joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10087de0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [0x1010f1bc]
sub esp, 8
cmp byte [0x1012d7aa], 0
push esi
mov esi, dword [0x1010f060]
push edi
mov edi, 0xfffe
je 0x10087e60
test byte [edx + 0x1e], 1
je 0x10087e60
mov ecx, dword [0x1012de78]
cmp ecx, 4
je 0x10087e66
cmp ecx, 0x19
je 0x10087e66
cmp ecx, 6
je 0x10087e66
cmp ecx, 9
je 0x10087e66
cmp ecx, 0x1d
je 0x10087e66
cmp dword [0x1012de74], 1
jge 0x10087e66
and word [edx + 0x1e], di
cmp dword [esi + 0x4170], 0
je 0x10087e47
and word [0x1010d546], di
mov eax, 0x2000
or word [edx + 0x1e], ax
cmp dword [esi + 0x4170], 0
je 0x10087e60
or word [0x1010d546], ax
mov ecx, dword [0x1012de78]
cmp byte [0x1012d7ab], 0
je case.0x10087e87.2
test byte [0x10133432], 1
je case.0x10087e87.2
lea eax, [ecx - 1]
cmp eax, 0x19
ja case.0x10087e87.2
movzx eax, byte [eax + 0x10087fe8]
jmp dword [eax*4 + 0x10087fe0]
cmp dword [0x1012de7c], 0
jne case.0x10087e87.2
movss xmm2, dword [0x1012dea0]
xorps xmm0, xmm0
movss xmm1, dword [0x1012dea8]
cmp ecx, 0x1d
jne 0x10087eb9
comiss xmm0, xmm1
jbe 0x10087eb9
comiss xmm0, xmm2
ja 0x10087ed5
comiss xmm0, xmm2
jb case.0x10087e87.2
comiss xmm0, dword [0x1012dea4]
jb case.0x10087e87.2
comiss xmm0, xmm1
jae 0x10087ed5
comiss xmm1, dword [0x100f9124]
jbe case.0x10087e87.2
and word [edx + 0x1e], di
cmp dword [esi + 0x4170], 0
je case.0x10087e87.2
and word [0x1010d546], di
cmp byte [0x1012d7f4], 0
movss xmm0, dword [0x1012d7e4]
jne 0x10087f14
cmp dword [0x1012d7f0], 0
jne 0x10087fd5
comiss xmm0, dword [0x100f8ef4]
jbe 0x10087fd5
mov eax, dword [0x1012d7e0]
test eax, eax
jne 0x10087faa
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x1010da70]
ucomisd xmm0, xmm1
movsd qword [esp + 8], xmm1
lahf
test ah, 0x44
jnp 0x10087fd5
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10128c20
push 0x40
push 8
push dword [0x1010f354]
call edi
movsd xmm0, qword [esp + 8]
mulsd xmm0, qword [0x100f90d0]
mov eax, dword [0x1010f354]
push 0x10128c20
movsd qword [eax], xmm0
push dword [0x10128c20]
mov esi, dword [0x1010f354]
push 8
push esi
call edi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [esp + 8]
movsd qword [0x1010da70], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
jne 0x10087fd5
mov eax, dword [0x1010f368]
cvtps2pd xmm0, xmm0
test eax, eax
je 0x10087fd5
comisd xmm0, xmmword [0x100f8e20]
jbe 0x10087fd5
divsd xmm0, qword [0x100f90d0]
addsd xmm0, qword [eax]
movsd qword [eax], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10087e8e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [0x1010f1bc]
sub esp, 8
cmp byte [0x1012d7aa], 0
push esi
mov esi, dword [0x1010f060]
push edi
mov edi, 0xfffe
je 0x10087e60
test byte [edx + 0x1e], 1
je 0x10087e60
mov ecx, dword [0x1012de78]
cmp ecx, 4
je 0x10087e66
cmp ecx, 0x19
je 0x10087e66
cmp ecx, 6
je 0x10087e66
cmp ecx, 9
je 0x10087e66
cmp ecx, 0x1d
je 0x10087e66
cmp dword [0x1012de74], 1
jge 0x10087e66
and word [edx + 0x1e], di
cmp dword [esi + 0x4170], 0
je 0x10087e47
and word [0x1010d546], di
mov eax, 0x2000
or word [edx + 0x1e], ax
cmp dword [esi + 0x4170], 0
je 0x10087e60
or word [0x1010d546], ax
mov ecx, dword [0x1012de78]
cmp byte [0x1012d7ab], 0
je case.0x10087e87.2
test byte [0x10133432], 1
je case.0x10087e87.2
lea eax, [ecx - 1]
cmp eax, 0x19
ja case.0x10087e87.2
movzx eax, byte [eax + 0x10087fe8]
jmp dword [eax*4 + 0x10087fe0]
cmp dword [0x1012de7c], 0
jne case.0x10087e87.2
movss xmm2, dword [0x1012dea0]
xorps xmm0, xmm0
movss xmm1, dword [0x1012dea8]
cmp ecx, 0x1d
jne 0x10087eb9
comiss xmm0, xmm1
jbe 0x10087eb9
comiss xmm0, xmm2
ja 0x10087ed5
comiss xmm0, xmm2
jb case.0x10087e87.2
comiss xmm0, dword [0x1012dea4]
jb case.0x10087e87.2
comiss xmm0, xmm1
jae 0x10087ed5
comiss xmm1, dword [0x100f9124]
jbe case.0x10087e87.2
and word [edx + 0x1e], di
cmp dword [esi + 0x4170], 0
je case.0x10087e87.2
and word [0x1010d546], di
cmp byte [0x1012d7f4], 0
movss xmm0, dword [0x1012d7e4]
jne 0x10087f14
cmp dword [0x1012d7f0], 0
jne 0x10087fd5
comiss xmm0, dword [0x100f8ef4]
jbe 0x10087fd5
mov eax, dword [0x1012d7e0]
test eax, eax
jne 0x10087faa
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x1010da70]
ucomisd xmm0, xmm1
movsd qword [esp + 8], xmm1
lahf
test ah, 0x44
jnp 0x10087fd5
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10128c20
push 0x40
push 8
push dword [0x1010f354]
call edi
movsd xmm0, qword [esp + 8]
mulsd xmm0, qword [0x100f90d0]
mov eax, dword [0x1010f354]
push 0x10128c20
movsd qword [eax], xmm0
push dword [0x10128c20]
mov esi, dword [0x1010f354]
push 8
push esi
call edi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [esp + 8]
movsd qword [0x1010da70], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
jne 0x10087fd5
mov eax, dword [0x1010f368]
cvtps2pd xmm0, xmm0
test eax, eax
je 0x10087fd5
comisd xmm0, xmmword [0x100f8e20]
jbe 0x10087fd5
divsd xmm0, qword [0x100f90d0]
addsd xmm0, qword [eax]
movsd qword [eax], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10093930
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1010d024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0x40
push 2
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [edi]
push 0
push dword [ebp - 8]
mov word [ebx], ax
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100bceb5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100adbd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movsd xmm1, qword [0x1010da70]
ucomisd xmm1, xmm0
movsd qword [ebp - 8], xmm0
lahf
test ah, 0x44
jnp 0x100adc51
push esi
push 0x10128c20
push 0x40
push 8
push dword [0x1010f354]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [ebp - 8]
mulsd xmm0, qword [0x100f90d0]
mov eax, dword [0x1010f354]
push 0x10128c20
movsd qword [eax], xmm0
push dword [0x10128c20]
mov esi, dword [0x1010f354]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 8]
movsd qword [0x1010da70], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100ade10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1010d024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
and eax, 0xfffffffc
mov ebx, edx
cdq
and edx, 3
push esi
lea esi, [edx + eax]
sar esi, 2
mov dword [ebp - 0xc], esi
test esi, esi
jle 0x100adeb9
mov eax, dword [ebp + 0xc]
push edi
not eax
lea edi, [ebp - 8]
mov dword [ebp - 0x10], eax
neg edi
nop dword [eax]
mov edx, dword [ebx]
xor edx, eax
mov eax, edx
sar eax, 8
movzx ecx, al
movzx eax, dl
shl eax, 8
add ecx, eax
mov eax, edx
sar eax, 0x10
shl ecx, 8
movzx eax, al
add ecx, eax
sar edx, 0x18
shl ecx, 8
movzx eax, dl
add ecx, eax
mov dword [ebp - 8], ecx
xor ecx, ecx
lea esi, [ebp - 8]
mov dl, cl
add esi, ecx
shl dl, cl
lea eax, [edi + esi]
and eax, 0xf
or dl, byte [eax + 0x100dd0a0]
or dl, cl
inc ecx
or dl, 0xa5
xor byte [esi], dl
cmp ecx, 4
jl 0x100ade81
mov eax, dword [ebp - 8]
inc edi
xor eax, dword [ebp + 0xc]
mov dword [ebx], eax
add ebx, 4
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
jne 0x100ade50
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100bceb5
mov esp, ebp
pop ebp
ret
Function at 0x100afc20
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x10128c20
push 0x40
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
ret

Function at 0x100afc80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push 0x10128c20
push 0x40
mov ebx, ecx
mov esi, edx
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
mov dword [ebx], eax
mov al, byte [esi + 4]
push 0x10128c20
mov byte [ebx + 4], al
push dword [0x10128c20]
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop esi
pop ebx
ret

Function at 0x100b0d30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1ca3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1010d024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea edx, [esi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], ecx
mov byte [esi + 0x64], 0
mov dword [esi + 0x68], eax
test byte [edi + 8], 8
je 0x100b0e2f
test cl, 0x10
jne 0x100b0e2f
mov al, 1
jmp 0x100b0e31
xor al, al
mov byte [esi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov edi, dword [edi + 0x18]
sar ecx, 3
cmp edi, ecx
jae 0x100b0e55
lea ecx, [edi*8]
mov dword [edx + 4], ecx
jmp 0x100b0e8c
jbe 0x100b0e8c
mov eax, dword [edx + 8]
sar eax, 3
cmp edi, eax
jbe 0x100b0e6c
push ecx
push edi
mov ecx, edx
call fcn.100b2cc0
jmp 0x100b0e8c
sub edi, ecx
je 0x100b0e89
lea eax, [edi*8]
push eax
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [ebx + edi*8]
lea edx, [esi + 0x40]
mov dword [edx + 4], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100b73f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x100b7421
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100b7410
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x100bb7dc
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1010d024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x100bb8e7
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100bb8e0
inc edi
cmp dword [ebp - 0x20], 0x10
jb 0x100bb8a4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100bb8a4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100bb8a4
mov edx, dword [esi]
test edx, edx
jne 0x100bb86d
push 0x200
push edx
push dword [0x10128c28]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100bb8c9
lea ebx, [esi + 8]
jmp 0x100bb897
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x100bb897
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x10128c28]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100bb8f8
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100bb825
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100bb8e0
xor edi, edi
cmp dword [esi], edi
je 0x100bb8e0
push dword [esi]
push edi
push dword [0x10128c28]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bceb5
leave
ret
mov ebx, dword [ebp - 0x24]
jmp 0x100bb8c9

Function at 0x100bb8fd
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.100bb7dc
test eax, eax
jne 0x100bb922
push 9
pop esi
jmp 0x100bb982
cmp dword [edi], esi
je 0x100bb982
push ebx
mov ebx, esi
cmp dword [edi + 8], esi
jbe 0x100bb981
mov eax, dword [edi]
push dword [eax + ebx*4]
push esi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
test eax, eax
je 0x100bb976
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x100bb968
push dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], 1
call fcn.100bb689
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], esi
jne 0x100bb97b
mov ecx, dword [edi]
mov dword [ecx + ebx*4], esi
inc ebx
cmp ebx, dword [edi + 8]
jb 0x100bb92e
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x100bb988
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x100bb9da
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100bb9c9
push ebx
mov eax, dword [esi]
cmp dword [eax + edi*4], 0
je 0x100bb9c2
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100bb9c2
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x100bb999
pop ebx
push dword [esi]
push 0
push dword [0x10128c28]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x100bb9dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
imul esi, ecx, 0x2c
push edi
mov edi, edx
mov dword [ebp - 0x10], edi
add esi, dword [0x1018c9c0]
mov dword [ebp - 8], esi
mov al, byte [esi + 0x14]
mov ebx, dword [esi]
and al, 1
je 0x100bba02
sub ebx, 5
movzx eax, al
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100bba29
push 0xa
pop eax
jmp 0x100bbaa9
test edi, edi
je 0x100bba4a
mov byte [ebx], 0xe9
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
test byte [esi + 0x14], 1
je 0x100bba69
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x100bba69
test byte [esi + 0x14], 1
je 0x100bba5e
lea esi, [esi + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
jmp 0x100bba69
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov al, byte [esi + 0x10]
mov byte [ebx + 4], al
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [ebp - 0x10]
mov cl, byte [esi + 0x14]
and dl, 1
mov al, dl
and cl, 0xfd
add al, al
shl dl, 2
or cl, al
and cl, 0xfb
or cl, dl
xor eax, eax
mov byte [esi + 0x14], cl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100bbfa0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x1018c9b0]
push esi
xor esi, esi
jmp 0x100bbfb2
cmp dword [edx + 4], esi
jne 0x100bc006
mov edx, dword [edx]
test edx, edx
jne 0x100bbfab
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x100bc002
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x100bbfd9
mov eax, dword [0x1018c9b0]
mov dword [edx], eax
mov dword [0x1018c9b0], edx
pop edi
test edx, edx
jne 0x100bc006
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
Function at 0x100bc6cb
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100bc6a7
pop esi
leave
ret 8
Function at 0x403420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd48
push ebx
push ebp
mov ebp, dword [esp + 0xd54]
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x28], ebx
call fcn.00444ce0
push 0x450
mov dword [esp + 0x38], eax
lea eax, [esp + 0x7c]
push ebx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call fcn.004bd240
lea ecx, [esp + 0x60]
add esp, 0xc
push ecx
mov dword [0x5d5d18], ebx
lea edi, [ebp + 0xec8]
call fcn.004565a0
add esp, 4
push 0xa
push edi
call fcn.00457f70
lea edx, [esp + 0x5c]
push 0xa
push edx
mov esi, eax
call fcn.00456980
lea eax, [esi - 1]
push eax
lea ecx, [esp + 0x68]
push ecx
mov edx, ecx
push edx
call fcn.00459240
add esp, 0x1c
lea eax, [esp + 0x54]
push edi
push eax
call fcn.00456920
xor ecx, ecx
test eax, eax
setg cl
lea edx, [esp + 0x5c]
push edx
sub esi, ecx
call fcn.00456900
add esp, 0xc
cmp esi, dword [ebp + 0x2350]
jae 0x4034f6
lea esi, [ebp + 0xa28]
push edi
push esi
call fcn.00456880
push ebp
call fcn.0041c3b0
add esp, 0xc
push esi
push edi
call fcn.00456880
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd48
ret
mov eax, dword [0x5d6510]
push eax
push edi
call fcn.00456e30
add esp, 8
test eax, eax
je 0x40356b
mov eax, edi
mov esi, ebp
call fcn.004464e0
cmp dword [0x5d5f9c], ebx
jl 0x40352e
push edi
call fcn.0044cfb0
push eax
push str.PRP_d___Zd_n
call fcn.00456570
add esp, 0xc
mov esi, 0x5d64d0
call fcn.0044ca50
push eax
call fcn.0044cfb0
push eax
push str.PRP_d___s_n
push 0x51a9e0
add ebp, 0x24
push ebp
call fcn.004439f0
add esp, 0x14
push 1
push edi
call fcn.00456980
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd48
ret
mov ecx, dword [edi + 4]
xor eax, eax
cmp ecx, ebx
setge al
cmp ecx, ebx
jle 0x403586
push ecx
mov ecx, dword [edi + 8]
push ecx
call fcn.00457960
add esp, 8
push edi
cmp eax, ebx
je 0x4035ee
push edi
call fcn.00457ad0
add esp, 8
mov eax, edi
mov esi, ebp
call fcn.004464e0
mov esi, 0x5d64d0
lea ebx, [ebp + 0x24]
call fcn.0044ca50
push eax
call fcn.0044cfb0
push eax
push str.prp_d___s_n
push 0x51a9e0
push ebx
call fcn.004439f0
add esp, 0x14
mov eax, edi
mov esi, ebp
call fcn.004464e0
mov esi, 0x5d64d0
call fcn.0044ca50
push eax
call fcn.0044cfb0
push eax
push str.prp_d___s_n
push 0x51a9e0
push ebx
jmp 0x40354d
call fcn.004575e0
add esp, 4
test eax, eax
je 0x4037b9
cmp dword [0x5d5f9c], ebx
jle 0x403613
push str.input_is_a_perfect_power_n
call fcn.004b7f6d
add esp, 4
push edi
push ebp
call fcn.0044b6b0
lea esi, [ebp + 0x24]
push 0x51a9e0
push esi
call fcn.004b80e6
add esp, 0x10
mov dword [esp + 0x1c], eax
invalid
Function at 0x414f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.004bdf20
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
lea edi, [ebp - 0x4008]
mov dword [ebp - 4], 8
xor ecx, ecx
xor edx, edx
xor esi, esi
test cl, 1
je 0x414fb0
mov edx, dword [eax]
mov esi, dword [eax + 4]
test cl, 2
je 0x414fbb
xor edx, dword [eax + 8]
xor esi, dword [eax + 0xc]
test cl, 4
je 0x414fc6
xor edx, dword [eax + 0x10]
xor esi, dword [eax + 0x14]
test cl, 8
je 0x414fd1
xor edx, dword [eax + 0x18]
xor esi, dword [eax + 0x1c]
test cl, 0x10
je 0x414fdc
xor edx, dword [eax + 0x20]
xor esi, dword [eax + 0x24]
test cl, 0x20
je 0x414fe7
xor edx, dword [eax + 0x28]
xor esi, dword [eax + 0x2c]
test cl, 0x40
je 0x414ff2
xor edx, dword [eax + 0x30]
xor esi, dword [eax + 0x34]
test cl, cl
jns 0x414ffc
xor edx, dword [eax + 0x38]
xor esi, dword [eax + 0x3c]
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], esi
inc ecx
cmp ecx, 0x100
jb 0x414fa2
add eax, 0x40
add edi, 0x800
dec dword [ebp - 4]
jne 0x414fa0
mov dword [ebp - 4], 0
push ebx
mov edi, dword [ebp + 0x10]
lea ebx, [ebp - 0x4008]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 4]
jmp 0x415040
movq mm0, qword [edi + ecx*8]
mov eax, dword [esi + ecx*8]
inc ecx
movzx edx, al
movq mm1, qword [ebx + edx*8]
movzx edx, ah
pxor mm1, qword [ebx + edx*8 + 0x800]
shr eax, 0x10
movzx edx, al
pxor mm1, qword [ebx + edx*8 + 0x1000]
movzx edx, ah
pxor mm1, qword [ebx + edx*8 + 0x1800]
mov eax, dword [esi + ecx*8 - 4]
movzx edx, al
pxor mm1, qword [ebx + edx*8 + 0x2000]
movzx edx, ah
shr eax, 0x10
cmp ecx, dword [ebp + 0x14]
pxor mm1, qword [ebx + edx*8 + 0x2800]
movzx edx, al
pxor mm1, qword [ebx + edx*8 + 0x3000]
movzx edx, ah
pxor mm1, qword [ebx + edx*8 + 0x3800]
pxor mm1, mm0
movq qword [edi + ecx*8 - 8], mm1
jne 0x415040
pop ebx
emms
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret