x100cc100
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], 0x100cc310
mov dword [edi + 0x5c], esi
mov dword [edi + 0x60], 0x100cbb50
mov dword [edi + 0x64], edx
mov dword [edi + 0x68], 0x100cbdb0
mov dword [edi + 0x6c], ecx
mov dword [edi + 0x70], 0x100cbff0
mov dword [edi + 0x74], eax
mov al, byte [ebp + 0xc]
mov dword [edi + 0x78], 0x100cc210
mov byte [edi + 0x98], al
mov al, 1
mov byte [edi + 0x99], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov dword [ebx], 0
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100d8fa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x10
push 0x90
mov esi, ecx
call fcn.10434a32
mov dword [esi + 0x3c], eax
add esp, 8
mov dword [eax + 0x84], 0
mov eax, dword [esi + 0x3c]
push 0x10468dc0
mov dword [eax + 0x88], 0
mov eax, dword [esi + 0x3c]
mov byte [eax + 0x8c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x54], eax
test eax, eax
je 0x100d8ffd
push 0x1046b950
push eax
call edi
jmp 0x100d8fff
xor eax, eax
mov dword [esi + 0x154], eax
mov eax, dword [esi + 0x54]
test eax, eax
je 0x100d9016
push 0x1046b980
push eax
call edi
jmp 0x100d9018
xor eax, eax
cmp dword [esi + 0x154], 0
mov dword [esi + 0x158], eax
je 0x100d90b6
test eax, eax
je 0x100d90b6
push 0x60
lea ebx, [esi + 0x68]
push 0
push ebx
call fcn.10425c00
mov eax, dword [ebp + 8]
lea edi, [esi + 0x58]
add esp, 0xc
mov dword [ebx], eax
mov dword [esi + 0x70], 4
xor ebx, ebx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi - 0x18], eax
test eax, eax
je 0x100d90b6
lea ecx, [esi + 0x68]
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0x154]
push ecx
call eax
test eax, eax
js 0x100d90b6
mov eax, dword [esi + 0xc0]
inc ebx
mov dword [edi], eax
add edi, 4
cmp ebx, 4
jb 0x100d9054
lea eax, [esi + 8]
push eax
push 0
push esi
push 0x100d9140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x100d90b6
pop edi
mov byte [esi], 0
mov al, 1
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
Function at 0x100da540
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x11d20648], 0
push ebx
push esi
push edi
mov esi, 0x10469160
je 0x100da562
push 0x11d20630
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 0x11d22b10
call fcn.10098480
xor eax, eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp byte [0x11d22b10], al
je 0x100da590
inc eax
cmp byte [eax + 0x11d22b10], 0
jne 0x100da583
mov dword [ebp - 4], eax
cmp dword [0x11cd34c0], 0
mov eax, 0x112295b0
cmove eax, esi
mov esi, 0x11d22b10
mov dword [ebp - 8], eax
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x100da5b0
sub esi, ecx
xor edi, edi
test esi, esi
jle 0x100da63c
nop
mov dl, byte [edi + 0x11d22b10]
lea eax, [edi + 0xf0]
cmp eax, esi
mov dword [ebp - 0xc], eax
mov ebx, eax
mov ecx, 0x11d22a10
cmovge ebx, esi
xor eax, eax
test dl, dl
je 0x100da5fe
cmp eax, 0xf0
jae 0x100da601
inc eax
mov byte [ecx], dl
inc ecx
mov dl, byte [edi + eax + 0x11d22b10]
test dl, dl
jne 0x100da5e1
cmp eax, 0xf0
jae 0x100da601
mov byte [ecx], 0
sub ebx, edi
cmp ebx, 0x100
jae 0x100da66b
mov byte [ebx + 0x11d22a10], 0
test edi, edi
jne 0x100da62a
push dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call ebx
push 0x11d22a10
call ebx
jmp 0x100da635
push 0x11d22a10
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [ebp - 0xc]
cmp edi, esi
jl 0x100da5c0
mov ecx, dword [ebp - 4]
xor eax, eax
cmp byte [ecx + 0x11d22b0f], 0xa
sete al
cmp byte [0x11d20648], 0
mov dword [0x11cd34c0], eax
je 0x100da664
push 0x11d20630
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1045079c
int3
Function at 0x100f28d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x200c]
test esi, esi
je 0x100f2973
mov ebx, dword [ebp + 8]
mov edx, ebx
movzx eax, dl
xor eax, 0x811c9dc5
shr edx, 8
imul ecx, eax, 0x1000193
movzx eax, dl
shr edx, 8
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, dl
shr edx, 8
xor eax, ecx
imul eax, eax, 0x1000193
xor eax, edx
mov edx, 1
imul eax, eax, 0x2f9fa7c3
mov ecx, eax
shr ecx, 7
xor ecx, eax
lea eax, [ecx + ecx*8]
mov ecx, dword [edi + 0x2018]
shl edx, cl
mov ecx, eax
shr ecx, 0x11
dec edx
xor ecx, eax
mov eax, ecx
shl eax, 5
add eax, ecx
and edx, eax
mov esi, dword [esi + edx*4]
test esi, esi
je 0x100f2973
mov ecx, dword [ebp + 0xc]
cmp dword [esi], ebx
jne 0x100f295c
cmp dword [esi + 4], ecx
je 0x100f296b
mov eax, dword [esi + 0xc]
shr eax, 0x1f
test al, al
jne 0x100f2973
mov esi, dword [esi + 0x14]
jmp 0x100f2953
lea ebx, [edi + 0x2014]
jmp 0x100f297e
lea ebx, [edi + 0x2014]
mov esi, ebx
or esi, 1
mov eax, ebx
or eax, 1
cmp esi, eax
je 0x100f2ad1
mov ecx, dword [0x11d0c5b8]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov dword [ebp + 0xc], eax
cmp byte [eax + 8], 0
jne 0x100f29ae
call fcn.10450c0b
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
push dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0x34]
lea eax, [edi + 0x2010]
or eax, 2
cmp esi, eax
je 0x100f2ad1
lea ecx, [esi + 0xc]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], edx
cmp dword [edi + 0x2010], esi
jne 0x100f29ec
mov dword [edi + 0x2010], edx
jmp 0x100f2a1e
mov edx, dword [eax + 0xc]
mov eax, edx
shr eax, 0x1f
test al, al
jne 0x100f2a05
mov eax, dword [ecx]
shr eax, 0x1f
test al, al
jne 0x100f2a05
xor eax, eax
jmp 0x100f2a0a
mov eax, 0x80000000
and edx, 0x7fffffff
or edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x14], edx
cmp dword [ebx], esi
jne 0x100f2a26
mov dword [ebx], eax
jmp 0x100f2a29
mov dword [edx + 0x10], eax
mov eax, dword [ecx]
mov ebx, 1
mov ecx, dword [edi + 0x2018]
mov edx, ebx
shl edx, cl
mov ecx, dword [edi + 0x200c]
dec edx
and edx, eax
cmp dword [ecx + edx*4], esi
jne 0x100f2a5e
shr eax, 0x1f
test al, al
je 0x100f2a58
mov dword [ecx + edx*4], 0
jmp 0x100f2a5e
mov eax, dword [esi + 0x14]
mov dword [ecx + edx*4], eax
push 0x18
push esi
call fcn.1045088a
dec dword [edi + 0x2020]
add esp, 8
mov eax, dword [edi + 0x2020]
mov ecx, dword [edi + 0x2018]
shl ebx, cl
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1122e340]
cvtpd2ps xmm1, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
shr ebx, 0x1f
addsd xmm0, qword [ebx*8 + 0x1122e340]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [edi + 0x2028]
comiss xmm0, xmm1
jbe 0x100f2ad1
cmp ecx, dword [edi + 0x201c]
jle 0x100f2ad1
lea eax, [ecx - 1]
push eax
lea ecx, [edi + 0x2008]
call fcn.100f2c60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100f6530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm2, xmmword [0x1122e3e0]
xor eax, eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x3c], 0x5af35aeb
mov dword [ebp - 0x38], 0x5ae45afa
mov ecx, 0x5aa5
mov dword [ebp - 0x34], 0x5af55af5
mov dword [ebp - 0x30], 0x5af55afa
mov dword [ebp - 0x2c], 0x5aea5af7
mov dword [ebp - 0x28], 0x5aec5ae3
mov dword [ebp - 0x24], 0x5ae05ae9
mov dword [ebp - 0x20], 0x5af55afa
mov dword [ebp - 0x1c], 0x5aea5af7
mov dword [ebp - 0x18], 0x5ae05ae6
mov dword [ebp - 0x14], 0x5af65af6
mov dword [ebp - 0x10], 0x5aeb5afa
mov dword [ebp - 0xc], 0x5ae85ae4
mov dword [ebp - 8], 0x5aa55ae0
nop dword [eax + eax]
movups xmm0, xmmword [ebp + eax*2 - 0x3c]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax*2 - 0x3c], xmm1
add eax, 8
cmp eax, 0x18
jb 0x100f65c0
cmp eax, 0x1c
jae 0x100f65eb
nop
xor word [ebp + eax*2 - 0x3c], cx
inc eax
cmp eax, 0x1c
jb 0x100f65e0
lea eax, [ebp - 0x3c]
push eax
call fcn.1043b631
mov esi, eax
add esp, 4
test esi, esi
je 0x100f6670
movzx eax, word [esi]
lea ecx, [ebp - 0x83c]
test ax, ax
je 0x100f6648
mov edx, eax
mov ebx, 0x2f
cmp dx, 0x5c
jne 0x100f661d
mov word [ecx], bx
jmp 0x100f6637
lea eax, [edx - 0x41]
cmp ax, 0x19
ja 0x100f662e
lea eax, [edx + 0x20]
mov word [ecx], ax
jmp 0x100f6637
cmp dx, 0x22
je 0x100f663a
mov word [ecx], dx
add ecx, 2
movzx eax, word [esi + 2]
add esi, 2
mov edx, eax
test ax, ax
jne 0x100f6612
xor eax, eax
lea edx, [ebp - 0x83c]
mov word [ecx], ax
mov ecx, dword [edi]
call fcn.10008140
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x100f99a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push 0x38
push 0
push eax
call fcn.10425c00
movaps xmm1, xmmword [0x1122e3e0]
add esp, 0xc
xor ecx, ecx
nop dword [eax]
movups xmm0, xmmword [ecx*2 + 0x11220a40]
pxor xmm0, xmm1
movups xmmword [ebp + ecx*2 - 0x3c], xmm0
add ecx, 8
cmp ecx, 0x18
jb 0x100f99d0
cmp ecx, 0x1c
jae 0x100f9a08
nop
mov eax, 0x5aa5
xor ax, word [ecx*2 + 0x11220a40]
mov word [ebp + ecx*2 - 0x3c], ax
inc ecx
cmp ecx, 0x1c
jb 0x100f99f0
lea eax, [ebp - 0x3c]
push eax
call fcn.1043b631
add esp, 4
test eax, eax
je 0x100f9a3a
push 0x200
push eax
push esi
call fcn.1043c460
add esp, 0xc
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [esi], ax
xor ecx, ebp
xor al, al
pop esi
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4
Function at 0x100fa350
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1224
call fcn.10451050
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor cl, cl
mov ebx, 0x11220930
push edi
mov byte [ebp - 0x1219], cl
xor esi, esi
mov dword [ebp - 0x1220], esi
cmp esi, 0x104
jae 0x100fa4fc
xor eax, eax
cmp byte [ebx], 0x99
je 0x100fa3b9
mov edx, ebx
cmp eax, 0x103
jae 0x100fa3ae
mov cl, byte [edx]
inc edx
xor cl, 0x99
mov byte [ebp + eax - 0x110], cl
inc eax
cmp byte [edx], 0x99
jne 0x100fa394
cmp eax, 0x104
jae 0x100fa515
mov byte [ebp + eax - 0x110], 0
test eax, eax
je 0x100fa4cf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x100fa3f1
add esi, 0x104
add ebx, 0x104
jmp 0x100fa379
lea eax, [ebp - 0x1224]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100fa4c8
mov eax, dword [ebp - 0x1224]
mov ecx, 0x400
cmp eax, 0x400
cmova eax, ecx
xor esi, esi
mov dword [ebp - 0x1224], eax
test eax, 0xfffffffc
jbe 0x100fa4c2
nop dword [eax]
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp + esi*4 - 0x1218]
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x100fa496
lea eax, [ebp - 0x110]
push eax
call fcn.1043a9cb
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.1043a9cb
add esp, 4
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10425570
add esp, 8
test eax, eax
jne 0x100fa4e0
mov eax, dword [ebp - 0x1224]
inc esi
shr eax, 2
cmp esi, eax
jb 0x100fa440
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1220]
add esi, 0x104
add ebx, 0x104
jmp 0x100fa379
mov esi, dword [ebp - 0x1220]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x104
add ebx, 0x104
jmp 0x100fa379
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, 1
mov al, cl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp - 0x1219]
mov al, cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret
call fcn.1045079c
int3