joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000534f
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xd], 0
je 0x1000536d
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x45]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x1000535a
pop ebx
mov byte [edx + 0xd], 0
mov eax, edx
ret

Function at 0x1000553e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xa], 0
je 0x1000555c
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x45]
xor byte [ecx], al
inc ebx
cmp ebx, 9
jb 0x10005549
pop ebx
mov byte [edx + 0xa], 0
mov eax, edx
ret

Function at 0x10005669
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1a], 0
je 0x10005687
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x45]
xor byte [ecx], al
inc ebx
cmp ebx, 0x19
jb 0x10005674
pop ebx
mov byte [edx + 0x1a], 0
mov eax, edx
ret

Function at 0x1000568a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x100056a7
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x45]
xor byte [ecx], al
inc edx
cmp edx, 0x19
jb 0x10005695
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x100056a9
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x100056c6
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x45]
xor byte [ecx], al
inc edx
cmp edx, 9
jb 0x100056b4
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x100056c8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x100056e5
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x45]
xor byte [ecx], al
inc edx
cmp edx, 0xc
jb 0x100056d3
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x10008573
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x10008581
pop esi
mov eax, edx
pop ebp
ret 4

Function at 0x1000859a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ecx + 0x14], 0xf
mov edi, dword [ecx + 0x10]
jbe 0x100085ad
mov ecx, dword [ecx]
xor esi, esi
mov edx, 0x811c9dc5
test edi, edi
je 0x100085c9
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x100085b8
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x10008ab3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x10008b0c
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp - 4]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10008ae4
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x10008b0b
lea eax, [ebp - 4]
mov esi, 0xf8
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10008b0b
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x10008b0f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x10008b49
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10008b4d
cmp edx, esi
jne 0x10008b32
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10008b6d
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10008b71
cmp edx, esi
jne 0x10008b56
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10008b91
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10008b95
cmp edx, esi
jne 0x10008b7a
popfd
popal
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b1db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x1005e040]
xor eax, esp
mov dword [esp + 0x164], eax
mov dword [esp + 8], ecx
mov ecx, dword [0x100d4994]
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 0xec]
mov ecx, eax
mov dword [esp + 0xc], eax
call fcn.10009f48
test eax, eax
je 0x1000b394
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp + 8], ecx
cmp dword [eax + 0x17c], ecx
jbe 0x1000b394
mov eax, dword [eax + 0x174]
mov esi, dword [eax + ecx*4]
mov ecx, esi
mov dword [esp + 0x14], esi
call fcn.10009f48
test eax, eax
je 0x1000b37b
mov ecx, dword [esi + 0x10]
call fcn.10009f48
test eax, eax
je 0x1000b37b
mov esi, dword [esi + 0x10]
lea edi, [esp + 0x28]
add esi, 0x10
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000a31e
test al, al
je 0x1000b37b
cvttss2si eax, dword [esp + 0x20]
sub eax, 0xf
cmp dword [esp + 0x10], 1
mov dword [esp + 0x18], eax
jne 0x1000b37b
mov esi, dword [esp + 0x14]
lea edi, [esp + 0x40]
mov eax, dword [0x100d49e8]
mov esi, dword [esi + 0x10]
add esi, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 0x13c]
lea edi, [esp + 0x34]
add esi, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss xmm1, dword [esp + 0x38]
movss xmm2, dword [esp + 0x34]
subss xmm2, dword [esp + 0x40]
subss xmm1, dword [esp + 0x44]
movss xmm0, dword [esp + 0x3c]
subss xmm0, dword [esp + 0x48]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
cvtsd2ss xmm0, xmm0
push 0x41
pop ecx
xor edx, edx
divss xmm0, dword [0x100598a4]
cvtss2sd xmm0, xmm0
mov al, byte [edx + 0x100547a4]
xor al, cl
inc ecx
mov byte [esp + edx + 0x4c], al
and ecx, 0x800000ff
jns 0x1000b330
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1a
jl 0x1000b313
push ecx
push ecx
movsd qword [esp], xmm0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x74]
mov byte [esp + 0x72], 0
push eax
call fcn.10008824
lea eax, [esp + 0x78]
push eax
cvttss2si eax, dword [esp + 0x30]
push 0x101
push 0xff800080
push dword [esp + 0x34]
push eax
push dword [0x100d49e4]
push 1
call fcn.10009dc3
add esp, 0x2c
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
inc ecx
mov dword [esp + 8], ecx
cmp ecx, dword [eax + 0x17c]
jb 0x1000b232
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
xor ecx, esp
call fcn.1004c3cd
mov esp, ebp
pop ebp
ret
Function at 0x1000ecee
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x14], 0
je 0x1000ed0c
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x47]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x1000ecf9
pop ebx
mov byte [edx + 0x14], 0
mov eax, edx
ret

Function at 0x1000ed6c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x13], 0
je 0x1000ed8a
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x47]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x1000ed77
pop ebx
mov byte [edx + 0x13], 0
mov eax, edx
ret

Function at 0x1000ed8d
Capabilities:
Get disk information

Disassembly:
push 0x40
mov eax, 0x10050edc
call fcn.1004fe7e
mov ebx, ecx
mov dword [ebp - 0x44], ebx
and dword [ebp - 4], 0
mov dword [ebp - 0x4c], ebx
and dword [ebp - 0x48], 0
push 0x10053593
call fcn.10007a81
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
mov dword [ebp - 4], ecx
push 0x10054944
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x13]
xor edx, edx
dec ecx
push 0xa
pop esi
div esi
add dl, 0x30
mov byte [ecx], dl
test eax, eax
jne 0x1000eddd
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
push 0xf
pop esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x13]
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
cmp ecx, eax
jne 0x1000ee12
mov edx, esi
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x2c], edx
jmp 0x1000ee24
lea eax, [ebp - 0x13]
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.10007eaf
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
cmp ebx, eax
je 0x1000ee56
mov edx, dword [ebx + 0x14]
cmp edx, esi
jbe 0x1000ee3a
mov ecx, dword [ebx]
inc edx
call fcn.1000806d
push 6
xor eax, eax
mov dword [ebx + 0x14], esi
pop ecx
lea esi, [ebp - 0x40]
mov dword [ebx + 0x10], eax
mov edi, ebx
mov byte [ebx], al
rep movsd dword es:[edi], dword [esi]
push 0xf
pop esi
mov edx, esi
mov byte [ebp - 0x40], al
cmp edx, esi
jbe 0x1000ee63
mov ecx, dword [ebp - 0x40]
inc edx
call fcn.1000806d
mov eax, ebx
call fcn.1004fe3c
ret
Function at 0x1000fc40
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x1000fc5e
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x47]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x1000fc4b
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret
Function at 0x10014531
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x1001454f
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x47]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x1001453c
pop ebx
mov byte [edx + 0x11], 0
mov eax, edx
ret

Function at 0x10014552
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x10014570
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x47]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x1001455d
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x10014573
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1b], 0
je 0x10014591
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x47]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1a
jb 0x1001457e
pop ebx
mov byte [edx + 0x1b], 0
mov eax, edx
ret

Function at 0x10014594
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x18], 0
je 0x100145b2
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x47]
xor byte [ecx], al
inc ebx
cmp ebx, 0x17
jb 0x1001459f
pop ebx
mov byte [edx + 0x18], 0
mov eax, edx
ret
Function at 0x1001ad96
Capabilities:
Encode data using xor

Disassembly:
push 0x34
mov eax, 0x100517c4
call fcn.1004fe7e
cmp byte [0x1005f498], 0
je 0x1001af5a
movaps xmm0, xmmword [0x10059fc0]
lea ecx, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x1007933
xor ebx, ebx
call fcn.1000ed6c
push eax
call fcn.1002c984
pop ecx
mov ecx, 0x98
mov edx, ebx
mov al, byte [edx + 0x10054e78]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001adf6
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001add9
mov byte [ebp - 0x11], bl
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x1005f49c
lea ecx, [ebp - 0x1c]
call fcn.100336af
movaps xmm0, xmmword [0x1005a470]
add esp, 0xc
movups xmmword [ebp - 0x40], xmm0
mov ecx, ebx
mov byte [ebp - 0x20], 1
movaps xmm0, xmmword [str._fmjj]
movups xmmword [ebp - 0x30], xmm0
lea eax, [ecx + 0x47]
xor byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 0x1f
jb 0x1001ae31
push 5
mov byte [ebp - 0x20], bl
mov edx, ebx
pop ecx
mov al, byte [edx + str._OX_Bjof]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ae63
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001ae46
mov byte [ebp - 0x13], bl
push ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
mov edx, 0x1005f4a0
lea ecx, [ebp - 0x1c]
call fcn.10033d6d
pop ecx
pop ecx
mov ecx, 0xfb
mov edx, ebx
mov al, byte [edx + 0x10054e90]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001aeab
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x1001ae8e
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x1005f4a8
lea ecx, [ebp - 0x1c]
call fcn.100336af
add esp, 0xc
mov ecx, 0xde
mov edx, ebx
mov al, byte [edx + 0x10054e9c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001aef2
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x1001aed5
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x1005f4b0
lea ecx, [ebp - 0x1c]
call fcn.100336af
add esp, 0xc
mov edx, ebx
push 0x50
pop ecx
mov al, byte [edx + 0x10054ea8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001af37
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xa
jl 0x1001af1a
mov byte [ebp - 0x12], bl
sub esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x1005f4a4
lea ecx, [ebp - 0x1c]
call fcn.100336af
add esp, 0xc
call fcn.1004fe3c
ret
Function at 0x1001b51c
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x100518f0
call fcn.1004fe7e
cmp byte [0x100d4958], 0
je 0x1001b6cf
movaps xmm0, xmmword [0x10059df0]
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x2e382e3e
xor ebx, ebx
mov dword [ebp - 0x28], 0x7c383e
mov byte [ebp - 0x24], 1
call fcn.10014594
push eax
call fcn.1002c984
lea ecx, [ebp - 0x20]
mov dword [esp], 0x3ba887d2
call fcn.1001e37d
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x100d495c
mov ecx, eax
call fcn.100336af
movaps xmm0, xmmword [0x1005a470]
add esp, 0xc
movups xmmword [ebp - 0x44], xmm0
mov ecx, ebx
mov byte [ebp - 0x24], 1
movaps xmm0, xmmword [str._fmjj]
movups xmmword [ebp - 0x34], xmm0
lea eax, [ecx + 0x47]
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0x1f
jb 0x1001b5a2
mov byte [ebp - 0x24], bl
mov ecx, 0x8f
mov edx, ebx
mov al, byte [edx + 0x10054fa8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b5d6
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xa
jl 0x1001b5b9
mov byte [ebp - 0x16], bl
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 1
push eax
mov edx, 0x100d4960
lea ecx, [ebp - 0x20]
call fcn.10033d6d
pop ecx
pop ecx
mov ecx, 0xe8
mov edx, ebx
mov al, byte [edx + 0x10054fb4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b61e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001b601
mov byte [ebp - 0x17], bl
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x100d4968
lea ecx, [ebp - 0x20]
call fcn.100336af
add esp, 0xc
mov ecx, 0x81
mov edx, ebx
mov al, byte [edx + 0x10054fc0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b665
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001b648
mov byte [ebp - 0x17], bl
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x100d496c
lea ecx, [ebp - 0x20]
call fcn.100336af
add esp, 0xc
mov ecx, 0xec
mov edx, ebx
mov al, byte [edx + 0x10054fcc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b6ac
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001b68f
mov byte [ebp - 0x15], bl
sub esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x100d4964
lea ecx, [ebp - 0x20]
call fcn.100336af
add esp, 0xc
call fcn.1004fe3c
ret
Function at 0x1001bc1a
Capabilities:
Execute command

Disassembly:
push 0x2c
mov eax, 0x100519c7
call fcn.1004fe7e
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
xor ebx, ebx
push 0x51
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10055040]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001bc52
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1001bc35
mov byte [ebp - 0x15], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
call fcn.1002d1a2
pop ecx
test al, al
je 0x1001bca5
push 0x11
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10055050]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x30], al
and ecx, 0x800000ff
jns 0x1001bc91
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1d
jl 0x1001bc74
lea eax, [ebp - 0x30]
mov byte [ebp - 0x13], bl
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [ebp - 0x38], 0
mov ecx, 0xbb
and dword [ebp - 0x34], 0
mov edx, ebx
mov al, byte [edx + 0x10055070]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001bcd1
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1001bcb4
mov byte [ebp - 0x13], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.1002d1a2
or dword [ebp - 4], 0xffffffff
pop ecx
test al, al
je 0x1001bcfb
call fcn.1000fc64
and dword [ebp - 0x38], 0
mov ecx, 0xf2
and dword [ebp - 0x34], 0
mov edx, ebx
mov al, byte [edx + 0x10055080]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001bd27
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1001bd0a
mov byte [ebp - 0x13], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.1002d1a2
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x20]
pop ecx
mov cl, al
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
test cl, cl
je 0x1001bd5d
call fcn.100145b5
call fcn.1004fe3c
ret
Function at 0x1001dd28
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x50
mov eax, 0x10051ad7
call fcn.1004fe7e
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x1001dde8
lea ecx, [ebp - 0x40]
call fcn.1000ed8d
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.10008237
call fcn.1000ee6b
add esp, 0x18
test al, al
je 0x1001ddf3
mov ecx, esi
call fcn.10008b0f
mov ecx, esi
call fcn.10008ab3
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x1001dd23
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x10008a61
push ebx
push ebx
call esi
push 6
pop ecx
movaps xmm0, xmmword [0x1005a4d0]
lea edi, [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0x6f6061
rep stosd dword es:[edi], eax
push ecx
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x14], 1
movups xmmword [ebp - 0x28], xmm0
call fcn.1000ecee
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.100023b8
pop ecx
pop ecx
call fcn.1000ed0f
lea ecx, [ebp - 0x40]
call fcn.10007a5e
xor eax, eax
inc eax
call fcn.1004fe3c
ret 0xc
movaps xmm0, xmmword [0x10059cd0]
lea ecx, [ebp - 0x28]
push 0x10
push 0x10053593
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x100
call fcn.10014531
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1001de82
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x46], 0
je 0x1001de9f
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x45
jb 0x1001de8d
mov byte [esi + 0x46], 0
pop esi
ret

Function at 0x1001dfb8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x1001dfd5
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x1001dfc3
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x1001dfd7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x1001dff4
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x1001dfe2
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x1001dff6
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1001e013
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x1001e001
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x1001e015
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x1001e032
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x1001e020
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x1001e034
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x1001e051
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x1001e03f
mov byte [esi + 0x15], 0
pop esi
ret
Function at 0x1001e053
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x1001e070
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x1001e05e
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x1001e072
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x1001e08f
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x1001e07d
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x1001e091
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x1001e0ae
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x1001e09c
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x1001e0b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x1001e0cd
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x1001e0bb
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x1001e16f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x1001e18c
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x1001e17a
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x1001e18e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x1001e1ab
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x47]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x1001e199
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x1001e37d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x70
pop edx
mov al, byte [esi + edi - 0x2ba33912]
xor al, dl
inc edx
mov byte [ecx + esi], al
and edx, 0x800000ff
jns 0x1001e3a7
dec edx
or edx, 0xffffff00
inc edx
inc esi
cmp esi, 0xc
jl 0x1001e38a
pop edi
pop esi
mov byte [ecx + 0xc], 0
mov eax, ecx
pop ebp
ret 4