joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7651b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00765140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00765140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00765140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00765140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x765bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x765c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x77787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x765c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x765c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1000aed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
cmp dword [esi + 4], ebp
jne 0x1000aee5
pop esi
mov eax, 0x271f
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x14]
push edi
test ebx, ebx
je 0x1000af51
push dword [esi + 8]
push 0
push dword [esi]
call sub.MSVCR120.dll_memset
mov edi, dword [esp + 0x28]
add esp, 0xc
cmp edi, dword [esi + 8]
jbe 0x1000af28
push dword [esi + 4]
call fcn.1000a1e0
push edi
push ebx
push dword [esi + 4]
call fcn.1000a210
push dword [esi]
push dword [esi + 4]
call fcn.1000a240
add esp, 0x18
jmp 0x1000af36
push edi
push ebx
push edi
push dword [esi]
call dword [sym.imp.MSVCR120.dll_memcpy_s]
add esp, 0x10
xor ecx, ecx
cmp dword [esi + 8], ecx
jbe 0x1000af51
lea ecx, [ecx]
mov eax, dword [esi]
xor dword [eax + ecx], 0x36363636
add ecx, 4
cmp ecx, dword [esi + 8]
jb 0x1000af40
push dword [esi + 4]
call fcn.1000a1e0
push dword [esi + 8]
push dword [esi]
push dword [esi + 4]
call fcn.1000a210
add esp, 0x10
test ebx, ebx
jne 0x1000af76
cmp dword [esi + 0x10], ebp
jne 0x1000b02e
mov ecx, dword [esi + 4]
push 0
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
shr eax, 1
and eax, 1
mov dword [esi + 0x20], eax
lea eax, [esp + 0x18]
push eax
push 0
push ecx
je 0x1000af9a
call fcn.10019a00
jmp 0x1000af9f
call fcn.10009e70
mov ebx, dword [esp + 0x30]
lea edi, [esi + 0x10]
add esp, 0x10
push ebx
push dword [edi]
call fcn.1003a6a0
lea ebp, [esi + 0x14]
push ebx
push dword [ebp]
call fcn.1003a6a0
mov eax, dword [esp + 0x24]
push 0
add eax, 7
mov dword [edi], 0
and eax, 0xfffffff8
mov dword [ebp], 0
push ebx
push eax
push edi
mov dword [esp + 0x34], eax
call fcn.1003a690
add esp, 0x20
test eax, eax
jne 0x1000b0a3
push eax
push ebx
push dword [esp + 0x1c]
push ebp
call fcn.1003a690
add esp, 0x10
test eax, eax
jne 0x1000b0a3
cmp dword [esi + 0x20], 0
mov eax, dword [esp + 0x14]
push eax
push 0
push dword [edi]
mov dword [esi + 0x18], eax
push dword [esi + 4]
je 0x1000b020
call fcn.10019a00
jmp 0x1000b025
call fcn.10009e70
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x1000b0a1
xor ecx, ecx
cmp dword [esi + 8], ecx
jbe 0x1000b051
jmp 0x1000b040
mov eax, dword [esi]
xor dword [eax + ecx], 0x6a6a6a6a
add ecx, 4
cmp ecx, dword [esi + 8]
jb 0x1000b040
push dword [esi + 4]
call fcn.1000a1e0
push dword [esi + 8]
push dword [esi]
push dword [esi + 4]
call fcn.1000a210
add esp, 0x10
cmp dword [esi + 0x20], 0
push dword [esi + 0x18]
push 0
push dword [esi + 0x14]
push dword [esi + 4]
je 0x1000b081
call fcn.10019a00
jmp 0x1000b086
call fcn.10009e70
xor ecx, ecx
add esp, 0x10
cmp dword [esi + 8], ecx
jbe 0x1000b0a1
mov eax, dword [esi]
xor dword [eax + ecx], 0x5c5c5c5c
add ecx, 4
cmp ecx, dword [esi + 8]
jb 0x1000b090
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x10034910
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 8], 0
mov eax, dword [edi + 0x38]
lea esi, [edi + 0x50]
add eax, 0x10
push eax
lea eax, [esp + 0xc]
push eax
push esi
push dword [edi + 0x8c]
push 0
push dword [edi + 4]
call fcn.1000e290
add esp, 0x18
test eax, eax
jne 0x10034a7d
mov edx, dword [esp + 8]
cmp edx, dword [esp + 0x2c]
push ebx
cmova edx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], edx
test edx, edx
jle 0x1003497e
mov ebx, dword [esp + 0x2c]
mov al, byte [ecx + ebx]
xor byte [esi + ecx], al
inc ecx
cmp ecx, edx
jl 0x10034973
cmp dword [edi + 0x98], 0
mov eax, dword [edi + 0x38]
lea ebx, [eax + 0x10]
je 0x100349aa
push 0
push 1
push eax
lea eax, [edi + 8]
push eax
push dword [edi]
call fcn.100331a0
mov ecx, eax
add esp, 0x14
test ecx, ecx
jne 0x10034a66
push 0x10
push dword [edi + 0x3c]
lea eax, [esp + 0x18]
push 0x10
push eax
call dword [sym.imp.MSVCR120.dll_memcpy_s]
add esp, 0x10
mov eax, 0xf
inc byte [esp + eax + 0x10]
jne 0x100349cd
dec eax
jns 0x100349c4
push 0x10
lea eax, [esp + 0x14]
push eax
lea esi, [edi + 8]
push esi
push dword [edi]
call fcn.100268f0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x10034a66
mov eax, 0xf
inc byte [esp + eax + 0x10]
jne 0x100349fa
dec eax
jns 0x100349f1
push 0x10
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 0x18]
push eax
push dword [edi]
call fcn.10003e90
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x10034a66
cmp dword [edi + 0x38], 0x10
jbe 0x10034a44
mov eax, 0xf
inc byte [esp + eax + 0x10]
jne 0x10034a29
dec eax
jns 0x10034a20
push 0x10
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 0x28]
push eax
push dword [edi]
call fcn.100268f0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x10034a66
test ebx, ebx
jle 0x10034a5c
jmp 0x10034a50
mov al, byte [esi + 0x48]
lea esi, [esi + 1]
xor byte [esi - 1], al
dec ebx
jne 0x10034a50
mov dword [edi + 0x98], 1
mov eax, ecx
pop ebx
test ecx, ecx
jne 0x10034a7d
mov dword [edi + 0x80], 1
mov dword [edi + 0x84], ecx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.1004475d
add esp, 0x18
ret
Function at 0x100352d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push ebx
push ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
push esi
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
shr eax, 4
mov edx, dword [esi]
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x54], eax
push edi
mov edi, dword [esi + 0xc]
mov dword [esp + 0x20], edi
test eax, eax
je 0x100353cf
mov esi, dword [esp + 0x58]
lea eax, [ecx + 8]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x14], eax
add ecx, 8
mov edi, edi
mov eax, dword [ecx - 8]
mov ebp, dword [ecx - 4]
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
add ecx, 0x10
push dword [esp + 0x24]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x30], ecx
call dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
add esp, 8
mov eax, dword [esp + 0x38]
xor eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x34]
mov dword [ecx - 8], eax
mov eax, dword [esp + 0x3c]
xor eax, dword [esp + 0x10]
mov dword [ecx - 4], eax
mov eax, dword [esp + 0x40]
xor eax, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x44]
xor eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
add ecx, 0x10
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], edi
dec esi
jne 0x10035340
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
xor eax, eax
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebx
mov dword [esi], edx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004475d
add esp, 0x3c
ret
Function at 0x418010
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
mov eax, dword [0x635acc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [0x632038]
push eax
mov dword [esp + 0xc], 0
mov dword [0x635acc], eax
lea edx, [ecx + ecx]
mov ecx, dword [0x63203c]
or edx, ecx
mov dword [esp + 8], edx
fild qword [esp + 8]
fadd qword [0x632050]
fstp qword [0x632050]
call dword [sym.imp.ole32.dll_RevokeDragDrop]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add byte [ebp + 0x5100244c], cl

Function at 0x62a975
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632388
cmp edx, dword [eax]
je 0x62a997
add eax, 8
inc ecx
cmp eax, 0x632418
jl 0x62a988
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x632388]
jne 0x62aac5
mov eax, dword [0x636d10]
cmp eax, 1
je 0x62aa9f
test eax, eax
jne 0x62a9c8
cmp dword [0x6322b0], 1
je 0x62aa9f
cmp edx, 0xfc
je 0x62aac5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62a9ff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062b360
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062b7f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62aa42
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062b7f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62f8a4
push edi
call fcn.0062d6c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062b360
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062b370
lea eax, [ebp - 0xa0]
push 0x62f884
push eax
call fcn.0062b370
push dword [esi + 0x63238c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062b370
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062d634
add esp, 0x2c
pop edi
jmp 0x62aac5
lea eax, [ebp + 8]
lea esi, [esi + 0x63238c]
push 0
push eax
push dword [esi]
call fcn.0062b7f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404d32
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004054e0
pop ecx
mov esi, eax
test esi, esi
jne 0x404d65
push 1
call fcn.00404530
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404dbb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404dde
