joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001b40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
add eax, 0xfffffb01
push ebx
mov ebx, dword [esp + 8]
add edx, 0x7f
push ebp
mov ebp, dword [esp + 0x20]
mov ecx, ebx
add ebp, 0xfffffb1b
mov dword [esp + 0x10], edx
xor eax, 0x199
mov dword [esp + 0xc], ebp
xor ecx, 0x158b
cmp ebp, eax
je 0x10001c10
mov eax, dword [esp + 0x1c]
xor eax, 0x19f
cmp edx, eax
jle 0x10001bb4
mov ecx, dword [0x100c0f90]
mov edx, dword [esp + 0x18]
cmp dword [ecx + 4], 0x10e32
jae 0x10001c14
mov eax, dword [ecx + 0xe4]
sub eax, dword [edx + 4]
add eax, 0x83459
imul eax, dword [ecx + 0x24]
mov dword [ecx + 0x24], eax
jmp 0x10001c14
mov ebp, dword [0x100c0ecc]
xor ebp, edx
push edi
mov edi, ecx
cmp ecx, ebp
jbe 0x10001c0f
or ebx, 0x1ac4
sub ebx, edx
push esi
nop dword [eax]
cmp ecx, ebx
jge 0x10001c07
mov eax, dword [esp + 0x20]
mov edx, ebx
sub edx, ecx
dec edx
mov esi, dword [eax + 0xf4]
imul esi, dword [eax + 0x100]
mov eax, 0xaaaaaaab
mul edx
imul esi, dword [esp + 0x14]
shr edx, 1
inc edx
nop dword [eax]
xor ecx, esi
sub edx, 1
jne 0x10001c00
add edi, 4
cmp edi, ebp
ja 0x10001bd0
pop esi
pop edi
mov edx, dword [esp + 0x18]
mov eax, dword [0x100c0f24]
add eax, 0x4186a
add eax, dword [edx + 0xf8]
mov dword [edx + 0xd0], eax
mov eax, dword [esp + 0x10]
pop ebp
add eax, 0xfffffbfc
pop ebx
ret
Function at 0x100022a0
Capabilities:
Create pipe

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
xor dword [esp + 0xc], 0x4c5
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 0x232]
xor esi, 0x7c7
mov ebx, ecx
push edi
lea edi, [eax - 0x7f3]
xor ebx, 0x1ba0
mov eax, esi
add ecx, 0xffffe460
xor eax, 0x86b
cmp edi, eax
jle 0x1000238f
lea eax, [edi - 0x92]
cmp ecx, eax
jge 0x10002320
mov ecx, dword [0x100c0f90]
mov eax, dword [0x100c0f14]
add eax, 0x1a7e02
add dword [ecx + 0x50], eax
mov ecx, dword [0x100c0f90]
mov eax, dword [ecx + 0x64]
xor eax, dword [ecx + 0xb8]
xor eax, 0x163038
mov dword [ecx + 0xb8], eax
jmp 0x1000238f
mov edx, dword [0x100c0f90]
imul eax, esi, 0x18bc
or eax, edi
cmp dword [edx + 0x6c], eax
jbe 0x10002395
mov eax, dword [0x100c0f74]
add eax, 0xffffe8c7
add eax, dword [edx + 0xc0]
push eax
mov eax, dword [0x100c0ee0]
or eax, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x9c]
or eax, ebx
xor eax, 0x178d
push eax
mov eax, dword [0x100c0ef4]
xor eax, ebp
push eax
mov eax, dword [edx + 0x1c]
imul eax, dword [edx + 0x14]
push eax
mov eax, dword [edx + 0xec]
xor eax, ecx
push eax
mov eax, ebp
or eax, 0x16a6
push eax
mov eax, ebp
xor eax, dword [esp + 0x38]
or eax, 0x1618
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [0x100c0f90]
lea eax, [esi - 0x615]
cmp edi, eax
jl 0x100023f7
lea eax, [ebp - 0x426]
cmp ebx, eax
jg 0x100023f7
mov eax, dword [0x100c0f6c]
add eax, 0x15d8be
add eax, dword [edx + 0x9c]
mov dword [0x100c0f6c], eax
mov eax, edi
xor eax, 0xee7
push eax
mov eax, dword [esp + 0x20]
add eax, 0x3b6
push eax
lea eax, [esi - 0x803]
push eax
lea eax, [edi - 0x92]
push eax
push dword [esp + 0x34]
lea eax, [ebp - 0x861]
push eax
call fcn.1000faa0
add esp, 0x18
xor esi, 0x1db
pop edi
lea eax, [esi - 0x3d5]
pop esi
pop ebp
pop ebx
ret
Function at 0x10003de0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
add eax, 0xffffff97
push edi
mov edi, dword [esp + 0xc]
lea ecx, [edx + 0x27b]
add esi, 0xffffffec
add edi, 0xffffe399
cmp ecx, eax
jl 0x10003f0f
mov eax, dword [esp + 0x10]
xor edx, 0x139d
add eax, 0xffffe399
xor eax, 0x1841
cmp edx, eax
jg 0x10003ec8
mov esi, dword [esp + 0x20]
mov eax, dword [0x100c0f90]
mov edx, dword [esi + 0x34]
cmp edx, dword [eax + 0x58]
ja 0x10003f0f
nop dword [eax]
mov eax, dword [0x100c0efc]
xor dword [0x100c0f64], eax
mov eax, 0x19a826
sub eax, dword [0x100c0ea8]
sub eax, dword [0x100c0f70]
add dword [esi + 0xf8], eax
mov eax, edx
mov ecx, dword [0x100c0f90]
imul eax, edx
inc edx
add dword [ecx + 0xcc], eax
mov ecx, dword [0x100c0f90]
mov eax, dword [0x100c0f7c]
add eax, 0xfff5c036
imul eax, dword [ecx + 0x9c]
mov dword [ecx + 0x9c], eax
mov eax, dword [esi + 0x4c]
mov ecx, dword [0x100c0f90]
xor eax, 0x888d5
add dword [ecx + 0xd0], eax
mov eax, dword [0x100c0eb0]
dec eax
add eax, dword [esi + 0x40]
mov dword [0x100c0eb0], eax
mov eax, dword [0x100c0f90]
cmp edx, dword [eax + 0x58]
jbe 0x10003e40
xor edi, 0x1e99
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0x20]
mov edx, dword [0x100c0f90]
mov eax, dword [eax + 0xf4]
add eax, dword [0x100c0f54]
add eax, esi
cmp dword [edx + 0x38], eax
jne 0x10003f0f
imul eax, esi, 0x178d
cmp dword [edx + 0xc0], eax
jbe 0x10003f0f
mov eax, dword [0x100c0ec4]
xor eax, 0x1ac4
cmp dword [edx + 0x48], eax
jbe 0x10003f0f
or ecx, 0x1614
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, 0x1e99
mov eax, edi
pop edi
pop esi
ret
Function at 0x10004200
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, edx
push esi
mov esi, dword [esp + 0x1c]
xor eax, 0x1841
add esi, 0x308
add eax, 0x1a7b
cmp esi, eax
jge 0x1000436e
mov ecx, esi
lea eax, [edx - 0xb4]
xor ecx, 0x11a
cmp eax, ecx
jl 0x1000436e
mov eax, dword [esp + 0x18]
push ebx
push edi
xor edi, edi
mov dword [eax + 0xa4], 0x100a0750
nop dword [eax + eax]
mov ecx, dword [eax + 0xe4]
add ecx, dword [0x100c0eec]
sub dword [0x100c0ec8], ecx
mov ecx, dword [eax + 0x64]
sub ecx, 0xdc9f7
add dword [eax + 0xf8], ecx
mov ecx, dword [eax + 0xa4]
mov edx, dword [ecx + edi]
add edi, 4
mov ecx, dword [0x100c0f90]
imul edx, dword [ecx + 0x60]
mov ecx, dword [0x100c0ec8]
sub ecx, dword [eax + 0xec]
sub ecx, 0x2543df
add dword [eax + 0x64], ecx
mov ecx, dword [0x100c0f90]
mov ebx, edx
mov dword [esp + 0x24], edx
shr ebx, 0x18
mov edx, dword [ecx + 0x80]
mov ecx, dword [eax + 0xb0]
mov byte [edx + ecx], bl
mov ecx, dword [0x100c0f90]
mov ebx, dword [esp + 0x24]
shr ebx, 0x10
inc dword [ecx + 0x80]
mov ecx, dword [0x100c0f90]
mov edx, dword [ecx + 0x80]
mov ecx, dword [0x100c0f28]
mov byte [ecx + edx], bl
mov ecx, dword [0x100c0f90]
mov ebx, dword [esp + 0x24]
shr ebx, 8
inc dword [ecx + 0x80]
mov ecx, dword [0x100c0f90]
mov edx, dword [ecx + 0xb0]
mov ecx, dword [ecx + 0x80]
mov byte [edx + ecx], bl
mov ecx, dword [0x100c0f90]
mov ebx, dword [esp + 0x24]
inc dword [ecx + 0x80]
mov ecx, dword [eax + 0xc8]
xor ecx, 0x5aec7
or dword [0x100c0ec8], ecx
mov edx, dword [eax + 0x80]
mov ecx, dword [0x100c0f28]
mov byte [ecx + edx], bl
inc dword [eax + 0x80]
mov ecx, dword [0x100c0f40]
xor ecx, dword [0x100c0f5c]
sub ecx, 0x5aec6
imul ecx, dword [0x100c0ed4]
mov dword [0x100c0ed4], ecx
cmp edi, 0x1fcf8
jl 0x10004250
pop edi
pop ebx
lea eax, [esi + 0x1ae]
pop esi
ret
Function at 0x10004380
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
add edx, 0x232
push esi
push edi
mov edi, dword [esp + 0x1c]
add ebx, 0x36d
lea esi, [edi - 0x1ae]
mov ecx, esi
lea eax, [edi - 0x12f]
xor ecx, 0x487
cmp eax, ecx
jle 0x10004491
mov ecx, dword [esp + 0x20]
lea eax, [esi - 0xf6]
add ecx, 0xfffffacd
cmp ecx, eax
jge 0x1000445d
mov edx, dword [esp + 0x14]
xor esi, esi
nop word [eax + eax]
mov eax, dword [edx + 0xe4]
xor eax, dword [0x100c0f6c]
sub eax, 0x15d8e0
imul eax, dword [edx + 0xb8]
mov dword [edx + 0xb8], eax
mov eax, dword [edx + 0xb4]
mov ecx, dword [eax + esi]
mov eax, dword [0x100c0f2c]
xor ecx, dword [0x100c0f00]
mov dword [esi + eax], ecx
add esi, 4
mov eax, dword [0x100c0f90]
mov ecx, dword [0x100c0ed4]
sub ecx, dword [eax + 0x74]
add dword [edx + 0x30], ecx
mov eax, dword [0x100c0f48]
add eax, 0xfffbe784
add dword [edx + 0x100], eax
mov eax, dword [0x100c0f3c]
add dword [edx + 0x88], eax
cmp esi, 0x7eec4
jl 0x100043e0
mov eax, dword [0x100c0f90]
mov ecx, dword [0x100c0f2c]
mov dword [eax + 0x90], ecx
mov eax, dword [0x100c0f68]
add eax, dword [0x100c0f28]
push eax
mov eax, dword [0x100c0f90]
push dword [0x100c0f60]
push dword [eax + 0x114]
call dword [0x100c0f08]
xor edi, 0xf85
mov dword [0x100c0f50], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [0x100c0eb8]
mov ecx, dword [0x100c0f40]
and eax, 0x1841
xor eax, ebx
cmp ecx, eax
jbe 0x100044b1
or edx, esi
add ecx, edx
mov dword [0x100c0f40], ecx
xor edi, 0xf85
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x1000ee60
Capabilities:
Create pipe

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
add eax, 0x24d
push ebx
mov ebx, dword [esp + 0x1c]
add edx, 0x920
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x28]
lea ecx, [ebx - 0x1c67]
xor ebx, 0xeb
mov dword [esp + 0x18], eax
xor ebp, 0xe59
mov dword [esp + 0xc], edx
add esi, 0x4a4
mov dword [esp + 0x24], ebx
lea eax, [ebx + 0x9a]
cmp edx, eax
jne 0x1000eeeb
xor esi, 0xe59
cmp ebp, esi
jl 0x1000efd1
cmp dword [0x100c0eb0], 0x12ba9
je 0x1000efd1
mov eax, dword [0x100c0f54]
xor eax, 0x1e76669d
xor ebx, 0x215
pop esi
mov dword [0x100c0e84], eax
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
push edi
mov edi, dword [0x100c0edc]
mov eax, edi
xor eax, esi
xor eax, ecx
cmp dword [0x100c0f04], eax
jb 0x1000efd0
mov eax, dword [esp + 0x20]
mov edx, dword [0x100c0f90]
mov eax, dword [eax + 0x84]
mov ecx, dword [edx + 0xe0]
imul eax, esi
or eax, 0x18bc
cmp ecx, eax
jne 0x1000efd0
mov eax, dword [esp + 0x1c]
mov ebx, ecx
xor eax, ebp
xor eax, 0x1e99
mov dword [esp + 0x1c], eax
nop dword [eax + eax]
mov eax, dword [0x100c0e80]
mov ecx, dword [esp + 0x20]
add eax, 0x1c8c
push eax
mov eax, dword [edx + 0xfc]
and eax, dword [ecx + 0x30]
mov ecx, dword [0x100c0f54]
and eax, 0x1406
push eax
lea eax, [ecx + ebp]
or ecx, 0x18bc
push eax
mov eax, dword [esp + 0x2c]
push ecx
push dword [esp + 0x2c]
mov eax, dword [eax + 0x38]
xor eax, edi
xor eax, dword [0x100c0f6c]
push eax
mov eax, dword [edx + 0xe0]
xor eax, dword [esp + 0x28]
push eax
mov eax, dword [0x100c0ec4]
add eax, 0xffffe2da
xor eax, 0x1c67
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [esp + 0x20]
inc ebx
mov eax, dword [eax + 0x84]
imul eax, esi
or eax, 0x18bc
cmp ebx, eax
jne 0x1000efcc
mov edi, dword [0x100c0edc]
mov edx, dword [0x100c0f90]
jmp 0x1000ef40
mov ebx, dword [esp + 0x28]
pop edi
pop esi
xor ebx, 0x215
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x1000f260
Capabilities:
Get hostname

Disassembly:
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 4]
xor dword [esp + 0x10], 0x18bc
add ecx, 0x38b
push ebx
push ebp
mov ebp, dword [esp + 0x10]
lea ebx, [eax + 0x9bf]
push esi
mov esi, dword [esp + 0x20]
add ebp, 0xfffffcbd
push edi
lea edi, [eax + 0x385]
mov dword [esp + 0x18], ecx
mov eax, edx
add esi, 0xffffec77
xor eax, 0xff0
cmp ebx, eax
je 0x1000f361
mov ecx, dword [0x100c0f90]
xor ebx, 0xe83
mov eax, dword [0x100c0ef0]
mov esi, dword [esp + 0x1c]
cmp eax, dword [ecx + 0x84]
jae 0x1000f2df
mov eax, dword [esi + 0x84]
sub dword [esi + 0x30], eax
mov ecx, dword [0x100c0f90]
jmp 0x1000f2f5
mov eax, dword [ecx + 0xd0]
sub eax, dword [0x100c0ec4]
xor eax, 0xfff09ad5
mov dword [0x100c0ed8], eax
cmp dword [ecx + 0x30], 0x2023
jae 0x1000f30a
add dword [ecx + 0x9c], 0xffffa642
jmp 0x1000f31e
mov eax, dword [ecx + 0x100]
xor eax, dword [0x100c0f24]
sub eax, 0x3a850
xor dword [ecx + 0x60], eax
xor edx, 0x8c3
cmp ebp, edx
je 0x1000f383
mov eax, dword [esp + 0x20]
lea ecx, [ebx + 0xace]
add eax, 0x1406
push eax
push esi
lea eax, [ebp + 0x6f9]
push eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffd7d
push eax
push ecx
push ecx
call fcn.10004200
add esp, 0x18
xor edi, 0xdca
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [0x100c0eec]
add edx, 0xffffea75
or eax, ecx
mov ecx, dword [0x100c0f90]
add eax, edx
push eax
mov ecx, dword [ecx + 8]
or ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor edi, 0xdca
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1000f390
Capabilities:
Encode data using xor
Get hostname

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
lea edx, [eax - 0x5dd]
push esi
push edi
lea edi, [eax - 0xa93]
mov esi, ecx
xor ecx, 0x585
mov dword [esp + 0x24], edi
lea eax, [edi + 0x4b6]
xor esi, 0x139d
xor ebp, 0x4cd
cmp ecx, eax
jg 0x1000f50b
mov ecx, dword [0x100c0f90]
mov esi, dword [esp + 0x20]
mov eax, dword [ecx + 0x60]
xor eax, dword [0x100c0efc]
xor eax, 0x6fe9220e
xor ebp, ebp
mov dword [ecx + 0x60], eax
mov eax, dword [0x100c0f90]
mov dword [eax + 0xa4], 0x10022148
nop
mov ecx, dword [esi + 0xac]
mov eax, 0x22c36
xor ecx, dword [esi + 0x8c]
sub eax, ecx
add dword [esi + 0xfc], eax
mov eax, dword [esi + 0xa4]
mov ecx, dword [0x100c0f90]
mov edx, dword [eax + ebp]
add ebp, 4
mov eax, dword [0x100c0f54]
add eax, 0xffffffed
or dword [0x100c0f14], eax
mov eax, dword [ecx + 0x50]
sub eax, 0x2543df
xor dword [ecx + 0x100], eax
mov ecx, dword [0x100c0f90]
mov eax, dword [0x100c0f28]
mov ebx, dword [ecx + 0x60]
mov ecx, dword [ecx + 0x80]
imul ebx, edx
mov edx, ebx
shr edx, 0x10
mov byte [eax + ecx], dl
mov edx, ebx
mov eax, dword [0x100c0f90]
shr edx, 8
inc dword [eax + 0x80]
mov eax, dword [0x100c0f90]
mov ecx, dword [eax + 0xb0]
mov eax, dword [0x100c0ef8]
mov byte [eax + ecx], dl
mov ecx, dword [0x100c0ef8]
mov eax, dword [0x100c0f28]
inc ecx
mov dword [0x100c0ef8], ecx
mov byte [ecx + eax], bl
inc dword [0x100c0ef8]
mov edx, dword [0x100c0f90]
mov eax, dword [0x100c0ec4]
add eax, 0xffbf101d
mov ecx, dword [edx + 0x30]
add ecx, dword [0x100c0ec8]
add eax, ecx
mov dword [0x100c0ec4], eax
mov eax, dword [esi + 0xf4]
sub eax, dword [edx + 4]
sub eax, 0x15d8e1
add dword [esi + 0xfc], eax
mov eax, dword [0x100c0f90]
mov eax, dword [eax + 0x74]
sub dword [esi + 4], eax
mov ecx, dword [0x100c0f90]
mov eax, dword [ecx + 0x84]
sub dword [ecx + 4], eax
cmp ebp, 0x31330
jl 0x1000f400
xor edi, 0xfa6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [0x100c0edc]
mov ebx, dword [0x100c0f10]
sub ecx, esi
or ebx, 0x1389
mov edi, dword [eax + 4]
imul edi, edx
mov edx, dword [0x100c0f90]
mov eax, dword [edx + 0x54]
or edi, esi
mov edx, dword [esp + 0x20]
xor eax, 0x1406
sub eax, dword [edx + 0x6c]
mov edx, dword [0x100c0f90]
push eax
push ecx
push edx
push edi
push ebx
call fcn.1000e760
mov edi, eax
add esp, 0x14
or eax, esi
and eax, 0x1614
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
imul eax, dword [0x100c0ecc], 0x1d48
mov ecx, dword [0x100c0f90]
add eax, 0x1841
cmp dword [ecx + 0xf4], eax
je 0x1000f5c6
xor edi, 0x158b
cmp esi, edi
je 0x1000f5a4
mov eax, dword [ecx + 8]
xor eax, esi
cmp dword [0x100c0e80], eax
jb 0x1000f5a4
mov eax, dword [0x100c0e7c]
xor eax, dword [0x100c0f70]
sub esi, eax
mov edx, dword [esp + 0x20]
mov ecx, dword [ecx + 0xc0]
mov eax, dword [edx + 0x48]
xor ecx, dword [edx + 0xac]
imul eax, esi
or eax, esi
sub ebp, eax
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edi, dword [esp + 0x24]
xor edi, 0xfa6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1000f5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [0x100c1740]
xor edx, edx
mov ecx, dword [0x100c1750]
inc eax
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov dword [0x100c1740], eax
push esi
push edi
movzx edi, ax
mov al, byte [esp + 0x20]
movzx esi, al
add al, 2
movzx ebx, al
mov eax, dword [ebp + ebx*4]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x4388]
div dword [ebp + ecx*4 + 0x48]
mov eax, dword [0x100c1728]
mov ecx, dword [0x100c1744]
add eax, ebx
dec dword [0x100c1780]
add ecx, 0xbf1
mov dword [esp + 0x10], eax
mov ebp, edx
lea eax, [esi - 1]
xor eax, dword [0x100c1708]
push eax
push ecx
call fcn.100033c0
mov ecx, edi
add esp, 8
mov edi, dword [esp + 0x1c]
mov dword [edi + ecx*4], eax
mov ax, word [0x100c1700]
mov esi, dword [0x100c177c]
mov word [0x100c1710], ax
cmp esi, ebx
je 0x1000f6b8
mov eax, 0xc96
lea edi, [edi + esi*4]
cdq
idiv ebp
add edi, 0x60
mov dword [esp + 0x20], edx
mov eax, dword [edi - 0x5c]
xor edx, edx
div dword [0x100c172c]
push dword [0x100c1704]
push ebp
push edx
push ebx
call fcn.10003700
mov ecx, dword [esp + 0x20]
lea edi, [edi + 4]
mov dword [edi - 4], eax
add esp, 0x10
mov eax, dword [esp + 0x20]
or dword [ecx + esi*4], eax
inc esi
cmp esi, ebx
jne 0x1000f682
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor edx, edx
movzx eax, byte [ebx + eax + 0x21]
div dword [edi + ebp*4 + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1000faa0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
lea edi, [ecx + 0x885]
mov ecx, dword [esp + 0x24]
add ebx, 0xffffffec
mov eax, ecx
xor esi, 0xa98
xor eax, 0xe59
add eax, 0x8e
cmp ebx, eax
je 0x1000fb28
xor ecx, 0xbc8
add ecx, 0x31d
cmp edi, ecx
jle 0x1000fb09
mov eax, dword [0x100c0f90]
mov ecx, dword [eax + 0x50]
mov eax, dword [0x100c0ec8]
xor ecx, dword [0x100c0f24]
add eax, 0xfff047d7
add eax, ecx
mov dword [0x100c0ec8], eax
lea eax, [edi - 0x70c]
pop edi
pop esi
pop ebx
ret
xor ebx, esi
cmp esi, ebx
jne 0x1000fb28
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x100c0eec]
xor eax, edi
push eax
call ebp
add esi, 2
cmp esi, ebx
je 0x1000fb16
pop ebp
lea eax, [edi - 0x70c]
pop edi
pop esi
pop ebx
ret
Function at 0x10010210
Capabilities:
Connect pipe
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x1c]
add ebx, 0xfffff6fd
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, edi
xor esi, 0x1e99
mov dword [esp + 0x10], ebx
lea edx, [edi - 0x2f9]
xor edi, 0xd10
lea eax, [edx - 0x58c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edi
cmp esi, eax
jge 0x10010365
xor edi, edi
nop word [eax + eax]
mov ecx, dword [0x100c0f90]
mov eax, dword [0x100c0eb0]
add eax, 0xfffffff4
imul eax, dword [ecx + 0x104]
mov dword [ecx + 0x104], eax
mov ecx, dword [0x100c0f90]
mov eax, dword [ecx + 0x78]
xor eax, dword [0x100c0ec4]
sub eax, 0x1704a4
or dword [ecx + 0x50], eax
mov eax, dword [0x100c0f1c]
mov ecx, dword [0x100c0f90]
mov ebx, dword [edi + eax]
add edi, 4
imul ebx, dword [ecx + 0x60]
mov ecx, dword [ecx + 0xb0]
mov eax, dword [0x100c0ef8]
mov edx, ebx
shr edx, 0x18
mov byte [eax + ecx], dl
mov edx, ebx
inc dword [0x100c0ef8]
mov eax, dword [0x100c0f04]
add eax, 0xfff2c89c
shr edx, 0x10
add dword [ebp + 0x4c], eax
mov ecx, dword [0x100c0ea8]
mov eax, dword [0x100c0ec8]
add ecx, 0xffbf101d
add eax, ecx
or dword [0x100c0f24], eax
mov eax, dword [ebp + 0x78]
sub eax, 0x1f8c71
add dword [ebp + 0x74], eax
mov ecx, dword [ebp + 0x80]
mov eax, dword [0x100c0f28]
mov byte [eax + ecx], dl
mov edx, ebx
inc dword [ebp + 0x80]
mov eax, dword [0x100c0f90]
shr edx, 8
mov ecx, dword [eax + 0x80]
