joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100700a3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d9a4f
call fcn.100d1b40
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.10001d0f
mov eax, dword [edi + 0x1c]
and dword [ebp - 4], 0
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
lea eax, [edi + 0x34]
push eax
lea ecx, [esi + 0x34]
call fcn.10016da1
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10075bcb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, ecx
test esi, esi
mov ecx, edx
jbe 0x10075bfa
push ebx
push edi
movzx edi, byte [ecx]
xor edx, edx
xor ebx, ebx
mov dl, ah
mov bh, al
xor edx, edi
movzx eax, bx
movzx edx, word [edx*2 + 0x100fb910]
xor eax, edx
inc ecx
dec esi
jne 0x10075bda
pop edi
pop ebx
pop esi
ret 4

Function at 0x100776cb
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100da1f2
call fcn.100d1b40
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x18]
lea edi, [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebp - 0x10], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x24]
lea edi, [ebx + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cl, byte [eax + 0x30]
add eax, 0x34
mov byte [ebx + 0x30], cl
push eax
lea ecx, [ebx + 0x34]
call fcn.10016da1
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebx + 0x3c]
lea eax, [esi + 0x3c]
push eax
call fcn.100777f6
add esi, 0x48
lea ecx, [ebx + 0x48]
push esi
mov byte [ebp - 4], 1
call fcn.10090bab
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1007e9da
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x100da7b5
call fcn.100d1b40
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x40]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
lea eax, [edi + 0x40]
push eax
call fcn.100024ce
and dword [ebp - 4], 0
lea eax, [edi + 0x4c]
push eax
lea ecx, [esi + 0x4c]
call fcn.100024ce
mov eax, dword [edi + 0x58]
lea ecx, [esi + 0x64]
mov dword [esi + 0x58], eax
mov al, byte [edi + 0x5c]
mov byte [esi + 0x5c], al
mov al, byte [edi + 0x5d]
mov byte [esi + 0x5d], al
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
lea eax, [edi + 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.1007ed21
add edi, 0x70
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 2
call fcn.10016da1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10080a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100da978
call fcn.100d1b40
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.10080c34
xor edi, edi
cmp eax, edi
jne 0x10080c23
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x10080ab4
push 1
pop eax
jmp 0x10080ab6
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.100799b5
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x10080c08
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x10080bdb
cmp word [eax + 0x20], 1
jne 0x10080bdb
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.1008228a
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.10080e24
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.1007fcf1
test eax, eax
jne 0x10080bf3
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10080b6f
cmp byte [ebx + 0x2c], 0
je 0x10080c0e
xor eax, eax
cmp byte [edi + eax], 0
jne 0x10080c0e
inc eax
cmp eax, 0x14
jb 0x10080b5f
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x10080b87
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.10082215
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.10080570
test eax, eax
jne 0x10080bf3
cmp byte [ebp + 0x17], al
je 0x10080bdb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x10080bef
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x10080bef
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x10080bdb
cmp dword [eax + 0x24], 1
jne 0x10080bdb
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x10080bd3
test al, al
je 0x10080c0e
test al, al
je 0x10080bdb
test cl, cl
je 0x10080bf7
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x10080c08
jmp 0x10080adb
xor cl, cl
jmp 0x10080bb3
mov esi, eax
jmp 0x10080c15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007f302
push 1
pop eax
jmp 0x10080c23
cmp byte [ebp + 0x17], 0
je 0x10080c13
push 1
pop esi
jmp 0x10080c15
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007f302
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x10081ca3
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100daa10
call fcn.100d1b40
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10081e28
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10081e28
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
mov byte [esi + 2], 1
call fcn.10002d73
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.10004125
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.1000334c
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.10002d73
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10081da5
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.1000334c
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.10002d73
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.10081da5
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.1000334c
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.10002c9f
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.10081dfa
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.1000334c
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100822d2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100daa8f
call fcn.100d1b40
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000241b
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10086d7b
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100db147
call fcn.100d1b40
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001d0f
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10086dfe
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1008f701
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x100db6b4
call fcn.100d1b40
sub esp, 0x14
mov ax, word [ebp + 8]
push esi
mov esi, ecx
mov word [ebp - 0x10], ax
xor eax, eax
mov word [ebp - 0x14], 2
mov byte [ebp - 0x12], dl
mov word [esi + 2], 0x63
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.1008f772
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x30]
push eax
call fcn.1008c32d
lea eax, [ebp - 0x20]
lea ecx, [esi + 0x50]
push eax
call fcn.1008c32d
push dword [ebp - 0x1c]
call fcn.1000334c
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10096340
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.100959f0
push 0x41
mov ecx, esi
call fcn.100959f0
push 0x59
mov ecx, esi
call fcn.100959f0
push 0x26
mov ecx, esi
call fcn.100959f0
push 0x53
mov ecx, esi
call fcn.100959f0
push 0x59
mov ecx, esi
call fcn.100959f0
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x100963d0
test cl, cl
jbe 0x100963cc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x100fbc14]
xor eax, edi
dec ecx
jne 0x100963b6
xor edi, edi
jmp 0x100963ff
cmp bl, cl
jne 0x100963d7
inc edi
jmp 0x100963e2
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x100fbc14]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x1009638e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.10095a30
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.10095b50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x10096610
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x174]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.10096440
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x1a8], bl
je 0x1009668c
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x184]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.100c9df0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x100966c9
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x180
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x1009669e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.100967a0
mov edi, dword [esi + 0x8ce0]
cmp byte [edi + 0x1a8], bl
je 0x10096789
mov ebp, dword [esi + 0x8cd8]
mov eax, dword [edi + 0x1a4]
inc ebp
cmp ebp, eax
jne 0x10096714
xor ebp, ebp
cmp dword [edi + 0x1bc], ebx
je 0x10096765
lea ecx, [edi + 0x148]
call fcn.10008c0f
mov ebx, dword [edi + 0x140]
mov ecx, 0xf
sub ecx, ebx
xor edi, edi
shr ecx, 3
add eax, ecx
adc edx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1bc]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [ebp + ebp*8]
shl ecx, 3
mov edx, dword [eax + 0x184]
sub ecx, ebp
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.100c9f10
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x100abf20
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, ecx
xor bl, bl
xor cl, cl
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
mov byte [esi + 4], 0
test edx, edx
mov dword [esi], 0xffffffff
jbe 0x100abf4d
xor cl, byte [eax + edi]
inc eax
cmp eax, edx
jb 0x100abf41
test cl, cl
jne 0x100abf67
test edx, edx
je 0x100abf67
mov bl, 1
mov ecx, edi
mov byte [esi + 4], bl
call fcn.100abf70
test eax, eax
mov dword [esi], eax
jge 0x100abf67
mov byte [esi + 4], 0
pop edi
mov al, bl
pop esi
pop ebx
ret 8
Function at 0x100b2ac0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x100b2afe
mov ecx, ebx
call fcn.100d0980
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.100d1930
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.100d1080
jmp 0x100b2b16
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x100b2b1f
mov ecx, ebx
call fcn.100d0980
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.100d1930
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x100b2b4d
lea esi, [ebx + 0x80]
mov ecx, esi
call fcn.100d0980
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.100d1930
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x100b2bc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc4
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x14
lea edx, [esp + 0x18]
call fcn.100d1160
lea ecx, [edi + 0x80]
push 0x14
lea edx, [esp + 0x98]
call fcn.100d1160
mov esi, dword [esp + 0xd8]
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xdc]
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
jbe 0x100b2c9a
mov dword [esp + 0x10], eax
lea eax, [esp + 0x94]
lea edx, [esp + 0x14]
push eax
mov ecx, edi
call fcn.100d11c0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
push ecx
lea ecx, [edi + 0x80]
call fcn.100d11c0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
xor ebx, edx
mov edx, dword [esp + 0x1c]
xor ebp, ecx
mov ecx, dword [esp + 0x60]
xor eax, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x20]
xor ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x24]
xor edx, ecx
dec eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x10], eax
jne 0x100b2c2f
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], ebx
mov dword [esi + 4], ebp
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret 8
Function at 0x100b2cd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x100b2d0e
mov ecx, ebx
call fcn.100d1310
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.100d1930
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.100d19c0
jmp 0x100b2d26
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x100b2d2f
mov ecx, ebx
call fcn.100d1310
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.100d1930
lea eax, [esp + 0xc]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x100b2d5d
lea esi, [ebx + 0x80]
mov ecx, esi
call fcn.100d1310
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.100d1930
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x100b3390
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.100d1310
mov ebp, 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.100d1930
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.100d1930
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100b342b
push str.SystemFunction036
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100b3424
lea ecx, [esp + 0x9c]
push 0x20
push ecx
call eax
test al, al
je 0x100b3424
push 0x20
lea edx, [esp + 0xa0]
lea ecx, [esp + 0x20]
mov ebp, 0x64
call fcn.100d1930
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x100b344f
push 8
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.100d1930
call ebx
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.100d1930
mov edi, 0x64
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.100d19c0
lea ecx, [esp + 0x1c]
call fcn.100d1310
push 0x20
mov edx, esi
lea ecx, [esp + 0x20]
call fcn.100d1930
dec edi
jne 0x100b3469
dec ebp
jne 0x100b3431
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.100d19c0
mov byte [esi + 0x20], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
Function at 0x100b3610
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push edi
xor edi, edi
xor eax, eax
lea edx, [ebp + 0x100]
lea esi, [edi + ecx]
xor ebx, ebx
add edx, 4
mov bl, byte [esi + eax]
mov ebx, dword [ebx*4 + 0x101015c0]
xor dword [edx - 4], ebx
inc eax
cmp eax, 4
jb 0x100b3627
add edi, 4
cmp edi, 0x10
jb 0x100b361c
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x100b3e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x124
push esi
add ecx, 0x7c
push 0x20
push ecx
lea ecx, [esp + 0x30]
call fcn.100b2cd0
mov eax, dword [esp + 0x12c]
push 4
lea edx, [esp + 8]
lea ecx, [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.100d1930
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x2c]
call fcn.100b2da0
xor eax, eax
lea ecx, [esp + 8]
mov edx, 8
mov esi, dword [ecx]
add ecx, 4
xor eax, esi
dec edx
jne 0x100b3e89
pop esi
add esp, 0x124
ret 4
Function at 0x100b4e20
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xc0
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x100b4e51
lea ecx, [esp + 0x4c]
call fcn.100d0980
lea edx, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
call fcn.100d1930
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0xd0]
call fcn.100d1080
pop edi
pop esi
pop ebx
add esp, 0xc0
ret 4