joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000535f
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xd], 0
je 0x1000537d
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x46]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x1000536a
pop ebx
mov byte [edx + 0xd], 0
mov eax, edx
ret

Function at 0x1000554e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xa], 0
je 0x1000556c
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x46]
xor byte [ecx], al
inc ebx
cmp ebx, 9
jb 0x10005559
pop ebx
mov byte [edx + 0xa], 0
mov eax, edx
ret

Function at 0x10005679
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1a], 0
je 0x10005697
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x46]
xor byte [ecx], al
inc ebx
cmp ebx, 0x19
jb 0x10005684
pop ebx
mov byte [edx + 0x1a], 0
mov eax, edx
ret

Function at 0x1000569a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x100056b7
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x46]
xor byte [ecx], al
inc edx
cmp edx, 0x19
jb 0x100056a5
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x100056b9
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x100056d6
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x46]
xor byte [ecx], al
inc edx
cmp edx, 9
jb 0x100056c4
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x100056d8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x100056f5
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x46]
xor byte [ecx], al
inc edx
cmp edx, 0xc
jb 0x100056e3
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x10008583
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x10008591
pop esi
mov eax, edx
pop ebp
ret 4

Function at 0x100085aa
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ecx + 0x14], 0xf
mov edi, dword [ecx + 0x10]
jbe 0x100085bd
mov ecx, dword [ecx]
xor esi, esi
mov edx, 0x811c9dc5
test edi, edi
je 0x100085d9
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x100085c8
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x10008ac3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x10008b1c
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp - 4]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10008af4
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x10008b1b
lea eax, [ebp - 4]
mov esi, 0xf8
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10008b1b
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x10008b1f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x10008b59
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10008b5d
cmp edx, esi
jne 0x10008b42
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10008b7d
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10008b81
cmp edx, esi
jne 0x10008b66
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10008ba1
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10008ba5
cmp edx, esi
jne 0x10008b8a
popfd
popal
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b1eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x1005d040]
xor eax, esp
mov dword [esp + 0x164], eax
mov dword [esp + 8], ecx
mov ecx, dword [0x100d3994]
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 0xec]
mov ecx, eax
mov dword [esp + 0xc], eax
call fcn.10009f58
test eax, eax
je 0x1000b3a4
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp + 8], ecx
cmp dword [eax + 0x17c], ecx
jbe 0x1000b3a4
mov eax, dword [eax + 0x174]
mov esi, dword [eax + ecx*4]
mov ecx, esi
mov dword [esp + 0x14], esi
call fcn.10009f58
test eax, eax
je 0x1000b38b
mov ecx, dword [esi + 0x10]
call fcn.10009f58
test eax, eax
je 0x1000b38b
mov esi, dword [esi + 0x10]
lea edi, [esp + 0x28]
add esi, 0x10
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000a32e
test al, al
je 0x1000b38b
cvttss2si eax, dword [esp + 0x20]
sub eax, 0xf
cmp dword [esp + 0x10], 1
mov dword [esp + 0x18], eax
jne 0x1000b38b
mov esi, dword [esp + 0x14]
lea edi, [esp + 0x40]
mov eax, dword [0x100d39e8]
mov esi, dword [esi + 0x10]
add esi, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 0x13c]
lea edi, [esp + 0x34]
add esi, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss xmm1, dword [esp + 0x38]
movss xmm2, dword [esp + 0x34]
subss xmm2, dword [esp + 0x40]
subss xmm1, dword [esp + 0x44]
movss xmm0, dword [esp + 0x3c]
subss xmm0, dword [esp + 0x48]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
cvtsd2ss xmm0, xmm0
push 0x41
pop ecx
xor edx, edx
divss xmm0, dword [0x100588a4]
cvtss2sd xmm0, xmm0
mov al, byte [edx + 0x100537a4]
xor al, cl
inc ecx
mov byte [esp + edx + 0x4c], al
and ecx, 0x800000ff
jns 0x1000b340
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1a
jl 0x1000b323
push ecx
push ecx
movsd qword [esp], xmm0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x74]
mov byte [esp + 0x72], 0
push eax
call fcn.10008834
lea eax, [esp + 0x78]
push eax
cvttss2si eax, dword [esp + 0x30]
push 0x101
push 0xff800080
push dword [esp + 0x34]
push eax
push dword [0x100d39e4]
push 1
call fcn.10009dd3
add esp, 0x2c
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
inc ecx
mov dword [esp + 8], ecx
cmp ecx, dword [eax + 0x17c]
jb 0x1000b242
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
xor ecx, esp
call fcn.1004c315
mov esp, ebp
pop ebp
ret
Function at 0x1000ecfe
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x14], 0
je 0x1000ed1c
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x3c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x1000ed09
pop ebx
mov byte [edx + 0x14], 0
mov eax, edx
ret

Function at 0x1000ed7c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x13], 0
je 0x1000ed9a
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x3c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x1000ed87
pop ebx
mov byte [edx + 0x13], 0
mov eax, edx
ret

Function at 0x1000ed9d
Capabilities:
Get disk information

Disassembly:
push 0x40
mov eax, 0x10050e1c
call fcn.1004fdbe
mov ebx, ecx
mov dword [ebp - 0x44], ebx
and dword [ebp - 4], 0
mov dword [ebp - 0x4c], ebx
and dword [ebp - 0x48], 0
push 0x10052593
call fcn.10007a91
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
mov dword [ebp - 4], ecx
push 0x10053944
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x13]
xor edx, edx
dec ecx
push 0xa
pop esi
div esi
add dl, 0x30
mov byte [ecx], dl
test eax, eax
jne 0x1000eded
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
push 0xf
pop esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x13]
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
cmp ecx, eax
jne 0x1000ee22
mov edx, esi
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x2c], edx
jmp 0x1000ee34
lea eax, [ebp - 0x13]
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.10007ebf
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
cmp ebx, eax
je 0x1000ee66
mov edx, dword [ebx + 0x14]
cmp edx, esi
jbe 0x1000ee4a
mov ecx, dword [ebx]
inc edx
call fcn.1000807d
push 6
xor eax, eax
mov dword [ebx + 0x14], esi
pop ecx
lea esi, [ebp - 0x40]
mov dword [ebx + 0x10], eax
mov edi, ebx
mov byte [ebx], al
rep movsd dword es:[edi], dword [esi]
push 0xf
pop esi
mov edx, esi
mov byte [ebp - 0x40], al
cmp edx, esi
jbe 0x1000ee73
mov ecx, dword [ebp - 0x40]
inc edx
call fcn.1000807d
mov eax, ebx
call fcn.1004fd7c
ret
Function at 0x1000fb6c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x1000fb8a
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x3c]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x1000fb77
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret
Function at 0x1001445a
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x10014478
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x3c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x10014465
pop ebx
mov byte [edx + 0x11], 0
mov eax, edx
ret

Function at 0x1001447b
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x10014499
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x3c]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x10014486
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x1001449c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1b], 0
je 0x100144ba
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x3c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1a
jb 0x100144a7
pop ebx
mov byte [edx + 0x1b], 0
mov eax, edx
ret

Function at 0x100144bd
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x18], 0
je 0x100144db
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x3c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x17
jb 0x100144c8
pop ebx
mov byte [edx + 0x18], 0
mov eax, edx
ret
Function at 0x1001acd1
Capabilities:
Encode data using xor

Disassembly:
push 0x34
mov eax, 0x100516d8
call fcn.1004fdbe
cmp byte [0x1005e498], 0
je 0x1001ae95
movaps xmm0, xmmword [0x100595b0]
lea ecx, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x100f4b0
xor ebx, ebx
call fcn.1000ed7c
push eax
call fcn.1002c8c6
pop ecx
mov ecx, 0x98
mov edx, ebx
mov al, byte [edx + 0x10053e78]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ad31
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001ad14
mov byte [ebp - 0x11], bl
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x1005e49c
lea ecx, [ebp - 0x1c]
call fcn.100335ef
movaps xmm0, xmmword [0x10059780]
add esp, 0xc
movups xmmword [ebp - 0x40], xmm0
mov ecx, ebx
mov byte [ebp - 0x20], 1
movaps xmm0, xmmword [0x10058b00]
movups xmmword [ebp - 0x30], xmm0
lea eax, [ecx - 0x3c]
xor byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 0x1f
jb 0x1001ad6c
push 5
mov byte [ebp - 0x20], bl
mov edx, ebx
pop ecx
mov al, byte [edx + str._OX_Bjof]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ad9e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001ad81
mov byte [ebp - 0x13], bl
push ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
mov edx, 0x1005e4a0
lea ecx, [ebp - 0x1c]
call fcn.10033cad
pop ecx
pop ecx
mov ecx, 0xfb
mov edx, ebx
mov al, byte [edx + 0x10053e90]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ade6
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x1001adc9
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x1005e4a8
lea ecx, [ebp - 0x1c]
call fcn.100335ef
add esp, 0xc
mov ecx, 0xde
mov edx, ebx
mov al, byte [edx + 0x10053e9c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ae2d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x1001ae10
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x1005e4b0
lea ecx, [ebp - 0x1c]
call fcn.100335ef
add esp, 0xc
mov edx, ebx
push 0x50
pop ecx
mov al, byte [edx + 0x10053ea8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ae72
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xa
jl 0x1001ae55
mov byte [ebp - 0x12], bl
sub esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x1005e4a4
lea ecx, [ebp - 0x1c]
call fcn.100335ef
add esp, 0xc
call fcn.1004fd7c
ret
Function at 0x1001b461
Capabilities:
Encode data using xor

Disassembly:
push 0x38
mov eax, 0x10051804
call fcn.1004fdbe
cmp byte [0x100d3958], 0
je 0x1001b614
movaps xmm0, xmmword [0x10059370]
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0xa3b7a3bd
xor ebx, ebx
mov dword [ebp - 0x28], 0xfbbdbd
mov byte [ebp - 0x24], 1
call fcn.100144bd
push eax
call fcn.1002c8c6
lea ecx, [ebp - 0x20]
mov dword [esp], 0x3ba877d2
call fcn.1001e2c2
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x100d395c
mov ecx, eax
call fcn.100335ef
movaps xmm0, xmmword [0x10059780]
add esp, 0xc
movups xmmword [ebp - 0x44], xmm0
mov ecx, ebx
mov byte [ebp - 0x24], 1
movaps xmm0, xmmword [0x10058b00]
movups xmmword [ebp - 0x34], xmm0
lea eax, [ecx - 0x3c]
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0x1f
jb 0x1001b4e7
mov byte [ebp - 0x24], bl
mov ecx, 0x8f
mov edx, ebx
mov al, byte [edx + 0x10053fa8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b51b
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xa
jl 0x1001b4fe
mov byte [ebp - 0x16], bl
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 1
push eax
mov edx, 0x100d3960
lea ecx, [ebp - 0x20]
call fcn.10033cad
pop ecx
pop ecx
mov ecx, 0xe8
mov edx, ebx
mov al, byte [edx + 0x10053fb4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b563
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001b546
mov byte [ebp - 0x17], bl
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x100d3968
lea ecx, [ebp - 0x20]
call fcn.100335ef
add esp, 0xc
mov ecx, 0x81
mov edx, ebx
mov al, byte [edx + 0x10053fc0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b5aa
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001b58d
mov byte [ebp - 0x17], bl
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x100d396c
lea ecx, [ebp - 0x20]
call fcn.100335ef
add esp, 0xc
mov ecx, 0xec
mov edx, ebx
mov al, byte [edx + 0x10053fcc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001b5f1
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001b5d4
mov byte [ebp - 0x15], bl
sub esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x100d3964
lea ecx, [ebp - 0x20]
call fcn.100335ef
add esp, 0xc
call fcn.1004fd7c
ret
Function at 0x1001bb5f
Capabilities:
Execute command

Disassembly:
push 0x2c
mov eax, 0x100518db
call fcn.1004fdbe
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
xor ebx, ebx
push 0x51
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10054040]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1001bb97
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1001bb7a
mov byte [ebp - 0x15], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
call fcn.1002d0e4
pop ecx
test al, al
je 0x1001bbea
push 0x11
pop ecx
mov edx, ebx
mov al, byte [edx + 0x10054050]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x30], al
and ecx, 0x800000ff
jns 0x1001bbd6
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1d
jl 0x1001bbb9
lea eax, [ebp - 0x30]
mov byte [ebp - 0x13], bl
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [ebp - 0x38], 0
mov ecx, 0xbb
and dword [ebp - 0x34], 0
mov edx, ebx
mov al, byte [edx + 0x10054070]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001bc16
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1001bbf9
mov byte [ebp - 0x13], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.1002d0e4
or dword [ebp - 4], 0xffffffff
pop ecx
test al, al
je 0x1001bc40
call fcn.1000fb8d
and dword [ebp - 0x38], 0
mov ecx, 0xf2
and dword [ebp - 0x34], 0
mov edx, ebx
mov al, byte [edx + 0x10054080]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001bc6c
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1001bc4f
mov byte [ebp - 0x13], bl
push ebx
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.1002d0e4
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x20]
pop ecx
mov cl, al
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
test cl, cl
je 0x1001bca2
call fcn.100144de
call fcn.1004fd7c
ret
Function at 0x1001dc6d
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x50
mov eax, 0x100519eb
call fcn.1004fdbe
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x1001dd2d
lea ecx, [ebp - 0x40]
call fcn.1000ed9d
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.10008247
call fcn.1000ee7b
add esp, 0x18
test al, al
je 0x1001dd38
mov ecx, esi
call fcn.10008b1f
mov ecx, esi
call fcn.10008ac3
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x1001dc68
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x10008a71
push ebx
push ebx
call esi
push 6
pop ecx
movaps xmm0, xmmword [0x10059830]
lea edi, [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0xe0ede2
rep stosd dword es:[edi], eax
push ecx
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x14], 1
movups xmmword [ebp - 0x28], xmm0
call fcn.1000ecfe
lea edx, [ebp - 0x5c]
mov ecx, eax
call fcn.100023c8
pop ecx
pop ecx
call fcn.1000ed1f
lea ecx, [ebp - 0x40]
call fcn.10007a6e
xor eax, eax
inc eax
call fcn.1004fd7c
ret 0xc
movaps xmm0, xmmword [0x10059140]
lea ecx, [ebp - 0x28]
push 0x10
push 0x10052593
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x100
call fcn.1001445a
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1001ddc7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x46], 0
je 0x1001dde4
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x45
jb 0x1001ddd2
mov byte [esi + 0x46], 0
pop esi
ret

Function at 0x1001defd
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x1001df1a
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x1001df08
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x1001df1c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x1001df39
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x1001df27
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x1001df3b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1001df58
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x1001df46
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x1001df5a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x1001df77
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x1001df65
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x1001df79
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x1001df96
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x1001df84
mov byte [esi + 0x15], 0
pop esi
ret
Function at 0x1001df98
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x1001dfb5
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x1001dfa3
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x1001dfb7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x1001dfd4
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x1001dfc2
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x1001dfd6
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x1001dff3
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x1001dfe1
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x1001dff5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x1001e012
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x1001e000
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x1001e0b4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x1001e0d1
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x1001e0bf
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x1001e0d3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x1001e0f0
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x3c]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x1001e0de
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x1001e2c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x70
pop edx
mov al, byte [esi + edi - 0x2ba33912]
xor al, dl
inc edx
mov byte [ecx + esi], al
and edx, 0x800000ff
jns 0x1001e2ec
dec edx
or edx, 0xffffff00
inc edx
inc esi
cmp esi, 0xc
jl 0x1001e2cf
pop edi
pop esi
mov byte [ecx + 0xc], 0
mov eax, ecx
pop ebp
ret 4