joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a103d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100bd080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x18], esi
cmp dword [0x100c0ac0], 0
je 0x100171ee
cmp byte [0x100c0b3c], 0
je 0x100171ee
mov eax, dword [edi]
cmp dword [eax + 0x18], 0x10
lea ecx, [eax + 4]
mov dword [ebp - 0x14], ecx
jb 0x1001705e
mov ecx, dword [ecx]
mov dword [ebp - 0x14], ecx
movaps xmm0, xmmword [0x100b40e0]
xor ecx, ecx
movups xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x20], 0x4b
mov al, byte [ebp - 0x30]
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x10
jb 0x10017071
sub esp, 0x18
mov byte [ebp - 0x1f], 0
mov edx, esp
mov dword [ebp - 0x38], esp
lea ecx, [ebp - 0x2f]
xorps xmm0, xmm0
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100170a7
sub ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x2f]
push ecx
push eax
mov ecx, edx
call fcn.10002570
mov edx, dword [ebp - 0x14]
sub esp, 0x18
mov eax, esp
mov dword [ebp - 4], 0
mov ecx, edx
mov dword [ebp - 0x34], eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100170f0
sub ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x34]
push edx
call fcn.10002570
mov dword [ebp - 4], 0xffffffff
call fcn.100162c0
add esp, 0x30
test al, al
je 0x100171ee
mov ecx, dword [0x100c0ac0]
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x100171de
push edi
push esi
mov ecx, eax
call fcn.1003d6f0
mov ecx, dword [0x100c0ac0]
cmp dword [ecx + 0x60], 0
je 0x10017191
xor dl, dl
xor esi, esi
mov byte [ebp - 0x14], dl
nop dword [eax + eax]
mov eax, dword [ecx + 0x5c]
movq xmm0, qword [eax + esi + 4]
mov eax, dword [eax + esi + 0xc]
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], eax
test al, al
je 0x10017184
push dword [ebp - 0x28]
mov ecx, dword [ecx + 0x60]
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x18]
call fcn.1003e920
mov ecx, dword [0x100c0ac0]
mov dl, byte [ebp - 0x14]
inc dl
add esi, 0xc
mov byte [ebp - 0x14], dl
cmp dl, 4
jb 0x10017150
cmp dword [ecx + 0x64], 0
je 0x100171de
mov byte [ebp - 0x14], 0
nop dword [eax + eax]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov ecx, dword [ecx + 0x5c]
push esi
push eax
call fcn.1003dc50
cmp byte [ebp - 0x24], 0
je 0x100171cc
push dword [ebp - 0x28]
mov ecx, dword [0x100c0ac0]
push esi
push edi
push dword [ebp - 0x18]
mov ecx, dword [ecx + 0x64]
call fcn.1003f090
mov al, byte [ebp - 0x14]
mov ecx, dword [0x100c0ac0]
inc al
mov byte [ebp - 0x14], al
cmp al, 8
jb 0x100171a0
mov ecx, dword [ecx + 0x58]
test ecx, ecx
je 0x100171ee
push edi
push dword [ebp - 0x18]
call fcn.1003cf40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f9b5
mov esp, ebp
pop ebp
ret
Function at 0x100177a0
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x100c0b20
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10017880
push 0x100c0b1c
push 0
push 0
push 0x8004
push dword [0x100c0b20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10017880
movaps xmm0, xmmword [str.mE.V_t]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x55d0b0c
movaps xmm0, xmmword [0x100b4310]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0xf591f2d
movaps xmm0, xmmword [0x100b3f00]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x4c1d1738
mov word [ebp - 4], 0x10
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x10017824
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x100c0b1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10017880
push 0x100c0b18
push 0x800000
push dword [0x100c0b1c]
push 0x6801
push dword [0x100c0b20]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10017880
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100c0b14], eax
call fcn.1007e600
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1007ead0
push 0x100175f0
push 0x100c0b10
call fcn.1007e310
call fcn.1007e660
push 4
push 0x450890
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100178ef
mov dword [0x100c0b10], 0x450890
call fcn.1007e600
call esi
push eax
call fcn.1007ead0
push 0x100175f0
push 0x100c0b10
call fcn.1007de80
call fcn.1007e660
call fcn.1007e600
call esi
push eax
call fcn.1007ead0
push 0x10017690
push 0x100c0b0c
call fcn.1007e310
call fcn.1007e660
push 4
push 0x4504c0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001794c
mov dword [0x100c0b0c], 0x4504c0
call fcn.1007e600
call esi
push eax
call fcn.1007ead0
push 0x10017690
push 0x100c0b0c
call fcn.1007de80
call fcn.1007e660
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017e30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100bd080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x10f]
mov byte [ebp - 0x110], 0
push 0
push eax
call fcn.10081a90
add esp, 0xc
mov eax, 0x100bef90
cmp dword [0x100befa4], 0xf
cmova eax, dword [0x100bef90]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Option.Ini
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x114], 0
movups xmmword [ebp - 0x128], xmm0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017ec0
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.10002570
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootWeapon
push str.PetLooting
call esi
mov byte [0x100bf018], al
cmp al, 1
jbe 0x10017f07
mov byte [0x100bf018], 1
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootArmor
push str.PetLooting
call esi
mov byte [0x100bf019], al
cmp al, 1
jbe 0x10017f2c
mov byte [0x100bf019], 1
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootAccessory
push str.PetLooting
call esi
mov byte [0x100bf01a], al
cmp al, 1
jbe 0x10017f51
mov byte [0x100bf01a], 1
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootNormal
push str.PetLooting
call esi
mov byte [0x100bf01b], al
cmp al, 1
jbe 0x10017f76
mov byte [0x100bf01b], 1
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootMagic
push str.PetLooting
call esi
mov byte [0x100bf01c], al
cmp al, 1
jbe 0x10017f9b
mov byte [0x100bf01c], 1
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootRare
push str.PetLooting
call esi
mov byte [0x100bf01d], al
cmp al, 1
jbe 0x10017fc0
mov byte [0x100bf01d], 1
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootUpgrade
push str.PetLooting
call esi
mov byte [0x100bf01e], al
cmp al, 1
jbe 0x10017fe5
mov byte [0x100bf01e], 1
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootUnique
push str.PetLooting
call esi
mov byte [0x100bf01f], al
cmp al, 1
jbe 0x1001800a
mov byte [0x100bf01f], 1
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootCraft
push str.PetLooting
call esi
mov byte [0x100bf020], al
cmp al, 1
jbe 0x1001802f
mov byte [0x100bf020], 1
mov ecx, dword [ebp - 0x114]
cmp ecx, 0xf
jbe 0x10018065
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001805b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018074
push ecx
push edx
call fcn.1007fa16
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1007f9b5
mov esp, ebp
pop ebp
ret
call fcn.10084b1f
int3
Function at 0x1001e700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a14c5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100bd080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [0x100c0b3c], 0
je 0x1001e80a
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100c0ba0]
sbb edx, dword [0x100c0ba4]
jne 0x1001e75b
cmp eax, 0x3e8
jb 0x1001e821
call esi
push ecx
lea ecx, [ebp - 0x2c]
mov dword [0x100c0ba0], eax
mov dword [0x100c0ba4], edx
call fcn.1000e800
push 0x1000
call fcn.1000ef00
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov esi, edi
mov edx, dword [ebp - 0x1c]
sub esi, edx
mov dword [ebp - 0x2c], vtable.Packet.0
cmp esi, 0x989680
ja 0x1001e7d9
mov ecx, dword [ebp - 0x20]
inc ecx
cmp esi, ecx
jae 0x1001e7cf
mov eax, dword [ebp - 0x14]
sub eax, edx
cmp ecx, eax
jbe 0x1001e7b8
push ecx
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1000efb0
jmp 0x1001e7cc
sub ecx, esi
push ecx
push 0
push edi
lea esi, [edi + ecx]
call fcn.10081a90
add esp, 0xc
mov dword [ebp - 0x18], esi
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov byte [edx + eax], 0xa1
inc dword [ebp - 0x20]
push 0xa4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.100207c0
push ebx
mov ecx, eax
call fcn.1001f320
lea ecx, [ebp - 0x2c]
call fcn.10020960
mov edx, dword [ebp - 0x18]
mov ecx, eax
sub edx, dword [ebp - 0x1c]
call fcn.10019810
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f9b5
mov esp, ebp
pop ebp
ret
Function at 0x10023ff0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x100bd080]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 6
mov dword [ebp - 0x2f8], 0x6a725406
mov dword [ebp - 0x2f4], 0x6267694a
xor eax, eax
mov dword [ebp - 0x2f0], 0x6f747255
mov word [ebp - 0x2ec], 0x6168
mov byte [ebp - 0x2ea], 0
xor byte [ebp + eax - 0x2f7], cl
inc eax
cmp eax, 0xd
jae 0x1002404a
mov cl, byte [ebp - 0x2f8]
jmp 0x10024035
push ebx
mov byte [ebp - 0x2e8], 0x2e
mov al, 0x40
xor al, byte [ebp - 0x2e8]
mov bl, 0x42
mov ah, bl
mov byte [ebp - 0x2e7], al
mov al, byte [ebp - 0x2e8]
mov dl, 0x4a
xor ch, ch
mov byte [ebp - 0x2d9], ah
mov bh, ah
mov byte [ebp - 0x2de], ch
mov dh, dl
mov byte [ebp - 0x2ea], 0
xor dl, al
mov byte [ebp - 0x2de], 0
xor bl, al
mov byte [ebp - 0x2e5], dl
xor ah, al
mov byte [ebp - 0x2e4], bl
xor ch, al
mov byte [ebp - 0x2e3], ah
xor dh, al
mov byte [ebp - 0x2e2], ch
xor bh, al
mov byte [ebp - 0x2e1], dh
mov cl, 0x5a
mov byte [ebp - 0x2e0], bh
xor cl, al
mov al, byte [ebp - 0x2d9]
xor al, byte [ebp - 0x2e8]
mov byte [ebp - 0x2df], al
lea eax, [ebp - 0x2e7]
push esi
push eax
mov byte [ebp - 0x2e6], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f7]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x100241c1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100241c1
push 0x2c8
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.10081a90
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100241c1
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x100241c1
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100241c1
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10001ea0
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x100241c1
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f9b5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1007f9b5
mov esp, ebp
pop ebp
ret
Function at 0x100241e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x100b4150]
xor eax, eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x18], 0x4f556953
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x595c58
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x10024206
mov byte [ebp - 0x10], 0x28
mov al, 0x46
xor al, byte [ebp - 0x10]
mov bl, 0x44
mov ah, bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov dl, 0x4c
mov bh, ah
mov byte [ebp - 1], ah
mov dh, dl
mov byte [ebp - 6], 0
xor dl, al
mov byte [ebp - 0x11], 0
xor bl, al
mov byte [ebp - 0xd], dl
xor ah, al
mov byte [ebp - 0xc], bl
xor dh, al
mov byte [ebp - 0xb], ah
xor bh, al
mov byte [ebp - 9], dh
mov cl, 0x5c
mov byte [ebp - 8], bh
xor cl, al
mov byte [ebp - 6], 0
mov ch, 6
mov byte [ebp - 0xe], cl
xor ch, al
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0xf]
push eax
mov byte [ebp - 0xa], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x27]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x100242b4
push 0
push 0
push 0x11
test esi, esi
jne 0x100242a5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100242c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x100242fe
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10024302
cmp edx, esi
jne 0x100242e7
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10024322
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10024326
cmp edx, esi
jne 0x1002430b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10024346
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002434a
cmp edx, esi
jne 0x1002432f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1a8d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push esi
push edi
mov eax, dword [0x100bd080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [0x100c0c0c], eax
test edx, edx
je 0x100270f8
cmp dword [ebp + 0xc], 1
jne 0x100270f8
mov eax, dword [esi + 4]
test eax, eax
je 0x100270e3
cmp edx, eax
jne 0x100270e3
cmp byte [0x100c0b5b], 0
sete al
xor ecx, ecx
mov byte [0x100c0b5b], al
test al, al
je 0x10026fd6
movaps xmm0, xmmword [0x100b3fc0]
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x30], 0x46
nop
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x10
jb 0x10026fc0
mov byte [ebp - 0x2f], 0
lea edx, [ebp - 0x3f]
jmp 0x10026ff9
movaps xmm0, xmmword [0x100b3cb0]
movups xmmword [ebp - 0x54], xmm0
mov byte [ebp - 0x44], 0
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0xf
jb 0x10026fe5
mov byte [ebp - 0x44], 0
lea edx, [ebp - 0x53]
mov ecx, edx
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10027013
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.10002570
mov dword [ebp - 4], 0
mov eax, dword [esi]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100270b4
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100270b4
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
cmova ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10027053
sub ecx, edx
mov dword [ebp - 0x10], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.1007fd43
push esi
mov edi, eax
push 0
push edi
call fcn.10081a90
cmp dword [ebp - 0x18], 0xf
lea edx, [ebp - 0x2c]
push dword [ebp - 0x10]
cmova edx, dword [ebp - 0x2c]
lea esi, [edi + 0x20]
push edx
push esi
call fcn.10081510
mov eax, dword [ebp - 0x10]
add esp, 0x1c
mov ecx, dword [ebp - 0x14]
mov dword [edi + 4], esi
mov dword [edi + 0x14], eax
push edi
mov dword [edi + 0x18], 0x1f
call dword [0x100b2f38]
push edi
call fcn.1007fd3e
mov esi, dword [ebp - 0x2c]
add esp, 4
mov eax, dword [ebp - 0x18]
cmp eax, 0xf
jbe 0x100270e3
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x100270d9
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002710d
push ecx
push esi
call fcn.1007fa16
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.10084b1f
int3
Function at 0x100273d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1abd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100bd080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
or eax, 0xffffffff
mov dword [ebp - 0x14], 0
mov dword [edi + 0x38], eax
lea ecx, [ebp - 0x34]
mov word [edi + 0x3c], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
movq qword [ebp - 0x1c], xmm0
sub eax, ecx
mov dword [edi + 0x14], 0
mov dword [ebp - 0x20], eax
sar eax, 2
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 0x34], 0x350
mov dword [ebp - 0x30], 0x140
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x100274d7
push eax
lea ecx, [ebp - 0x1c]
call fcn.10025380
push dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.10081510
mov eax, dword [ebp - 0x24]
add esp, 0xc
lea eax, [esi + eax*4]
mov dword [ebp - 0x18], eax
sub esp, 0xc
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x24], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
sar eax, 2
test eax, eax
je 0x10027533
push eax
mov ecx, esi
call fcn.10025380
mov edi, dword [esi]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub esi, eax
push esi
push eax
push edi
call fcn.10081510
mov ecx, dword [ebp - 0x24]
add esp, 0xc
sar esi, 2
lea eax, [edi + esi*4]
mov edi, dword [ebp - 0x28]
mov dword [ecx + 4], eax
mov ecx, 0xd78d54
call fcn.10019750
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 0xc
mov dword [edi], eax
push 4
push 0x4de1e6
call esi
test eax, eax
jne 0x10027564
mov edx, 0x10029e60
mov ecx, 0x4de1e6
call fcn.1001e420
mov eax, dword [edi]
test eax, eax
je 0x100275cc
push 4
push eax
call esi
test eax, eax
jne 0x100275cc
mov ecx, edi
call fcn.10027600
cmp dword [0x100c0c1c], 0
jne 0x100275d2
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x100275ae
push 4
push eax
call esi
test eax, eax
jne 0x100275ae
mov eax, dword [ebp - 0x20]
push 4
add eax, 0x64
push eax
call esi
test eax, eax
jne 0x100275ae
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
add esi, 0x64
jmp 0x100275b0
xor esi, esi
mov eax, dword [esi]
push 4
push eax
mov dword [0x100c0c1c], eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100275d2
mov dword [esi], 0x10029e90
jmp 0x100275d2
mov dword [edi], 0
lea ecx, [ebp - 0x1c]
call fcn.10010620
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f9b5
mov esp, ebp
pop ebp
ret
Function at 0x10036fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
movaps xmm0, xmmword [0x100b42d0]
push esi
mov esi, ecx
mov dword [esp + 0x18], 0x475d714b
push edi
mov dword [esp + 8], esi
xor ecx, ecx
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x20], 0x5a4f5b5a
mov dword [esp + 0x24], 0x404147
mov al, byte [esp + 0xc]
xor byte [esp + ecx + 0xd], al
inc ecx
cmp ecx, 0x1a
jb 0x10036fd7
xorps xmm0, xmm0
mov byte [esp + 0x27], 0
lea ecx, [esp + 0xd]
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x40], 0
lea edx, [ecx + 1]
mov dword [esp + 0x44], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10037010
sub ecx, edx
lea eax, [esp + 0xd]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.10002570
cmp dword [esp + 0x40], 0
mov edi, dword [esi]
mov dword [esp + 0x28], edi
je 0x100370ac
test edi, edi
je 0x100370ac
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100370ac
mov eax, dword [edi + 0xc4]
mov dword [esp + 0x2c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x100370a8
cmp esi, dword [edi + 0xc4]
jne 0x10037063
call fcn.10084b0f
mov edi, dword [esi + 8]
test edi, edi
je 0x1003708f
cmp dword [edi + 0x78], 0x10
lea ecx, [edi + 0x64]
jb 0x10037075
mov ecx, dword [ecx]
cmp dword [esp + 0x44], 0xf
lea eax, [esp + 0x30]
cmova eax, dword [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100370db
mov edi, dword [esp + 0x28]
cmp esi, dword [edi + 0xc4]
jne 0x100370a0
call fcn.10084b0f
mov esi, dword [esi]
cmp esi, dword [esp + 0x2c]
jne 0x10037056
mov esi, dword [esp + 8]
xor edi, edi
mov ecx, dword [esp + 0x44]
mov dword [esi + 4], edi
cmp ecx, 0xf
jbe 0x100370eb
mov edx, dword [esp + 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100370e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003710e
jmp 0x100370e1
mov esi, dword [esp + 8]
jmp 0x100370ae
push ecx
push edx
call fcn.1007fa16
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x10037108
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10037108
push 0x14
mov ecx, esi
call dword [0x100b2ee8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10084b1f
int3