joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esi + 0x14]
inc esi
mov al, byte [esi - 1]
jp 0x407e51
jne 0x407eb3
adc eax, 0xcc851845
mov eax, dword [esi]
jne 0xff7eb5
mov byte [esi - 1], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi - 1], dl
inc eax
mov byte [esi], 0x2e
inc esi
jno 0x407e4c
inc dword [ecx]
jle 0x407e5a
add dword [esi + 0xa], edi
dec edi
outsd dx, dword [esi]
or byte [eax - 0xbfa16f2], cl
jne 0x407e43
mov byte [esi], 0x65
inc esi
stosb byte es:[edi], al
invalid
sub byte [eax + 0x39], 0x88
push ss
inc esi
add cl, 0x30
mov byte [esi], cl
jmp 0x407e0c
int 0xc2
invalid
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebx + 0x77c4f10], 0xffffffc7
inc ebp
adc byte [esi], cl
add byte [eax], al
insb byte es:[edi], dx
inc ebp
or ah, bl
inc eax
sub edx, eax
ja 0x407f0c
mov edx, dword [eax]
sbb byte [ebx - 0x75], dl
pop ebp
and byte [esi + 0x3257f633], dl
loopne 0x407ea3
jne 0x407f18
mov dword [ecx], esi
test ah, 5
mov edi, ebx
jp 0x407f2b
fld qword [ebp + 8]
fchs
fstp qword [ebp + 8]
mov dword [ecx], 0x6a00a801
mov dl, 0x4d
pop ebp
or bh, al
add dword [ecx], eax
test al, 0
push 0xffffffffffffffb2
dec ebp
or al, 0x8b
push ebp
or byte [eax], dh
dec ecx
in al, dx
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_modf]
mov ecx, 0x45dd085d
in al, dx
fcomp qword [0x40c230]
invalid
Function at 0x7ffe5412
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
push bx
inc esp
inc esp
add al, 0
push bx
inc esp
inc esp
push es
pop ds
add al, 4
sub al, 4
add al, 0
xor eax, ecx
xor eax, ecx
push es
pop ds
push bx
inc esp
inc esp
push eax
pop eax
push bx
inc esp
inc esp
add al, 0
push bx
inc esp
inc esp
add al, 0
not eax
not eax
and al, 0xff
push bx
inc esp
inc esp
push eax
pop eax
add al, 4
sub al, 4
and al, 0xff
push bx
inc esp
inc esp
push es
pop ds
push eax
pop eax
call 0x7ffe5461
pop edx
xor dx, dx
cld
push eax
pop eax
add edx, 0xd5e0
inc esi
dec esi
push eax
pop eax
xor ecx, ecx
mov cl, 0x1e
xor byte [ecx + edx], 0x99
loop 0x7ffe5476
inc esi
dec esi
add al, 4
sub al, 4
push dword fs:[0x24]
clc
inc esi
dec esi
pop dword [edx + 0xa]
inc esi
dec esi
mov cl, 0xff
push es
pop ds
push edx
loop 0x7ffe5495
push eax
pop eax
push bx
inc esp
inc esp
mov dword [edx + 0x11], 0xffffacbb
add al, 0
mov ecx, dword [eax + 0x2c]
add al, 4
sub al, 4
mov dword [edx + 0x1b], ecx
clc
inc esi
dec esi
mov dword [edx + 0x100], ecx
cld
mov dword [eax + 0x2c], esp
push 0
not eax
not eax
add al, 0
push 0
inc esi
dec esi
push 0
and al, 0xff
pushal
inc eax
popal
push 0
push eax
pop eax
push 0x30
push 0x20
xor eax, ecx
xor eax, ecx
push 0
clc
push 0
and al, 0xff
add edx, 0xffff7f32
cld
push edx
push edx
push 0
cld
call dword [edx + 0x8211]
push es
pop ds
stc
and al, 0xff
add esp, 0x3f8
push eax
pop eax
nop
xor eax, eax
inc esi
dec esi
inc eax
ret 0xc

Function at 0x7ffe9c50
Capabilities:
Encode data using xor

Disassembly:
and dword [0x1b091d03], edx
adc eax, 0x1b091d03
adc ebx, dword [eax]
daa
push ds
cmp byte [edx + eax*2], bh
xor dword [edi], edx
adc byte [ecx], bh
or eax, 0x10232e06
sub al, 0x2f
sbb al, byte [eax + 0x2f]
pop ss
adc dh, byte [edi]
and bh, byte [0x35040915]
push ss
sub eax, dword cs:[esi]
aas
sbb byte [ebx], ch
sbb al, 0x42
cmp eax, 0x1b1b210d
or byte [ebx], ch
adc dword [eax + edi], ecx
cmp dword [ebx], eax
adc byte [ebx], dh
push ds
and edx, dword [edi]
adc eax, 0x422e1209
sub byte [edx], bh
inc edx
aaa
and byte [edi], ah
add edx, dword [ebx]
sbb ecx, dword [eax]
xor esp, dword [edx]
aas
adc ah, byte [edi + edi]
sbb eax, 0xa87f2510
jg 0x7ffe9bfa
jg 0x7ffe9bfa
and cl, byte [edi + 0x1f365a1c]
and esi, dword [ebx - 0x19d0de]
mov esp, 0x3138747a
add dword [ebx], ebp
shl dword [esi + 0x263d14e8], 0x5a
sal byte [edx + 0x1a], cl
add dword [edi], ebp
jg 0x7ffe9bfb
xchg edi, eax
mov al, byte [0x4100fe6]
sbb eax, dword [esi + 0x2a]
out 0x20, al
sahf
xchg ebp, eax
lcall 0x806c, 0x24132bdf
pop eax
out dx, eax
mov al, byte [0xc3152ba7]
cli
or edx, esi
sbb esp, dword [ebp + 0x16]
mov eax, eax
cdq
dec ebp
mov ebp, 0x2e5025dc
scasb al, byte es:[edi]
daa
cmp dh, al
inc esp
mov edi, dword [edi - 0x2f4ad4d4]
add edx, 0xfffffff5
lodsd eax, dword [esi]
cld
cli
fstp xword es:[ebx]
mov al, 0x96
add dh, byte [ebx]
pop ss
adc eax, 0x30bec62c
push cs
sbb al, byte [esp + ebx]
fdiv qword [0x4117a174]
mov eax, 0xb0711ae1
pop es
mov ch, 0x25
cmp byte [edx], 0x81
invalid
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x1002ae40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d39e5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1021b380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1002c600
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1002aecc
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x102b3fc0], 0x52bf5a
jne 0x1002aee3
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x102b3fbc
mov dword [ebp - 4], 0
push 0x318
mov dword [ebp - 0x18], 0
call fcn.101d040b
mov ecx, dword [esi]
add esp, 4
mov ebx, eax
mov dword [ebp - 0x18], ebx
push 0x30c
lea esi, [ebx + 0xc]
mov dword [ebx + 8], ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, esi
call fcn.1002d470
mov dword [ebp - 4], 1
mov eax, dword [0x102b3fc0]
mov esi, dword [0x102b3fd4]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102082c0]
mov eax, esi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x102082c0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x102b3fb8]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x1002afca
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1000d5b0
call fcn.101d1980
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x1002afb2
cmp esi, 0x200
jae 0x1002afb0
shl esi, 3
cmp esi, ecx
jae 0x1002afb2
mov esi, ecx
push esi
call fcn.1002bc00
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002c600
mov ecx, dword [eax]
jmp 0x1002afcd
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.1002b840
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002bc00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1002bc2c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x102b3fbc]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x102b3fc4
lea eax, [edi + edi]
push eax
call fcn.10029d90
mov eax, dword [0x102b3fbc]
lea ebx, [edi - 1]
mov dword [0x102b3fd0], ebx
mov dword [0x102b3fd4], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1002bd66
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x102b3fc4]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x1002bcc4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1002bd31
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1002bcfe
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x1002bcf6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x1002bd31
cmp ebx, edx
je 0x1002bd0e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1002bd42
cmp ebx, edx
jne 0x1002bd02
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1002bd66
mov ebx, dword [0x102b3fd0]
jmp 0x1002bc72
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1002bd31
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002c670
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x10038e90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d423d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1021b380]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [0x107001f0]
mov eax, dword [ebp + 0xc]
add ebx, 0xd5bd03c9
mov edi, dword [ebp + 8]
xor ebx, 0xde9a561b
mov dword [ebp - 0x44], eax
mov eax, dword [0x102bb42c]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x30], ebx
test eax, eax
jne 0x10038ff4
mov edi, dword [0x102bb424]
test edi, edi
jne 0x10038fa0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x3c], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x38], ecx
cmp ecx, ebx
je 0x10038f7a
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x10038f7a
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [ebp - 0x34], ecx
mov edi, 0x38921ba0
mov dword [ebp - 0x2c], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x10038f70
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x10038f42
mov edx, dword [ebp - 0x2c]
cmp edi, 0x60f92b2c
je 0x10038f7e
mov ecx, dword [ebp - 0x34]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x10038f28
mov eax, dword [eax]
jmp 0x10038f03
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x30]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
add edi, esi
mov dword [0x102bb424], edi
lea eax, [ebp - 0x28]
mov ecx, 0x102ad6e8
push eax
call fcn.100438a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
mov eax, dword [0x107001f0]
cmova ecx, dword [ebp - 0x28]
add eax, 0xd5bd03c9
xor eax, 0xde9a561b
push ecx
push dword [eax + 0x170]
call edi
lea ecx, [ebp - 0x28]
mov dword [0x102bb42c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10029c20
mov eax, dword [0x102bb42c]
mov edi, dword [ebp - 0x40]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call eax
mov ecx, dword [ebx + 0x108]
mov esi, eax
add esp, 8
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ebp - 0x44]
sub eax, dword [ecx]
cdq
xor eax, edx
sub eax, edx
cmp eax, esi
jle 0x1003903a
mov eax, dword [0x107001f0]
add eax, 0xd5bd03c9
xor eax, 0xde9a561b
mov eax, dword [eax + 0x108]
mov eax, dword [eax + 0x1c]
mov dword [ecx], eax
cmp byte [edi], 0
sete al
mov byte [edi], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d03f8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100394d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d429f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1021b380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov word [esi], 0
lea eax, [esi + 0x3c]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x3f800000
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push 0x60
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
push 0
push eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
call sub.VCRUNTIME140.dll_memset
mov byte [esi + 0x9c], 0
xorps xmm0, xmm0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
movups xmmword [esi + 0xb0], xmm0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 0xf
mov byte [esi + 0xb0], 0
mov dword [ebp - 4], 0
movups xmmword [esi + 0xc8], xmm0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0xf
mov byte [esi + 0xc8], 0
movups xmmword [esi + 0xe0], xmm0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0xf
mov byte [esi + 0xe0], 0
mov byte [ebp - 4], 2
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0xbf800000
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x118], 0
push 0x4b0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x124], 0
add esi, 0x128
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
mov ecx, esi
call fcn.10039ad0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003f480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1003f4f0
cmp byte [esi + 1], 0
jne 0x1003f537
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x19
jb 0x1003f4b0
jmp 0x1003f537
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x19
jb 0x1003f4f6
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1a]
push eax
push edi
call fcn.10041a10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003f620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1003f690
cmp byte [esi + 1], 0
jne 0x1003f6d7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xe
jb 0x1003f650
jmp 0x1003f6d7
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xe
jb 0x1003f696
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xf]
push eax
push edi
call fcn.10041a10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003f700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1003f770
cmp byte [esi + 1], 0
jne 0x1003f7b7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xc
jb 0x1003f730
jmp 0x1003f7b7
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xc
jb 0x1003f776
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xd]
push eax
push edi
call fcn.10041a10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003fb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1003fb70
cmp byte [esi + 1], 0
jne 0x1003fbb7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xb
jb 0x1003fb30
jmp 0x1003fbb7
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xb
jb 0x1003fb76
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xc]
push eax
push edi
call fcn.10041a10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10040db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1021b380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10040e6c
cmp byte [esi + 0x3d], 0
je 0x10040e6c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10040e5a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10040e21
sub eax, 1
je 0x10040e25
sub eax, 2
jne 0x10040e5a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d03f8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10040e43
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10040e5a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d03f8
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d03f8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.101d03f8
mov esp, ebp
pop ebp
ret