joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019a37c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101a4c78]
jne 0x1019a386
repz ret
jmp fcn.1019bdeb

Function at 0x1019cf3f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1019a3fd
and dword [ebp - 4], 0
cmp dword [0x101a6bb8], 0
mov ebx, eax
jne 0x1019cff0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019d0a1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019d0a1
push eax
call fcn.1019a38b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101a6bb8], eax
call esi
push eax
call fcn.1019a38b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101a6bbc], eax
call esi
push eax
call fcn.1019a38b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101a6bc0], eax
call esi
push eax
call fcn.1019a38b
pop ecx
mov dword [0x101a6bc8], eax
test eax, eax
je 0x1019cff0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1019a38b
pop ecx
mov dword [0x101a6bc4], eax
mov eax, dword [0x101a6bc4]
cmp eax, ebx
je 0x1019d048
cmp dword [0x101a6bc8], ebx
je 0x1019d048
push eax
call fcn.1019a406
push dword [0x101a6bc8]
mov esi, eax
call fcn.1019a406
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1019d048
test edi, edi
je 0x1019d048
call esi
test eax, eax
je 0x1019d03f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019d03f
test byte [ebp - 0xc], 1
jne 0x1019d048
or dword [ebp + 0x10], 0x200000
jmp 0x1019d081
mov eax, dword [0x101a6bbc]
cmp eax, ebx
je 0x1019d081
push eax
call fcn.1019a406
pop ecx
test eax, eax
je 0x1019d081
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019d081
mov eax, dword [0x101a6bc0]
cmp eax, ebx
je 0x1019d081
push eax
call fcn.1019a406
pop ecx
test eax, eax
je 0x1019d081
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101a6bb8]
call fcn.1019a406
pop ecx
test eax, eax
je 0x1019d0a1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019d0a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1019ea93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x101a46f8], 0x1dce
mov dword [ebp - 0x10], eax
call fcn.1019f9a6
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1019ead9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101a46f4], 0x18ed
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1019ebfa
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [0x101a46f8], 0x1dce
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x1019eb9a
mov al, byte [ebp - 0x4d]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x4c]
add edx, 1
mov ah, byte [ebp - 0x4e]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x48], edx
jne 0x1019eb48
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x1019ebcd
jmp 0x1019eba3
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x3c]
add edx, 2
mov esi, dword [ebp - 0x2c]
cmp ecx, esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
jb 0x1019eb24
jmp 0x1019ebfa
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov dword [0x101a46f4], 0x1941
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101a46f8], 0x92b
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019ef0c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1019ef79
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1019efe6
xor eax, eax
mov ecx, 0x1088
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x1019f02f
mov dword [0x101a46f4], 0x636
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1019efc4
jmp 0x1019ef4c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x1019efa6
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
jl 0x1019ef79
mov eax, dword [ebp - 0x28]
mov dword [0x101a46f8], 0x258e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x1019ef5e
jmp 0x1019ef4c
mov dword [0x101a46f4], 0x3d46
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1019ef39
jmp 0x1019ef4c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1019ef4c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1019ef4c
mov eax, 1
mov ecx, 0x18d0
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x1019ef4c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [0x101a46f4], eax
mov eax, ecx
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x1019f1f1
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101a4700], 0
mov byte [0x101a4704], 0
mov edi, dword [0x101a46f4]
add edi, 0xfffff8e9
mov dword [0x101a46f8], edi
mov dword [0x101a46fc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1019f251
xor eax, eax
mov dword [0x101a46fc], 0
mov dword [ebp - 0x20], eax
jmp 0x1019f28d
mov eax, dword [ebp - 0x1c]
mov dword [0x101a46f4], 0x7c1
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101a46f8], 0x17ea
mov eax, dword [0x101a46fc]
add eax, 1
mov dword [0x101a46fc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1019f251
jmp 0x1019f240
