joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100694f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea eax, [esi + edx]
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x400], 0
jne 0x100695d9
test edx, edx
jle 0x10069595
mov edi, esi
and edi, 3
je 0x10069595
movzx edi, bl
movzx eax, byte [esi]
xor eax, edi
shr ebx, 8
xor ebx, dword [ecx + eax*4]
lea edi, [esi + 1]
cmp edx, 2
jl 0x10069593
mov eax, edi
and eax, 3
je 0x10069593
movzx eax, bl
mov edi, edx
movzx edx, byte [esi + 1]
xor edx, eax
shr ebx, 8
xor ebx, dword [ecx + edx*4]
mov eax, edi
lea edi, [esi + 2]
cmp eax, 3
jl 0x10069593
mov eax, edi
and eax, 3
je 0x10069593
movzx eax, bl
movzx edx, byte [esi + 2]
xor edx, eax
shr ebx, 8
xor ebx, dword [ecx + edx*4]
lea edi, [esi + 3]
cmp dword [ebp + 0x14], 4
jl 0x10069593
mov eax, edi
and eax, 3
je 0x10069593
movzx eax, bl
movzx edx, byte [esi + 3]
add esi, 4
xor edx, eax
shr ebx, 8
xor ebx, dword [ecx + edx*4]
jmp 0x10069595
mov esi, edi
mov eax, dword [ebp - 0x10]
lea edi, [eax - 3]
cmp esi, edi
jae 0x100695d9
nop
xor ebx, dword [esi]
movzx edx, bl
movzx eax, bh
mov eax, dword [ecx + eax*4 + 0x800]
xor eax, dword [ecx + edx*4 + 0xc00]
mov edx, ebx
shr edx, 0xe
and edx, 0x3fc
xor eax, dword [ecx + edx + 0x400]
add esi, 4
shr ebx, 0x18
xor eax, dword [ecx + ebx*4]
mov ebx, eax
cmp esi, edi
jb 0x100695a0
jmp 0x100695db
mov eax, ebx
mov ebx, dword [ebp - 0x10]
cmp esi, ebx
jae 0x10069605
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, al
movzx edi, byte [esi]
xor edi, edx
shr eax, 8
xor eax, dword [ecx + edi*4]
add esi, 1
cmp ebx, esi
jne 0x100695f0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1006ffd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, ecx
or eax, edx
je 0x10070199
mov eax, esi
or eax, edi
je 0x100700df
mov eax, ecx
neg ecx
mov ebx, 0
sbb ebx, edx
and ebx, edx
and ecx, eax
mov eax, ecx
mov dword [ebp - 0x10], edx
mov edx, 0xcc95386d
mul edx
imul eax, ecx, 0x22fdd63
add eax, edx
imul ecx, ebx, 0xcc95386d
add ecx, eax
shr ecx, 0x1a
mov dword [ebp - 0x14], ecx
mov ecx, esi
neg ecx
mov ebx, 0
sbb ebx, edi
and ecx, esi
mov eax, ecx
mov edx, 0xcc95386d
mul edx
imul eax, ecx, 0x22fdd63
add eax, edx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx + 0x1015bfec]
and ebx, edi
imul edx, ebx, 0xcc95386d
mov ebx, dword [ebp + 8]
add edx, eax
shr edx, 0x1a
movzx eax, byte [edx + 0x1015bfec]
cmp ecx, eax
mov edx, ecx
cmova edx, eax
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0xc]
shrd ebx, edx, cl
mov edx, dword [ebp + 0xc]
sar edx, cl
sar dword [ebp - 0x10], 0x1f
test cl, 0x20
cmovne ebx, edx
mov ecx, dword [ebp - 0x10]
cmove ecx, edx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sar edx, 0x1f
add ebx, edx
adc dword [ebp - 0x10], edx
xor dword [ebp - 0x10], edx
mov ecx, eax
shrd esi, edi, cl
xor ebx, edx
mov edx, edi
mov ecx, eax
sar edx, cl
sar edi, 0x1f
test al, 0x20
cmovne esi, edx
cmove edi, edx
mov edx, dword [ebp - 0x10]
mov eax, edi
sar eax, 0x1f
add esi, eax
adc edi, eax
xor edi, eax
xor esi, eax
mov eax, ebx
xor eax, esi
mov ecx, edx
xor ecx, edi
or ecx, eax
jne 0x100700e8
mov eax, edx
mov dword [ebp - 0x14], ebx
mov ebx, edx
jmp 0x1007017e
mov esi, ecx
mov edi, edx
jmp 0x10070199
mov eax, edx
mov dword [ebp - 0x14], ebx
mov ecx, ebx
mov ebx, edx
nop word cs:[eax + eax]
nop dword [eax + eax]
cmp esi, ecx
mov eax, edi
sbb eax, edx
cmovl ebx, edi
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x14]
cmovl eax, esi
mov dword [ebp - 0x14], eax
cmovl edi, edx
cmovl esi, ecx
sub esi, eax
sbb edi, ebx
mov ecx, esi
neg ecx
mov ebx, 0
sbb ebx, edi
and ecx, esi
mov eax, ecx
mov edx, 0xcc95386d
mul edx
mov eax, 0x22fdd63
imul ecx, eax
add edx, ecx
and ebx, edi
mov eax, 0xcc95386d
imul ebx, eax
add ebx, edx
shr ebx, 0x1a
movzx ecx, byte [ebx + 0x1015bfec]
mov ebx, dword [ebp - 0x10]
shrd esi, edi, cl
mov eax, edi
sar eax, cl
sar edi, 0x1f
test cl, 0x20
cmovne esi, eax
cmove edi, eax
mov edx, dword [ebp - 0x14]
mov eax, edx
xor eax, esi
mov ecx, ebx
xor ecx, edi
or ecx, eax
mov ecx, edx
mov edx, ebx
jne 0x10070100
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
shld ebx, esi, cl
shl esi, cl
test cl, 0x20
cmovne ebx, esi
mov eax, 0
cmovne esi, eax
mov edi, ebx
mov eax, esi
mov edx, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10074930
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov eax, dword [0x1018fc64]
xor eax, ebp
mov dword [esp + 0xa8], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov dword [esp + 0xa4], 0xffffffff
mov dword [esp + 0xa0], 0xffffffff
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0xffffffff
cmp dword [0x10165740], 0x79
jae 0x10074b3f
mov eax, dword [0x10252284]
mov dword [esp + 0xc], eax
mov eax, dword [0x10252280]
mov dword [esp + 8], eax
lfence
rdtsc
xor dword [0x102522bc], eax
lfence
rdtsc
xor dword [0x1025232c], edx
xor edi, edi
xor ebx, ebx
mov dword [esp + 4], 0
jmp 0x10074a31
mov ecx, dword [0x10252280]
mov edx, 0x1ff
and ecx, edx
imul edx, dword [ecx*4 + 0x10252288], 0x19660d
mov edi, ebx
sub edi, 0xc46031b9
cmovb edi, ebx
add edx, edi
add edx, 0x3c6ef35f
mov dword [ecx*4 + 0x10252288], edx
mov ecx, dword [esp + 4]
test ecx, ecx
cmove ecx, eax
mov dword [esp + 4], ecx
mov edi, eax
call fcn.101135dd
lea ecx, [edi + ebx*2]
mov ebx, eax
sub ebx, edi
cmp ecx, eax
jge 0x100749f0
mov edi, ebx
sub edi, 0xc46031b9
cmovb edi, ebx
mov ecx, dword [0x10252284]
mov esi, dword [0x10252280]
add esi, 1
adc ecx, 0
mov edx, esi
and edx, 0x1ff
add dword [edx*4 + 0x10252288], edi
mov dword [0x10252280], esi
mov dword [0x10252284], ecx
mov edx, eax
sub edx, dword [esp + 4]
cmp edx, 0x1f
jl 0x10074a22
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
or edx, edi
setne byte [esp + 3]
sub esi, dword [esp + 8]
sbb ecx, edi
mov edx, 4
cmp edx, esi
mov edx, 0
sbb edx, ecx
setb byte [esp + 2]
mov edx, 0x40
cmp edx, esi
mov edx, 0
sbb edx, ecx
jb 0x10074acb
movzx ecx, byte [esp + 2]
and byte [esp + 3], cl
je 0x10074a22
lfence
rdtsc
add dword [0x10252444], eax
lea esi, [esp + 0x30]
push 0xa0
push esi
call fcn.1007581f
add esp, 8
push 0x800
push 0x10252288
push esi
call fcn.10079040
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push esi
call fcn.10079100
add esp, 8
push dword [esp + 0x10]
call fcn.1010d8c5
add esp, 4
mov esi, eax
push dword [esp + 0x20]
call fcn.1010d8c5
add esp, 4
mov edi, eax
add edi, esi
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.10102288
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4d
push str..._.._third_party_ffmpeg_libavutil_random_seed.c
push str.sizeof_tmp____av_sha_size
push str.Assertion__s_failed_at__s:_d_n
push 0
push 0
call fcn.1006fc50
add esp, 0x18
call fcn.10112c55
int3
Function at 0x100792c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 0x18]
test esi, esi
js 0x10079489
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
jne 0x100792ef
call fcn.10065070
lea ecx, [eax + 1]
cmp eax, 1
mov esi, 1
cmovg esi, ecx
cmp ebx, 1
mov dword [ebp - 0x18], esi
sbb esi, 0
push 0x34
call fcn.10070af0
add esp, 4
mov dword [edi], eax
mov edi, 0xfffffff4
test eax, eax
je 0x1007947f
mov edx, eax
test esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], eax
je 0x10079335
push 0x20
push esi
call fcn.10070a70
mov edx, dword [ebp - 0x10]
add esp, 8
mov dword [edx], eax
test eax, eax
je 0x10079474
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x28], ecx
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], ebx
mov edi, dword [ebp - 0x18]
mov dword [edx + 4], edi
mov dword [edx + 0x24], 0
lea eax, [edx + 0x18]
xorps xmm0, xmm0
movups xmmword [edx + 8], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 0
cmp dword [ebp - 0x1c], 0
jle 0x1007947f
xor edi, edi
jmp 0x100793a9
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, dword [ebp - 0x20]
add edi, 1
cmp edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
je 0x1007946f
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], edi
shl edi, 5
lea ecx, [edx + edi]
mov dword [ebp - 0x24], ecx
mov dword [edx + edi], eax
lea esi, [edx + edi]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov eax, dword [ebp - 0x14]
lea ebx, [eax + edi]
add ebx, 8
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + edi + 0x1c], 0
lea eax, [ecx + edi]
add eax, 0xc
mov dword [ecx + edi + 0x10], 0x100794b0
mov edx, dword [ebp - 0x24]
mov dword [ecx + edi + 0x14], edx
push 0
push 0
push eax
push 0x10023f50
push 0
push 0
call fcn.1010d6d4
mov ecx, dword [ebp - 0x14]
add esp, 0x18
mov dword [ecx + edi + 0xc], eax
test eax, eax
je 0x10079446
add edi, ecx
add edi, 0x1c
cmp dword [edi], 0
jne 0x10079390
push 0
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
cmp dword [edi], 0
je 0x10079430
jmp 0x10079390
cmp dword [ebp + 0x14], 1
mov ecx, dword [ebp - 0x20]
adc ecx, 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push dword [ebp + 8]
call fcn.100795a0
add esp, 4
mov edi, 0xffffffff
jmp 0x1007947f
mov edi, dword [ebp - 0x18]
jmp 0x1007947f
push dword [ebp + 8]
call fcn.100709e0
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x66
push str..._.._third_party_ffmpeg_libavutil_slicethread.c
push str.nb_threads___0
push str.Assertion__s_failed_at__s:_d_n
push 0
push 0
call fcn.1006fc50
add esp, 0x18
call fcn.10112c55
int3
Function at 0x100bb430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x1018fc64]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.101141f5
add esp, 0x10
cmp eax, esi
jne 0x100bb4b3
cmp ebx, 1
je 0x100bb455
cmp ebx, 2
mov esi, 0xffffffff
je 0x100bb4b6
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.10113b07
add esp, 4
neg eax
sbb esi, esi
jmp 0x100bb4b6
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10102288
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100bb4d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x100bb4f4
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.101141f5
add esp, 0x14
jmp 0x100bb523
test esi, esi
jle 0x100bb51c
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x100bb51e
inc edi
cmp esi, edi
mov eax, ebx
jne 0x100bb4fd
mov edi, esi
jmp 0x100bb51e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x100bb530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x1018fc64]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x100bb580
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x100bb589
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.101141f5
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x100bb582
jmp 0x100bb611
xor ebx, ebx
mov esi, ebx
jmp 0x100bb611
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x100bb60e
mov ebx, eax
cmp eax, 3
je 0x100bb5f1
cmp ebx, 1
ja 0x100bb60e
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.101141f5
add esp, 0x10
cmp eax, esi
jne 0x100bb60e
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x100bb594
jmp 0x100bb606
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.101141f5
add esp, 0x10
cmp eax, ebx
jne 0x100bb60e
mov ebx, dword [ebp + 8]
jmp 0x100bb582
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10102288
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x100bb660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x100bb684
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.101141f5
add esp, 0x14
jmp 0x100bb6b4
test esi, esi
jle 0x100bb6ad
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x100bb6af
inc edi
cmp esi, edi
mov eax, ebx
jne 0x100bb68d
mov edi, esi
jmp 0x100bb6af
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x100bb6c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x1018fc64]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x100bb70f
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x100bb727
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.101141f5
add esp, 0x10
cmp eax, 1
je 0x100bb711
xor esi, esi
dec esi
jmp 0x100bb711
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10102288
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x100bb70a
mov ebx, eax
cmp eax, 3
je 0x100bb78f
cmp ebx, 1
ja 0x100bb70a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.101141f5
add esp, 0x10
cmp eax, esi
jne 0x100bb70a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x100bb732
jmp 0x100bb7a8
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.101141f5
add esp, 0x10
cmp eax, ebx
jne 0x100bb70a
movzx esi, word [ebp + 8]
jmp 0x100bb711

Function at 0x100bf990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x100bf9bf
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x100bf9a1
pop esi
pop edi
pop ebp
ret 8

Function at 0x100bfad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x100bfb01
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x100bfae1
pop esi
pop edi
pop ebp
ret 8
Function at 0x100c0990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, esp
mov dword [esi + 0x78], ebp
lea ecx, [esi + 0x80]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x100cf2d0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x18]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esi + 0x70]
push ebx
call fcn.100bb860
add esp, 4
push dword [ebp + 0x18]
lea eax, [esi + 0x18]
push eax
push dword [ebx + 4]
push dword [ebx]
push 0x14
push edi
call fcn.100d08a7
add esp, 0x18
mov dword [esi + 0x14], eax
add eax, esi
add eax, 0x50
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
push eax
push edi
call fcn.100be42c
add esp, 0xc
mov dword [esi + 0xc], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 8]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.100b9a9a
lea eax, [esi + 0x80]
mov dword [eax + 8], 0
mov ecx, edi
push 0x10254378
call fcn.100bc430
mov ebx, eax
mov ecx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x100c0a76
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x88], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov edi, dword [esi + 0x10]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 0xc]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 0x14]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.100c9e00
add esp, 0x1c
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x100c3fa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x100cf450
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.1007ce20
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.100b9a9a
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x10254378
call fcn.100bc430
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea ecx, [esi + 0x84]
lea edx, [esi + 3]
mov byte [edx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.100cbbd0
add esp, 0x2c
test al, al
je 0x100c40fe
mov ecx, dword [ebp + 0x20]
test byte [ecx], 1
jne 0x100c4097
mov word [ecx], 0
jmp 0x100c40a4
mov eax, dword [ecx + 8]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [esi + 3], 0
je 0x100c40c0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.100cfd5e
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ebx, [edi - 1]
cmp edx, ebx
jae 0x100c40ea
lea ecx, [edx + 1]
cmp ebx, ecx
cmova ecx, ebx
cmp byte [edx], al
jne 0x100c40ea
inc edx
cmp ecx, edx
jne 0x100c40df
mov edx, ecx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.100cecc0
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.100ba380
mov edi, dword [ebp + 8]
test al, al
je 0x100c4117
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x100c4130
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x100c4152
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x100cb7e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.100cec84
mov ebx, eax
test esi, esi
je 0x100cb821
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x100cb80e
movzx eax, word [eax]
jmp 0x100cb815
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x100cb821
test bl, bl
jne 0x100cb827
jmp 0x100cb884
xor esi, esi
test bl, bl
jne 0x100cb875
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x100cb836
movzx eax, word [eax]
jmp 0x100cb83b
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x100cb866
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x100cb85f
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x100cb7f4
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x100cb7f4
mov ecx, edi
call fcn.100cec84
mov ebx, eax
test esi, esi
jne 0x100cb88d
jmp 0x100cb87e
mov ecx, edi
call fcn.100cec84
mov ebx, eax
test bl, bl
jne 0x100cb8ac
jmp 0x100cb8b2
mov ecx, edi
call fcn.100cec84
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x100cb89a
movzx eax, word [eax]
jmp 0x100cb8a1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x100cb8b2
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10