mov eax, dword [ebp + 0xb0]
mov byte [ecx + eax], dl
mov eax, dword [0x100c0f90]
inc dword [eax + 0x80]
mov eax, dword [0x100c0f90]
mov ecx, dword [eax + 0xb0]
mov eax, dword [eax + 0x80]
mov byte [ecx + eax], bl
mov eax, dword [0x100c0f90]
inc dword [eax + 0x80]
cmp edi, 0x84a8
jl 0x10010260
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
lea eax, [esi + 0x1b0e]
cmp dword [esp + 0x2c], eax
je 0x10010399
mov eax, dword [ebp + 0xfc]
xor esi, 0x1c8c
sub eax, dword [0x100c0f14]
sub eax, 0x883fdde
pop edi
mov dword [0x100c0ed8], eax
lea eax, [esi - 0x3d0]
pop esi
pop ebp
pop ebx
pop ecx
ret
imul eax, edx, 0x1841
cmp dword [0x100c0ef4], eax
jae 0x100103c4
mov eax, dword [0x100c0f90]
and edi, ebx
xor edi, edx
mov ecx, dword [eax + 0x4c]
sub ecx, dword [eax + 0xd0]
imul ecx, ebx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
pop edi
lea eax, [esi - 0x3d0]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10013fb9
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014014
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10013ff5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10014012
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10015ff8
mov dword [eax], 0x15bb0028
jmp 0x10013fea
jmp 0x10014032
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10014032
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x1002f6fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 0xd90
push 0
push 0x5a19
push 0x7e50
call fcn.1002f58b
add esp, 0x18
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f73b
xor eax, eax
jmp 0x1002f895
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x3d58
push 1
push 0x6bb3
lea eax, [ebp + 8]
push eax
call fcn.1002f499
add esp, 0x18
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f76d
xor eax, eax
jmp 0x1002f895
lea eax, [ebp - 0xc]
push eax
push 0x6cc7
push 1
push dword [ebp - 8]
push 0x2d38
call fcn.1002f250
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1002f795
xor eax, eax
jmp 0x1002f895
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002f50c
add esp, 0x18
push 0
push dword [ebp + 8]
push 0x1b3a
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.10027ce4
add esp, 0x14
push 0x17d3
push 0x1125
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002f58b
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x1002f812
push 0x3a0
push 0x6bef
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x94c
push 1
call fcn.1002f5f7
add esp, 0x18
push dword [ebp - 4]
call fcn.1002efb8
pop ecx
test eax, eax
jne 0x1002f823
xor eax, eax
jmp 0x1002f895
push 1
push 0x59dc
push 0xbcf
lea eax, [ebp - 4]
push eax
call fcn.1002f67d
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f87d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f85a
xor eax, eax
jmp 0x1002f895
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f873
xor eax, eax
jmp 0x1002f895
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f88e
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f892
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret