joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d1a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1014e058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.10018df1
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.100d2f1c
leave
ret

Function at 0x1001d43d
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x1001dbf2
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
ret

Function at 0x1001e28a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1014e058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.10018df1
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.100d2f1c
leave
ret

Function at 0x1002d8af
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
cmp esi, 0x200
jb 0x1002d913
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1002d913
mov edx, dword [ecx + 0x3c]
cmp edx, 0x1000
jae 0x1002d913
lea eax, [edx + 0x200]
cmp eax, esi
ja 0x1002d913
test dl, 7
jne 0x1002d913
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x1002d913
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x1002d92f
sub eax, 0x74
je 0x1002d928
dec eax
sub eax, 1
je 0x1002d928
dec eax
sub eax, 1
je 0x1002d921
sub eax, 0x3c
je 0x1002d91a
sub eax, 0x8464
je 0x1002d92f
xor eax, eax
pop esi
pop ebp
ret 4
mov edx, 0x3030401
jmp 0x1002d934
mov edx, 0x3030701
jmp 0x1002d934
mov edx, 0x3030501
jmp 0x1002d934
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x1002d913
movzx eax, word [ecx + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x1002d957
mov ecx, 0x20b
cmp ax, cx
jne 0x1002d913
mov eax, dword [ebp + 8]
mov dword [eax], edx
xor eax, eax
inc eax
jmp 0x1002d915
Function at 0x100356b1
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp edx, 8
jb 0x100356d2
push edi
mov edi, edx
shr edi, 3
mov eax, dword [ecx + 4]
sub edx, 8
xor eax, dword [ecx]
add ecx, 8
xor esi, eax
sub edi, 1
jne 0x100356bf
pop edi
cmp edx, 4
jb 0x100356dc
xor esi, dword [ecx]
add ecx, 4
and edx, 3
cmp edx, 2
jbe 0x100356ed
movzx eax, byte [ecx]
shl eax, 0x10
xor esi, eax
inc ecx
cmp edx, 1
jbe 0x100356fb
movzx eax, byte [ecx]
shl eax, 8
xor esi, eax
inc ecx
test edx, edx
je 0x10035704
movzx ecx, byte [ecx]
xor esi, ecx
mov eax, esi
pop esi
ret
Function at 0x10047137
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10111ba7
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1014e058]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0x30]
call fcn.100d349e
pop ecx
lea ecx, [esi + 0x10]
call fcn.100470dc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1004717e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x1005124f
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [ecx]
xor ecx, ecx
mov eax, ecx
cmp dword [eax + str.Hah_], edx
je 0x1005126c
add eax, 0xc
inc ecx
cmp eax, 0xcc
jb 0x10051255
or eax, 0xffffffff
ret
mov eax, ecx
ret

Function at 0x1005bc8f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
lea eax, [edx + esi]
cmp edx, eax
cmova esi, ebx
test esi, esi
je 0x1005bcc3
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
movzx eax, word [eax*2 + 0x10153428]
xor ecx, eax
inc edx
inc edi
cmp edi, esi
jne 0x1005bca8
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret 4

Function at 0x1006203d
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x3c], 2
mov eax, dword [ebp + 8]
jge 0x10062059
cmp byte [ecx + 0x42], 0
je 0x100620ba
cmp eax, 0x3f
jb 0x100620ba
je 0x100620ae
dec eax
jmp 0x100620ba
cmp eax, 0x2c
jb 0x100620ba
cmp dword [ecx + 0x3c], 3
jl 0x1006206e
cmp eax, 0x2c
jne 0x1006206d
push 0x48
jmp 0x100620b9
dec eax
cmp dword [ecx + 0x3c], 4
jl 0x1006207e
cmp eax, 0x2c
jne 0x1006207d
push 0x49
jmp 0x100620b9
dec eax
cmp eax, 0x3a
jb 0x100620ba
cmp byte [ecx + 0x14], 0
je 0x1006209e
cmp eax, 0x3a
jne 0x10062092
push 0x44
jmp 0x100620b9
cmp eax, 0x3b
jne 0x1006209b
push 0x45
jmp 0x100620b9
sub eax, 2
cmp eax, 0x3f
jb 0x100620b2
cmp byte [ecx + 0x42], 0
je 0x100620b2
cmp eax, 0x3f
jne 0x10062056
push 0x46
jmp 0x100620b9
cmp eax, 0x44
jne 0x100620ba
push 0x47
pop eax
pop ebp
ret 4

Function at 0x10062849
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, edx
cmp esi, 2
jb 0x1006288f
cmp byte [ecx], 0x4d
jne 0x1006288f
cmp byte [ecx + 1], 0x5a
jne 0x1006288f
cmp esi, 0x40
jb 0x1006288f
mov edx, dword [ecx + 0x3c]
lea eax, [edx - 0x40]
cmp eax, 0xfc0
ja 0x1006288f
test dl, 7
jne 0x1006288f
lea eax, [edx + 0x18]
cmp eax, esi
ja 0x1006288f
cmp dword [ecx + edx], 0x4550
jne 0x1006288f
cmp word [ecx + edx + 0x14], 0x60
pop esi
sbb al, al
inc al
ret
xor al, al
pop esi
ret
Function at 0x100795e6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10115560
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1014e058]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x160]
mov dword [esi], vtable.NArchive::NSquashfs::CHandler.0
mov dword [esi + 4], vtable.NArchive::NSquashfs::CHandler.1.0
call fcn.10015cd3
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x814]
test ecx, ecx
je 0x10079637
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x808]
call fcn.100d349e
pop ecx
mov ecx, dword [esi + 0x15c]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x1007965a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x154]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x10079671
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x14c]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x10079688
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x144]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x1007969f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x128]
call fcn.100d349e
push dword [esi + 0x11c]
call fcn.100d349e
push dword [esi + 0x110]
call fcn.100d349e
add esp, 0xc
mov ecx, dword [esi + 0xf8]
mov dword [ebp - 4], 5
test ecx, ecx
je 0x100796da
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x7c]
call fcn.100d349e
pop ecx
lea ecx, [esi + 0x5c]
call fcn.100795c7
lea ecx, [esi + 0x3c]
call fcn.100795c7
push dword [esi + 0x30]
call fcn.100d349e
push dword [esi + 0x24]
call fcn.100d349e
push dword [esi + 0x18]
call fcn.100d349e
push dword [esi + 0xc]
call fcn.100d349e
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x100847ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
test edi, edi
je 0x100847e1
movzx eax, byte [ebx]
mov edx, esi
shr edx, 8
xor edx, eax
shl esi, 8
movzx eax, dl
movzx esi, si
movzx ecx, word [eax*2 + 0x10153648]
xor esi, ecx
inc ebx
sub edi, 1
jne 0x100847be
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10090cc3
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
add ecx, 0x18
jmp fcn.10012b90
Function at 0x100987dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x74
mov eax, 0x10117652
call fcn.100d350e
mov edi, ecx
mov esi, dword [ebp + 0xc]
mov edx, esi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov al, byte [esi + 0x2c]
mov byte [edi + 0x69], al
cmp dword [esi], 0x10900
push edi
sete al
mov dword [ebp - 0x40], ecx
mov byte [edi + 0x68], al
call fcn.1009971b
test eax, eax
jne 0x100989a3
mov eax, dword [esi + 0x80]
or eax, dword [esi + 0x84]
push 1
pop ebx
mov byte [ebp - 0x25], 0
je 0x10098834
mov byte [ebp - 0x25], bl
and dword [ebp - 0x38], 0
lea ecx, [ebp - 0x80]
call fcn.1008d3e6
and dword [ebp - 4], 0
and dword [ebp - 0x3c], 0
cmp dword [edi + 0x24], 0
jbe 0x10098991
and dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x20]
add eax, ecx
mov dword [ebp - 0x34], eax
cmp word [esi + 0x20], bx
jne 0x1009897b
cmp word [eax + 0x20], bx
jne 0x1009897b
xor ebx, ebx
lea ecx, [edi + 0x5c]
cmp byte [edi + 0x68], bl
sete bl
add ebx, dword [edi + 0x60]
call fcn.100975cf
mov edx, ebx
mov dword [ebp - 0x30], eax
mov ecx, eax
call fcn.10099a6c
mov ebx, dword [ebp - 0x34]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x80]
push edi
push esi
push ebx
push dword [ebp - 0x40]
call fcn.1009a5b3
test eax, eax
jne 0x100989b0
lea eax, [ebx + 0x2c]
push 0x14
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.100d550c
add esp, 0xc
test eax, eax
je 0x100988e4
cmp byte [esi + 0x2c], 0
je 0x100989ab
lea ecx, [ebx + 0x2c]
call fcn.1008f18c
test al, al
je 0x100989ab
mov eax, dword [ebp - 0x30]
and dword [eax + 0x1c], 0
cmp dword [edi + 0x3c], 0
jne 0x100988ff
push dword [ebp + 0x10]
lea ecx, [edi + 0x38]
call fcn.1009769a
mov eax, dword [ebp - 0x30]
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.100992cd
test eax, eax
jne 0x100989b0
mov dl, byte [ebp - 0x25]
test dl, dl
je 0x10098975
mov eax, dword [esi + 0x78]
cmp eax, dword [ebx + 8]
jne 0x1009892f
mov eax, dword [esi + 0x7c]
cmp eax, dword [ebx + 0xc]
jne 0x1009892f
xor ebx, ebx
inc ebx
mov dh, bl
jmp 0x10098934
xor ebx, ebx
xor dh, dh
inc ebx
xor ecx, ecx
movzx eax, dl
test dh, dh
cmove ecx, eax
cmp byte [esi + 0x2d], 0
mov dl, cl
mov byte [ebp - 0x25], dl
je 0x10098978
mov eax, dword [ebp - 0x34]
mov byte [ebp - 0x25], dl
cmp dword [eax + 0x24], ebx
jne 0x10098978
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
test dh, dh
je 0x10098964
cmp dword [esi + 0x28], eax
jne 0x10098999
mov byte [ebp - 0x25], dl
cmp dword [esi + 0x28], eax
jne 0x10098978
mov byte [ebp - 0x25], dl
test dh, dh
jne 0x10098978
jmp 0x10098999
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
add ecx, 0x40
inc eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x3c], eax
cmp eax, dword [edi + 0x24]
jb 0x10098859
cmp byte [ebp - 0x25], 0
jne 0x10098999
xor ebx, ebx
lea ecx, [ebp - 0x80]
call fcn.10097479
mov eax, ebx
call fcn.100d34b8
ret 0x10
xor ebx, ebx
inc ebx
jmp 0x10098999
mov ebx, eax
jmp 0x10098999
Function at 0x100aa542
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [esi + 0x18]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0xc], eax
mov al, byte [esi + 2]
mov word [edi], cx
mov byte [ebp + 0xf], al
cmp byte [esi + 1], cl
je 0x100aa5df
lea eax, [esi + 0x20]
push eax
lea ecx, [edi + 0x24]
call fcn.10018b50
lea eax, [esi + 0x2c]
lea ecx, [edi + 0x60]
cmp eax, ecx
je 0x100aa58c
push dword [eax + 4]
push dword [eax]
call fcn.10028197
movzx eax, byte [esi + 4]
mov ecx, edi
push eax
push 0x800
call fcn.100aa699
mov eax, dword [esi + 0x10]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x84], eax
mov al, byte [esi + 3]
mov byte [edi + 0x88], al
mov al, byte [ebp + 0xf]
xor edx, edx
mov dword [edi + 0x40], 0x3f
mov byte [edi + 5], dl
test al, al
jne 0x100aa5f8
mov byte [ebp - 4], 1
cmp byte [ebx + 0x58], dl
jne 0x100aa5fb
mov byte [ebp - 4], dl
push dword [ebp - 4]
mov ecx, edi
push 1
call fcn.100aa699
push dword [ebp + 8]
mov ecx, edi
push 8
call fcn.100aa699
cmp byte [ebp + 0xf], 0
je 0x100aa632
xor eax, eax
mov byte [edi + 4], 0x14
mov word [edi + 2], ax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x1c], eax
lea ecx, [edi + 0x30]
call fcn.100a469a
lea ecx, [edi + 0x50]
mov byte [edi + 0x3e], 0
call fcn.100a469a
xor ecx, ecx
mov byte [edi + 0x5e], cl
cmp byte [ebp + 0xf], cl
je 0x100aa66b
xor eax, eax
mov byte [edi + 4], 0x14
mov word [edi + 2], ax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x1c], ecx
jmp 0x100aa692
cmp byte [ebx + 0x58], cl
je 0x100aa692
cmp byte [ebx + 0x48], cl
je 0x100aa692
cmp dword [ebx + 0x50], ecx
jne 0x100aa67f
push 8
pop eax
jmp 0x100aa684
mov eax, dword [ebx + 0x4c]
mov al, byte [eax]
mov dl, byte [ebx + 0x49]
mov ecx, edi
movzx eax, al
push eax
call fcn.100a9d3b
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100ac446
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x10118e21
call fcn.100d34da
mov dword [ebp - 0x10], edx
mov edi, ecx
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
test ecx, ecx
je 0x100ac476
mov eax, dword [ecx]
push 3
push dword [esi + 8]
push 1
push ecx
call dword [eax + 0x10]
test eax, eax
jne 0x100ac5e3
cmp byte [esi + 1], 0
je 0x100ac52c
mov ebx, dword [ebp + 0x10]
mov al, byte [ebx]
shr al, 3
test al, 1
je 0x100ac496
mov eax, 0x80004001
jmp 0x100ac5e3
lea eax, [esi + 0x2c]
lea ecx, [ebx + 0x60]
cmp eax, ecx
je 0x100ac4aa
push dword [eax + 4]
push dword [eax]
call fcn.10028197
lea eax, [esi + 0x20]
push eax
lea ecx, [ebx + 0x24]
call fcn.10018b50
mov al, byte [esi + 4]
mov ecx, ebx
mov byte [ebp + 0x10], al
push dword [ebp + 0x10]
push 0x800
call fcn.100aa699
mov eax, dword [esi + 0x14]
lea ecx, [ebx + 0x50]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x74], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x78], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x7c], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x80], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x84], eax
mov al, byte [esi + 3]
mov byte [ebx + 0x88], al
call fcn.100aa4b2
lea ecx, [ebx + 0x30]
call fcn.100aa4b2
push 0
push ebx
mov ecx, edi
call fcn.100a906f
mov ecx, ebx
call fcn.100a9f50
mov ebx, eax
mov dword [ebp + 0x10], edx
jmp 0x100ac553
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi + 0x38]
mov edx, dword [edi + 0x3c]
mov dword [eax + 0x48], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0x4c], edx
call fcn.100a9f50
mov ecx, dword [ebp + 8]
mov ebx, eax
mov eax, edx
add ebx, dword [ecx + 0x70]
adc eax, 0
mov dword [ebp + 0x10], eax
and dword [ebp + 0x18], 0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x18]
and dword [ebp - 4], 0
push eax
movzx eax, byte [esi + 1]
push eax
push dword [ebp + 8]
call fcn.100a513f
mov esi, eax
mov eax, dword [ebp + 0x18]
test esi, esi
jne 0x100ac5d0
test eax, eax
jne 0x100ac583
mov esi, 0x80004001
jmp 0x100ac5d0
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x10]
add dword [eax], ebx
adc dword [eax + 4], esi
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.100a89a2
push dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
push esi
push ebx
call fcn.100b870e
add dword [edi + 0x38], ebx
mov esi, eax
mov eax, dword [ebp + 0x10]
adc dword [edi + 0x3c], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 4
test eax, eax
je 0x100ac5cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], 5
test eax, eax
je 0x100ac5e1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.100d34a3
ret 0x18
Function at 0x100b54b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x34], 0xa
jae 0x100b5515
nop dword [eax + eax]
mov edi, dword [esi]
cmp edi, 8
jae 0x100b54ed
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
je 0x100b55b4
mov dl, byte [eax]
lea ebx, [edi + 8]
mov ecx, 0x18
movzx edx, dl
sub ecx, edi
inc eax
shl edx, cl
or edx, dword [esi + 4]
mov dword [esi + 8], eax
jmp 0x100b54f2
mov edx, dword [esi + 4]
mov ebx, edi
mov eax, edx
shr edx, 0x18
shl eax, 8
mov dword [esi + 4], eax
lea eax, [ebx - 8]
mov dword [esi], eax
mov eax, dword [esi + 0x34]
mov byte [esi + eax + 0x70ce], dl
inc dword [esi + 0x34]
cmp dword [esi + 0x34], 0xa
jb 0x100b54c0
mov dword [esi + 0x70d8], 0
movzx eax, byte [esi + 0x70d4]
shl eax, 8
mov dword [esi + 0x70d8], eax
movzx ecx, byte [esi + 0x70d5]
or ecx, eax
shl ecx, 8
mov dword [esi + 0x70d8], ecx
movzx eax, byte [esi + 0x70d6]
or eax, ecx
lea ecx, [esi + 0x70ce]
shl eax, 8
mov dword [esi + 0x70d8], eax
movzx edi, byte [esi + 0x70d7]
or edi, eax
mov dword [esi + 0x70d8], edi
call fcn.100b44d0
test al, al
je 0x100b55ba
cmp byte [esi + 0x70e0], 0
jne 0x100b5588
add dword [esi + 0x70e8], 1
adc dword [esi + 0x70ec], 0
add dword [esi + 0x70f0], 1
mov byte [esi + 0x70e0], 1
adc dword [esi + 0x70f4], 0
mov eax, dword [esi + 0x70dc]
rol eax, 1
xor eax, edi
mov dword [esi + 0x70dc], eax
mov dword [esi + 0x30], 2
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea ecx, [esi + 0x70ce]
call fcn.100b4500
test al, al
je 0x100b561b
cmp byte [esi + 0x70e0], 0
jne 0x100b55e0
add dword [esi + 0x70e8], 1
adc dword [esi + 0x70ec], 0
mov edx, dword [esi + 4]
mov byte [esi + 0x70e0], 1
test edx, edx
je 0x100b55f5
mov byte [esi + 0x70e2], 1
mov eax, dword [esi]
mov ecx, eax
and ecx, 7
mov dword [esi + 0x30], 0xb
sub eax, ecx
shl edx, cl
mov dword [esi], eax
mov dword [esi + 4], edx
cmp edi, dword [esi + 0x70dc]
je 0x100b55b4
mov byte [esi + 0x70e1], 1
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x100b6790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
mov dword [ebp - 0x18], 0
push edi
mov dword [ebp - 0x14], 8
mov byte [ebp - 0x10], 0
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x8ce0]
mov dword [esi + 0x8cd4], 0
push dword [eax + 0x174]
push dword [ebp + 8]
push dword [esi]
call fcn.100b65c0
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x1a0], 0
je 0x100b6809
imul eax, dword [esi + 0x8cd8], 0x8e00
mov ecx, dword [ecx + 0x17c]
mov ecx, dword [eax + ecx + 0x8cf0]
call fcn.1001485a
mov ecx, dword [esi + 0x8ce0]
xor edi, edi
cmp dword [esi + 0x8cd4], edi
jbe 0x100b6849
lea edx, [esi + 0x7cd4]
nop dword [eax]
mov ecx, dword [esi + 0x8ce0]
lea edx, [edx + 4]
inc edi
mov eax, dword [ecx + 0x178]
rol eax, 1
xor eax, dword [edx - 4]
mov dword [ecx + 0x178], eax
cmp edi, dword [esi + 0x8cd4]
jb 0x100b6820
mov ecx, dword [esi + 0x8ce0]
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x10]
lea eax, [eax*8 + 8]
sub eax, dword [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.100b7c80
mov edi, dword [esi + 0x8ce0]
xor eax, eax
mov dword [ebp + 8], eax
cmp byte [edi + 0x1a0], al
je 0x100b68fe
mov eax, dword [esi + 0x8cd8]
inc eax
push ebx
xor ebx, ebx
cmp eax, dword [edi + 0x19c]
cmovne ebx, eax
cmp dword [edi + 0x1b4], 0
je 0x100b68e1
lea ecx, [edi + 0x148]
call fcn.100b058a
mov ecx, eax
mov eax, 0xf
sub eax, dword [edi + 0x140]
shr eax, 3
add ecx, eax
mov eax, dword [esi + 0x8ce0]
mov dword [ebp - 8], ecx
adc edx, 0
mov dword [ebp - 4], edx
mov ecx, dword [eax + 0x1b4]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x8cf8]
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0xc]
mov edi, dword [esi + 0x8ce0]
mov dword [ebp + 8], eax
mov ecx, dword [edi + 0x17c]
imul edx, ebx, 0x8e00
add edx, 0x8cf0
add ecx, edx
call fcn.1001480d
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100b72f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
push 0x31
mov dword [ebp - 4], ebx
call fcn.100b7c40
push 0x41
mov ecx, ebx
call fcn.100b7c40
push 0x59
mov ecx, ebx
call fcn.100b7c40
push 0x26
mov ecx, ebx
call fcn.100b7c40
push 0x53
mov ecx, ebx
call fcn.100b7c40
push 0x59
mov ecx, ebx
call fcn.100b7c40
mov eax, dword [ebp + 8]
or esi, 0xffffffff
xor ebx, ebx
xor edi, edi
mov dh, byte [eax]
nop dword [eax]
mov dl, byte [edi + eax]
cmp ebx, 4
jne 0x100b736a
test dl, dl
je 0x100b7366
movzx ecx, dh
nop
mov eax, esi
shl esi, 8
shr eax, 0x18
xor eax, ecx
xor esi, dword [eax*4 + 0x10153ab0]
add dl, 0xff
jne 0x100b7350
xor ebx, ebx
jmp 0x100b7394
mov ecx, esi
movzx eax, dl
shr ecx, 0x18
inc ebx
xor ecx, eax
shl esi, 8
mov eax, 1
xor esi, dword [ecx*4 + 0x10153ab0]
cmp dh, dl
movzx ecx, dh
cmovne ebx, eax
movzx eax, dl
cmovne ecx, eax
mov dh, cl
mov eax, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x100b7340
mov ecx, dword [ebp - 4]
not esi
push esi
call fcn.100b7d60
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push dword [ebp + 8]
call fcn.100b6910
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100b7fda
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov byte [ebp - 1], dl
or dword [ebx], 0xffffffff
cmp dword [ecx], 0x23170f69
jne 0x100b80b3
mov eax, 0x40c1
cmp word [ecx + 4], ax
jne 0x100b80b3
mov edi, dword [ebp + 0xc]
mov edx, 0x2790
mov byte [edi], 1
movzx eax, word [ecx + 6]
cmp ax, dx
jne 0x100b801f
mov byte [edi], 0
jmp 0x100b802d
mov edx, 0x2791
cmp ax, dx
jne 0x100b80b3
mov eax, dword [ecx + 8]
xor esi, esi
mov ecx, dword [ecx + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], ecx
cmp dword [0x10153858], esi
jbe 0x100b80b3
mov ch, byte [ebp + 8]
mov edx, dword [esi*4 + 0x10153860]
cmp eax, dword [edx + 8]
jne 0x100b8089
mov ebx, dword [ebp - 8]
cmp ebx, dword [edx + 0xc]
mov ebx, dword [ebp + 0x10]
jne 0x100b8089
xor eax, eax
cmp byte [edi], al
je 0x100b8068
cmp dword [edx + 4], eax
jmp 0x100b806a
cmp dword [edx], eax
sete al
test eax, eax
jne 0x100b8086
mov cl, byte [edx + 0x18]
test ch, ch
je 0x100b807f
test cl, cl
sete al
jmp 0x100b8082
movzx eax, cl
test eax, eax
je 0x100b8094
mov eax, dword [ebp + 0xc]
inc esi
cmp esi, dword [0x10153858]
jb 0x100b8046
jmp 0x100b80b3
movzx ecx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
xor ecx, 1
cmp dword [edx + 0x14], 1
cmove ecx, eax
test ecx, ecx
je 0x100b80b1
mov eax, 0x80004002
jmp 0x100b80b5
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100bf35e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101198dc
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1014e058]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x30]
mov dword [esi], vtable.NCompress::NLzma::CDecoder.0
mov edx, 0x1011a4ec
mov dword [esi + 4], vtable.NCompress::NLzma::CDecoder.1.0
mov dword [esi + 8], vtable.NCompress::NLzma::CDecoder.2.0
mov dword [esi + 0xc], vtable.NCompress::NLzma::CDecoder.3.0
mov dword [esi + 0x10], vtable.NCompress::NLzma::CDecoder.4.0
mov dword [esi + 0x14], vtable.NCompress::NLzma::CDecoder.5.0
mov dword [esi + 0x18], vtable.NCompress::NLzma::CDecoder.6.0
mov dword [esi + 0x1c], vtable.NCompress::NLzma::CDecoder.7.0
call fcn.10009ef0
mov ecx, dword [esi + 0x24]
call fcn.10002954
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xcc]
test ecx, ecx
je 0x100bf3e3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret