joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10079868
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100dc1ea
call fcn.100d39f0
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x18]
lea edi, [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebp - 0x10], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x24]
lea edi, [ebx + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cl, byte [eax + 0x30]
add eax, 0x34
mov byte [ebx + 0x30], cl
push eax
lea ecx, [ebx + 0x34]
call fcn.10016f42
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebx + 0x3c]
lea eax, [esi + 0x3c]
push eax
call fcn.10079939
add esi, 0x48
lea ecx, [ebx + 0x48]
push esi
mov byte [ebp - 4], 1
call fcn.1007997e
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100808ae
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
mov ecx, dword [ecx + 0x18]
jmp fcn.100d2830

Function at 0x10080bea
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x100dc7ad
call fcn.100d39f0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x40]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
lea eax, [edi + 0x40]
push eax
call fcn.1000257a
and dword [ebp - 4], 0
lea eax, [edi + 0x4c]
push eax
lea ecx, [esi + 0x4c]
call fcn.1000257a
mov eax, dword [edi + 0x58]
lea ecx, [esi + 0x64]
mov dword [esi + 0x58], eax
mov al, byte [edi + 0x5c]
mov byte [esi + 0x5c], al
mov al, byte [edi + 0x5d]
mov byte [esi + 0x5d], al
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
lea eax, [edi + 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.10080f4a
add edi, 0x70
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 2
call fcn.10016f42
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10082bf5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100dc970
call fcn.100d39f0
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.10082dcd
xor edi, edi
cmp eax, edi
jne 0x10082dbc
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x10082c4d
push 1
pop eax
jmp 0x10082c4f
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.1007bb8f
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x10082da1
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x10082d74
cmp word [eax + 0x20], 1
jne 0x10082d74
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.10084423
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.1006dc5d
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.10081e8a
test eax, eax
jne 0x10082d8c
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10082d08
cmp byte [ebx + 0x2c], 0
je 0x10082da7
xor eax, eax
cmp byte [edi + eax], 0
jne 0x10082da7
inc eax
cmp eax, 0x14
jb 0x10082cf8
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x10082d20
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.100843ae
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.1006dc5d
test eax, eax
jne 0x10082d8c
cmp byte [ebp + 0x17], al
je 0x10082d74
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x10082d88
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x10082d88
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x10082d74
cmp dword [eax + 0x24], 1
jne 0x10082d74
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x10082d6c
test al, al
je 0x10082da7
test al, al
je 0x10082d74
test cl, cl
je 0x10082d90
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x10082da1
jmp 0x10082c74
xor cl, cl
jmp 0x10082d4c
mov esi, eax
jmp 0x10082dae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10081494
push 1
pop eax
jmp 0x10082dbc
cmp byte [ebp + 0x17], 0
je 0x10082dac
push 1
pop esi
jmp 0x10082dae
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10081494
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x10083e3c
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100dca08
call fcn.100d39f0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10083fc1
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10083fc1
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
mov byte [esi + 2], 1
call fcn.1006dc5d
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.100041e2
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.10003419
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.1006dc5d
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.1006dc5d
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.10003419
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.1006dc5d
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.1006dc5d
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.10003419
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.1006dc5d
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.1006dc5d
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.10003419
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1008446b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100dca87
call fcn.100d39f0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.100024c7
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10088ef5
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100dd13f
call fcn.100d39f0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001d91
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10088f78
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10091908
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x100dd6ac
call fcn.100d39f0
sub esp, 0x14
mov ax, word [ebp + 8]
push esi
mov esi, ecx
mov word [ebp - 0x10], ax
xor eax, eax
mov word [ebp - 0x14], 2
mov byte [ebp - 0x12], dl
mov word [esi + 2], 0x63
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.10091979
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x30]
push eax
call fcn.1008e504
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x50]
push eax
call fcn.1008e504
push dword [ebp - 0x1c]
call fcn.10003419
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10098540
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.10097bf0
push 0x41
mov ecx, esi
call fcn.10097bf0
push 0x59
mov ecx, esi
call fcn.10097bf0
push 0x26
mov ecx, esi
call fcn.10097bf0
push 0x53
mov ecx, esi
call fcn.10097bf0
push 0x59
mov ecx, esi
call fcn.10097bf0
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x100985d0
test cl, cl
jbe 0x100985cc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x100ff02c]
xor eax, edi
dec ecx
jne 0x100985b6
xor edi, edi
jmp 0x100985ff
cmp bl, cl
jne 0x100985d7
inc edi
jmp 0x100985e2
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x100ff02c]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x1009858e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.10097c30
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.10097d50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x10098810
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x174]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.10098640
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x1a8], bl
je 0x1009888c
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x184]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.100cbca0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x100988c9
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x180
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x1009889e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.100989a0
mov edi, dword [esi + 0x8ce0]
cmp byte [edi + 0x1a8], bl
je 0x10098989
mov ebp, dword [esi + 0x8cd8]
mov eax, dword [edi + 0x1a4]
inc ebp
cmp ebp, eax
jne 0x10098914
xor ebp, ebp
cmp dword [edi + 0x1bc], ebx
je 0x10098965
lea ecx, [edi + 0x148]
call fcn.10008e84
mov ebx, dword [edi + 0x140]
mov ecx, 0xf
sub ecx, ebx
xor edi, edi
shr ecx, 3
add eax, ecx
adc edx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1bc]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [ebp + ebp*8]
shl ecx, 3
mov edx, dword [eax + 0x184]
sub ecx, ebp
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.100cbdc0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x100ae180
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, ecx
xor bl, bl
xor cl, cl
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
mov byte [esi + 4], 0
test edx, edx
mov dword [esi], 0xffffffff
jbe 0x100ae1ad
xor cl, byte [eax + edi]
inc eax
cmp eax, edx
jb 0x100ae1a1
test cl, cl
jne 0x100ae1c7
test edx, edx
je 0x100ae1c7
mov bl, 1
mov ecx, edi
mov byte [esi + 4], bl
call fcn.100ae1d0
test eax, eax
mov dword [esi], eax
jge 0x100ae1c7
mov byte [esi + 4], 0
pop edi
mov al, bl
pop esi
pop ebx
ret 8
Function at 0x100b4980
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x100b49be
mov ecx, ebx
call fcn.100d2830
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.100d2f30
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.100d2fc0
jmp 0x100b49d6
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x100b49df
mov ecx, ebx
call fcn.100d2830
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.100d2f30
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x100b4a0d
lea esi, [ebx + 0x80]
mov ecx, esi
call fcn.100d2830
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.100d2f30
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x100b4a80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc4
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x14
lea edx, [esp + 0x18]
call fcn.100d30a0
lea ecx, [edi + 0x80]
push 0x14
lea edx, [esp + 0x98]
call fcn.100d30a0
mov esi, dword [esp + 0xd8]
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xdc]
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
jbe 0x100b4b5a
mov dword [esp + 0x10], eax
lea eax, [esp + 0x94]
lea edx, [esp + 0x14]
push eax
mov ecx, edi
call fcn.1006dc5d
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
lea ecx, [edi + 0x80]
call fcn.1006dc5d
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor ebp, ecx
mov ecx, dword [esp + 0x60]
xor eax, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x20]
xor ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x24]
xor edx, ecx
dec eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x10], eax
jne 0x100b4aef
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], ebx
mov dword [esi + 4], ebp
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret 8
Function at 0x100b4b90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x100b4bce
mov ecx, ebx
call fcn.100d3250
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.100d2f30
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.100d3870
jmp 0x100b4be6
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x100b4bef
mov ecx, ebx
call fcn.100d3250
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.100d2f30
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x100b4c1d
lea esi, [ebx + 0x80]
mov ecx, esi
call fcn.100d3250
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.100d2f30
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x100b5250
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.100d3250
mov ebp, 0x3e8
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.100d2f30
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.100d2f30
push str.Advapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100b52eb
push str.SystemFunction036
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x100b52e4
lea ecx, [esp + 0x9c]
push 0x20
push ecx
call eax
test al, al
je 0x100b52e4
push 0x20
lea edx, [esp + 0xa0]
lea ecx, [esp + 0x20]
mov ebp, 0x64
call fcn.100d2f30
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x100b530f
push 8
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.100d2f30
call ebx
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.100d2f30
mov edi, 0x64
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.100d3870
lea ecx, [esp + 0x1c]
call fcn.100d3250
push 0x20
mov edx, esi
lea ecx, [esp + 0x20]
call fcn.100d2f30
dec edi
jne 0x100b5329
dec ebp
jne 0x100b52f1
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.100d3870
mov byte [esi + 0x20], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
Function at 0x100b54d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push edi
xor edi, edi
xor eax, eax
lea edx, [ebp + 0x100]
lea esi, [edi + ecx]
xor ebx, ebx
add edx, 4
mov bl, byte [esi + eax]
mov ebx, dword [ebx*4 + 0x101049e0]
xor dword [edx - 4], ebx
inc eax
cmp eax, 4
jb 0x100b54e7
add edi, 4
cmp edi, 0x10
jb 0x100b54dc
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x100b5d00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x124
push esi
add ecx, 0x7c
push 0x20
push ecx
lea ecx, [esp + 0x30]
call fcn.100b4b90
mov eax, dword [esp + 0x12c]
push 4
lea edx, [esp + 8]
lea ecx, [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.100d2f30
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x2c]
call fcn.100b4c60
xor eax, eax
lea ecx, [esp + 8]
mov edx, 8
mov esi, dword [ecx]
add ecx, 4
xor eax, esi
dec edx
jne 0x100b5d49
pop esi
add esp, 0x124
ret 4
Function at 0x100b65e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x140
push ebp
push esi
push edi
mov edi, ecx
lea esi, [esp + 0xc]
mov ebp, 0x10
lea eax, [edi + 2]
xor ecx, ecx
xor edx, edx
mov ch, byte [eax - 2]
mov dl, byte [eax]
mov cl, byte [eax - 1]
add eax, 4
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax - 3]
add esi, 4
shl ecx, 8
or ecx, edx
dec ebp
mov dword [esi - 4], ecx
jne 0x100b65f7
lea eax, [esp + 0x14]
mov ecx, 0x40
mov edx, dword [eax + 0x2c]
mov esi, dword [eax + 0x18]
mov ebp, dword [eax - 8]
xor edx, esi
mov esi, dword [eax]
xor edx, ebp
xor edx, esi
add eax, 4
rol edx, 1
mov dword [eax + 0x34], edx
dec ecx
jne 0x100b6627
mov ecx, 0x10
lea esi, [esp + 0x10c]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
add esp, 0x140
ret

Function at 0x100b6cd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xc0
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x100b6d01
lea ecx, [esp + 0x4c]
call fcn.100d2830
lea edx, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
call fcn.100d2f30
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0xd0]
call fcn.100d2fc0
pop edi
pop esi
pop ebx
add esp, 0xc0
ret 4