joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005dbf4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ebx, 7
ja 0x10046bdd
shl eax, 0x20
jbe 0x10022c7e
aaa
scasd eax, dword es:[edi]
mov ecx, 0x348da3a9
fld qword [eax]
add byte [eax], al
add byte [ebp - 0x93626c], cl
invalid
lea esi, [ebx*8]
lea edx, [ebp + ebx*4 - 0x94]
sub esi, ebx
mov dword [ebp - 0x10], edx
jmp fcn.10041356
pop esi
xor ax, ax
jb 0x10051786
pop ebx
mov esp, ebp
mov si, si
jno 0x10054d19
shr dx, 0x40
mov edi, edi
jo 0x1002a711
xor eax, 0xc768d23
sub word [ebp + ebx], ax
mov bl, bl
jmp dword [esi]
add edx, 0
add esp, 0xc
mov dword [ebp - 0xb0], 0x61
xor ebx, ebx
jb 0x1002cc48
lea eax, [ebp - 0x5c]
cmp dword [eax], 0
jne 0x10022c68
je 0x1002d90b
pop ebx
push ebx
mov ebp, 0x20e5c166
shl bp, 0x20
inc ebx
add eax, 4
cmp ebx, 7
lea edx, [edx]
jbe 0x1002d8fa
ja 0x1002d92b
push edi
xchg ecx, eax
mov es, ebx
and dword [ecx + ebp*8 + 0x192ad], esp
cmpsb byte [esi], byte es:[edi]
pop eax
jmp 0x10046bdd
ret
pop dword [esp - 4]
pop edi
ja 0x1002a6ee
xchg dx, bp
shl si, 0x20
xchg bp, dx
jbe 0x1005dc10
cdq
mov eax, 0xfe94f7d
xchg al, bl
retf 0xfffc
jbe 0x1002a6ee
mov al, byte [ebp - 0x24]
push 0x1c
lea ecx, [ebp - 0xb0]
push 0
push ecx
mov byte [ebp - 0x15], al
mov bp, bp
call fcn.1002c548
jno 0x1002d8d9
jo 0x1005dc39
pop ecx
cmp cl, byte [edi]
sbb byte [edx - 0x26000304], 0x6f
jo 0x1002d8d9
fldcw word [edi - 0x75]
inc ebp
clc
mov eax, dword [ebp - 8]
push ebx
pop ebx
mov ecx, dword [ebp - 4]
mov dword [esi - 8], eax
shl edi, 0x20
mov dword [esi - 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
jmp 0x10038b45
Function at 0x10061090
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.10076d00
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
pop esi
ret

Function at 0x100659b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 4], edi
jle 0x10065a6b
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
xor ecx, ecx
xor esi, esi
inc ecx
and ecx, 0x800000ff
jns 0x100659e4
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x20], cl
xor edx, edx
mov ecx, dword [esp + 0x20]
and ecx, 0xff
mov dl, byte [ecx + eax]
add edx, esi
and edx, 0x800000ff
jns 0x10065a09
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x18], dl
mov dl, byte [ecx + eax]
mov esi, dword [esp + 0x18]
and esi, 0xff
mov bl, byte [esi + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx + eax]
mov bl, byte [esi + eax]
add edx, ebx
and edx, 0x800000ff
jns 0x10065a3f
dec edx
or edx, 0xffffff00
inc edx
mov bl, byte [edi + ebp]
and edx, 0xff
mov dl, byte [edx + eax]
xor bl, dl
mov edx, dword [esp + 0x10]
inc edx
mov byte [edi + ebp], bl
movsx edi, dx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x1c]
cmp edi, edx
jl 0x100659d3
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x100661d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov ecx, edi
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x100661df
mov byte [esp + 0x24], 0
xor ecx, ecx
mov esi, edi
mov dword [esp + 0x10], 0x100
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov dl, byte [esi]
and eax, 0xff
xor ebx, ebx
mov bl, byte [eax + ebp]
mov ebp, edx
and ebp, 0xff
sub ebx, ebp
add ebx, ecx
and ebx, 0x800000ff
jns 0x1006622a
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x14], bl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
inc eax
mov bl, byte [ecx + edi]
mov byte [esi], bl
mov byte [ecx + edi], dl
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc esi
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x100661fa
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10066260
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
test ebp, ebp
push edi
jne 0x10066285
pop edi
pop esi
pop ebp
mov eax, 0xc9
pop ebx
add esp, 0x110
ret
mov ebx, dword [esp + 0x12c]
test ebx, ebx
jne 0x100662a0
pop edi
pop esi
pop ebp
mov eax, 0xc9
pop ebx
add esp, 0x110
ret
xor eax, eax
mov ax, word [ebp]
add eax, 7
cdq
and edx, 7
add eax, edx
mov esi, eax
lea eax, [esp + 0x20]
sar esi, 3
mov edi, esi
and edi, 0xffff
push edi
push ebp
push eax
mov dword [esp + 0x28], edi
call fcn.10076d20
add esp, 0xc
cmp si, 0xfc
jbe 0x100662e6
pop edi
pop esi
pop ebp
mov eax, 0xc9
pop ebx
add esp, 0x110
ret
push ebx
call fcn.10061090
mov esi, dword [esp + 0x12c]
add esp, 4
test esi, esi
jne 0x10066387
lea esi, [ebx + 0x5c]
xor eax, eax
mov ecx, esi
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x10066305
mov byte [esp + 0x10], 0
xor ecx, ecx
mov edi, esi
mov dword [esp + 0x14], 0x100
jmp 0x10066329
mov ebp, dword [esp + 0x124]
mov eax, dword [esp + 0x10]
mov dl, byte [edi]
and eax, 0xff
xor ebx, ebx
mov bl, byte [eax + ebp + 2]
mov ebp, edx
and ebp, 0xff
sub ebx, ebp
add ebx, ecx
and ebx, 0x800000ff
jns 0x10066356
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov ecx, dword [esp + 0x18]
and ecx, 0xff
inc eax
mov bl, byte [ecx + esi]
mov byte [edi], bl
mov byte [ecx + esi], dl
cdq
idiv dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
inc edi
dec eax
mov dword [esp + 0x14], eax
mov byte [esp + 0x10], dl
jne 0x10066322
jmp 0x1006643c
push edi
lea ecx, [esp + 0x24]
push ebp
push ecx
call fcn.10076d20
add esi, 2
push 4
lea edx, [esp + edi + 0x30]
push esi
push edx
call fcn.10076d20
lea esi, [ebx + 0x5c]
add esp, 0x18
xor eax, eax
mov ecx, esi
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x100663ad
xor ecx, ecx
add edi, 4
mov dword [esp + 0x18], edi
mov byte [esp + 0x14], 0
mov edi, esi
mov dword [esp + 0x10], 0x100
mov eax, dword [esp + 0x14]
mov dl, byte [edi]
and eax, 0xff
xor ebx, ebx
mov ebp, edx
mov bl, byte [esp + eax + 0x20]
and ebp, 0xff
sub ebx, ebp
add ebx, ecx
and ebx, 0x800000ff
jns 0x100663fc
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x1c], bl
mov ecx, dword [esp + 0x1c]
and ecx, 0xff
inc eax
mov bl, byte [ecx + esi]
mov byte [edi], bl
mov byte [ecx + esi], dl
cdq
idiv dword [esp + 0x18]
mov eax, dword [esp + 0x10]
inc edi
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], dl
jne 0x100663cf
push 0
lea eax, [esp + 0x24]
push 0x100
push eax
call fcn.10076d00
add esp, 0xc
mov ecx, dword [esp + 0x12c]
push 0x100
push esi
push ecx
call fcn.100610e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x100665a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push ebx
push esi
push edi
mov edi, dword [esp + 0x198]
mov dword [edi], 0
mov eax, dword [eax]
test eax, eax
jne 0x100665ce
pop edi
pop esi
mov ax, 0xcc
pop ebx
add esp, 0x174
ret
mov edx, dword [esp + 0x188]
lea ecx, [esp + 0x24]
push ecx
push edx
push eax
call fcn.10066260
add esp, 0xc
test ax, ax
jne 0x10066741
mov eax, dword [esp + 0x194]
and eax, 0xff
sub eax, 0
je 0x100666a8
dec eax
je 0x10066619
mov dword [edi], 0
pop edi
pop esi
mov ax, 0xa
pop ebx
add esp, 0x174
ret
mov eax, dword [esp + 0x18c]
test eax, eax
je 0x10066642
lea ecx, [esp + 0x24]
test ecx, ecx
je 0x10066642
mov edx, dword [esp + 0x190]
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.100610e0
add esp, 0xc
lea ecx, [esp + 0x24]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.10061250
add esp, 8
xor esi, esi
xor eax, eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + eax + 0x10]
mov bl, byte [esp + edx + 0x80]
and ebx, 0x80000003
jns 0x10066676
dec ebx
or ebx, 0xfffffffc
inc ebx
shl ebx, cl
add ecx, 2
or esi, ebx
inc eax
cmp ecx, 0x20
jl 0x1006665a
mov dword [esp + 0xc], esi
xor eax, eax
mov cl, byte [esp + eax + 0x20]
mov bl, byte [esp + eax + 0xc]
xor bl, cl
mov byte [esp + eax + 0xc], bl
inc eax
cmp eax, 4
jb 0x10066689
mov edx, dword [esp + 0xc]
mov dword [edi], edx
jmp 0x1006672a
mov eax, dword [esp + 0x18c]
test eax, eax
je 0x100666d1
lea ecx, [esp + 0x24]
test ecx, ecx
je 0x100666d1
mov edx, dword [esp + 0x190]
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.100610e0
add esp, 0xc
lea ecx, [esp + 0x24]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.10061250
add esp, 8
xor esi, esi
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dl, byte [esp + eax + 0x10]
mov dl, byte [esp + edx + 0x80]
shr edx, 3
and edx, 3
shl edx, cl
add ecx, 2
or esi, edx
inc eax
cmp ecx, 0x20
jb 0x100666e9
mov dword [esp + 0xc], esi
xor eax, eax
lea ecx, [esp + 0xf]
mov dl, byte [esp + eax + 0x20]
mov bl, byte [ecx]
xor bl, dl
inc eax
mov byte [ecx], bl
dec ecx
cmp eax, 4
jb 0x10066713
mov eax, dword [esp + 0xc]
mov dword [edi], eax
push 0
lea ecx, [esp + 0x28]
push 0x15c
push ecx
call fcn.10076d00
add esp, 0xc
xor ax, ax
pop edi
pop esi
pop ebx
add esp, 0x174
ret
Function at 0x10066cb0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
jbe 0x10066d07
push ebx
push esi
mov esi, dword [esp + 0x10]
xor edx, edx
mov ecx, eax
mov dl, byte [esi]
and ecx, 0xf
mov ebx, edx
mov ecx, dword [ecx*4 + 0x10090010]
and ebx, 0xf
shr ax, 4
xor cx, word [ebx*4 + 0x10090010]
shr edx, 4
xor ecx, eax
mov eax, ecx
and eax, 0xf
shr cx, 4
mov eax, dword [eax*4 + 0x10090010]
xor ax, word [edx*4 + 0x10090010]
xor eax, ecx
inc esi
dec edi
jne 0x10066cc1
pop esi
pop ebx
pop edi
ret

Function at 0x10066e60
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x20]
cmp ebx, 1
jae 0x10066e7e
mov eax, dword [esp + 0x18]
pop ebx
mov dword [eax], 0
xor eax, eax
add esp, 0xc
ret
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ebx
test ebx, ebx
mov dword [ecx], 0
jbe 0x10066fac
mov eax, dword [esp + 0x1c]
or ecx, 0xffffffff
push ebp
push esi
sub ecx, eax
push edi
mov dword [esp + 0x14], 0
lea edi, [eax + 1]
mov dword [esp + 0x18], ecx
jmp 0x10066eb5
mov ebx, dword [esp + 0x10]
cmp ebx, 3
jb 0x10066ebf
mov ebx, 3
mov eax, 0xaaaaaaab
mul dword [esp + 0x14]
mov eax, dword [esp + 0x20]
shr edx, 1
add edx, eax
xor eax, eax
mov al, byte [edi - 1]
mov esi, eax
shr esi, 2
cmp ebx, 1
jle 0x10066ef0
xor ecx, ecx
and eax, 3
mov cl, byte [edi]
shr ecx, 4
shl eax, 4
or ecx, eax
jmp 0x10066ef8
and eax, 3
shl eax, 4
mov ecx, eax
cmp ebx, 2
jle 0x10066f13
xor eax, eax
mov al, byte [edi + 1]
mov ebp, eax
mov al, byte [edi]
and eax, 0xf
shr ebp, 6
shl eax, 2
or ebp, eax
jmp 0x10066f1d
mov al, byte [edi]
and eax, 0xf
shl eax, 2
mov ebp, eax
mov al, byte [edi + 1]
and esi, 0x3f
and eax, 0x3f
and ecx, 0x3f
mov dword [esp + 0x28], eax
mov al, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc edx
mov byte [edx], cl
inc edx
cmp ebx, 1
jne 0x10066f4d
mov byte [edx], 0x3d
mov byte [edx + 1], 0x3d
jmp 0x10066f73
and ebp, 0x3f
inc edx
cmp ebx, 2
mov al, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], al
jne 0x10066f64
mov byte [edx], 0x3d
jmp 0x10066f73
mov eax, dword [esp + 0x28]
and eax, 0x3f
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov esi, dword [eax]
add edi, 3
add esi, 4
add edx, edi
mov dword [eax], esi
mov eax, dword [esp + 0x2c]
sub ebx, 3
add ecx, 0xc
cmp edx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ecx
jb 0x10066eb1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x1006ad50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov eax, 0xffffffff
push esi
xor ecx, ecx
push edi
mov edi, dword [esp + 0x14]
cmp edi, ecx
je 0x1006ad86
mov edx, dword [esp + 0x10]
xor ebx, ebx
mov bl, byte [edx + ecx]
inc ecx
xor ebx, eax
shr eax, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x10090540]
xor esi, eax
cmp ecx, edi
mov eax, esi
jb 0x1006ad66
not eax
pop edi
pop esi
pop ebx
ret

Function at 0x1006b230
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x1006b268
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x1006b250
pop esi
pop ebx
ret

Function at 0x1006b2e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
push ebx
push esi
mov si, word [esp + 0x14]
push edi
test si, si
mov ebx, dword [esp + 0x14]
je 0x1006b34c
mov di, 0x10
mov eax, dword [ebx + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
and eax, 0xf
push eax
push ecx
call fcn.1006b270
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x24]
xor dword [esp + 0x14], ecx
add esp, 8
mov edx, dword [ebx]
push 2
xor dword [esp + 0x10], edx
push eax
call fcn.1006b2a0
add esp, 8
mov ecx, dword [ebx + 4]
dec di
mov dword [ebx], ecx
mov edx, dword [esp + 0xc]
mov dword [ebx + 4], edx
jne 0x1006b2f8
add ebx, 8
inc dword [esp + 0x1c]
dec si
jne 0x1006b2f4
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x1006b6a0
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x1006b723
pop esi
pop ebx
ret
Function at 0x1006d3e0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor cl, cl
mov esi, dword [esp + 0x14]
test bp, bp
lea eax, [ebp - 1]
je 0x1006d431
mov dl, byte [esi]
mov edi, esi
dec esi
mov bl, cl
mov cl, dl
add dl, dl
shr cl, 7
or dl, bl
mov bx, ax
mov byte [edi], dl
dec ax
test bx, bx
jne 0x1006d415
test cl, cl
je 0x1006d43c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x1006d407
xor si, si
test ebp, ebp
je 0x1006d469
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x1006d452
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x1006dc20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x1006dc4a
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x1006dc39
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x1006dc8c
mov bl, byte [esi]
mov ebp, esi
inc esi
mov al, cl
shl al, 7
mov cl, bl
shr bl, 1
and cl, 1
or bl, al
mov byte [ebp], bl
mov bp, di
dec di
test bp, bp
jne 0x1006dc6b
test cl, cl
je 0x1006dc93
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x1006dc58
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x100730f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x10073120
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x10073212
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x100731e2
cmp dword [esp + 0x1c], 2
push 0
jbe 0x100731c3
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.100732c0
add esp, 0xc
cmp dword [0x10090c8c], 0
jne 0x100732ad
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x10073194
jmp 0x100731f0
push 0
push esi
call fcn.100732c0
add esp, 0xc
cmp dword [0x10090c8c], 0
je 0x100731f0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.10073370
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x10073147
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x10073228
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x1007321a
cmp dword [esp + 0x1c], 2
jbe 0x10073243
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.10073370
add esp, 8
jmp 0x10073268
cmp dword [esp + 0x1c], 1
jne 0x10073257
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.100732c0
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x100732a0
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x10073287
mov dl, byte [esi + eax - 8]
lea ecx, [esi + eax]
inc eax
mov byte [ecx], dl
cmp eax, dword [esp + 0x18]
jb 0x10073277
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x10073370
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
push edi
mov eax, dword [edx]
push ebp
mov esi, dword [esp + 0x14]
add edx, 8
mov ebp, 0xc
add dword [esi + 4], eax
mov ecx, dword [edx - 4]
add dword [esi], ecx
mov ebx, dword [esi]
mov edi, dword [esi + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add edx, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [edx - 8]
mov dword [esi + 4], eax
mov edi, dword [esi]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [edx - 4]
dec ebp
mov dword [esi], ebx
jne 0x1007338e
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100733e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x90
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov ebx, dword [esp + 0xa0]
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0x10073410
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x14], 1
jbe 0x10073505
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
sub eax, 2
mov dword [esp + 0x2c], eax
je 0x10073505
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x28], 0
jne 0x100734c5
lea eax, [esp + 0x30]
push 0
push eax
push ebx
call fcn.100732c0
add esp, 0xc
cmp dword [0x10090c8c], 0
jne 0x10073602
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x38]
mov esi, 0x19
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov cl, 0x20
add eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [edi + 4], eax
add edi, 4
mov eax, dword [esp + 0x30]
mov edx, dword [edi - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x3c], eax
dec esi
jne 0x10073496
jmp 0x100734d3
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.10073610
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [ebx], eax
mov edx, dword [esp + 0x20]
xor dword [ebx + 4], ecx
mov eax, dword [esp + 0x24]
add ebx, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x2c]
jb 0x10073454
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], eax
je 0x1007352e
mov eax, dword [esp + 0x10]
lea esi, [ebx + 8]
lea edi, [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x14], 1
jne 0x10073556
push 0
push 0
push ebx
call fcn.100732c0
add esp, 0xc
cmp dword [0x10090c8c], 0
je 0x1007358c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
cmp dword [esp + 0x14], 2
jne 0x1007357e
push 0
push 0
push ebx
call fcn.100732c0
add esp, 0xc
cmp dword [0x10090c8c], 0
je 0x1007358c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.10073610
add esp, 8
cmp dword [esp + 0x14], 1
jbe 0x100735f5
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor dword [esp + 0x18], eax
xor dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x100735bf
mov dl, byte [ebx + ecx + 8]
lea eax, [ebx + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x10]
mov dl, byte [esp + ecx + 0x17]
mov byte [eax + 8], dl
jb 0x100735a8
cmp dword [esp + 0x14], 2
jne 0x100735e7
push 0
push 0
push ebx
call fcn.100732c0
add esp, 0xc
cmp dword [0x10090c8c], 0
je 0x100735f5
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.10073610
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor dword [ebx], eax
xor dword [ebx + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
Function at 0x10073610
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0xc
mov edx, dword [esp + 8]
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push ebp
add esi, 0x64
mov ebp, dword [edx]
mov eax, dword [edx + 4]
sub ebp, dword [esi]
mov ebx, eax
shr ebx, 7
mov edi, ebp
and bl, 0x1f
mov cl, 0x20
sub cl, bl
sub esi, 8
shl edi, cl
mov cl, bl
shr ebp, cl
or edi, ebp
mov cl, 0x20
xor edi, eax
mov eax, edi
mov dword [edx], edi
shr eax, 4
mov ebx, dword [esi + 4]
add ebx, dword [edx + 4]
and al, 0x1f
mov ebp, ebx
sub cl, al
shl ebp, cl
mov cl, al
shr ebx, cl
or ebp, ebx
xor ebp, edi
dec dword [esp + 0x10]
mov dword [edx + 4], ebp
jne 0x1007362a
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
mov ecx, dword [eax + 4]
sub dword [edx], ecx
mov ebx, dword [eax]
sub dword [edx + 4], ebx
pop ebx
add esp, 4
ret

Function at 0x10074bd0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push 0
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x10074bf9
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
inc esi
push esi
call fcn.1006af70
mov dword [esp + 0x10], eax
add esp, 4
test eax, eax
jne 0x10074c14
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0xc]
push esi
push eax
push ebx
call edi
test eax, eax
jne 0x10074c2a
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 4
ret