joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10127bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1017a133
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.101272a0
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.10154190
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x1017ba40
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10129f00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x268
push ebx
push ebp
push esi
mov esi, dword [esp + 0x278]
push edi
xor edx, edx
mov ecx, 0x97
xor eax, eax
lea edi, [esp + 0x1c]
xor bl, bl
mov dword [esp + 0x18], edx
cmp esi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], edx
jne 0x10129f45
mov ebp, dword [esp + 0x4dc]
pop edi
pop esi
mov eax, edx
mov dword [ebp], edx
pop ebp
pop ebx
add esp, 0x268
ret
cmp esi, 0x400
jle 0x10129f5b
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x268
ret
mov edi, dword [esp + 0x4e0]
mov eax, dword [esp + 0x280]
cmp eax, edi
jne 0x10129fac
mov ebp, dword [esp + 0x4dc]
lea ecx, [esi - 1]
cmp ecx, edx
mov dword [ebp + 4], edi
mov dword [ebp], esi
jl 0x1012a050
lea edx, [esp + 0x27c]
lea eax, [ecx + ebp + 8]
sub edx, ebp
lea esi, [ecx + 1]
mov cl, byte [edx + eax]
mov byte [eax], cl
dec eax
dec esi
jne 0x10129f95
mov eax, dword [ebp]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x268
ret
lea eax, [esi - 1]
cmp eax, edx
jl 0x10129fc1
mov dl, byte [esp + eax + 0x284]
mov byte [esp + eax + 0x20], dl
dec eax
jns 0x10129fb3
mov ebp, dword [esp + 0x4dc]
mov dword [esp + 0x18], esi
mov al, byte [esp + 0x280]
dec esi
imul bl
add al, byte [esp + esi + 0x20]
mov byte [esp + 0x14], al
mov ecx, dword [esp + 0x14]
and ecx, 0xff
mov eax, ecx
cdq
idiv edi
mov eax, ecx
mov bl, dl
cdq
idiv edi
test esi, esi
mov byte [esp + esi + 0x20], al
jg 0x10129fcc
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov byte [eax + ebp + 8], bl
xor bl, bl
inc eax
mov dword [ebp], eax
mov dword [esp + 0x10], eax
mov al, byte [esp + esi + 0x1f]
test al, al
jne 0x1012a02b
test esi, esi
jle 0x1012a02f
dec esi
mov dword [esp + 0x18], esi
mov al, byte [esp + esi + 0x1f]
test al, al
je 0x1012a01a
test esi, esi
jg 0x10129fcc
mov eax, dword [ebp]
mov dword [ebp + 4], edi
mov cl, byte [eax + ebp + 7]
test cl, cl
jne 0x1012a050
mov eax, dword [ebp]
test eax, eax
jle 0x1012a050
dec eax
mov dword [ebp], eax
mov cl, byte [eax + ebp + 7]
test cl, cl
je 0x1012a03d
mov eax, dword [ebp]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x268
ret
Function at 0x1012ce40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
xor edx, edx
cmp dword [esi + 0x324], edx
lea eax, [ebp + 4]
lea ecx, [edi + 4]
lea ebx, [esi + 4]
jle 0x1012ce82
sub ebx, ecx
mov ebp, dword [ebx + ecx]
add eax, 4
xor ebp, dword [ecx]
add ecx, 4
inc edx
mov dword [eax - 4], ebp
mov ebp, dword [esi + 0x324]
cmp edx, ebp
jl 0x1012ce65
mov ebp, dword [esp + 0x14]
cmp edx, dword [edi + 0x324]
jge 0x1012ce9f
mov esi, dword [ecx]
add ecx, 4
mov dword [eax], esi
mov esi, dword [edi + 0x324]
add eax, 4
inc edx
cmp edx, esi
jl 0x1012ce8a
mov ecx, dword [edi + 0x324]
sub eax, 4
mov dword [ebp + 0x324], ecx
cmp dword [eax], 0
jne 0x1012cecd
mov ecx, dword [ebp + 0x324]
cmp ecx, 1
jle 0x1012cecd
dec ecx
sub eax, 4
mov dword [ebp + 0x324], ecx
cmp dword [eax], 0
je 0x1012ceb3
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10139070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10138c53
push eax
push esi
push dword [ebp + 8]
call fcn.10138c08
sti
invalid
inc dword [ebx - 0x7a76cf3c]
dec eax
invalid
invalid
invalid
call fcn.10138c43
inc esp
sti
or byte [edx - 0x78], ah
popfd
jl 0x101390c8
invalid
invalid
Function at 0x1013f230
