joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103dd490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x14
call fcn.1039fcd0
mov eax, dword [esp + 0x2c]
push ebx
xor edx, edx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x38]
movzx ecx, byte [edi]
lea ebp, [edi + 1]
mov eax, ebp
mov dh, byte [eax]
xor ebx, ebx
mov dword [esp + 0x10], 0
or ecx, edx
movzx edx, byte [eax + 1]
inc eax
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 1]
inc eax
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
inc eax
mov bh, byte [eax + 1]
inc eax
mov byte [esp + 0x14], cl
or edx, ebx
inc eax
xor ebx, ebx
mov bh, byte [eax + 1]
mov bl, byte [eax]
mov eax, ecx
shr eax, 8
mov byte [esp + 0x15], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x16], al
shl ebx, 0x10
or edx, ebx
mov ebx, ecx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x17], cl
mov ecx, edx
mov byte [esp + 0x1a], al
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], edx
mov byte [esp + 0x18], dl
shr ecx, 8
shr edx, 0x18
test eax, eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x19], cl
mov byte [esp + 0x1b], dl
je 0x103dd630
mov dword [esp + 0x38], eax
test esi, esi
jne 0x103dd5a5
mov ecx, dword [esp + 0x34]
push 1
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.103e9000
mov ebx, dword [esp + 0x28]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x21], al
mov eax, dword [esp + 0x2c]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x22], cl
mov ecx, eax
mov byte [esp + 0x23], dl
mov edx, eax
mov byte [esp + 0x24], al
shr eax, 0x18
mov byte [esp + 0x27], al
mov eax, dword [esp + 0x1c]
shr ecx, 8
shr edx, 0x10
add esp, 0xc
inc eax
mov byte [esp + 0x14], bl
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], dl
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov al, byte [ecx]
mov dl, byte [esp + esi + 0x14]
xor dl, al
mov eax, dword [esp + 0x2c]
inc eax
mov byte [eax - 1], dl
inc ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
inc esi
and esi, 7
dec eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], eax
jne 0x103dd540
mov eax, dword [esp + 0x10]
test eax, eax
je 0x103dd622
mov byte [edi], bl
mov ecx, ebx
shr ecx, 8
mov eax, ebp
mov byte [eax], cl
mov ecx, dword [esp + 0x20]
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ebx, 0x18
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
shr ecx, 0x18
mov byte [eax + 1], cl
mov eax, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edx, dword [esp + 0x3c]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x103dfc2e
Capabilities:
Get common file path

Disassembly:
push 0x120
push 0x1042af80
call fcn.103a535c
mov eax, dword [0x10485d90]
xor eax, ebp
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
and dword [ebp - 0x128], 0
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x12c], esi
cmp esi, 0x104
jle 0x103dfcd4
and dword [ebp - 4], 0
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.1039fcd0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x130], edi
jmp 0x103dfcc1
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x103dfcd4
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x103dfcef
cmp byte [edi + 1], 0x3a
jne 0x103dfcef
movzx eax, byte [edi]
push eax
call fcn.103a0344
pop ecx
mov ebx, eax
sub ebx, 0x40
cmp dword [ebp - 0x128], 0
je 0x103dfcff
push edi
call fcn.103a264e
pop ecx
mov eax, ebx
lea esp, [ebp - 0x13c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1039fd3e
call fcn.103a5397
ret

Function at 0x103dfe3f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x103dfe6d
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x103dfe72
cmp eax, 1
je 0x103dfe72
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x103dfe76
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x10485d90]
push ebx
mov ebx, dword [ebp + 0x98]
xor eax, ebp
test ebx, ebx
push edi
mov edi, dword [ebp + 0x9c]
mov dword [ebp + 0x8c], eax
je 0x103dff08
push ebx
call fcn.103dfe3f
test eax, eax
pop ecx
jne 0x103dfedd
call fcn.103a0bdd
mov dword [eax], 0xf
call fcn.103a0bd4
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp + 0x8c]
pop edi
xor ecx, ebp
pop ebx
call fcn.1039fd3e
add ebp, 0x90
leave
ret
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x104
lea eax, [ebp - 0x7c]
add bl, 0x40
push eax
mov byte [ebp - 0x7c], bl
mov byte [ebp - 0x7b], 0x3a
mov byte [ebp - 0x7a], 0x2e
mov byte [ebp - 0x79], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x103dff17
lea eax, [ebp - 0x78]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x103dfec4
inc eax
cmp eax, 0x104
ja 0x103dfec4
test edi, edi
mov ecx, edi
jne 0x103dff54
cmp eax, dword [ebp + 0xa0]
jg 0x103dff37
mov eax, dword [ebp + 0xa0]
push eax
call fcn.103a040d
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x103dff6c
call fcn.103a0bd4
mov dword [eax], 0xc
jmp 0x103dfec4
cmp eax, dword [ebp + 0xa0]
jle 0x103dff6c
call fcn.103a0bd4
mov dword [eax], 0x22
jmp 0x103dfec4
lea eax, [ebp - 0x78]
push eax
push ecx
call fcn.103a1e10
pop ecx
pop ecx
jmp 0x103dfec6
Function at 0x103e6000
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x10], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0xc]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x10]
mov dword [esp + 0xc], edi
jb 0x103e6020
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0xc]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x103e6acf
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x10], esi
nop
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, ebx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, ah
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, ecx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0xc]
and edx, 0xff
mov edx, dword [ebp + edx*8]
movzx ecx, ch
xor edx, dword [ebp + ecx*8 + 3]
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
shr eax, 0x18
xor edx, dword [ebp + eax*8 + 1]
mov eax, dword [esp + 4]
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x10]
mov dword [esp + 0xc], edi
jb 0x103e6af0
mov esi, eax
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, dh
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, ebx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, ah
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, ecx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
movzx esi, byte [ebp + esi + 0x800]
movzx edi, bh
movzx edi, byte [ebp + edi + 0x800]
shl edi, 8
xor esi, edi
mov edi, eax
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x10
xor esi, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [ebp + edi + 0x800]
shl edi, 0x18
xor esi, edi
mov edi, dword [esp + 0xc]
and edx, 0xff
movzx edx, byte [ebp + edx + 0x800]
movzx ecx, ch
movzx ecx, byte [ebp + ecx + 0x800]
shl ecx, 8
xor edx, ecx
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
movzx ebx, byte [ebp + ebx + 0x800]
shl ebx, 0x10
xor edx, ebx
mov ebx, dword [esp + 8]
shr eax, 0x18
movzx eax, byte [ebp + eax + 0x800]
shl eax, 0x18
xor edx, eax
mov eax, dword [esp + 4]
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x103e7d80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.103e7ad2
add esp, 0xc
cmp eax, 0
je 0x103e7da8
ret
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0xf0]
lea ecx, [ecx*4]
lea edi, [esi + ecx*4]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [esi], ecx
mov dword [esi + 4], edx
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
add esi, 0x10
sub edi, 0x10
cmp esi, edi
jne 0x103e7dc0
call 0x103e7dfb
pop ebp
lea edi, [ebp - 0x10bb]
lea ebp, [ebp - 0x1bbb]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0xf0]
dec ecx
nop
add esi, 0x10
mov eax, dword [esi]
mov edx, eax
movzx ebx, ah
shr edx, 0x10
and eax, 0xff
movzx eax, byte [ebp + eax*8 + 2]
movzx ebx, byte [ebp + ebx*8 + 2]
mov eax, dword [edi + eax*8]
xor eax, dword [edi + ebx*8 + 3]
movzx ebx, dh
and edx, 0xff
movzx edx, byte [ebp + edx*8 + 2]
movzx ebx, byte [ebp + ebx*8 + 2]
xor eax, dword [edi + edx*8 + 2]
xor eax, dword [edi + ebx*8 + 1]
mov dword [esi], eax
mov eax, dword [esi + 4]
mov edx, eax
movzx ebx, ah
shr edx, 0x10
and eax, 0xff
movzx eax, byte [ebp + eax*8 + 2]
movzx ebx, byte [ebp + ebx*8 + 2]
mov eax, dword [edi + eax*8]
xor eax, dword [edi + ebx*8 + 3]
movzx ebx, dh
and edx, 0xff
movzx edx, byte [ebp + edx*8 + 2]
movzx ebx, byte [ebp + ebx*8 + 2]
xor eax, dword [edi + edx*8 + 2]
xor eax, dword [edi + ebx*8 + 1]
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
mov edx, eax
movzx ebx, ah
shr edx, 0x10
and eax, 0xff
movzx eax, byte [ebp + eax*8 + 2]
movzx ebx, byte [ebp + ebx*8 + 2]
mov eax, dword [edi + eax*8]
xor eax, dword [edi + ebx*8 + 3]
movzx ebx, dh
and edx, 0xff
movzx edx, byte [ebp + edx*8 + 2]
movzx ebx, byte [ebp + ebx*8 + 2]
xor eax, dword [edi + edx*8 + 2]
xor eax, dword [edi + ebx*8 + 1]
mov dword [esi + 8], eax
mov eax, dword [esi + 0xc]
mov edx, eax
movzx ebx, ah
shr edx, 0x10
and eax, 0xff
movzx eax, byte [ebp + eax*8 + 2]
movzx ebx, byte [ebp + ebx*8 + 2]
mov eax, dword [edi + eax*8]
xor eax, dword [edi + ebx*8 + 3]
movzx ebx, dh
and edx, 0xff
movzx edx, byte [ebp + edx*8 + 2]
movzx ebx, byte [ebp + ebx*8 + 2]
xor eax, dword [edi + edx*8 + 2]
xor eax, dword [edi + ebx*8 + 1]
mov dword [esi + 0xc], eax
dec ecx
jne 0x103e7e14
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x103eafec
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x103eb0bc
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x103eb05a
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.103e9000
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x103eb02c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x103eb163
call 0x103eb06c
pop edx
lea ecx, [edx + 0x114]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x103eb10c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.103e9000
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x103eb0c9
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x103eb163
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.103e9000
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x103eb161
jmp 0x103eb163
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x103eb1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x103eb299
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x103eb237
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.103eada4
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x103eb209
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x103eb340
call 0x103eb249
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x103eb2e9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.103eaec8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x103eb2a6
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x103eb340
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.103eaec8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x103eb33e
jmp 0x103eb340
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1014d6a4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10269320]
jne 0x1014d6ae
repz ret
jmp fcn.101552c7

Function at 0x101593cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1014b6be
and dword [ebp - 4], 0
cmp dword [0x1026ab34], 0
mov ebx, eax
jne 0x1015947c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1015952d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x102590cc
push edi
call esi
test eax, eax
je 0x1015952d
push eax
call fcn.1014b64c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1026ab34], eax
call esi
push eax
call fcn.1014b64c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1026ab38], eax
call esi
push eax
call fcn.1014b64c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1026ab3c], eax
call esi
push eax
call fcn.1014b64c
pop ecx
mov dword [0x1026ab44], eax
test eax, eax
je 0x1015947c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1014b64c
pop ecx
mov dword [0x1026ab40], eax
mov eax, dword [0x1026ab40]
cmp eax, ebx
je 0x101594d4
cmp dword [0x1026ab44], ebx
je 0x101594d4
push eax
call fcn.1014b6c7
push dword [0x1026ab44]
mov esi, eax
call fcn.1014b6c7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101594d4
test edi, edi
je 0x101594d4
call esi
test eax, eax
je 0x101594cb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101594cb
test byte [ebp - 0xc], 1
jne 0x101594d4
or dword [ebp + 0x10], 0x200000
jmp 0x1015950d
mov eax, dword [0x1026ab38]
cmp eax, ebx
je 0x1015950d
push eax
call fcn.1014b6c7
pop ecx
test eax, eax
je 0x1015950d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1015950d
mov eax, dword [0x1026ab3c]
cmp eax, ebx
je 0x1015950d
push eax
call fcn.1014b6c7
pop ecx
test eax, eax
je 0x1015950d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1026ab34]
call fcn.1014b6c7
pop ecx
test eax, eax
je 0x1015952d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1015952f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1015cb51
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [0x102688ac]
add ecx, 0x205c
mov dword [0x102688a8], ecx
mov dword [0x102688ac], 0x879
mov dword [ebp - 0x10], eax
call fcn.1015df18
xor ecx, ecx
mov edx, eax
mov dword [0x102688a8], 0xfffff7a8
mov esi, dword [eax + 0x3c]
mov dword [0x102688ac], 0x2416
mov dword [0x102688a8], 0x1348
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x102688a8], 0x254a
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x1015ccc4
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x1015cc5a
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x1015cc09
mov al, byte [ebp - 0x46]
test al, 1
jne 0x1015cc97
jmp 0x1015cc63
xor eax, eax
mov dword [0x102688a8], 0x150d
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jb 0x1015cbef
jmp 0x1015ccc4
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov dword [0x102688ac], 0x2552
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x102688a8], 0xfffff15b
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret