joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ef320
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [ebx]
mov al, byte [esi]
cmp al, 0x61
jl 0x100ef336
cmp al, 0x7a
jle 0x100ef3e6
cmp al, 0x41
jl 0x100ef342
cmp al, 0x5a
jle 0x100ef3e6
cmp al, 0x30
jl 0x100ef34e
cmp al, 0x39
jle 0x100ef3e6
cmp al, 0x2d
je 0x100ef3e6
cmp al, 0x2e
je 0x100ef3e6
cmp al, 0x5f
je 0x100ef3e6
cmp al, 0x7e
je 0x100ef3e6
cmp al, 0x25
jne 0x100ef3b6
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100ef37b
cmp cl, 0x39
jle 0x100ef38d
cmp cl, 0x61
jl 0x100ef385
cmp cl, 0x66
jle 0x100ef38d
sub cl, 0x41
cmp cl, 5
ja 0x100ef3ae
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100ef39a
cmp cl, 0x39
jle 0x100ef3e6
cmp cl, 0x61
jl 0x100ef3a4
cmp cl, 0x66
jle 0x100ef3e6
cmp cl, 0x41
jl 0x100ef3ae
cmp cl, 0x46
jle 0x100ef3e6
pop esi
mov eax, 1
pop ebx
ret
cmp al, 0x21
je 0x100ef3e6
cmp al, 0x24
je 0x100ef3e6
cmp al, 0x26
je 0x100ef3e6
cmp al, 0x28
je 0x100ef3e6
cmp al, 0x29
je 0x100ef3e6
cmp al, 0x2a
je 0x100ef3e6
cmp al, 0x2b
je 0x100ef3e6
cmp al, 0x2c
je 0x100ef3e6
cmp al, 0x3b
je 0x100ef3e6
cmp al, 0x3d
je 0x100ef3e6
cmp al, 0x27
je 0x100ef3e6
cmp al, 0x3a
jne 0x100ef3f6
xor ecx, ecx
cmp al, 0x25
sete cl
lea esi, [esi + ecx*2]
inc esi
jmp 0x100ef328
cmp al, 0x40
jne 0x100ef3ae
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x100ef444
mov eax, dword [edi + 0x10]
test eax, eax
je 0x100ef414
push eax
call dword [0x1030d464]
add esp, 4
mov ecx, dword [ebx]
mov eax, esi
sub eax, ecx
test byte [edi + 0x24], 2
je 0x100ef435
push eax
push ecx
call fcn.100e3540
add esp, 8
mov dword [edi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push eax
push ecx
call fcn.100f05e0
add esp, 0xc
mov dword [edi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x100f6760
Capabilities:
Query environment variable

Disassembly:
cmp dword [0x1031e3e8], 0
je 0x100f676d
or eax, 0xffffffff
ret
mov dword [0x1031e3e8], 1
call fcn.100ac180
push str.XML_MEM_BREAKPOINT
mov dword [0x1031e3f8], eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x100f67a6
push 0x1031e400
push 0x10276d3c
push eax
call fcn.100f6700
add esp, 0xc
push str.XML_MEM_TRACE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x100f67cb
push 0x1031e404
push 0x10276d50
push eax
call fcn.100f6700
add esp, 0xc
xor eax, eax
ret

Function at 0x100fa210
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x7d4
mov eax, dword [0x1030fff4]
xor eax, esp
mov dword [esp + 0x7d0], eax
push esi
push edi
mov edi, dword [esp + 0x7e0]
xor esi, esi
push 0xd
push str.urn:publicid:
push edi
call fcn.100e34e0
add esp, 0xc
test eax, eax
je 0x100fa25c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x7d0]
xor ecx, esp
call fcn.10236000
add esp, 0x7d4
ret
mov al, byte [edi + 0xd]
add edi, 0xd
test al, al
je 0x100fa36e
nop word [eax + eax]
cmp esi, 0x7cc
ja 0x100fa366
cmp al, 0x2b
jne 0x100fa28a
mov byte [esp + esi + 8], 0x20
jmp 0x100fa35a
cmp al, 0x3a
jne 0x100fa29e
mov word [esp + esi + 8], 0x2f2f
inc edi
add esi, 2
jmp 0x100fa35c
cmp al, 0x3b
jne 0x100fa2b2
mov word [esp + esi + 8], 0x3a3a
inc edi
add esi, 2
jmp 0x100fa35c
cmp al, 0x25
jne 0x100fa356
mov al, byte [edi + 1]
cmp al, 0x32
jne 0x100fa318
cmp byte [edi + 2], 0x42
jne 0x100fa2d5
mov byte [esp + esi + 8], 0x2b
add edi, 3
inc esi
jmp 0x100fa35c
cmp byte [edi + 2], 0x46
jne 0x100fa2e6
mov byte [esp + esi + 8], 0x2f
add edi, 3
inc esi
jmp 0x100fa35c
cmp byte [edi + 2], 0x37
jne 0x100fa2f7
mov byte [esp + esi + 8], 0x27
add edi, 3
inc esi
jmp 0x100fa35c
mov al, byte [edi + 2]
cmp al, 0x33
jne 0x100fa309
mov byte [esp + esi + 8], 0x23
add edi, 3
inc esi
jmp 0x100fa35c
cmp al, 0x35
jne 0x100fa34f
mov byte [esp + esi + 8], 0x25
add edi, 3
inc esi
jmp 0x100fa35c
cmp al, 0x33
jne 0x100fa34f
cmp byte [edi + 2], 0x41
jne 0x100fa32d
mov byte [esp + esi + 8], 0x3a
add edi, 3
inc esi
jmp 0x100fa35c
cmp byte [edi + 2], 0x42
jne 0x100fa33e
mov byte [esp + esi + 8], 0x3b
add edi, 3
inc esi
jmp 0x100fa35c
cmp byte [edi + 2], 0x46
jne 0x100fa34f
mov byte [esp + esi + 8], 0x3f
add edi, 3
inc esi
jmp 0x100fa35c
mov byte [esp + esi + 8], 0x25
jmp 0x100fa35a
mov byte [esp + esi + 8], al
inc esi
inc edi
mov al, byte [edi]
test al, al
jne 0x100fa270
cmp esi, 0x7d0
jae 0x100fa397
lea eax, [esp + 8]
mov byte [esp + esi + 8], 0
push eax
call fcn.100e31c0
mov ecx, dword [esp + 0x7dc]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.10236000
add esp, 0x7d4
ret
call fcn.1014ecdb
int3
Function at 0x1014ecdb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1014ecea
pop dword [ebp - 0x4c]
mov eax, 0xb32bf3d1
sub eax, 0xa31706e7
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xfcc58228
add dword [ebp - 0x5c], 0x518cc323
mov dword [ebp - 0x58], 0xe695f1f3
add dword [ebp - 0x58], 0x4b9d5a52
mov dword [ebp - 0x54], 0xaa63f102
add dword [ebp - 0x54], 0xa1e8532c
mov dword [ebp - 0x50], 0xf357e32d
sub dword [ebp - 0x50], 0xf357e32d
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xccdbe99
sub eax, 0xfca85d31
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x17729f16
sub dword [ebp - 0x5c], 0xa30035c0
mov dword [ebp - 0x58], 0x9b808511
sub dword [ebp - 0x58], 0x5a14239c
mov dword [ebp - 0x54], 0xe5fbd605
sub dword [ebp - 0x54], 0x828c6999
mov dword [ebp - 0x50], 0x44d43396
sub dword [ebp - 0x50], 0x44d43396
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x2cf06b54
add eax, 0xe334f650
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x61ce4
push 0
call eax
mov ecx, 0x520e
xor ebx, ebx
add ebx, eax
mov edx, 0x10346200
add edx, dword [ebp - 0x4c]
mov edi, 0x113b68f5
sub edi, 0x13b03f98
mov dword [ebp - 0x44], 0xa7c00c8b
mov esi, dword [edx]
xor esi, edi
add dword [ebp - 0x10], eax
mov dword [ebx], esi
add dword [ebp - 0x44], ebx
add ebx, 0xa3ad2a02
sub ebx, 0xa3ad29fe
add edx, 0x8e05a139
add edx, 0x71fa5ecb
loop 0x1014ee02
add eax, 0x13b0b
mov ebx, eax
add eax, 0x52de5cea
add eax, 0xad21a31b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10156948
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
push 0x14
and dword [edi], 0
call fcn.1014ecdb
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10156967
push 7
pop eax
jmp 0x101569db
cmp byte [0x1030db34], 0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
je 0x101569b2
mov eax, dword [0x1030dc24]
test eax, eax
je 0x1015698f
push 0xc8
call eax
pop ecx
test eax, eax
jne 0x101569b2
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
xor eax, eax
mov dword [esi + 0xc], ebx
push eax
push esi
push 0x10156a40
push eax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x101569bf
push 0x14
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [esi + 8], 0
jne 0x101569d5
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call ebp
pop ecx
mov dword [esi + 0x10], eax
pop ebp
mov dword [edi], esi
xor eax, eax
pop ebx
pop edi
pop esi
ret
Function at 0x1016e5c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x1030fff4]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
mov ebx, dword [esp + 0x78]
push ebp
push esi
push edi
mov edi, dword [esp + 0x80]
push 0x30
mov eax, dword [edi + 0x20]
mov esi, dword [eax]
lea eax, [esp + 0x1c]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
push edi
call fcn.1016edd6
push 0x30
lea eax, [esi + 0x30]
push eax
lea eax, [esp + 0x60]
push eax
call sub.VCRUNTIME140.dll_memcpy
push 0x30
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x3c]
push eax
call sub.VCRUNTIME140.dll_memcmp
xor ebp, ebp
add esp, 0x28
inc ebp
test eax, eax
jne 0x1016e695
cmp byte [esp + 0x24], al
je 0x1016e695
lea eax, [esp + 0x10]
push eax
push 0
push 0x28
lea eax, [esp + 0x24]
push eax
push ebp
call fcn.1016db60
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp eax, dword [esp + 0x40]
jne 0x1016e695
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x44]
jne 0x1016e695
push 0x30
lea eax, [esp + 0x1c]
push eax
lea esi, [edi + 0x34]
push esi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1016e691
push 0x30
lea eax, [esp + 0x1c]
mov dword [ebx], ebp
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [edi + 0x42]
add esp, 0xc
mov eax, ecx
and ecx, 0xfe00
and eax, ebp
shl eax, 0x10
add eax, ecx
mov dword [edi + 0x24], eax
xor eax, eax
jmp 0x1016e697
mov eax, ebp
mov ecx, dword [esp + 0x78]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10236000
add esp, 0x6c
ret
Function at 0x101759ea
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x18]
mov edx, dword [esi + 8]
test edi, edi
jle 0x10175a1c
push ebp
mov ebp, dword [esp + 0x18]
mov ecx, dword [esi]
mov al, byte [ebx + ebp]
xor byte [ecx + edx], al
lea eax, [edx + 1]
xor edx, edx
cmp eax, dword [esi + 4]
cmovl edx, eax
inc ebx
cmp ebx, edi
jl 0x10175a03
pop ebp
add dword [esi + 0xc], edi
pop edi
mov dword [esi + 8], edx
pop esi
pop ebx
ret
Function at 0x10184770
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x10184797
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x10184786
pop edi
movzx eax, dl
pop esi
ret

Function at 0x10188420
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10236840
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x10188469
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x10188469
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x10188450
mov ecx, dword [esp + 0x2c]
movzx edx, byte [ecx + 0xc]
movzx eax, byte [ecx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x10188538
mov edi, ecx
nop dword [eax + eax]
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x10188516
mov edx, 0xc
mov eax, 1
nop dword [eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x10188500
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x101884a0
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x101885a6
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push ecx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x10188587
push edx
call fcn.101885f0
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x10188594
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10188bc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10236840
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x10188bdf
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x10188ca9
jb 0x10188c04
test eax, eax
jne 0x10188ca9
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [ebp + 0x16c]
mov dword [ebp + 0x34], ecx
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x30], eax
test edi, edi
je 0x10188c55
nop dword [eax]
test esi, esi
je 0x10188c3a
mov al, byte [ebx]
lea ecx, [ebp + 0x40]
xor byte [ecx + edi], al
inc ebx
inc edi
mov dword [esp + 0x18], ecx
dec esi
and edi, 0xf
jne 0x10188c20
jmp 0x10188c42
mov dword [esp + 0x18], ecx
test edi, edi
jne 0x10188c9b
lea eax, [ebp + 0x60]
push eax
push ecx
call fcn.1018a2d0
mov ecx, dword [esp + 0x20]
add esp, 8
jmp 0x10188c59
mov dword [esp + 0x18], ecx
mov eax, esi
lea edx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x10188c7b
push eax
push ebx
push edx
push ecx
call fcn.1018a0a0
add ebx, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x10188c9b
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x10188c9b
mov edx, dword [esp + 0x18]
nop dword [eax + eax]
mov al, byte [ecx + ebx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, esi
jb 0x10188c90
mov dword [ebp + 0x16c], edi
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
Function at 0x10189e70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.10236840
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebx, 0xc
jne 0x10189edc
mov eax, dword [esp + 0x20]
mov ebx, 1
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x1018a019
mov dword [esi + 0x40], 0
lea edx, [esi + 0x60]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esp + 0x14], ebx
mov dword [esi + 0x4c], 0
mov dword [esp + 0xc], edx
push ebp
mov ebp, dword [esp + 0x24]
push edi
lea edi, [esi + 0x40]
cmp ebx, 0x10
jb 0x10189f7f
mov eax, ebx
lea ecx, [esi + 0x41]
shr eax, 4
mov esi, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2c], eax
mov eax, ecx
lea edx, [ebp + 1]
mov edi, 4
nop dword [eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub edi, 1
jne 0x10189f30
push dword [esp + 0x14]
push esi
call fcn.1018a2d0
mov ecx, dword [esp + 0x20]
add esp, 8
add ebp, 0x10
sub ebx, 0x10
sub dword [esp + 0x2c], 1
jne 0x10189f23
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x40]
lea edx, [esi + 0x60]
test ebx, ebx
je 0x10189fa5
xor ecx, ecx
test ebx, ebx
je 0x10189f9b
nop dword [eax]
mov al, byte [ecx + ebp]
xor byte [edi + ecx], al
inc ecx
cmp ecx, ebx
jb 0x10189f90
push edx
push edi
call fcn.1018a2d0
add esp, 8
mov edx, dword [esp + 0x1c]
xor ebx, ebx
shld ebx, edx, 3
xor byte [esi + 0x4b], bl
mov eax, ebx
shl edx, 3
xor byte [esi + 0x4f], dl
mov ecx, edx
shrd ecx, eax, 0x18
xor byte [esi + 0x4c], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
xor byte [esi + 0x4d], cl
shrd eax, ebx, 8
xor byte [esi + 0x4e], al
lea eax, [esi + 0x60]
push eax
push edi
call fcn.1018a2d0
movzx ebx, byte [esi + 0x4c]
add esp, 8
movzx eax, byte [esi + 0x4d]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4f]
shl ebx, 8
or ebx, eax
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
pop edi
mov dword [esi + 0xc], eax
pop ebp
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
inc ebx
add esp, 0xc
mov eax, ebx
mov byte [esi + 0xf], bl
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [esi + 0xe], al
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x101f9960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10236840
mov eax, dword [0x1030fff4]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x24], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x101f9b25
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
nop dword [eax]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x101f9ab5
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.101f9390
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x101f9a50
test ebp, ebp
mov ebp, dword [esp + 0x24]
je 0x101f9b0c
mov ecx, dword [esp + 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10236000
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10236000
add esp, 0x28
ret
Function at 0x101fd680
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x88
call fcn.10236840
mov eax, dword [0x1030fff4]
xor eax, esp
mov dword [esp + 0x84], eax
mov ecx, dword [esp + 0x98]
push edi
mov edi, dword [esp + 0x90]
mov dword [esp + 0x48], 0x61707865
mov eax, dword [ecx]
mov dword [esp + 0x58], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x60], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x74], eax
mov dword [esp + 0x4c], 0x3320646e
mov dword [esp + 0x50], 0x79622d32
mov eax, dword [ecx]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x54], 0x6b206574
test eax, eax
je 0x101fd857
push ebx
mov ebx, dword [esp + 0x98]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.101fd870
add esp, 8
xor eax, eax
test esi, esi
je 0x101fd82a
cmp esi, 0x40
jb 0x101fd7f1
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x13]
add edx, esi
cmp edi, ecx
ja 0x101fd784
lea ecx, [esp + 0x14]
cmp edx, ecx
jae 0x101fd7f1
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x101fd791
cmp edx, ebx
jae 0x101fd7f1
mov edx, esi
lea ecx, [edi + 0x10]
mov ebp, ebx
and edx, 0xffffffc0
sub ebp, edi
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x14]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ebx + eax]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x24]
movups xmmword [edi + eax], xmm1
movups xmm1, xmmword [ecx + ebp - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
movups xmmword [ecx - 0x40], xmm1
movups xmm1, xmmword [ebx + eax + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x44]
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [ebx + eax + 0x30]
add eax, 0x40
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp eax, edx
jb 0x101fd7a0
cmp eax, esi
jae 0x101fd82a
mov ebp, ebx
lea ecx, [esp + 0x14]
sub ebp, ecx
lea edx, [esp + 0x14]
mov ecx, edi
sub ecx, edx
mov dword [esp + 0x10], ecx
mov ebx, ecx
nop dword [eax + eax]
lea edx, [esp + 0x14]
add edx, eax
inc eax
mov cl, byte [edx + ebp]
xor cl, byte [edx]
mov byte [ebx + edx], cl
cmp eax, esi
jb 0x101fd810
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
add ebx, esi
inc dword [esp + 0x84]
sub eax, esi
add edi, esi
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], eax
test eax, eax
jne 0x101fd740
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
pop edi
xor ecx, esp
call fcn.10236000
add esp, 0x88
ret
Function at 0x10200190
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x102001a4
mov dword [esp + 0x18], fcn.101fe960
jmp fcn.10188170
mov dword [esp + 0x18], fcn.101fdc00
jmp fcn.10187ea0