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404dc6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404dd9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404dc1
lea eax, [ecx + 1]
push eax
call fcn.004054e0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404e05
push 1
call fcn.00404530
pop ecx
mov esi, ebx
jmp 0x404e3a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404e0e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404e35
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404e25
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404e09
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404e51
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x710c73
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x7109ec
inc eax
call fcn.00710caa
or ebx, eax
and eax, ebx
sub esp, 4
mov dword [esp], 0xa1b80dbe
mov eax, dword [esp]
add esp, 4
xor dword [edx], ecx
mov ebx, 0x6f077b7c
add edx, 1
or eax, eax
cmp edx, edi
jne fcn.00710c73
add ebx, ebx
ret
Function at 0x51d640
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc0000]
mov dword [edi + 0xcf740], 0xf898813a
push edi
jmp 0x51d66a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51d671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d660
mov eax, 1
add ebx, ebx
jne 0x51d683
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51d694
jne 0x51d6b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d6b3
dec eax
add ebx, ebx
jne 0x51d6a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51d678
add ebx, ebx
jne 0x51d6af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51d705
xor ecx, ecx
sub eax, 3
jb 0x51d6cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51d73a
sar eax, 1
mov ebp, eax
jmp 0x51d6d6
add ebx, ebx
jne 0x51d6d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d6a4
inc ecx
add ebx, ebx
jne 0x51d6e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51d6a4
add ebx, ebx
jne 0x51d6f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51d6e6
jne 0x51d702
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51d6e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51d724
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51d716
jmp 0x51d666
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51d724
add edi, ecx
jmp 0x51d666
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51d742
cmp byte [edi], 0x11
jne 0x51d742
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51d747
lea edi, [esi + 0x116000]
mov eax, dword [edi]
or eax, eax
je 0x51d7bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x154f9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x155118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51d774
mov ecx, edi
jns 0x51d7a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15511c]
or eax, eax
je 0x51d7b9
mov dword [ebx], eax
add ebx, 4
jmp 0x51d791
call dword [esi + 0x15512c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x51d7f0
cmp al, 0xef
ja 0x51d7e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x51d7c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x51d7d2
mov ebp, dword [esi + 0x155120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51d824
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x10001460
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x508
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x1003a794]
lea eax, [esp + 8]
push 0x105
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, 3
lea edi, [esp + 8]
mov byte [ecx + edx], 0x74
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 8]
dec ecx
sub eax, 2
lea edi, [esp + 8]
mov edx, dword [esp + 0x514]
mov byte [ecx + eax], 0x78
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x110]
mov byte [esp + ecx + 7], 0x74
lea ecx, [esp + 0x518]
push ecx
push edx
push 0x400
push eax
call fcn.10023a93
mov eax, dword [0x1003a798]
add esp, 0x10
test eax, eax
je 0x1000154c
lea ecx, [esp + 8]
push 0x10038064
push ecx
call fcn.10023a80
mov esi, eax
add esp, 8
test esi, esi
je 0x1000154c
lea edx, [esp + 0x110]
push esi
push edx
call fcn.10023a1d
push esi
call fcn.100239c7
add esp, 0xc
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x508
ret
Function at 0x10012560
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
test edi, edi
jle 0x100125a1
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
xor edx, edx
mov ax, word [esi]
mov dl, byte [ecx + ebp]
mov ebx, eax
and ebx, 0xff
xor edx, ebx
sar eax, 8
mov edx, dword [edx*4 + 0x10038a8c]
xor edx, eax
inc ecx
cmp ecx, edi
mov word [esi], dx
jl 0x10012576
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x1001df20
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [edi + 4]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
cmp eax, ecx
jl 0x1001df6c
xor ebx, ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
mov dword [edi + 4], eax
je 0x1001df45
mov dword [eax + 0x10], ebx
jmp 0x1001df4a
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov eax, dword [esi]
push eax
call fcn.10024e6d
push esi
call fcn.10024e6d
mov esi, dword [edi + 4]
add esp, 8
cmp esi, ebx
je 0x1001df8d
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
cmp eax, ecx
jge 0x1001df36
mov ecx, dword [edi + 4]
mov edx, dword [ecx]
xor ecx, ecx
mov cl, byte [edx + eax]
mov edx, dword [edi + 0x2c]
dec edx
mov eax, ecx
mov dword [edi + 0x2c], edx
mov edi, dword [edi + 4]
mov ecx, dword [edi + 8]
inc ecx
mov dword [edi + 8], ecx
pop edi
pop esi
pop ebx
ret
push str.Fatal_error__tried_to_read_past_mp_buffer_n
push 0x10039a88
call fcn.10025fb3
add esp, 8
push 1
call fcn.10026012
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1001e1d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
test eax, 0x100000
je 0x1001e1f9
mov ecx, eax
mov dword [esi + 0x10], 0
not ecx
shr ecx, 0x13
and ecx, 1
mov dword [esi + 0xc], ecx
jmp 0x1001e207
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 1
mov edx, eax
mov ecx, eax
shr edx, 0x11
and edx, 3
mov ebp, 4
and ecx, 0xc00
sub ebp, edx
cmp ecx, 0xc00
mov dword [esi + 0x18], ebp
jne 0x1001e242
push str.Stream_error_n
push 0x10039a88
call fcn.10025fb3
add esp, 8
push 1
call fcn.10026012
mov edx, dword [esi + 0x10]
test edx, edx
je 0x1001e259
mov ecx, eax
shr ecx, 0xa
and ecx, 3
add ecx, 6
mov dword [esi + 0x24], ecx
jmp 0x1001e26c
mov ecx, dword [esi + 0xc]
mov edi, eax
shr edi, 0xa
and edi, 3
lea ecx, [ecx + ecx*2]
add edi, ecx
mov dword [esi + 0x24], edi
mov ecx, eax
not ecx
shr ecx, 0x10
and ecx, 1
test edx, edx
mov dword [esi + 0x1c], ecx
je 0x1001e288
mov edx, eax
shr edx, 0xc
and edx, 0xf
mov dword [esi + 0x20], edx
mov ebx, eax
mov ecx, eax
shr ebx, 4
and ebx, 3
mov edx, eax
mov dword [esi + 0x34], ebx
mov ebx, eax
shr ecx, 8
shr ebx, 3
and ecx, 1
and ebx, 1
mov dword [esi + 0x2c], ecx
mov ecx, eax
mov dword [esi + 0x38], ebx
mov edi, eax
mov ebx, eax
and eax, 3
shr ecx, 6
shr edx, 0xc
shr edi, 9
shr ebx, 2
and ecx, 3
mov dword [esi + 0x40], eax
and edx, 0xf
and edi, 1
and ebx, 1
xor eax, eax
cmp ecx, 3
mov dword [esi + 0x20], edx
setne al
inc eax
mov dword [esi + 0x28], edi
mov dword [esi], eax
mov eax, ebp
sub eax, 2
mov dword [esi + 0x30], ecx
mov dword [esi + 0x3c], ebx
je 0x1001e35f
dec eax
je 0x1001e30a
push ebp
push str.Sorry__layer__d_not_supported_n
push 0x10039a88
call fcn.10025fb3
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
test edx, edx
jne 0x1001e31b
mov dword [esi + 0x44], edx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov ecx, dword [esi + 0xc]
lea eax, [ecx + ecx*2]
shl eax, 4
add eax, edx
mov edx, dword [esi + 0x24]
mov eax, dword [eax*4 + 0x10031ffc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 7
mov dword [esi + 0x44], eax
mov ebx, dword [edx*4 + 0x100320fc]
shl ebx, cl
cdq
idiv ebx
lea eax, [eax + edi - 4]
pop edi
mov dword [esi + 0x44], eax
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov eax, dword [esi + 0xc]
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, edx
mov eax, dword [ecx*4 + 0x10031fbc]
mov ecx, dword [esi + 0x24]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 7
mov dword [esi + 0x44], eax
cdq
idiv dword [ecx*4 + 0x100320fc]
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0x20
lea edx, [eax + edi - 4]
pop edi
mov dword [esi + 0x44], edx
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x10026ad8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov bl, byte [edi]
inc edi
test bl, bl
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp + 0xc], edi
je 0x100271f1
mov ecx, dword [ebp - 0x10]
xor edx, edx
jmp 0x10026b0c
cmp dword [ebp - 0x14], edx
jl 0x100271f1
cmp bl, 0x20
jl 0x10026b2d
cmp bl, 0x78
jg 0x10026b2d
movsx eax, bl
mov al, byte [eax + 0x10036108]
and eax, 0xf
jmp 0x10026b2f
xor eax, eax
movsx eax, byte [esi + eax*8 + 0x10036128]
sar eax, 4
cmp eax, 7
mov dword [ebp - 0x30], eax
ja 0x100271e0
jmp dword [eax*4 + 0x100271f9]
inc ebp
cdq
sub dh, al
inc ebp
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
invalid
invalid