joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67eed0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x97344e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x14f
mov dword [esp + 0x18], esi
call fcn.00912176
push fcn.00911ee2
push fcn.00911f0c
push 0x64
lea ecx, [esi + 0xf8]
xor ebx, ebx
push 4
push ecx
mov dword [esp + 0x30], ebx
call fcn.00912870
push fcn.00911ee2
push fcn.00911f0c
push 0x64
lea edx, [esi + 0x288]
push 4
push edx
mov byte [esp + 0x30], 1
call fcn.00912870
lea ecx, [esi + 0x418]
mov byte [esp + 0x1c], 2
call fcn.00911f0c
lea ecx, [esi + 0x41c]
mov byte [esp + 0x1c], 3
call fcn.00911f0c
lea edi, [esi + 0x420]
mov byte [esp + 0x1c], 4
mov ecx, edi
call fcn.00911f0c
mov dword [esi + 0x1eac], ebx
mov dword [esi + 0x1ea8], 0x9cb93c
lea ebp, [esi + 0x1eb4]
mov byte [esp + 0x1c], 6
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cca08
lea ebp, [esi + 0x1ef4]
mov byte [esp + 0x1c], 7
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cca08
lea ebp, [esi + 0x1f34]
mov byte [esp + 0x1c], 8
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cca08
lea ebp, [esi + 0x1f74]
mov byte [esp + 0x1c], 9
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cc948
lea ebp, [esi + 0x1fb4]
mov byte [esp + 0x1c], 0xa
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9ccc5c
lea ebp, [esi + 0x1ff4]
mov byte [esp + 0x1c], 0xb
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9ccb8c
lea ebp, [esi + 0x2034]
mov byte [esp + 0x1c], 0xc
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9ccc5c
lea ebp, [esi + 0x2074]
mov byte [esp + 0x1c], 0xd
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cca08
lea ebp, [esi + 0x20b4]
mov byte [esp + 0x1c], 0xe
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cc888
mov dword [esi + 0x428], ebx
mov dword [esi], 0x9d23f8
mov dword [esi + 0x42c], ebx
mov dword [esi + 0xf0], ebx
mov eax, 0x64
mov dword [0xa8e764], ebx
mov ecx, edi
mov byte [esp + 0x1c], 0xf
mov dword [esi + 0xd8], eax
mov dword [esi + 0xdc], eax
mov dword [esi + 0xf4], 0x1c
mov dword [esi + 0xe8], 1
mov dword [esi + 0xec], 4
mov dword [esi + 0xe0], 0x16
call fcn.0091204a
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x6c15a0
Capabilities:
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x97bd36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x121
mov dword [esp + 0x18], esi
call fcn.00912176
lea edi, [esi + 0x64]
mov dword [esp + 0x1c], 0
mov ecx, edi
call fcn.00911f0c
lea ecx, [esi + 0x68]
mov byte [esp + 0x1c], 1
call fcn.00911f0c
lea ecx, [esi + 0x6c]
mov byte [esp + 0x1c], 2
call fcn.00911f0c
push fcn.00911ee2
push fcn.00911f0c
push 0x1f4
lea ecx, [esi + 0x70]
push 4
push ecx
mov byte [esp + 0x30], 3
call fcn.00912870
push fcn.00911ee2
push fcn.00911f0c
push 0x1f4
lea edx, [esi + 0x840]
push 4
push edx
mov byte [esp + 0x30], 4
call fcn.00912870
push fcn.00911ee2
push fcn.00911f0c
push 0x1f4
lea eax, [esi + 0x1010]
push 4
push eax
mov byte [esp + 0x30], 5
call fcn.00912870
push fcn.00911ee2
push fcn.00911f0c
push 0x1f4
lea ecx, [esi + 0x17e0]
push 4
push ecx
mov byte [esp + 0x30], 6
call fcn.00912870
push fcn.00911ee2
push fcn.00911f0c
push 0x1f4
lea edx, [esi + 0x1fb0]
push 4
push edx
mov byte [esp + 0x30], 7
call fcn.00912870
lea ecx, [esi + 0x2780]
mov byte [esp + 0x1c], 8
call fcn.00911f0c
lea ebp, [esi + 0x2784]
mov byte [esp + 0x1c], 9
mov ecx, ebp
call fcn.00911f0c
lea ebx, [esi + 0x2788]
mov byte [esp + 0x1c], 0xa
mov ecx, ebx
call fcn.00911f0c
lea ecx, [esi + 0x278c]
mov byte [esp + 0x1c], 0xb
call fcn.00911f0c
lea ecx, [esi + 0x7fc0]
mov byte [esp + 0x1c], 0xc
call fcn.009124ee
lea ecx, [esi + 0x8060]
mov byte [esp + 0x1c], 0xd
call fcn.009124e2
mov dword [esi + 0x8060], 0x9cca08
lea ecx, [esi + 0x80a0]
mov byte [esp + 0x1c], 0xe
call fcn.009124e2
mov dword [esi + 0x80a0], 0x9cc948
lea ecx, [esi + 0x80e0]
mov byte [esp + 0x1c], 0xf
call fcn.009124e2
mov dword [esi + 0x80e0], 0x9cca08
lea ecx, [esi + 0x8120]
mov byte [esp + 0x1c], 0x10
call fcn.009124e2
mov dword [esi + 0x8120], 0x9cca08
lea ecx, [esi + 0x8160]
mov byte [esp + 0x1c], 0x11
call fcn.009124e2
mov dword [esi + 0x8160], 0x9ccb8c
lea ecx, [esi + 0x81a0]
mov byte [esp + 0x1c], 0x12
call fcn.009124e2
mov dword [esi + 0x81a0], 0x9cc888
xor ecx, ecx
mov dword [esi + 0x81e0], 0x9cb93c
mov dword [esi + 0x81e4], ecx
mov eax, 1
mov dword [esi + 0x27f8], ecx
lea ecx, [esi + 0x278c]
mov byte [esp + 0x1c], 0x14
mov dword [esi], 0x9d4938
mov dword [esi + 0x27e4], eax
mov dword [esi + 0x27e0], eax
mov dword [esi + 0x27f4], 6
mov dword [esi + 0x27e8], eax
call fcn.0091204a
mov ecx, edi
call fcn.0091204a
mov ecx, ebp
call fcn.0091204a
mov ecx, ebx
call fcn.0091204a
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x82f6c8
Capabilities:
Parse credit card information

Disassembly:
push 0xffffffffffffffff
push 0x9a8c80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.00911f0c
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0
call fcn.00911f0c
mov ecx, dword [esi + 0x1ac0]
mov byte [esp + 0x18], 1
test ecx, ecx
jle 0x82f8b9
cmp ecx, 0x493e0
jge 0x82f8b9
xor eax, eax
test ecx, ecx
jle 0x82f8b9
lea edi, [eax + 1]
mov ecx, esi
push edi
call fcn.00805c90
mov ax, word [esi + 0xcaf0]
cmp ax, 2
je 0x82f756
cmp ax, 7
je 0x82f756
cmp ax, 0xa
je 0x82f756
cmp ax, 0xb
je 0x82f756
cmp ax, 0xc
je 0x82f756
cmp ax, 0xd
je 0x82f756
mov ecx, dword [esi + 0x1ac0]
mov eax, edi
cmp eax, ecx
jl 0x82f70f
jmp 0x82f8b9
mov ax, word [esi + 0xcaf2]
cmp ax, 0x51
je 0x82f8a9
cmp ax, 0x52
jne 0x82f777
push 0xa7762c
jmp 0x82f8ae
cmp ax, 0x53
jne 0x82f787
push 0xa77610
jmp 0x82f8ae
cmp ax, 0x54
jne 0x82f797
push 0xa839f8
jmp 0x82f8ae
cmp ax, 0x55
jne 0x82f7a7
push 0xa7dff4
jmp 0x82f8ae
cmp ax, 0x56
jne 0x82f7b7
push 0xa839c8
jmp 0x82f8ae
cmp ax, 0x57
jne 0x82f7c7
push 0xa7e014
jmp 0x82f8ae
cmp ax, 0x58
jne 0x82f7d7
push 0xa7f0f4
jmp 0x82f8ae
cmp ax, 0x33
jne 0x82f7e7
push str.1998
jmp 0x82f8ae
cmp ax, 0x34
jne 0x82f7f7
push str.1991
jmp 0x82f8ae
cmp ax, 0x35
jne 0x82f807
push str.1983
jmp 0x82f8ae
cmp ax, 0x36
jne 0x82f817
push 0xa83e38
jmp 0x82f8ae
cmp ax, 0x37
jne 0x82f827
push 0xa83e14
jmp 0x82f8ae
cmp ax, 0x38
jne 0x82f834
push str.2000
jmp 0x82f8ae
cmp ax, 0x39
jne 0x82f841
push 0xa83dc4
jmp 0x82f8ae
cmp ax, 0x3a
jne 0x82f84e
push 0xa83d98
jmp 0x82f8ae
cmp ax, 0x3b
jne 0x82f85b
push 0xa83d64
jmp 0x82f8ae
cmp ax, 0x3c
jne 0x82f868
push 0xa83d30
jmp 0x82f8ae
cmp ax, 0x3d
jne 0x82f875
push 0xa83cfc
jmp 0x82f8ae
cmp ax, 0x44
jne 0x82f882
push 0xa7dfc4
jmp 0x82f8ae
cmp ax, 0x41
jne 0x82f88f
push 0xa7df94
jmp 0x82f8ae
cmp ax, 0x42
jne 0x82f89c
push str.1996
jmp 0x82f8ae
cmp ax, 0x43
jne 0x82f8a9
push 0xa7dfac
jmp 0x82f8ae
push 0xa77708
lea ecx, [esi + 0x2e0]
call fcn.00911f06
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.00911ee2
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.00911ee2
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x87c5db
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x9b3101
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c8
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x10]
call fcn.00735050
lea ecx, [esp + 4]
mov dword [esp + 0x8d4], 0
call fcn.00911f0c
mov eax, dword [0xa8e864]
lea ecx, [esp + 4]
push eax
push str._sQDCUT.DB
push ecx
mov byte [esp + 0x8e0], 1
call fcn.00911f42
mov al, byte [esp + 0x8e8]
add esp, 0xc
cmp al, 0x52
je 0x87c665
cmp al, 0x72
je 0x87c665
cmp al, 0x57
je 0x87c638
cmp al, 0x77
jne 0x87c6be
mov edx, dword [esi + 0x448]
lea eax, [esi + 0x458]
lea ecx, [esi + 0x448]
push eax
mov eax, dword [esp + 8]
push 0x1002
push eax
call dword [edx + 0x28]
test eax, eax
jne 0x87c6be
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
jmp 0x87c6ab
push ecx
lea eax, [esp + 8]
mov ecx, esp
mov dword [esp + 0xc], esp
push eax
call fcn.0091203e
lea ecx, [esp + 0x10]
call fcn.007351b0
test eax, eax
je 0x87c6be
mov edx, dword [esi + 0x448]
lea eax, [esi + 0x458]
lea ecx, [esi + 0x448]
push eax
mov eax, dword [esp + 8]
push 0
push eax
call dword [edx + 0x28]
test eax, eax
jne 0x87c6be
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
lea edx, [esp + 8]
push edx
call fcn.0091203e
lea ecx, [esp + 0x10]
call fcn.007355a0
mov eax, dword [esi + 0x448]
lea ecx, [esi + 0x448]
push 0
push 0
call dword [eax + 0x30]
lea ecx, [esp + 4]
mov byte [esp + 0x8d4], 0
call fcn.00911ee2
push fcn.00911ee2
push 0x12d
lea ecx, [esp + 0x78]
push 4
push ecx
mov dword [esp + 0x8e4], 2
call fcn.009128f2
lea ecx, [esp + 0xc]
mov dword [esp + 0x8d4], 0xffffffff
call fcn.00911f36
mov ecx, dword [esp + 0x8cc]
pop esi
mov dword fs:[0], ecx
add esp, 0x8d4
ret 4
Function at 0x8b6f7a
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x9bafd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
call fcn.00911f0c
mov edi, dword [0xb21334]
push 0
mov dword [esp + 0x30], 0
call edi
push 1
mov ebx, eax
call edi
sub eax, 0x1e
push 1
movsx eax, ax
movsx ebx, bx
push eax
push ebx
push 0
push 0
mov ecx, esi
call fcn.00912548
push 1
push 0x26
push ebx
push 3
push 0
lea ecx, [esi + 0x1f9a0]
call fcn.00912548
push 0
call edi
mov ebx, eax
push 1
sub bx, word [esi + 0x1f94c]
dec ebx
call edi
sub eax, 0x9d
push 1
movsx ebp, ax
movsx eax, bx
mov dword [esp + 0x14], eax
push ebp
cdq
sub eax, edx
lea ecx, [esi + 0x1fb40]
mov ebx, eax
mov dword [esi + 0x1f930], 0x45
sar ebx, 1
push ebx
push 0x4a
push 5
call fcn.00912548
mov eax, ebp
push 1
cdq
sub eax, edx
mov ebp, eax
mov eax, dword [esp + 0x14]
cdq
and edx, 3
add eax, edx
lea edx, [ebx + 0xa]
sar ebp, 1
sar eax, 2
lea ecx, [ebp - 0x41]
mov dword [esp + 0x1c], eax
add eax, 0xfffffffb
push ecx
push eax
mov dword [esp + 0x20], ecx
push 0x4a
push edx
lea ecx, [esi + 0x1fb80]
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], edx
call fcn.00912548
mov ecx, dword [esp + 0x14]
push 1
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push edx
lea ecx, [eax + ebx + 0xa]
push 0x4a
push ecx
lea ecx, [esi + 0x1fc00]
call fcn.00912548
mov edx, dword [esp + 0x1c]
lea eax, [ebp + 0xe]
add ebp, 0x3c
push 1
add ebx, 0xfffffffb
push ebp
push ebx
push eax
push edx
lea ecx, [esi + 0x1fbc0]
mov dword [esi + 0x1f934], eax
call fcn.00912548
push 0
call edi
cdq
and edx, 3
push 1
add eax, edx
push 1
mov ebx, eax
sar ebx, 2
movsx ebp, bx
call edi
sub eax, 0xc8
lea ecx, [esi + 0x1fa40]
push eax
push ebp
push 0x2e
push 5
call fcn.00912548
lea eax, [ebx + 0xa]
push 1
push 1
mov dword [esp + 0x18], eax
call edi
movsx ecx, word [esp + 0x14]
sub eax, 0xc8
push eax
push ebp
push 0x2e
push ecx
lea ecx, [esi + 0x1fa80]
call fcn.00912548
mov edx, dword [esp + 0x10]
push 1
push 1
lea eax, [edx + ebx + 5]
mov dword [esp + 0x18], eax
call edi
sub eax, 0x64
add ebp, 0x50
push eax
push ebp
mov ebp, dword [esp + 0x1c]
push 0x2e
movsx ecx, bp
push ecx
lea ecx, [esi + 0x1fb00]
call fcn.00912548
lea edx, [ebx + ebp + 0x55]
push 0
mov dword [esp + 0x14], edx
call edi
mov ebp, eax
lea eax, [ebx + ebx*2]
mov ecx, 0xffffff92
push 1
sub ecx, eax
push 1
add ebp, ecx
call edi
sub eax, 0x64
movsx edx, bp
push eax
push edx
movsx eax, word [esp + 0x1c]
push 0x2e
push eax
lea ecx, [esi + 0x1fac0]
call fcn.00912548
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00911ee2
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x8df2a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x9c17fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0xee
mov dword [esp + 0x18], esi
call fcn.00912176
lea edi, [esi + 0x64]
mov dword [esp + 0x1c], 0
mov ecx, edi
call fcn.00911f0c
lea ebx, [esi + 0x68]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call fcn.00911f0c
push fcn.00911ee2
push fcn.00911f0c
push 0x64
lea ecx, [esi + 0x200]
push 4
push ecx
mov byte [esp + 0x30], 2
call fcn.00912870
lea ebp, [esi + 0x450]
mov byte [esp + 0x1c], 3
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cca08
lea ebp, [esi + 0x490]
mov byte [esp + 0x1c], 4
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cca08
lea ebp, [esi + 0x4d0]
mov byte [esp + 0x1c], 5
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cc948
lea ebp, [esi + 0x510]
mov byte [esp + 0x1c], 6
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cc888
push 0xa78194
mov ecx, ebx
mov byte [esp + 0x20], 7
mov dword [esi], 0x9ddbe8
call fcn.00911f06
push 0xa907a4
mov ecx, edi
call fcn.00911f06
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x8e9f00
Capabilities:
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x9c391e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x107
mov dword [esp + 0x18], esi
call fcn.00912176
lea edi, [esi + 0x64]
mov dword [esp + 0x1c], 0
mov ecx, edi
call fcn.00911f0c
lea ebx, [esi + 0x68]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call fcn.00911f0c
push fcn.00911ee2
push fcn.00911f0c
push 0x64
lea ecx, [esi + 0x70]
push 4
push ecx
mov byte [esp + 0x30], 2
call fcn.00912870
lea ebp, [esi + 0x264]
mov byte [esp + 0x1c], 3
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cca08
lea ebp, [esi + 0x2a4]
mov byte [esp + 0x1c], 4
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cca08
lea ebp, [esi + 0x2e4]
mov byte [esp + 0x1c], 5
mov ecx, ebp
call fcn.009124e2
mov dword [ebp], 0x9cc888
push 0xa78194
mov ecx, ebx
mov byte [esp + 0x20], 6
mov dword [esi], 0x9df4a8
call fcn.00911f06
push 0xa907a4
mov ecx, edi
call fcn.00911f06
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x90ca9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 8]
push 0xfffffffffffffff0
add ecx, 0x646c6f47
pop esi
xor word [eax + 0xc], cx
xor word [eax + 0xe], cx
xor dword [eax + 0x110], ecx
xor byte [eax + 0x114], cl
mov dword [ebp + 8], ecx
lea ecx, [eax + 0x10]
sub esi, eax
mov edi, 0x100
lea eax, [ecx + esi]
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 8]
xor byte [ecx], al
inc ecx
dec edi
jne 0x90cad2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x90caea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov eax, dword [eax + 8]
mov dword [ebp + 0x10], 0x100
add eax, 0x646c6f47
xor edi, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 7]
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp - 4]
xor al, byte [esi + edi]
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x90cb14
pop edi
pop esi
pop ebx
leave
ret

Function at 0x90cc82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add dword [ebp + 0x10], 0x646c6f47
mov eax, dword [eax]
mov dx, word [eax + 6]
test dx, dx
jbe 0x90ccc9
push ebx
push esi
mov esi, dword [eax + 0xa]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
lea ecx, [eax + 7]
movzx eax, dx
mov dword [ebp + 8], eax
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 0x10]
xor al, byte [ecx]
mov byte [esi + edi], al
inc edi
inc ecx
dec dword [ebp + 8]
jne 0x90ccae
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x90d258
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, ax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x90d26e
pop es
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
jne 0x90d281
add al, 0x55
mov ecx, dword [ebp + 8]
pop esi
mov byte [ecx], al
xor al, al
leave
ret
Function at 0xb0b3da
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0xb0b400
jmp 0xb0b516
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0xb0b420
jmp 0xb0b516
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00b0f999
add esp, 4
mov dword [0xb1f0a0], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0xb0b46d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0xb0b48d
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0xb0b46a
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0xb0b4f5
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00b0f53c
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0xb0b4a9
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0xb0b51b
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00b0f2f1
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00b0f379
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00b0fc4f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 2
jne 0xb0b59e
cmp dword [0xb1f2d2], 1
jne 0xb0b59e
cmp dword [ebp - 0xc], 0
je 0xb0b59e
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00b0b3da
add esp, 8
jmp 0xb0b5ad
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x14], eax
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0xb0b77c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
jmp 0xb0b7c4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0xb0b7ea
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0xb1f0a4], ecx
jne 0xb0b7e8
cmp dword [ebp - 0xc], 0
je 0xb0b7e6
mov eax, dword [ebp - 0xc]
add dword [eax + 8], 0xa
jmp 0xb0b7ea
jmp 0xb0b7c1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0xb0b88d
mov dword [ebp - 0x18], 0
jmp 0xb0b818
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0xb0b88d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0xb1f0a4], ecx
jne 0xb0b88b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx*4 + 0xb1f1b2]
cmp dword [eax*4 + 0xb1f13a], ecx
jb 0xb0b87a
mov eax, dword [ebp - 0x10]
cmp dword [0xb1f0a0], eax
je 0xb0b868
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0xb1f11c]
push eax
call fcn.00b0f999
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0xb1f0a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00b0f4f0
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add dword [ecx*4 + 0xb1f13a], eax
jmp 0xb0b88d
jmp 0xb0b815
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0xb0b89e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0xb0b8ec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0xb0b94e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0xb1f0a4], ecx
jne 0xb0b94c
mov eax, dword [ebp - 0xc]
cmp dword [0xb1f0a0], eax
je 0xb0b926
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0xb1f11c]
push eax
call fcn.00b0f999
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0xb1f0a0], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00b0f53c
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0xb0b94a
mov eax, dword [ebp - 8]
add dword [eax + 8], 0xa
jmp 0xb0b94e
jmp 0xb0b8e9
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0xb0b97c
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00b0f4f0
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14