joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c3a70
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.1010c7b0
mov eax, dword [0x10183eb8]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100c3ae6
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x100c3ada
mov eax, 8
call fcn.1010c7b0
movsd xmm0, qword [0x10164500]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.10082c50
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100c3b4a
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x100c3b3e
mov eax, 8
call fcn.1010c7b0
movsd xmm0, qword [0x10164500]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.10082c50
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.100c3bd0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.1010c7b0
movsd xmm0, qword [0x1012c048]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call fcn.10082c50
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.1010c7b0
movsd xmm0, qword [0x1012c048]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call fcn.10082c50
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.1010c03e
add esp, 0x6c
ret
Function at 0x100c7150
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, 0x400
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, 0x80
mov esi, edx
mov ecx, edi
mov byte [ebp], 0
cmp dword [esp + 0x18], ecx
cmovle ecx, dword [esp + 0x18]
test eax, eax
cmovg esi, eax
cmp esi, edx
cmovg esi, edx
mov dword [esp + 0x14], esi
test ecx, ecx
jle 0x100c71a5
mov ebx, dword [esp + 0x1c]
mov edx, ebp
sub ebx, ebp
mov esi, ecx
mov al, byte [ebx + edx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub esi, 1
jne 0x100c7193
mov esi, dword [esp + 0x14]
movzx ebx, byte [ecx + ebp - 1]
cmp ecx, edi
jge 0x100c71ca
mov edx, ebp
movzx eax, byte [edx]
lea edx, [edx + 1]
add eax, ebx
movzx eax, al
movzx ebx, byte [eax + 0x10164ec8]
mov byte [ecx + ebp], bl
inc ecx
cmp ecx, edi
jl 0x100c71b0
mov ecx, dword [esp + 0x14]
lea ebx, [esi + 7]
sar ebx, 3
neg ecx
sub edi, ebx
and ecx, 7
movzx eax, byte [edi + ebp]
lea esi, [edi + ebp]
mov edx, 0xff
sar edx, cl
and edx, eax
movzx ecx, byte [edx + 0x10164ec8]
mov byte [esi], cl
test edi, edi
je 0x100c7218
nop dword [eax + eax]
movzx eax, byte [esi + ebx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x10164ec8]
mov byte [esi], cl
sub edi, 1
jne 0x100c7200
lea esi, [ebp + 0xfc]
mov edi, 0x40
lea edx, [ebp + 0x7e]
movzx ecx, byte [edx + 1]
lea esi, [esi - 4]
movzx eax, byte [edx]
lea edx, [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
sub edi, 1
jne 0x100c7226
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100cbe30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.1010c7b0
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [esi + 0x160]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esp + 0x14], ebx
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp edi, 0xc
jne 0x100cbedb
mov eax, dword [esp + 0x18]
mov edi, 1
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
jmp 0x100cbff9
mov dword [esp + 0xc], edi
push ebp
mov ebp, dword [esp + 0x1c]
cmp edi, 0x10
jb 0x100cbf53
mov ebx, ebp
lea ecx, [esi + 0xf]
mov eax, edi
sub ebx, esi
shr eax, 4
mov dword [esp + 0x20], eax
nop dword [eax]
lea eax, [ebx + ecx]
cmp esi, eax
ja 0x100cbf22
cmp ecx, ebp
jb 0x100cbf22
mov ecx, esi
mov edx, 0x10
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x100cbf12
jmp 0x100cbf30
movups xmm1, xmmword [esi]
movups xmm0, xmmword [ebp]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x20]
add esp, 8
lea ecx, [esi + 0xf]
add ebp, 0x10
add ebx, 0x10
sub edi, 0x10
sub dword [esp + 0x20], 1
jne 0x100cbf00
mov ebx, dword [esp + 0x18]
test edi, edi
je 0x100cbfd2
xor edx, edx
test edi, edi
je 0x100cbfc8
cmp edi, 0x20
jb 0x100cbfab
lea eax, [ebp - 1]
lea ecx, [esi - 1]
add eax, edi
add ecx, edi
cmp esi, eax
ja 0x100cbf74
cmp ecx, ebp
jae 0x100cbfab
mov ecx, edi
mov ebx, ebp
and ecx, 0xffffffe0
mov eax, esi
sub ebx, esi
nop
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [edx + ebp + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x100cbf80
cmp edx, edi
jae 0x100cbfc4
sub ebp, esi
lea ecx, [edx + esi]
sub edi, edx
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x100cbfb6
mov ebx, dword [esp + 0x18]
lea eax, [esi + 0x60]
push eax
push esi
call ebx
add esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0xc], eax
lea eax, [esi + 0x60]
push eax
bswap ecx
xor dword [esi + 8], ecx
push esi
call ebx
mov edi, dword [esi + 0xc]
add esp, 8
bswap edi
pop ebp
push dword [esi + 0x174]
lea eax, [esi + 0x20]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100d1000
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x100d1014
mov dword [esp + 0x18], fcn.100cf7e0
jmp fcn.100caa70
mov dword [esp + 0x18], fcn.100cea80
jmp fcn.100ca7c0
Function at 0x100deb60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.1010c7b0
mov eax, dword [0x10183eb8]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x100debc6
cmp edi, dword [esi]
je 0x100debbd
test ebp, ebp
je 0x100dec40
test ebx, ebx
js 0x100dec40
mov eax, 1
mov dword [esi], edi
jmp 0x100debcc
mov edi, dword [esi]
test edi, edi
je 0x100dec40
test ebp, ebp
je 0x100ded5a
push edi
call fcn.100bce50
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x100dec00
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.10062e80
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x100dec5b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.1006cef0
add esp, 0xc
test eax, eax
je 0x100dec40
push ebx
push ebp
push dword [esi + 4]
call fcn.1006d0a0
add esp, 0xc
test eax, eax
je 0x100dec40
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.1006ce50
add esp, 0xc
test eax, eax
jne 0x100dec77
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010c03e
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x100dec40
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.1010dab0
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x100dec9a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.1010d3d0
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x100deca0
push edx
push edi
push dword [esi + 8]
call fcn.1006cef0
add esp, 0xc
test eax, eax
je 0x100dec40
push edi
call fcn.100bce50
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.1006d0a0
add esp, 0x10
test eax, eax
je 0x100dec40
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x100decf0
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.1006cef0
add esp, 0xc
test eax, eax
je 0x100dec40
push edi
call fcn.100bce50
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.1006d0a0
add esp, 0x10
test eax, eax
je 0x100dec40
push dword [esi + 8]
push dword [esi + 4]
call fcn.1006d0d0
add esp, 8
test eax, eax
je 0x100dec40
mov eax, 1
jmp 0x100dec42
test eax, eax
je 0x100ded3a
jmp 0x100dec9e
Function at 0x101074b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.1010c7b0
mov eax, dword [0x10183eb8]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x10107510
push 0x4d1
push 0x10171578
push str.assertion_failed:_rec__orig_len___md_size
call fcn.10062e80
add esp, 0xc
cmp ebx, 0x40
jbe 0x1010752c
push 0x4d2
push 0x10171578
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.10062e80
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x1010755a
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.1010d3d0
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x1010760d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x10107595
xor edx, edx
test ebx, ebx
je 0x10107641
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x10107617
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010c03e
add esp, 0xa8
ret
Function at 0x101081a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.1010c7b0
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x28]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x101081ed
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x101081dd
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x101081f2
cmp edi, dword [esi + 8]
ja 0x101081d4
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebp
call fcn.100e6750
push eax
call fcn.10096680
add esp, 8
test eax, 0x200000
je 0x10108238
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x101082c4
mov eax, dword [esi + 0x14]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebp, dword [esp + 0x10]
shr edx, 0x1f
dec ebp
mov dword [esp + 0x18], edx
add ebp, eax
nop
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x2c]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jb 0x10108280
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x1011ec3c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1011eabb

Function at 0x101220a9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10121d69
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000e9bf
pop dword [ebp - 0xc]
mov eax, 0x1000e9bf
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x7e0eb80
add dword [ebp - 0x1c], 0x467159cb
mov dword [ebp - 0x18], 0x5c30f9b9
sub dword [ebp - 0x18], 0x29fdad74
mov dword [ebp - 0x14], 0x9ae375f
add dword [ebp - 0x14], 0x429e0ccf
mov dword [ebp - 0x10], 0x5322cf9a
sub dword [ebp - 0x10], 0x5322cf9a
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x46eb459f
sub dword [ebp - 0x1c], 0xd278dc49
mov dword [ebp - 0x18], 0x21fb3ced
add dword [ebp - 0x18], 0x1f712488
mov dword [ebp - 0x14], 0xba86bf27
sub dword [ebp - 0x14], 0x571752bb
mov dword [ebp - 0x10], 0x7d7347be
sub dword [ebp - 0x10], 0x7d7347be
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x4e736d6e
sub eax, 0x3e71dd36
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3cc11
push 0
call eax
mov ecx, 0xafc94b88
add ecx, 0x5037153f
xor edx, edx
add edx, eax
mov edi, 0x24d9bfec
add edi, 0xeb286814
add edi, dword [ebp - 0xc]
mov esi, 0x84406008
add esi, 0x3d21f736
mov dword [ebp - 4], 0x1afef674
mov ebx, dword [edi]
mov dword [ebp - 4], 0xca48ac1e
sub ebx, esi
add dword [ebp - 4], eax
mov dword [edx], ebx
xor dword [ebp - 4], ecx
add edx, 4
add edi, 4
loop 0x1000ead9
add eax, 0xae2c08d9
sub eax, 0xae2a92ea
mov ebx, eax
add eax, 5
mov ecx, 0x9e97ef88
add ecx, 0x71681078
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x10001000
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001010
sub eax, edx
mov edi, eax
xor eax, eax
lea ecx, [ecx]
mov byte [eax + 0x10010a68], al
inc eax
cmp eax, 0x100
jl 0x10001020
xor ecx, ecx
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 8]
movzx ebx, byte [ecx + 0x10010a68]
movzx edx, byte [edx + eax]
add edx, ebx
add esi, edx
and esi, 0x800000ff
jns 0x10001057
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [esi + 0x10010a68]
mov byte [ecx + 0x10010a68], al
inc ecx
mov byte [esi + 0x10010a68], bl
cmp ecx, 0x100
jl 0x10001030
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x100014b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov bl, byte [0x1000fdb8]
push esi
push edi
mov dword [ebp - 8], 3
jmp 0x100014d0
movsx eax, byte [0x1000fdc0]
cmp eax, 0x412bcc
jg 0x10001577
movsx ecx, byte [0x1000fdbf]
cmp ecx, 0x8c1321
jl 0x100014fc
or bl, 0xe7
mov byte [0x1000fdc3], bl
jmp 0x10001503
mov byte [0x1000fdbb], 0xc4
mov byte [0x1000fdc4], 0x10
mov byte [0x1000fdbf], 0x93
call fcn.10001b40
mov dl, byte [0x1000fdc3]
add dl, 0x41
mov byte [0x1000fdc1], dl
mov byte [0x1000fdba], 0xac
mov byte [0x1000fdc0], 0
mov dword [ebp - 4], 5
lea ebx, [ebx]
mov edi, 5
mov esi, 2
lea ebx, [ebx]
call fcn.10001b90
mov bl, al
call fcn.10001730
xor bl, al
dec esi
mov byte [0x1000fdc6], bl
jne 0x10001550
dec edi
jne 0x10001545
dec dword [ebp - 4]
jne 0x10001540
mov bl, byte [0x1000fdb8]
jmp 0x10001595
mov bl, 0xa7
sub bl, byte [0x1000fdba]
mov byte [0x1000fdb8], bl
call fcn.10001c80
xor al, byte [0x1000fdc0]
mov byte [0x1000fdb9], al
dec dword [ebp - 8]
jne 0x100014d0
pop edi
pop esi
mov al, 8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10004846
push eax
push eax
push eax
push 0x10001fb0
push eax
push eax
call fcn.10004b69
add esp, 0x18
test eax, eax
je 0x10004846
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100048b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100048ba
repz ret
jmp fcn.10004e86
Function at 0x1000aca4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10005fef
and dword [ebp - 0x14], 0
cmp dword [0x10010a48], 0
mov dword [ebp - 0x18], eax
jne 0x1000ad57
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000adff
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000adff
mov esi, dword [0x1000fdb4]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10010a48], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10010a4c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10010a50], eax
call edi
push eax
call esi
mov dword [0x10010a58], eax
test eax, eax
je 0x1000ad57
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10010a54], eax
mov eax, dword [0x10010a54]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x1000fdb0]
cmp eax, ecx
je 0x1000adb0
cmp dword [0x10010a58], ecx
je 0x1000adb0
push eax
call esi
push dword [0x10010a58]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000adb0
test ebx, ebx
je 0x1000adb0
call edi
test eax, eax
je 0x1000ada7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000ada7
test byte [ebp - 8], 1
jne 0x1000adb0
or dword [ebp + 0x10], 0x200000
jmp 0x1000ade3
mov eax, dword [0x10010a4c]
cmp eax, dword [ebp - 0x18]
je 0x1000ade3
push eax
call esi
test eax, eax
je 0x1000ade3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000ade3
mov eax, dword [0x10010a50]
cmp eax, dword [ebp - 0x18]
je 0x1000ade3
push eax
call esi
test eax, eax
je 0x1000ade3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10010a48]
call esi
test eax, eax
je 0x1000adff
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000ae01
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100048b0
leave
ret

Function at 0x408959
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.00408978
or ecx, ecx
xor dword [edx], ebx
mov eax, ecx
inc ecx
inc edx
add eax, eax
push 0x8c667046
pop eax
cmp edx, edi
jne fcn.00408959
ret
Function at 0x674a2030
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x674a1fab
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x674a1fc9
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x674a2027
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x674a200e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x674a2017
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x674a2021
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x674a2003
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x674a1f8d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x674a2074
dec eax
je 0x674a206b
sub eax, 3
je 0x674a2062
mov dword [ebp - 4], 0x40
jmp 0x674a2091
mov dword [ebp - 4], 4
jmp 0x674a2077
mov dword [ebp - 4], 0x20
jmp 0x674a2077
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x674a20c3
invalid
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x674a2043
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.674a18d4
les edx, [ecx]
lodsd eax, dword gs:[esi]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x674a20cf
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi

Function at 0x674a2110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
invalid
invalid
invalid
cld
invalid