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101a4708], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x101a4700]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101a4708], esi
mov dword [0x101a46f4], 0xa1b
mov eax, esi
cdq
idiv ecx
mov dword [0x101a4700], edx
mov dword [0x101a46f8], 0xd32
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101a4704], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101a4704]
mov esi, dword [0x101a4700]
mov byte [ebx + esi], cl
mov esi, dword [0x101a46fc]
add esi, 1
mov dword [0x101a46fc], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1019f28d
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019f6e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101a46f8], 0x1e49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + str._Q]
mov dh, byte [eax + 0x101a028d]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1019f702
lea eax, [ebp - 0x24]
mov dword [0x101a46f8], 0x1a22
mov ecx, dword [0x101a46f4]
add ecx, 0xffffefe3
mov dword [0x101a46f4], ecx
mov dword [ebp - 0x34], eax
call fcn.1019ec05
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1019e818
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1019f818
mov dword [0x101a46f4], 0x2091
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1019f04d
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101a46f4], 0x1f7a
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x2c], ecx
mov dword [0x101a46f8], 0x8aa
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x34], ecx
add ecx, 0x1b82
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1019f80f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1019fb36
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x1e25
xor ebx, ebx
mov dword [0x101a46fc], 0
mov dword [0x101a4700], 0
mov dword [0x101a470c], 0
mov dword [0x101a46f4], 0xfa3
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1019fcd1
jmp 0x1019fbb5
mov eax, dword [0x101a46f4]
add eax, 0xe82
mov dword [ebp - 0x2c], eax
jmp 0x1019fcd1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
add ecx, 1
mov edi, eax
add edi, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101a46fc], edx
mov dword [0x101a46f4], 0x3264
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x101a4700], edx
mov ecx, dword [0x101a46f8]
add ecx, 0xfffff82b
mov dword [0x101a46f8], ecx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101a4704], cl
mov dword [0x101a46f4], 0x26b4
mov ebx, dword [ebp - 0x24]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x101a46f8], 0x112a
mov cl, byte [0x101a4704]
mov edx, dword [0x101a4700]
mov byte [ebx + edx], cl
mov edx, dword [0x101a46fc]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101a4700]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x101a46f8], 0x55d
and ecx, 0xff
mov dword [0x101a470c], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x101a46f4], 0x65f
mov dword [0x101a46f8], 0xffffdf97
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x3c], edi
je 0x1019fba3
mov eax, dword [0x101a4700]
mov ecx, dword [0x101a46fc]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], edx
jmp 0x1019fbb5
mov eax, dword [ebp - 0x2c]
mov dword [0x101a46f4], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019fce1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov edx, dword [0x101a46f4]
mov esi, edx
add esi, 0xffffdde0
mov dword [0x101a46f8], esi
add edx, 0xffffe928
mov dword [0x101a46f4], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1019f400
lea ecx, [0x1019f18c]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x88], 0x147200
mov edx, dword [0x101a46e0]
mov dword [esp + 0x54], edx
mov edx, dword [0x101a46e4]
mov dword [esp + 0x70], edx
mov edx, dword [0x101a46e8]
mov dword [esp + 0x4c], edx
mov edx, dword [0x101a46ec]
mov dword [esp + 0x68], edx
mov dword [0x101a46f4], 0x5bd
mov edx, dword [0x101a46f0]
mov dword [esp + 0x7c], edx
mov dword [0x101a46f8], 0xfffff4b2
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1019fda1
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1019fdc4
jmp 0x1019fdb0
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x1019fd8b
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1019fda1
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x50], edx
mov dword [0x101a46f4], 0xe1c
call fcn.1019ef0c
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x1019fe1e
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1019f6e0
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x10018370
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbcbb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100d200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x100e5e20]
test al, 1
jne 0x100184bb
or eax, 1
mov dword [0x100e5e20], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100c7b90]
pxor xmm0, xmmword [0x100c7dc0]
mov dword [ebp - 0x1c], 0xa1bea1be
mov dword [ebp - 0x18], 0xc7a1c3b9
mov word [ebp - 0x14], 0x81b0
movups xmmword [ebp - 0x2c], xmm0
xor byte [ebp + eax - 0x2c], 0x81
inc eax
cmp eax, 0x1a
jb 0x100183f4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018420
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.1001d4d0
mov byte [ebp - 4], 1
mov edx, dword [0x100e60d4]
test edx, edx
je 0x10018449
mov edx, dword [edx + 0x50]
jmp 0x1001844b
xor edx, edx
mov eax, dword [0x100e60cc]
test eax, eax
je 0x10018459
mov eax, dword [eax + 0x18]
jmp 0x1001845b
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.10017f30
mov eax, dword [ebp - 0x30]
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov dword [0x100e5e24], eax
cmp edx, 0x10
jb 0x100184b2
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100184a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100184a3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100bac64
mov eax, dword [0x100e5e24]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x100184c0
mov eax, dword [0x100e5e24]
test eax, eax
je 0x100184c8
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001d7e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbee7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100d200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x410
call fcn.100ba805
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov ecx, edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100c6618
mov eax, dword [esi]
push eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov dword [edi + 0x3c0], 0
mov word [edi + 0x3c8], pe_nt_image_headers32
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov dword [edi + 0x3e4], 0
mov word [edi + 0x3f4], 0
call fcn.100184e0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0xe4e5eecc
xor eax, eax
mov dword [ebp - 0xc], 0xe4f5a1ed
mov dword [ebp - 8], 0xf3f4f5f9
mov word [ebp - 4], 0xf2e4
mov byte [ebp - 2], 0x81
xor byte [ebp + eax - 0x10], 0x81
inc eax
cmp eax, 0xf
jb 0x10022577
movaps xmm0, xmmword [0x100c82f0]
mov eax, 0x10
pxor xmm0, xmmword [0x100c7b90]
mov dword [ebp - 0x18], 0xf4e2f5ef
mov word [ebp - 0x14], 0xe4e3
mov byte [ebp - 0x12], 0x81
movups xmmword [ebp - 0x28], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x28], 0x81
inc eax
cmp eax, 0x17
jb 0x100225b0
mov ecx, dword [0x100e6140]
lea edx, [ebp - 0x10]
push 0
push 1
push edx
mov eax, dword [ecx]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [eax + 0x150]
call eax
mov ecx, eax
mov dword [0x100e5edc], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov dword [ebp - 0x10], 0xe4e5eecc
xor eax, eax
mov dword [ebp - 0xc], 0xe4f5a1ed
mov dword [ebp - 8], 0xf3f4f5f9
mov word [ebp - 4], 0xf2e4
mov byte [ebp - 2], 0x81
xor byte [ebp + eax - 0x10], 0x81
inc eax
cmp eax, 0xf
jb 0x10022607
movaps xmm0, xmmword [0x100c8450]
mov eax, 0x10
pxor xmm0, xmmword [0x100c7b90]
mov dword [ebp - 0x18], 0x81f5e0ed
movups xmmword [ebp - 0x28], xmm0
xor byte [ebp + eax - 0x28], 0x81
inc eax
cmp eax, 0x14
jb 0x10022631
mov ecx, dword [0x100e6140]
lea edx, [ebp - 0x10]
push 0
push 1
push edx
mov eax, dword [ecx]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [eax + 0x150]
call eax
mov ecx, eax
mov dword [0x100e5ee0], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esp, ebp
pop ebp
ret
Function at 0x10025800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100e423c], 0
push ebx
push esi
push edi
je 0x1002598e
mov ecx, dword [0x100e6110]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002598e
mov ecx, dword [0x100e6194]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1002598e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x10025860
xor edx, edx
test ecx, ecx
je 0x10025889
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10025870
cmp edi, 0x5ff56dc5
je 0x10025898
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1002598e
mov ecx, dword [ebp - 4]
jmp 0x10025844
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1002598e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1002598e
movss xmm1, dword [0x100c7998]
xor ebx, ebx
cmp edx, 4
jl 0x1002595b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100258fc
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10025917
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10025932
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10025945
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x100258e1
cmp ebx, edx
jl 0x1002595f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1002598e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10025983
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10025970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret