joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100081df
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0x30
push esi
push edi
mov edi, eax
mov dword [ebp - 4], 0x40
jne 0x100081fc
mov dword [ebp - 4], 0x80
test ebx, ebx
je 0x10008213
mov esi, dword [ebp + 8]
sub esi, edi
mov ecx, ebx
mov dl, byte [esi + eax]
xor dl, 0x36
mov byte [eax], dl
inc eax
dec ecx
jne 0x10008207
cmp ebx, dword [ebp - 4]
jge 0x1000822c
mov ecx, dword [ebp - 4]
sub ecx, ebx
push ecx
lea eax, [edi + ebx]
push 0x36
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0x30
jne 0x1000824b
lea eax, [edi + 0x80]
call fcn.1000b612
push dword [ebp - 4]
mov esi, eax
push edi
call fcn.1000bd82
pop ecx
jmp 0x10008261
lea esi, [edi + 0x80]
mov eax, esi
call fcn.1000b476
mov eax, dword [ebp - 4]
push edi
call fcn.1000b4b9
pop ecx
test ebx, ebx
je 0x1000827b
mov esi, dword [ebp + 8]
mov eax, edi
sub esi, edi
mov ecx, ebx
mov dl, byte [eax + esi]
xor dl, 0x5c
mov byte [eax], dl
inc eax
dec ecx
jne 0x1000826f
mov eax, dword [ebp - 4]
cmp ebx, eax
jge 0x10008292
sub eax, ebx
push eax
add edi, ebx
push 0x5c
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
pop edi
pop esi
leave
ret

Function at 0x10009a2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x10009afc
cmp dword [ebp + 0xc], ebx
je 0x10009afc
cmp esi, ebx
je 0x10009afc
test byte [ebp + 0x10], 7
jne 0x10009afc
mov eax, dword [esi]
cmp eax, ebx
jl 0x10009af8
cmp eax, 0x10
jg 0x10009af8
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], ebx
jbe 0x10009ae7
push edi
xor edi, edi
cmp eax, ebx
jle 0x10009a98
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
sub edx, ecx
lea ecx, [ebp + edi - 0x1c]
mov bl, byte [edx + ecx]
xor bl, byte [esi + edi + 4]
inc edi
mov byte [ecx], bl
cmp edi, eax
jl 0x10009a84
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 0x14]
push eax
lea eax, [ebp - 0x1c]
call fcn.1000a002
add esp, 4
push 0x20
pop ecx
lea eax, [ebp - 0x3c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10009ab0
push 0x2c
pop ecx
call fcn.1000abbe
xor eax, eax
cmp dword [esi], ebx
jle 0x10009ad3
mov ecx, dword [ebp + 0xc]
mov cl, byte [eax + ecx]
mov byte [esi + eax + 4], cl
inc eax
cmp eax, dword [esi]
jl 0x10009ac4
mov eax, dword [esi]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], eax
add dword [ebp + 8], eax
cmp ecx, dword [ebp + 0x10]
jb 0x10009a76
pop edi
push 0x18
pop ecx
lea eax, [ebp - 0x1c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10009aed
mov eax, dword [ebp + 0x10]
jmp 0x10009aff
push 0xfffffffffffffff7
jmp 0x10009afe
push 0xfffffffffffffffa
pop eax
pop ebx
leave
ret
Function at 0x10009b02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov ebx, eax
xor ecx, ecx
cmp ebx, ecx
je 0x10009bdf
cmp dword [ebp + 8], ecx
je 0x10009bdf
cmp edi, ecx
je 0x10009bdf
test byte [ebp + 0xc], 7
jne 0x10009bdf
mov eax, dword [edi]
cmp eax, ecx
jl 0x10009bdb
cmp eax, 0x10
jg 0x10009bdb
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], ecx
jbe 0x10009bbc
push esi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x14]
lea esi, [ebp - 0x34]
call fcn.1000a4ea
push 0x20
pop ecx
lea eax, [ebp - 0x54]
mov byte [eax], 0
inc eax
dec ecx
jne 0x10009b60
push 0x2c
pop ecx
call fcn.1000abbe
xor eax, eax
cmp dword [edi], eax
jle 0x10009b96
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
sub esi, ecx
lea ecx, [ebp + eax - 0x1c]
mov dl, byte [esi + ecx]
mov byte [ecx], dl
mov cl, byte [edi + eax + 4]
xor cl, byte [ebp + eax - 0x34]
mov byte [eax + ebx], cl
inc eax
cmp eax, dword [edi]
jl 0x10009b7d
xor eax, eax
cmp dword [edi], eax
jle 0x10009ba9
mov cl, byte [ebp + eax - 0x1c]
mov byte [edi + eax + 4], cl
inc eax
cmp eax, dword [edi]
jl 0x10009b9c
mov eax, dword [edi]
add dword [ebp - 4], eax
add dword [ebp + 8], eax
add ebx, eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x10009b4c
pop esi
push 0x18
pop ecx
lea eax, [ebp - 0x34]
mov byte [eax], 0
inc eax
dec ecx
jne 0x10009bc2
push 0x18
pop ecx
lea eax, [ebp - 0x1c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x10009bcf
mov eax, dword [ebp + 0xc]
jmp 0x10009be2
push 0xfffffffffffffff7
jmp 0x10009be1
push 0xfffffffffffffffa
pop eax
pop ebx
leave
ret
Function at 0x1000afe8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
xor edx, edx
lea ecx, [eax + 0x21]
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x150], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x1000aff9
mov ecx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0x18]
push 0x40
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x148]
pop edi
mov ebx, dword [ecx + 0x2c]
xor ebx, dword [ecx + 0x18]
xor ebx, dword [ecx - 8]
xor ebx, dword [ecx]
add ecx, 4
dec edi
rol ebx, 1
mov dword [ecx + 0x34], ebx
jne 0x1000b04b
xor ecx, ecx
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
xor ebx, edx
and ebx, esi
mov esi, dword [ebp - 4]
xor ebx, esi
rol edi, 5
add edi, ebx
add edi, dword [ebp + ecx*4 - 0x150]
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
lea edi, [ebx + edi + 0x5a827999]
rol edx, 0x1e
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
cmp ecx, 0x14
jb 0x1000b063
cmp ecx, 0x28
jae 0x1000b11c
mov ebx, dword [ebp - 4]
xor ebx, edx
xor ebx, esi
rol edi, 5
add edi, ebx
add edi, dword [ebp + ecx*4 - 0x150]
mov ebx, dword [ebp - 8]
lea edi, [ebx + edi + 0x6ed9eba1]
mov ebx, dword [ebp - 4]
rol esi, 0x1e
inc ecx
mov dword [ebp - 4], edx
mov edx, esi
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
cmp ecx, 0x28
jb 0x1000b0a8
jmp 0x1000b119
mov ebx, edx
or ebx, esi
and ebx, dword [ebp - 4]
mov esi, edx
and esi, dword [ebp - 0x10]
rol edi, 5
or ebx, esi
add ebx, dword [ebp + ecx*4 - 0x150]
mov esi, dword [ebp - 4]
add ebx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
lea edi, [ebx + edi - 0x70e44324]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
inc ecx
rol edx, 0x1e
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
cmp ecx, 0x3c
jb 0x1000b0e1
jmp 0x1000b157
mov ebx, dword [ebp - 4]
xor ebx, edx
xor ebx, esi
add ebx, dword [ebp + ecx*4 - 0x150]
mov esi, dword [ebp - 4]
add ebx, dword [ebp - 8]
rol edi, 5
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
lea edi, [ebx + edi - 0x359d3e2a]
inc ecx
rol edx, 0x1e
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
cmp ecx, 0x50
jb 0x1000b123
mov ecx, dword [eax + 8]
add ecx, edi
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ecx, esi
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x10]
add ecx, edx
mov dword [eax + 0x10], ecx
mov ecx, dword [eax + 0x14]
add ecx, dword [ebp - 4]
pop edi
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0x18]
add ecx, dword [ebp - 8]
pop esi
mov dword [eax + 0x18], ecx
pop ebx
leave
ret
Function at 0x1000b1af
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
ret

Function at 0x1000b30d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push esi
push edi
lea esi, [ecx + 8]
push 8
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], esi
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
add eax, 2
movzx edx, byte [eax - 2]
movzx esi, byte [eax - 1]
shl edx, 8
or edx, esi
movzx esi, byte [eax]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 1]
shl edx, 8
or edx, esi
mov dword [ebp + ecx*4 - 0x124], edx
inc ecx
add eax, 4
cmp ecx, 0x10
jl 0x1000b32b
push 0x30
pop esi
lea eax, [ebp - 0xec]
push ebx
mov edx, dword [eax]
mov ecx, dword [eax - 0x34]
mov edi, edx
ror edi, 0x13
mov ebx, edx
shr edx, 0xa
ror ebx, 0x11
xor edi, ebx
xor edi, edx
mov edx, ecx
ror edx, 0x12
mov ebx, ecx
ror ebx, 7
xor edx, ebx
shr ecx, 3
xor edx, ecx
add edi, edx
add edi, dword [eax - 0x38]
add eax, 4
add edi, dword [eax - 0x18]
dec esi
mov dword [eax + 4], edi
jne 0x1000b363
mov esi, dword [ebp - 0x10]
xor edx, edx
pop ebx
mov eax, esi
ror eax, 0x19
mov ecx, esi
ror ecx, 0xb
xor eax, ecx
mov ecx, esi
ror ecx, 6
xor eax, ecx
mov ecx, dword [ebp - 0xc]
xor ecx, dword [ebp - 8]
add edx, 4
and ecx, esi
xor ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x20]
add eax, ecx
add eax, dword [edx + 0x1002099c]
mov edi, esi
add eax, dword [ebp + edx - 0x128]
mov ecx, esi
add eax, dword [ebp - 4]
add dword [ebp - 0x14], eax
ror edi, 0x16
ror ecx, 0xd
xor edi, ecx
mov ecx, esi
ror ecx, 2
xor edi, ecx
mov ecx, dword [ebp - 0x1c]
add edi, eax
mov eax, dword [ebp - 8]
or ecx, esi
and ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
and esi, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
or ecx, esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
add ecx, edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
cmp edx, 0x100
jl 0x1000b3a1
mov eax, dword [ebp - 0x24]
pop edi
xor ecx, ecx
pop esi
mov edx, dword [ebp + ecx*4 - 0x20]
add dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jl 0x1000b441
leave
ret

Function at 0x1000b476
Capabilities:
Hash data using sha256

Disassembly:
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
mov dword [eax], ecx
mov dword [eax + 4], ecx
ret
Function at 0x1000b612
Capabilities:
Hash data using sha224

Disassembly:
xor ecx, ecx
mov dword [eax + 0x48], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0xcbbb9d5d
mov dword [eax + 0x10], 0x367cd507
mov dword [eax + 0x14], 0x629a292a
mov dword [eax + 0x18], 0x3070dd17
mov dword [eax + 0x1c], 0x9159015a
mov dword [eax + 0x20], 0xf70e5939
mov dword [eax + 0x24], 0x152fecd8
mov dword [eax + 0x28], 0xffc00b31
mov dword [eax + 0x2c], 0x67332667
mov dword [eax + 0x30], 0x68581511
mov dword [eax + 0x34], 0x8eb44a87
mov dword [eax + 0x38], 0x64f98fa7
mov dword [eax + 0x3c], 0xdb0c2e0d
mov dword [eax + 0x40], 0xbefa4fa4
mov dword [eax + 0x44], 0x47b5481d
ret
Function at 0x1000bf2e
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x1000bf6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000bf6a
push dword [ebp + 0xc]
push esi
call fcn.1000bf6f
pop ecx
pop ecx
test eax, eax
jns 0x1000bf6a
push esi
call dword [0x10028a84]
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x1000bfa8
Capabilities:
Copy file
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x3628
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], ebx
call fcn.1000ec70
mov dword [ebp - 8], eax
mov eax, dword [0x1002a674]
mov edi, 0x80
cmp eax, 0x100
je 0x1000bffc
cmp eax, edi
je 0x1000bffc
cmp eax, 2
je 0x1000bffc
cmp dword [0x10028bc4], 0xa
jb 0x1000c0bc
test al, 4
je 0x1000c0bc
mov esi, 0x10028c64
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
xor eax, eax
call fcn.10010643
push eax
push 0x10021d30
lea eax, [ebp - 0x9c]
push 0x40
push eax
call fcn.1000d7a6
push ebx
push dword [ebp - 8]
mov esi, 0x1001cba0
push esi
push str.SysWOW64
push esi
push 0x10029dfc
call fcn.1000c8b6
push ebx
push 0x10021d50
mov dword [ebp - 0x10], eax
push str..2_
lea eax, [ebp - 0x9c]
push eax
push esi
push 0x1002a006
call fcn.1000c8b6
add esp, 0x48
push ebx
push eax
push dword [ebp - 0x10]
mov dword [0x100289ec], eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [0x100289ec]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x100289e8], eax
cmp eax, ebx
je 0x1000c08e
mov dword [ebp - 0xc], 1
push 0xfffffffffffffffe
pop eax
lea esi, [ebp - 0x10]
call fcn.1000d970
push edi
lea eax, [ebp - 0x9c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp - 0xc], ebx
jne 0x1000c0dd
push 0xfffffffffffffffe
pop eax
mov esi, 0x100289ec
call fcn.1000d970
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x100289e8], eax
cmp eax, ebx
jne 0x1000c0dd
lea eax, [ebp - 8]
call fcn.1000edb0
xor eax, eax
jmp 0x1000c1e7
lea eax, [ebp - 8]
call fcn.1000edb0
mov eax, 0x1cc1
call fcn.1000ecfd
mov dword [ebp - 0xc], eax
mov eax, 0x1ba
call fcn.1000ecfd
mov dword [ebp - 0x10], eax
mov eax, 0x7af
call fcn.1000ecfd
mov dword [ebp - 8], eax
mov eax, 0x957
call fcn.1000ecfd
mov dword [ebp - 0x1c], eax
mov eax, 0x20bd
call fcn.1000ecfd
mov dword [ebp - 0x14], eax
mov eax, 0x2a1e
call fcn.1000ecfd
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x100289e8]
mov dword [ebp - 0x18], eax
call esi
mov dword [0x10028b90], eax
cmp eax, ebx
je 0x1000c1b1
push dword [ebp - 0x10]
push dword [0x100289e8]
call esi
mov dword [0x10028b94], eax
cmp eax, ebx
je 0x1000c1b1
push dword [ebp - 8]
push dword [0x100289e8]
call esi
mov dword [0x10028b98], eax
cmp eax, ebx
je 0x1000c1b1
push dword [ebp - 0x1c]
push dword [0x100289e8]
call esi
mov dword [0x10028b9c], eax
cmp eax, ebx
je 0x1000c1b1
push dword [ebp - 0x14]
push dword [0x100289e8]
call esi
mov dword [0x10028ba0], eax
cmp eax, ebx
je 0x1000c1b1
push dword [ebp - 0x18]
push dword [0x100289e8]
call esi
mov dword [0x10028ba8], eax
cmp eax, ebx
jne 0x1000c1b4
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xc]
call fcn.1000ed9b
lea eax, [ebp - 0x10]
call fcn.1000ed9b
lea eax, [ebp - 8]
call fcn.1000ed9b
lea eax, [ebp - 0x1c]
call fcn.1000ed9b
lea eax, [ebp - 0x14]
call fcn.1000ed9b
lea eax, [ebp - 0x18]
call fcn.1000ed9b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000c467
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
push ebx
push esi
mov esi, eax
xor ebx, ebx
call fcn.1000bfa8
test eax, eax
je 0x1000c52e
push dword [ebp + 0xc]
push dword [esi]
call fcn.1000c262
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1000c52e
push 0x2cc
lea eax, [ebp - 0x2e0]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2e0]
push eax
push dword [esi + 4]
mov dword [ebp - 0x2e0], 0x10002
call dword [0x10028a78]
test eax, eax
je 0x1000c52e
mov eax, dword [ebp - 0x230]
mov edx, dword [ebp + 8]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
mov ecx, ebx
sub ecx, eax
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
push 0x40
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
lea ecx, [ecx + edx - 5]
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0xb], ecx
mov dword [ebp - 4], 5
call dword [0x10028ba0]
test eax, eax
js 0x1000c52c
lea eax, [ebp - 4]
push eax
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x230]
push dword [esi]
call dword [0x10028b9c]
test eax, eax
jns 0x1000c52e
xor ebx, ebx
mov eax, dword [0x100289e8]
test eax, eax
je 0x1000c545
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [0x100289e8], 0
mov eax, dword [0x100289ec]
test eax, eax
je 0x1000c562
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xfffffffffffffffe
pop eax
mov esi, 0x100289ec
call fcn.1000d970
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1000c568
Capabilities:
Resume thread

Disassembly:
push esi
push dword [eax + 4]
xor esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x1000c57b
xor esi, esi
mov eax, esi
pop esi
ret

Function at 0x1000d5ad
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov dword [eax], ecx
mov dword [eax + 0x9c0], 1
push edi
mov edx, dword [eax + 0x9c0]
lea ecx, [eax + edx*4]
mov esi, dword [ecx - 4]
mov edi, esi
shr edi, 0x1e
xor edi, esi
imul edi, edi, 0x6c078965
add edi, edx
mov dword [ecx], edi
inc dword [eax + 0x9c0]
cmp dword [eax + 0x9c0], 0x270
jl 0x1000d5bb
pop edi
pop esi
ret
Function at 0x1000d5ed
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c0], 0x270
jl 0x1000d699
push ebx
push esi
push edi
xor esi, esi
mov edi, closesocket
mov eax, dword [ecx + esi*4 + 4]
lea edx, [ecx + esi*4]
xor eax, dword [edx]
and eax, edi
xor eax, dword [edx]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x100275d0]
xor eax, dword [ecx + esi*4 + 0x634]
inc esi
mov dword [edx], eax
cmp esi, 0xe3
jl 0x1000d607
jmp 0x1000d65b
mov eax, dword [ecx + esi*4 + 4]
lea edx, [ecx + esi*4]
xor eax, dword [edx]
and eax, edi
xor eax, dword [edx]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x100275d0]
xor eax, dword [ecx + esi*4 - 0x38c]
inc esi
mov dword [edx], eax
cmp esi, 0x26f
jl 0x1000d636
mov eax, dword [ecx + 0x9bc]
xor eax, dword [ecx]
and eax, edi
xor eax, dword [ecx + 0x9bc]
pop edi
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x100275d0]
xor edx, dword [ecx + 0x630]
shr eax, 1
xor edx, eax
and dword [ecx + 0x9c0], 0
pop esi
mov dword [ecx + 0x9bc], edx
pop ebx
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x1000db89
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 4], esi
call fcn.1000dad3
mov edi, eax
pop ecx
cmp edi, esi
jne 0x1000dbaf
xor eax, eax
jmp 0x1000dbfe
push esi
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000dbef
cmp dword [ebp - 4], esi
je 0x1000dbf5
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
mov eax, ebx
call fcn.10010643
pop ecx
pop ecx
mov ebx, eax
cmp dword [ebp - 4], esi
ja 0x1000dbaf
jmp 0x1000dbf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [0x10028a84]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000dc03
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.1000dad3
mov edi, eax
pop ecx
cmp edi, ebx
je 0x1000dc6c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x1000dc57
lea eax, [esi + 1]
push eax
call fcn.1000d95a
mov ebx, eax
pop ecx
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x1000dc57
lea eax, [ebp - 8]
push eax
push esi
push edi
call fcn.1000db3b
add esp, 0xc
test eax, eax
je 0x1000dc57
cmp dword [ebp - 8], esi
je 0x1000dc70
push edi
call dword [0x10028a84]
test ebx, ebx
je 0x1000dc6c
xor eax, eax
lea esi, [ebp - 4]
call fcn.1000d970
xor eax, eax
jmp 0x1000dc86
mov eax, dword [ebp + 0xc]
mov byte [esi + ebx], 0
test eax, eax
je 0x1000dc7d
mov dword [eax], esi
push edi
call dword [0x10028a84]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ec70
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x10028970], ebx
jne 0x1000ec9d
push esi
push 0x10021f98
mov esi, 0x373b
call fcn.1000d9b1
pop ecx
mov dword [0x10028970], eax
pop esi
test eax, eax
jne 0x1000ec9d
mov eax, 0x100289f0
pop ebx
ret
mov ecx, 0x373a
mov eax, edi
cmp edi, ecx
jae 0x1000ecc6
mov edx, eax
and edx, 0x3f
mov dl, byte [edx + 0x10027188]
xor dl, byte [eax + 0x10021f98]
je 0x1000ecc2
inc eax
cmp eax, ecx
jb 0x1000eca8
jmp 0x1000ecc6
sub eax, edi
mov ebx, eax
lea eax, [ebx + ebx + 2]
push eax
call fcn.1000d95a
pop ecx
test eax, eax
je 0x1000ec96
xor ecx, ecx
test ebx, ebx
je 0x1000ecfb
lea edx, [ecx + edi]
and edx, 0x3f
mov dl, byte [edx + 0x10027188]
xor dl, byte [edi + ecx + 0x10021f98]
movsx dx, dl
mov word [eax + ecx*2], dx
inc ecx
cmp ecx, ebx
jb 0x1000ecdb
pop ebx
ret

Function at 0x1000ecfd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, eax
mov eax, dword [0x10028970]
push esi
test eax, eax
jne 0x1000ed32
push 0x10021f98
mov esi, 0x373b
call fcn.1000d9b1
pop ecx
mov dword [0x10028970], eax
test eax, eax
jne 0x1000ed32
mov eax, 0x100289e6
jmp 0x1000ed97
mov esi, 0x373a
mov ecx, ebx
cmp ebx, esi
jae 0x1000ed59
mov edx, ecx
and edx, 0x3f
mov dl, byte [edx + 0x10027188]
xor dl, byte [eax + ecx]
je 0x1000ed54
inc ecx
cmp ecx, esi
jb 0x1000ed3d
jmp 0x1000ed59
sub ecx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.1000d95a
pop ecx
test eax, eax
je 0x1000ed2b
xor edx, edx
cmp dword [ebp - 4], edx
jbe 0x1000ed97
mov esi, dword [0x10028970]
push edi
mov edi, ebx
sub edi, eax
add esi, ebx
lea ecx, [eax + edx]
lea ebx, [edi + ecx]
and ebx, 0x3f
mov bl, byte [ebx + 0x10027188]
xor bl, byte [esi + edx]
inc edx
mov byte [ecx], bl
cmp edx, dword [ebp - 4]
jb 0x1000ed7c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f104
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push edi
push 0
push 2
call dword [0x10028b04]
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x1000f193
push esi
mov esi, 0x22c
push esi
lea eax, [ebp - 0x22c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
push edi
mov dword [ebp - 0x22c], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1000f15d
push edi
call dword [0x10028a84]
push 0xfffffffffffffffe
pop eax
jmp 0x1000f192
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
push eax
call dword [ebp + 8]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1000f184
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000f15d
push edi
call dword [0x10028a84]
xor eax, eax
test esi, esi
sete al
pop esi
pop edi
leave
ret