joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c9e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x43ca04
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
xor cl, byte [eax]
lea eax, [eax + 1]
or dl, cl
dec esi
jne 0x43c9f6
pop edi
movzx eax, dl
pop esi
ret

Function at 0x43cb50
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.0042d520
mov eax, dword [0x535820]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x43cbd7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x43cbd7
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.004e1e9b
add esp, 0x10
lea ecx, [esp + 4]
push 0
push ecx
test eax, eax
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0041d8e4
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0xff
push eax
call fcn.004e1e9b
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x43cc64
call fcn.0043ca10
test eax, eax
jle 0x43cc64
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0041d8e4
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0041d8e4
add esp, 0x108
ret
Function at 0x44e160
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20
call fcn.0042d520
mov eax, dword [0x535820]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44e185
push 0
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
push edi
push 8
push 0xfde9
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jg 0x44e1f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x44e1e3
push 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jg 0x44e1f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jmp 0x44e26c
lea eax, [esi + esi]
call fcn.0042d6e0
mov eax, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push edi
push dword [ebp - 0x18]
push 0xfde9
call esi
test eax, eax
je 0x44e2cb
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44e220
push 8
sub ecx, edx
lea eax, [ebp - 0x14]
push eax
lea eax, [ecx + 1]
push eax
push ebx
push 0
push 0xfde9
call esi
test eax, eax
je 0x44e2cb
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
call fcn.004e263c
mov esi, eax
add esp, 8
test esi, esi
jne 0x44e27e
call fcn.004237f2
cmp dword [eax], 2
je 0x44e26e
call fcn.004237f2
cmp dword [eax], 9
jne 0x44e2cb
push ebx
push edi
call fcn.0041f7fc
mov esi, eax
add esp, 8
test esi, esi
je 0x44e2cb
push 0x536a10
call fcn.004485b0
mov edi, eax
add esp, 4
test edi, edi
jne 0x44e29f
push esi
call fcn.00420242
add esp, 4
jmp 0x44e333
push 0
push edi
call fcn.004481f0
push esi
push 1
push 0x6a
push edi
call fcn.00448220
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d8e4
mov esp, ebp
pop ebp
ret
push 0xa8
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0043afa0
push 0x50469c
push ebx
push 0x5046a0
push edi
push str.fopen_
push 5
call fcn.0043a600
add esp, 0x2c
call fcn.004237f2
cmp dword [eax], 2
jne 0x44e31b
push 0xab
push str..crypto_bio_bss_file.c
push 0x80
jmp 0x44e327
push 0xad
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0043afa0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d8e4
mov esp, ebp
pop ebp
ret
Function at 0x4582e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0042d520
mov eax, dword [0x535820]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
xor eax, eax
mov dword [esp + 0x10], edx
test edi, edi
je 0x458346
cmp edi, dword [esi]
je 0x45833d
test ebp, ebp
je 0x4583c0
test ebx, ebx
js 0x4583c0
mov eax, 1
mov dword [esi], edi
jmp 0x45834c
mov edi, dword [esi]
test edi, edi
je 0x4583c0
test ebp, ebp
je 0x4584db
push edi
call fcn.00455e70
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x458380
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.0043cc90
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x4583db
push dword [esp + 0x10]
lea eax, [esi + 4]
push edi
push eax
call fcn.00454b20
add esp, 0xc
test eax, eax
je 0x4583c0
push ebx
push ebp
lea ebx, [esi + 4]
push ebx
call fcn.00454cd0
add esp, 0xc
test eax, eax
je 0x4583c0
lea ebp, [esi + 0x4c]
push ebp
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.00454a70
add esp, 0xc
test eax, eax
jne 0x4583f7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041d8e4
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x4583c0
push ebx
lea eax, [esi + 0x50]
push ebp
push eax
call fcn.00421360
lea ebp, [esi + 0x4c]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x45841a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x50]
add eax, ecx
push 0
push eax
call fcn.00423960
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x50]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x458420
push edx
lea ebx, [esi + 0x1c]
push edi
push ebx
call fcn.00454b20
add esp, 0xc
test eax, eax
je 0x4583c0
push edi
call fcn.00455e70
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.00454cd0
add esp, 0x10
test eax, eax
je 0x4583c0
xor ecx, ecx
jmp 0x458470
mov al, byte [esi + ecx + 0x50]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x458470
push dword [esp + 0x10]
lea ebx, [esi + 0x34]
push edi
push ebx
call fcn.00454b20
add esp, 0xc
test eax, eax
je 0x4583c0
push edi
call fcn.00455e70
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.00454cd0
add esp, 0x10
test eax, eax
je 0x4583c0
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 4]
push eax
call fcn.00454da0
add esp, 8
test eax, eax
je 0x4583c0
mov eax, 1
jmp 0x4583c2
test eax, eax
je 0x4584b9
jmp 0x45841e
Function at 0x4777f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
call fcn.0042d520
mov eax, dword [0x535820]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push ebx
push ebp
mov ebp, dword [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
push esi
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [eax], ebx
push edi
mov edi, dword [esp + 0x8c]
lea eax, [esp + 0x20]
push eax
xor esi, esi
call fcn.00454f40
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.00454da0
add esp, 0xc
test eax, eax
je 0x4778f5
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00454a70
add esp, 0xc
test eax, eax
je 0x4778f5
lea eax, [esp + 0x20]
push eax
call fcn.00454ce0
mov esi, dword [ebp]
add esp, 4
test byte [esi + 0xc], 4
je 0x477913
push edi
call fcn.0043bee0
push ebx
push edi
mov dword [esp + 0x28], eax
call fcn.00478b20
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4778f5
push esi
call fcn.00479460
add esp, 4
test eax, eax
jle 0x4778f5
push dword [ebp]
push ebx
push 1
push 0xf8
push 0xffffffffffffffff
push esi
call fcn.004788d0
add esp, 0x18
test eax, eax
jle 0x4778f5
push dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push esi
call fcn.00479380
add esp, 0x14
test eax, eax
jle 0x4778f5
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
mov ebx, 1
push esi
call fcn.00478ac0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0041d8e4
add esp, 0x6c
ret
xor eax, eax
lea ecx, [esi + 0x2c]
mov edx, dword [ecx]
test edx, edx
je 0x47792b
cmp dword [edi], edx
je 0x477955
inc eax
add ecx, 4
cmp eax, 4
jl 0x477918
push 0x7b
push str..cryptoevpp_sign.c
push 0x6e
push 0x6b
push 6
call fcn.0043afa0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0041d8e4
add esp, 0x6c
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x477989
push 0x80
push str..cryptoevpp_sign.c
push 0x68
push 0x6b
push 6
call fcn.0043afa0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0041d8e4
add esp, 0x6c
ret
push dword [edi + 0x14]
mov ecx, dword [esp + 0x1c]
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x44]
push dword [esp + 0x20]
push ecx
push dword [esi]
call eax
mov ecx, dword [esp + 0x90]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041d8e4
add esp, 0x6c
ret
Function at 0x4ae6b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov eax, dword [ebp + 4]
cmp eax, dword [ecx + 4]
jge 0x4ae6c7
mov edi, ecx
jmp 0x4ae6cb
mov edi, ebp
mov ebp, ecx
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jg 0x4ae6db
mov eax, ebx
jmp 0x4ae6e5
push eax
push ebx
call fcn.004539d0
add esp, 8
test eax, eax
jne 0x4ae6ed
pop edi
pop ebp
pop ebx
ret
push esi
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x4ae70c
mov eax, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [eax + esi*4]
xor edx, dword [ecx + esi*4]
mov eax, dword [ebx]
inc esi
mov dword [eax + esi*4 - 4], edx
cmp esi, dword [ebp + 4]
jl 0x4ae6f5
cmp esi, dword [edi + 4]
jge 0x4ae721
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [edi + 4]
jl 0x4ae711
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
pop esi
test ecx, ecx
jle 0x4ae745
mov edx, dword [ebx]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x4ae742
dec ecx
test ecx, ecx
jg 0x4ae734
mov dword [ebx + 4], ecx
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x10003266
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x100032ce
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, 0x105
push edi
mov edi, edx
cmp dword [esi + 8], eax
mov ebx, ecx
jg 0x100032eb
push eax
mov ecx, esi
call fcn.10002652
push dword [esi]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, esi
mov edi, eax
call fcn.10002e86
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x1000985c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10095924
call fcn.10094750
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.100022c0
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.100022c0
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov al, byte [edi + 0x2d]
mov byte [esi + 0x2d], al
mov al, byte [edi + 0x2e]
mov byte [esi + 0x2e], al
mov al, byte [edi + 0x2f]
mov byte [esi + 0x2f], al
mov al, byte [edi + 0x30]
mov byte [esi + 0x30], al
mov al, byte [edi + 0x31]
mov byte [esi + 0x31], al
mov ax, word [edi + 0x32]
mov word [esi + 0x32], ax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1000f14a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009604b
call fcn.10094750
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x1009f644
mov dword [esi + 4], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], edi
lea ecx, [esi + 0xc]
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.10002652
mov ecx, dword [ebp - 0xc]
push 4
pop eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x18], 0x1009f840
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x2c], 0x1009f838
mov dword [esi], 0x1009f804
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100148fe
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
test edi, edi
mov ax, word [esi]
jbe 0x1001492e
push ebx
movzx ecx, byte [edx]
movzx ebx, al
xor ecx, ebx
xor ebx, ebx
mov bl, ah
mov ax, word [ecx*2 + 0x100b9184]
xor ax, bx
inc edx
dec edi
jne 0x10014912
pop ebx
mov word [esi], ax
pop edi
pop esi
ret 8
Function at 0x10025f7c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x10097ae4
call fcn.10094750
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 3
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.10002652
lea ecx, [esi + 0xc]
push 3
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.10002652
or dword [esi + 0x60], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov byte [esi + 0x49], bl
mov byte [esi + 0x4a], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10027360
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10097ca0
call fcn.10094750
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.100022c0
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.100022c0
mov eax, dword [esi + 0x18]
push 5
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov al, byte [esi + 0x48]
mov byte [ebx + 0x48], al
mov al, byte [esi + 0x49]
mov byte [ebx + 0x49], al
mov al, byte [esi + 0x4a]
mov byte [ebx + 0x4a], al
mov eax, dword [ebp + 8]
add esi, 0x4b
lea edi, [ebx + 0x4b]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x60], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1002e27f
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100989e3
call fcn.10094750
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x100a07d4
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x100a07cc
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
push 3
mov byte [ebp - 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.100017a3
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x100306dd
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x1009902c
call fcn.10094750
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x100a0450
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x100a07e4
push 4
mov ebx, 0x1009f848
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.10003550
mov dword [esi + 0x3c], 0x100a0894
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.10003550
mov dword [edi], 0x100a089c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.1002d11e
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.1002f7a0
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.1002d11e
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.1002f7a0
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.1002d11e
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.1002f7a0
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.1002d11e
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.1002f7a0
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.1002f7a0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10039af1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov eax, ecx
push esi
push edi
mov edi, dword [eax]
cmp dword [ebp + 0xc], 0
je 0x10039b40
mov esi, dword [eax + 4]
test esi, esi
je 0x10039b40
mov cl, byte [edx]
inc edx
mov byte [esi + eax + 8], cl
mov ecx, dword [eax + 4]
inc ecx
and ecx, 3
dec dword [ebp + 0xc]
test ecx, ecx
mov dword [eax + 4], ecx
jne 0x10039afe
and dword [ebp + 8], ecx
lea esi, [eax + 8]
movzx ebx, byte [esi]
mov ecx, dword [ebp + 8]
add dword [ebp + 8], 8
shl ebx, cl
xor edi, ebx
inc esi
cmp dword [ebp + 8], 0x20
jl 0x10039b29
jmp 0x10039afe
mov ecx, dword [ebp + 0xc]
shr ecx, 2
mov esi, ecx
dec ecx
test esi, esi
je 0x10039b70
inc ecx
movzx esi, byte [edx]
inc edx
xor ebx, ebx
mov bh, byte [edx]
or esi, ebx
inc edx
movzx ebx, byte [edx]
shl ebx, 0x10
or esi, ebx
inc edx
movzx ebx, byte [edx]
shl ebx, 0x18
or esi, ebx
inc edx
xor edi, esi
dec ecx
jne 0x10039b4e
mov esi, dword [ebp + 0xc]
mov dword [eax], edi
and esi, 3
je 0x10039b91
mov ecx, dword [eax + 4]
mov bl, byte [edx]
inc edx
mov byte [ecx + eax + 8], bl
mov ecx, dword [eax + 4]
inc ecx
and ecx, 3
dec esi
mov dword [eax + 4], ecx
jne 0x10039b7a
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10039cd9
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
xor esi, esi
mov edx, dword [eax + 4]
test edx, edx
jle 0x10039cff
push edi
lea ecx, [edx*8 - 8]
movzx edi, byte [eax + esi + 8]
shl edi, cl
sub ecx, 8
xor dword [eax], edi
inc esi
cmp esi, edx
jl 0x10039ced
pop edi
pop esi
ret

Function at 0x10043927
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009a66c
call fcn.10094750
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10002a00
mov eax, dword [edi + 0xc]
and dword [ebp - 4], 0
mov dword [esi + 0xc], eax
mov ax, word [edi + 0x10]
mov word [esi + 0x10], ax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
add edi, 0x34
lea ecx, [esi + 0x34]
push edi
mov dword [esi + 0x30], eax
call fcn.10043a12
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100483a8
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1009ad26
call fcn.10094750
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.100022c0
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10002a00
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.100022c0
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.10002a00
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov al, byte [edi + 0x38]
mov byte [esi + 0x38], al
mov al, byte [edi + 0x39]
mov byte [esi + 0x39], al
mov al, byte [edi + 0x3a]
mov byte [esi + 0x3a], al
mov al, byte [edi + 0x3b]
mov byte [esi + 0x3b], al
mov al, byte [edi + 0x3c]
mov byte [esi + 0x3c], al
mov al, byte [edi + 0x3d]
mov byte [esi + 0x3d], al
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4