joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019a70
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
sub esp, 0x30
mov eax, dword [0x1008a884]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x24]
push eax
push ebx
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x10019beb
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10019beb
mov eax, dword [eax + 0xc]
push ebp
push esi
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ebp, eax
mov dword [esp + 0x10], 0
mov esi, ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x24], 0xf
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10019ad2
sub esi, ecx
push edi
cmp esi, 0xf
ja 0x10019b03
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x28], esi
push ebp
push eax
call fcn.100496c0
mov byte [esp + esi + 0x20], 0
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x20]
jmp 0x10019b82
cmp esi, 0x7fffffff
ja 0x10019bfd
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x10019b33
mov eax, connect
mov edi, closesocket
push eax
call fcn.10001820
add esp, 4
mov ebp, eax
jmp 0x10019b67
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x10019b54
push eax
call fcn.10001820
add esp, 4
mov ebp, eax
jmp 0x10019b67
test eax, eax
je 0x10019b65
push eax
call fcn.10046a4f
add esp, 4
mov ebp, eax
jmp 0x10019b67
xor ebp, ebp
push esi
push dword [esp + 0x14]
mov dword [esp + 0x2c], esi
push ebp
mov dword [esp + 0x34], edi
call fcn.100496c0
mov byte [esi + ebp], 0
mov dword [esp + 0x20], ebp
add esp, 0xc
mov dword [ebx], 0
cmp edi, 0x10
lea ecx, [esp + 0x14]
cmovae ecx, ebp
sub ebx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx - 1], al
test al, al
jne 0x10019b97
lea esi, [esp + 0x14]
cmp edi, 0x10
jb 0x10019bd6
inc edi
mov esi, ebp
mov ecx, esi
cmp edi, 0x1000
jb 0x10019bcc
mov ecx, dword [ebp - 4]
mov eax, esi
sub eax, ecx
add edi, 0x23
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10019c02
push edi
push ecx
call fcn.10046a7f
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10046da7
add esp, 0x30
ret
mov ecx, dword [esp + 0x30]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10046da7
add esp, 0x30
ret
call fcn.10002410
call fcn.1004b97f
int3

Function at 0x10019de0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008a884]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10005610
push 0
push str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890__
lea ecx, [ebp - 0x1c]
call fcn.1001a7e0
cmp eax, 0xffffffff
je 0x10019e2f
push 0x10
push 0x1006a1b4
push str.Window_title_is_invalid__alphanumerical_characters__space_and______are_allowed_only
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x1c]
call fcn.10006b80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10046da7
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c4e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
mov ebx, dword [esp + 0x10]
sub eax, edi
cmp eax, ebx
jae 0x1001c510
push ebp
mov ebp, dword [esp + 0x18]
nop
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, ebx
jb 0x1001c500
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x1001c540
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x1001c58b
mov ebx, dword [edi + 0x3c]
cmp dword [ebx + edi], 0x4550
jne 0x1001c58b
mov ebx, dword [ebx + edi + 0x78]
xor esi, esi
add ebx, edi
mov ebp, dword [ebx + 0x20]
add ebp, edi
cmp dword [ebx + 0x14], esi
jbe 0x1001c58b
mov eax, dword [ebp + esi*4]
push dword [esp + 0x18]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001c592
inc esi
cmp esi, dword [ebx + 0x14]
jb 0x1001c570
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, si
cmp ax, 0xffff
je 0x1001c58b
movsx ecx, ax
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movsx ecx, word [eax + edi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10024920
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x1009ebe0], 0
jne 0x1002492e
call fcn.1003ff90
cmp byte [0x1009ebea], 0
je 0x1002494c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.10040390
add esp, 0x10
ret
jmp fcn.10020120
Function at 0x10029710
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0x18], ecx
push edi
test eax, eax
je 0x10029726
mov ebp, dword [eax]
xor ebx, ebx
bswap ebp
add eax, 4
je 0x10029731
mov ebx, dword [eax]
xor edi, edi
bswap ebx
add eax, 4
je 0x1002973c
mov edi, dword [eax]
mov eax, dword [ecx + 8]
mov edx, 0xb0b
mov dword [esp + 0x24], edx
mov dword [esp + 0xc], eax
push esi
bswap edi
test eax, eax
je 0x1002982a
mov eax, dword [ecx + 0x24]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
nop
mov eax, edx
xor ebx, esi
shl eax, 0x10
xor eax, ecx
xor ebp, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov esi, ebp
xor edi, eax
shr esi, 0x10
mov eax, edi
xor esi, edi
xor eax, ebx
shr esi, 8
xor eax, ebp
mov edx, ebx
mov ecx, eax
shl edx, 0x10
rol eax, 8
xor edx, edi
rol ecx, 0x10
xor ecx, eax
shl edx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor edx, eax
mov eax, edx
shl edx, 0x10
xor eax, ecx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, ecx
xor edx, eax
xor esi, ebp
xor edx, ecx
ror esi, 0xa
xor edx, edi
mov edi, ebx
rol edx, 1
not edi
mov ebp, edx
or edi, esi
not ebp
xor edi, edx
or ebp, ebx
ror edi, 0xa
xor ebp, esi
not esi
or esi, edx
rol ebp, 1
mov edx, dword [esp + 0x28]
xor ebx, esi
mov esi, dword [esp + 0x1c]
add edx, edx
mov ecx, edx
mov eax, edx
xor edx, 0x11011
and eax, 0x10000
cmove edx, ecx
sub dword [esp + 0x10], 1
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
jne 0x10029770
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x24]
mov eax, edx
shl eax, 0x10
xor eax, dword [ecx]
xor ebx, dword [ecx + 4]
xor ebp, eax
mov eax, dword [ecx + 8]
mov esi, ebp
xor eax, edx
shr esi, 0x10
xor edi, eax
mov ecx, ebx
mov eax, edi
shl ecx, 0x10
xor eax, ebx
xor esi, edi
xor eax, ebp
shr esi, 8
mov edx, eax
xor ecx, edi
rol eax, 8
rol edx, 0x10
xor edx, eax
shl ecx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor ecx, eax
mov eax, ecx
shl ecx, 0x10
xor eax, edx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, edx
xor ecx, eax
xor esi, ebp
xor ecx, edx
xor edi, ecx
mov ecx, dword [esp + 0x2c]
bswap esi
test ecx, ecx
je 0x100298a0
xor esi, dword [ecx]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100298aa
mov dword [eax], esi
lea edx, [eax + 4]
test ecx, ecx
lea eax, [ecx + 4]
cmove eax, ecx
bswap ebx
pop esi
test eax, eax
je 0x100298be
xor ebx, dword [eax]
test edx, edx
je 0x100298c4
mov dword [edx], ebx
add edx, 4
lea ecx, [eax + 4]
test eax, eax
bswap edi
cmove ecx, eax
test ecx, ecx
je 0x100298d7
xor edi, dword [ecx]
test edx, edx
je 0x100298dd
mov dword [edx], edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x1002a710
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push esi
xor esi, esi
push edi
mov edi, dword [ecx + 0x34]
test eax, eax
je 0x1002a729
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x1002a734
mov edx, dword [eax]
bswap edx
test edi, edi
je 0x1002a79f
mov eax, dword [ecx + 0x2c]
push ebp
mov ecx, dword [eax + 0xc]
mov ebp, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
nop dword [eax]
mov ecx, esi
mov eax, esi
shr ecx, 5
shl eax, 4
add ecx, ebx
add eax, ebp
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
sub edx, ecx
mov ecx, edx
mov eax, edx
shr ecx, 5
add ecx, dword [esp + 0x10]
shl eax, 4
add eax, dword [esp + 0x14]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub esi, ecx
add edi, 0x61c88647
jne 0x1002a760
mov ebx, dword [esp + 0x20]
pop ebp
bswap esi
test ebx, ebx
je 0x1002a7a7
xor esi, dword [ebx]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1002a7b1
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x1002a7c7
xor edx, dword [eax]
test ecx, ecx
je 0x1002a7cd
mov dword [ecx], edx
add esp, 8
ret 0xc

Function at 0x1002a7e0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
xor edi, edi
xor esi, esi
test eax, eax
je 0x1002a7f8
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x1002a803
mov edx, dword [eax]
push ebp
mov ebp, dword [ecx + 0x34]
bswap edx
test ebp, ebp
je 0x1002a872
mov eax, dword [ecx + 0x2c]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
nop
mov ecx, edx
mov eax, edx
shr ecx, 5
sub edi, 0x61c88647
shl eax, 4
add ecx, ebx
add eax, dword [esp + 0x10]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add esi, ecx
mov ecx, esi
mov eax, esi
shr ecx, 5
add ecx, dword [esp + 0x14]
shl eax, 4
add eax, dword [esp + 0x18]
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
add edx, ecx
cmp edi, ebp
jne 0x1002a830
mov ebx, dword [esp + 0x24]
bswap esi
pop ebp
test ebx, ebx
je 0x1002a87b
xor esi, dword [ebx]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1002a885
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x1002a89b
xor edx, dword [eax]
test ecx, ecx
je 0x1002a8a1
mov dword [ecx], edx
add esp, 0xc
ret 0xc
Function at 0x1002a950
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0x18]
lea eax, [eax*4]
add eax, ebp
test ecx, ecx
je 0x1002a975
mov ebx, dword [ecx]
xor edx, edx
add ecx, 4
je 0x1002a97e
mov edx, dword [ecx]
mov edi, dword [edi + 8]
test edi, edi
je 0x1002a9a6
sub edx, dword [eax - 4]
lea eax, [eax - 8]
movzx ecx, bl
and ecx, 0x1f
ror edx, cl
xor edx, ebx
sub ebx, dword [eax]
movzx ecx, dl
and ecx, 0x1f
ror ebx, cl
xor ebx, edx
sub edi, 1
jne 0x1002a985
sub edx, dword [ebp + 4]
sub ebx, dword [ebp]
test esi, esi
je 0x1002a9b2
xor ebx, dword [esi]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1002a9bc
mov dword [eax], ebx
test esi, esi
lea ecx, [eax + 4]
lea eax, [esi + 4]
pop edi
cmove eax, esi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x1002a9d3
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x1002a9d9
mov dword [ecx], edx
ret 0xc

Function at 0x1002a9e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x18]
test eax, eax
je 0x1002a9f9
mov edx, dword [eax]
xor ecx, ecx
add eax, 4
je 0x1002aa02
mov ecx, dword [eax]
mov ebx, dword [esi]
mov eax, dword [edi + 8]
add ebx, edx
mov edx, dword [esi + 4]
xor edi, edi
add edx, ecx
test eax, eax
je 0x1002aa3b
mov ebp, eax
movzx ecx, dl
xor ebx, edx
and ecx, 0x1f
rol ebx, cl
add ebx, dword [esi + edi*8 + 8]
movzx ecx, bl
xor edx, ebx
and ecx, 0x1f
rol edx, cl
add edx, dword [esi + edi*8 + 0xc]
inc edi
cmp edi, ebp
jb 0x1002aa16
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x1002aa42
xor ebx, dword [ebp]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1002aa4c
mov dword [eax], ebx
test ebp, ebp
lea ecx, [eax + 4]
pop edi
lea eax, [ebp + 4]
pop esi
cmove eax, ebp
pop ebp
pop ebx
test eax, eax
je 0x1002aa63
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x1002aa69
mov dword [ecx], edx
ret 0xc
Function at 0x1002acf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
push ebp
push esi
xor esi, esi
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x14], ecx
push edi
lea eax, [ecx + eax*4]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1002ad12
mov esi, dword [ecx]
lea edx, [ecx + 4]
xor ecx, ecx
mov dword [esp + 0x20], ecx
test edx, edx
je 0x1002ad25
mov ecx, dword [edx]
mov dword [esp + 0x20], ecx
xor edi, edi
add edx, 4
je 0x1002ad2e
mov edi, dword [edx]
xor ebp, ebp
add edx, 4
je 0x1002ad37
mov ebp, dword [edx]
mov edx, dword [ebx + 8]
sub eax, 8
mov dword [esp + 0x10], edx
sub edi, dword [eax + 4]
sub esi, dword [eax]
test edx, edx
je 0x1002ada7
nop word [eax + eax]
sub eax, 8
mov dword [esp + 0x14], eax
mov eax, esi
mov esi, ebp
mov ebp, edi
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], ecx
lea ebx, [eax*2 + 1]
imul ebx, eax
lea edx, [ebp*2 + 1]
mov eax, dword [esp + 0x14]
imul edx, ebp
sub edi, dword [eax + 4]
sub esi, dword [eax]
rol ebx, 5
movzx ecx, bl
and ecx, 0x1f
rol edx, 5
ror edi, cl
movzx ecx, dl
xor edi, edx
and ecx, 0x1f
ror esi, cl
mov ecx, dword [esp + 0x20]
xor esi, ebx
sub dword [esp + 0x10], 1
jne 0x1002ad50
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub ebp, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1002adc4
mov eax, dword [eax]
xor esi, eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
test edx, edx
je 0x1002adce
mov dword [edx], esi
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x1002addf
xor ecx, dword [edx]
test esi, esi
je 0x1002ade5
mov dword [esi], ecx
add esi, 4
lea ecx, [edx + 4]
test edx, edx
cmove ecx, edx
test ecx, ecx
je 0x1002adf6
xor edi, dword [ecx]
test esi, esi
je 0x1002adfc
mov dword [esi], edi
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x1002ae0f
mov eax, dword [eax]
xor ebp, eax
test esi, esi
je 0x1002ae15
mov dword [esi], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x1002ae20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0x18]
test eax, eax
je 0x1002ae40
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
add eax, 4
je 0x1002ae49
mov ebx, dword [eax]
lea ecx, [eax + 4]
xor eax, eax
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1002ae5c
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
xor edx, edx
add ecx, 4
je 0x1002ae65
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 4]
add ebp, 8
add ebx, edx
test ecx, ecx
je 0x1002aed2
nop
lea edx, [edi*2 + 1]
imul edx, edi
lea eax, [ebx*2 + 1]
imul eax, ebx
rol edx, 5
rol eax, 5
mov esi, edx
xor esi, dword [esp + 0x10]
movzx ecx, al
and ecx, 0x1f
mov dword [esp + 0x10], edi
rol esi, cl
mov edi, eax
xor edi, dword [esp + 0x1c]
mov eax, ebx
mov ebx, dword [ebp]
movzx ecx, dl
add ebx, esi
and ecx, 0x1f
mov dword [esp + 0x1c], eax
rol edi, cl
add edi, dword [ebp + 4]
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x1002ae80
add eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1002aef0
mov eax, dword [eax]
xor ecx, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test edx, edx
je 0x1002aefa
mov dword [edx], ecx
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x1002af0b
xor edi, dword [edx]
test esi, esi
je 0x1002af11
mov dword [esi], edi
add esi, 4
lea ecx, [edx + 4]
test edx, edx
pop edi
cmove ecx, edx
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x1002af27
xor edx, dword [ecx]
test esi, esi
je 0x1002af2d
mov dword [esi], edx
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x1002af40
mov eax, dword [eax]
xor ebx, eax
test esi, esi
je 0x1002af46
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x1003eb20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 4
jb 0x1003eb58
mov esi, eax
shr esi, 2
nop
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x1003eb40
mov dword [esp + 0x24], eax
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
mov dword [esp + 0x10], esi
test eax, eax
je 0x1003ec47
cmp eax, 8
jb 0x1003ec28
mov ebx, eax
mov esi, edi
and ebx, 0xfffffff8
xorps xmm4, xmm4
sub esi, edx
xorps xmm3, xmm3
mov dword [esp + 0x14], esi
mov ecx, edx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
nop dword [eax + eax]
movd xmm2, dword [eax + ecx]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 8]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ecx - 4]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [edi + ebp + 4]
add ebp, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ebp, ebx
jb 0x1003ebb0
mov eax, dword [esp + 0x24]
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x1003ec47
sub edi, edx
lea ebx, [edx + ebp]
sub eax, ebp
movzx edx, byte [ebx + edi]
lea ebx, [ebx + 1]
movzx ecx, byte [ebx - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x1003ec33
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x1003ec60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x1c
test eax, eax
je 0x1003eda6
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x2c]
push edi
cmp eax, 4
jb 0x1003eca3
mov edi, eax
shr edi, 2
mov ecx, dword [esi]
sub eax, 4
xor ecx, dword [ebx]
add esi, 4
mov dword [edx], ecx
add ebx, 4
add edx, 4
sub edi, 1
jne 0x1003ec88
mov dword [esp + 0x38], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
test eax, eax
je 0x1003eda2
cmp eax, 0x40
jb 0x1003ed7f
lea ecx, [ebx - 1]
lea edi, [edx - 1]
add ecx, eax
add edi, eax
cmp edx, ecx
ja 0x1003ecd5
cmp edi, ebx
jae 0x1003ed7f
lea ecx, [esi - 1]
add ecx, eax
cmp edx, ecx
ja 0x1003ece6
cmp edi, esi
jae 0x1003ed7f
mov ecx, eax
lea edi, [edx + 0x10]
mov eax, edx
mov dword [esp + 0x18], edi
sub eax, ebx
and ecx, 0xffffffc0
mov dword [esp + 0x20], eax
mov edi, esi
sub edi, ebx
mov dword [esp + 0x28], ecx
mov eax, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x20]
mov ecx, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
movups xmm0, xmmword [ecx]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [eax + ecx - 0x40]
lea edi, [edi + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x30]
movups xmmword [edx + ecx - 0x40], xmm1
movups xmm1, xmmword [ebx + edi - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x20]
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [esi + ebp + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x10]
movups xmmword [edi - 0x30], xmm1
movups xmm1, xmmword [esi + ebp + 0x30]
add ebp, 0x40
pxor xmm1, xmm0
movups xmmword [edi - 0x20], xmm1
cmp ebp, dword [esp + 0x28]
jb 0x1003ed20
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp ebp, eax
jae 0x1003eda2
sub esi, ebx
lea edi, [ebx + ebp]
sub edx, ebx
sub eax, ebp
nop dword [eax]
mov cl, byte [edi + esi]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [edi + edx - 1], cl
sub eax, 1
jne 0x1003ed90
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x1003edb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1003ee81
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
cmp eax, 4
jb 0x1003ede2
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor dword [esi], ecx
add edx, 4
add esi, 4
sub edi, 1
jne 0x1003edd0
push ebx
xor ebx, ebx
test eax, eax
je 0x1003ee7e
cmp eax, 0x40
jb 0x1003ee5e
lea ecx, [edx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x1003ee04
cmp edi, edx
jae 0x1003ee5e
push ebp
mov edi, eax
mov ebp, edx
and edi, 0xffffffc0
mov ecx, esi
sub ebp, esi
movups xmm0, xmmword [ecx]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ecx + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [edx + ebx + 0x10]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [edx + ebx + 0x20]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
movups xmm0, xmmword [ecx - 0x10]
movups xmm1, xmmword [edx + ebx + 0x30]
add ebx, 0x40
pxor xmm1, xmm0
movups xmmword [ecx - 0x10], xmm1
cmp ebx, edi
jb 0x1003ee10
pop ebp
cmp ebx, eax
jae 0x1003ee7e
sub edx, esi
lea edi, [ebx + esi]
sub eax, ebx
nop dword [eax]
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor byte [edi - 1], cl
sub eax, 1
jne 0x1003ee70
pop ebx
pop edi
pop esi
ret

Function at 0x10044ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10044c80
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10044ba4
cmp dword [ebp - 4], 0x50000000
jb 0x10044b21
cmp dword [ebp - 4], 0x80000000
ja 0x10044b21
mov dword [ebp - 4], 0x4fff0000
jmp 0x10044afa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10049e20
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10044b47
jmp 0x10044ba4
cmp dword [ebp - 0x14], 0x10000
jne 0x10044b8a
cmp dword [ebp - 0x18], 0x10000
jb 0x10044b8a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10044b7d
mov eax, dword [ebp - 8]
jmp 0x10044ba6
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10044b9f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10044c80
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10044afa
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10044bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10044cb0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10044c6c
cmp dword [ebp - 4], 0x50000000
jb 0x10044bec
cmp dword [ebp - 4], 0x80000000
ja 0x10044bec
mov dword [ebp - 4], 0x80010000
jmp 0x10044bc5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10049e20
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10044c12
jmp 0x10044c6c
cmp dword [ebp - 0x14], 0x10000
jne 0x10044c55
cmp dword [ebp - 0x18], 0x10000
jb 0x10044c55
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10044c48
mov eax, dword [ebp - 8]
jmp 0x10044c6e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10044c67
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10044cb0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10044bc5
xor eax, eax
mov esp, ebp
pop ebp
ret