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp esi, 0x80
push edi
jle 0x1013f243
mov esi, 0x80
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
test ecx, ecx
mov byte [edx], 0
jle 0x1013f25a
cmp ecx, 0x400
jle 0x1013f25f
mov ecx, 0x400
test esi, esi
push ebx
jle 0x1013f279
mov edi, dword [esp + 0x14]
push ebp
mov eax, edx
sub edi, edx
mov ebp, esi
mov bl, byte [edi + eax]
mov byte [eax], bl
inc eax
dec ebp
jne 0x1013f26f
pop ebp
cmp esi, 0x80
jge 0x1013f2a9
mov edi, esi
mov eax, edx
sub edi, edx
mov bl, byte [esi + eax - 1]
add bl, byte [eax]
and ebx, 0xff
inc eax
mov bl, byte [ebx + 0x1017eb54]
mov byte [eax + esi - 1], bl
lea ebx, [edi + eax]
cmp ebx, 0x80
jl 0x1013f287
lea esi, [ecx + 7]
mov eax, 0x80
neg ecx
sar esi, 3
and ecx, 7
mov edi, 0xff
sub eax, esi
sar edi, cl
xor ecx, ecx
mov cl, byte [eax + edx]
and edi, ecx
mov cl, byte [edi + 0x1017eb54]
mov byte [eax + edx], cl
mov ecx, eax
dec eax
test ecx, ecx
je 0x1013f2fa
lea ecx, [eax + edx + 1]
lea edi, [eax + 1]
xor eax, eax
xor ebx, ebx
mov al, byte [esi + ecx - 1]
mov bl, byte [ecx]
xor eax, ebx
dec edi
lea ecx, [ecx - 1]
mov al, byte [eax + 0x1017eb54]
mov byte [ecx], al
jne 0x1013f2e0
lea esi, [edx - 1]
mov edi, edx
mov eax, 0x7f
sub edi, esi
lea ecx, [esi + 0x7f]
pop ebx
xor edx, edx
sub eax, 2
mov dh, byte [edi + ecx]
mov dl, byte [ecx]
sub ecx, 2
mov word [esi + eax + 2], dx
test eax, eax
jge 0x1013f30a
pop edi
pop esi
ret
Function at 0x10149610
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x10
add eax, 0xfffffff0
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x2c]
test eax, eax
jl 0x101496a9
lea ebp, [eax + 0x10]
shr ebp, 4
mov ecx, ebp
neg ecx
shl ecx, 4
add eax, ecx
mov dword [esp + 0x2c], eax
mov edx, dword [edi]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
xor edx, eax
mov eax, dword [edi + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 8]
xor eax, ecx
mov ecx, dword [edi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
xor ecx, edx
mov edx, dword [edi + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x24]
xor edx, eax
lea eax, [esp + 0x10]
push ebx
push eax
push ecx
mov dword [esp + 0x28], edx
call fcn.10145310
mov edx, ebx
mov eax, esi
add esp, 0xc
add edi, 0x10
mov ecx, dword [edx]
add ebx, 0x10
mov dword [eax], ecx
dec ebp
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
jne 0x10149641
mov eax, dword [esp + 0x2c]
cmp eax, 0xfffffff0
je 0x10149717
xor eax, eax
mov ecx, dword [edi]
mov dword [esp + 0x10], eax
mov edx, dword [edi + 4]
mov dword [esp + 0x14], eax
mov ebp, dword [esi + 4]
mov dword [esp + 0x18], eax
xor edx, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
xor ecx, eax
mov eax, dword [edi + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 8]
xor eax, ecx
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x14], edx
xor ecx, eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x10]
push ebx
push edx
push eax
mov dword [esp + 0x28], ecx
call fcn.10145310
mov ecx, dword [ebx]
add esp, 0xc
mov dword [esi], ecx
mov edx, dword [ebx + 4]
mov dword [esi + 4], edx
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0xc], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10149720
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x28]
lea ecx, [eax - 0x10]
test ecx, ecx
push edi
mov dword [esp + 0x2c], esi
jl 0x101497de
lea edi, [ecx + 0x10]
shr edi, 4
mov edx, edi
neg edx
shl edx, 4
add ecx, edx
mov dword [esp + 0x28], ecx
mov eax, esi
push ebx
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x28], edx
call fcn.10146ae0
mov edx, dword [ebp]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor eax, edx
mov edx, dword [ebx + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 4]
add esp, 0xc
xor ecx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 4], ecx
mov ecx, dword [ebp + 8]
xor edx, ecx
mov ecx, ebp
mov dword [ebx + 8], edx
mov edx, dword [ebp + 0xc]
xor eax, edx
mov dword [ebx + 0xc], eax
mov eax, esi
add esi, 0x10
add ebx, 0x10
mov edx, dword [eax]
dec edi
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
jne 0x10149759
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x2c], esi
cmp ecx, 0xfffffff0
je 0x1014985f
xor edx, edx
mov eax, ecx
mov dword [esp + 0x10], edx
lea edi, [esp + 0x10]
mov dword [esp + 0x14], edx
push ebx
mov dword [esp + 0x1c], edx
shr ecx, 2
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.10146ae0
mov eax, dword [ebp]
mov ecx, dword [ebx]
mov edi, dword [ebx + 4]
xor ecx, eax
mov esi, dword [ebx + 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 4]
add esp, 0xc
xor edi, ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebx + 4], edi
mov edx, dword [ebp + 8]
xor esi, edx
mov dword [ebx + 8], esi
mov eax, dword [ebp + 0xc]
xor ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax]
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1014cb10
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x1014f230
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 4], 0
mov dword [eax], 0
ret
Function at 0x10152140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov edx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x10]
test edi, edi
mov dword [esp + 0x10], edx
lea eax, [ebp + 4]
mov dword [esp + 0x18], ecx
je 0x10152238
lea ecx, [edi + edx]
cmp ecx, 8
jl 0x10152217
mov ebx, dword [esp + 0x24]
mov ecx, 8
sub ecx, edi
mov esi, ebx
mov edx, ecx
add edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dh, byte [eax + 1]
xor ecx, ecx
mov cl, byte [eax]
inc eax
mov esi, ecx
xor ecx, ecx
mov cl, byte [eax + 1]
or esi, edx
inc eax
xor edx, edx
shl ecx, 0x10
mov dl, byte [eax + 1]
or esi, ecx
inc eax
xor ecx, ecx
shl edx, 0x18
mov cl, byte [eax + 1]
or esi, edx
inc eax
xor edx, edx
inc eax
mov edi, ecx
xor ecx, ecx
mov dh, byte [eax]
mov ch, byte [eax + 2]
mov cl, byte [eax + 1]
or edi, edx
mov edx, dword [esp + 0x14]
inc eax
shl ecx, 0x10
xor edx, esi
or edi, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
lea eax, [ebp + 0x14]
xor ecx, edi
push edx
push eax
mov dword [esp + 0x20], ecx
call fcn.10139570
mov edx, dword [ebp]
mov ecx, 8
sub ecx, edx
mov edx, dword [esp + 0x30]
add esp, 8
add ebx, ecx
mov dword [ebp], 0
jmp 0x1015223c
mov esi, dword [esp + 0x24]
mov ecx, edx
add edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [ebp], edx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ebx, dword [esp + 0x24]
cmp edx, 8
jl 0x101522c5
mov edi, edx
shr edi, 3
lea ecx, [edi*8]
sub edx, ecx
mov dword [esp + 0x10], edx
xor eax, eax
xor edx, edx
mov al, byte [ebx]
mov dh, byte [ebx + 1]
inc ebx
or eax, edx
inc ebx
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx]
mov dl, byte [ebx + 1]
shl ecx, 0x10
or eax, ecx
inc ebx
shl edx, 0x18
or eax, edx
inc ebx
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx]
mov dh, byte [ebx + 1]
inc ebx
mov esi, ecx
or esi, edx
inc ebx
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx]
mov dl, byte [ebx + 1]
shl ecx, 0x10
or esi, ecx
mov ecx, dword [esp + 0x14]
inc ebx
xor ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
shl edx, 0x18
or esi, edx
inc ebx
xor eax, esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.10139570
add esp, 8
dec edi
jne 0x10152257
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x101522e0
mov edx, ecx
mov esi, ebx
lea edi, [ebp + 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop edi
mov dword [ebp], eax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10154ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1017a395
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x41c
push ebx
push ebp
push esi
mov ebp, ecx
xor esi, esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [ebp + 0x10], esi
call fcn.10154190
mov ebx, dword [ebp + 4]
mov edi, 1
cmp ebx, esi
mov dword [esp + 0x434], edi
jne 0x10154c02
mov esi, dword [esp + 0x43c]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.10154220
mov dword [esp + 0x10], edi
jmp 0x10154d80
lea eax, [ebx + ebx]
mov dword [esp + 0x28], eax
lea edi, [eax + 1]
push edi
call fcn.10164e45
mov esi, eax
add esp, 4
test esi, esi
jne 0x10154c27
mov dword [ebp + 0x10], 2
jmp 0x10154d65
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dl, 0x64
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, 0x80
mov eax, 0x30303030
lea edi, [esp + 0x22c]
mov ebp, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov cl, 0x65
mov al, 0x66
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], al
mov byte [esp + 0x30c], cl
mov byte [esp + 0x31c], al
xor eax, eax
xor ecx, ecx
test ebx, ebx
mov byte [esp + 0x2c], 0x30
mov byte [esp + 0x2d], 0x31
mov byte [esp + 0x2e], 0x32
mov byte [esp + 0x2f], 0x33
mov byte [esp + 0x30], 0x34
mov byte [esp + 0x31], 0x35
mov byte [esp + 0x32], 0x36
mov byte [esp + 0x33], 0x37
mov byte [esp + 0x34], 0x38
mov byte [esp + 0x35], 0x39
mov byte [esp + 0x36], 0x61
mov byte [esp + 0x37], 0x62
mov byte [esp + 0x38], 0x63
mov byte [esp + 0x39], dl
mov byte [esp + 0x23c], 0x31
mov byte [esp + 0x24c], 0x32
mov byte [esp + 0x25c], 0x33
mov byte [esp + 0x26c], 0x34
mov byte [esp + 0x27c], 0x35
mov byte [esp + 0x28c], 0x36
mov byte [esp + 0x29c], 0x37
mov byte [esp + 0x2ac], 0x38
mov byte [esp + 0x2bc], 0x39
mov byte [esp + 0x2cc], 0x61
mov byte [esp + 0x2dc], 0x62
mov byte [esp + 0x2ec], 0x63
mov byte [esp + 0x2fc], dl
jle 0x10154d55
mov dl, byte [ecx + ebp]
and edx, 0xf0
inc eax
mov dl, byte [esp + edx + 0x22c]
mov byte [eax + esi - 1], dl
mov dl, byte [ecx + ebp]
and edx, 0xf
inc eax
inc ecx
mov dl, byte [esp + edx + 0x2c]
cmp ecx, ebx
mov byte [eax + esi - 1], dl
jl 0x10154d2c
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x43c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.10154220
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x434], 0
call fcn.10154250
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x428
ret 4
Function at 0x10155040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1017a3f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x14]
call fcn.10154190
mov eax, dword [edi + 4]
mov ebx, 1
cdq
sub eax, edx
mov dword [esp + 0x130], ebx
mov esi, eax
sar esi, 1
cmp esi, ebx
jge 0x101550af
mov esi, dword [esp + 0x138]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [edi + 0x10], 3
call fcn.10154220
mov dword [esp + 0x10], ebx
jmp 0x10155272
lea ecx, [esi + 1]
push ecx
call fcn.10164e45
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x101550e4
mov esi, dword [esp + 0x138]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [edi + 0x10], 2
call fcn.10154220
mov dword [esp + 0x10], ebx
jmp 0x10155272
mov edx, dword [edi + 0xc]
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0xa8]
rep stosd dword es:[edi], eax
mov ecx, 0x20
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov al, 0xf
mov bl, 0xd
mov byte [esp + 0x6e], al
mov byte [esp + 0x8e], al
mov cl, 0xe
mov al, 0xf0
mov byte [esp + 0x6c], bl
mov byte [esp + 0x6d], cl
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], cl
mov byte [esp + 0xee], al
mov byte [esp + 0x10e], al
mov bl, 0xd0
mov cl, 0xe0
xor eax, eax
mov byte [esp + 0x59], 1
test esi, esi
mov byte [esp + 0x5a], 2
mov byte [esp + 0x5b], 3
mov byte [esp + 0x5c], 4
mov byte [esp + 0x5d], 5
mov byte [esp + 0x5e], 6
mov byte [esp + 0x5f], 7
mov byte [esp + 0x60], 8
mov byte [esp + 0x61], 9
mov byte [esp + 0x69], 0xa
mov byte [esp + 0x6a], 0xb
mov byte [esp + 0x6b], 0xc
mov byte [esp + 0x89], 0xa
mov byte [esp + 0x8a], 0xb
mov byte [esp + 0x8b], 0xc
mov byte [esp + 0xd9], 0x10
mov byte [esp + 0xda], 0x20
mov byte [esp + 0xdb], 0x30
mov byte [esp + 0xdc], 0x40
mov byte [esp + 0xdd], 0x50
mov byte [esp + 0xde], 0x60
mov byte [esp + 0xdf], 0x70
mov byte [esp + 0xe0], 0x80
mov byte [esp + 0xe1], 0x90
mov byte [esp + 0xe9], 0xa0
mov byte [esp + 0xea], 0xb0
mov byte [esp + 0xeb], 0xc0
mov byte [esp + 0xec], bl
mov byte [esp + 0xed], cl
mov byte [esp + 0x109], 0xa0
mov byte [esp + 0x10a], 0xb0
mov byte [esp + 0x10b], 0xc0
mov byte [esp + 0x10c], bl
mov byte [esp + 0x10d], cl
jle 0x1015524b
xor ecx, ecx
xor ebx, ebx
mov cl, byte [edx + 1]
mov bl, byte [edx]
add edx, 2
mov cl, byte [esp + ecx + 0x28]
add cl, byte [esp + ebx + 0xa8]
inc eax
cmp eax, esi
mov byte [eax + ebp - 1], cl
jl 0x1015522b
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x138]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
mov dword [esp + 0x24], ebp
call fcn.10154220
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x130], 0
call fcn.10154250
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4
Function at 0x10155740
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
push edi
mov ebp, dword [esi + 4]
test ebp, ebp
je 0x10155908
mov eax, dword [esi]
lea ebx, [ebp + ebp*2]
mov cl, 0x3d
mov dl, byte [eax + ebp - 1]
shr ebx, 2
cmp dl, cl
jne 0x10155784
mov dl, byte [eax + ebp - 2]
dec ebp
dec ebx
cmp dl, cl
jne 0x10155784
dec ebp
dec ebx
push ebp
call fcn.10155520
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x101557a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
mov esi, dword [esi]
mov ecx, ebp
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov edx, dword [esp + 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push ebx
push edx
call fcn.10155930
mov esi, eax
add esp, 0xc
test esi, esi
je 0x101557e2
mov eax, dword [esp + 0x10]
push eax
call fcn.10155540
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
xor edi, edi
mov dword [edx], ecx
mov dword [edx + 4], ebx
test ebp, ebp
mov ecx, esi
jbe 0x10155841
mov al, byte [ecx]
cmp al, 0x2f
jne 0x10155806
mov byte [ecx], 0x3f
jmp 0x1015583b
cmp al, 0x2b
jne 0x1015580f
mov byte [ecx], 0x3e
jmp 0x1015583b
cmp al, 0x30
jb 0x1015581b
cmp al, 0x39
ja 0x1015581b
add al, 4
jmp 0x10155839
cmp al, 0x61
jb 0x10155827
cmp al, 0x7a
ja 0x10155827
sub al, 0x47
jmp 0x10155839
cmp al, 0x41
jb 0x10155910
cmp al, 0x5a
ja 0x10155910
sub al, 0x41
mov byte [ecx], al
inc ecx
inc edi
cmp edi, ebp
jb 0x101557fb
mov ebp, dword [edx + 4]
mov ecx, esi
mov esi, dword [edx]
xor edx, edx
cmp ebp, 2
mov dword [esp + 0x18], esi
jbe 0x101558c3
add ebp, 0xfffffffe
test ebp, ebp
jbe 0x101558c0
lea edx, [ebp + 2]
mov eax, 0xaaaaaaab
mul edx
mov edi, edx
shr edi, 1
lea edx, [edi + edi*2]
mov al, byte [ecx]
mov bl, byte [ecx + 1]
shl al, 2
inc ecx
shr bl, 4
and bl, 3
or bl, al
mov byte [esi], bl
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
mov al, byte [ecx]
mov bl, byte [ecx + 1]
shl al, 4
inc ecx
shr bl, 2
and bl, 0xf
or bl, al
mov byte [esi], bl
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
mov al, byte [ecx]
mov bl, byte [ecx + 1]
shl al, 6
inc ecx
and bl, 0x3f
or bl, al
mov byte [esi], bl
mov esi, dword [esp + 0x18]
inc esi
inc ecx
dec edi
mov dword [esp + 0x18], esi
jne 0x1015586b
add ebp, 2
cmp edx, ebp
jae 0x101558fb
mov al, byte [ecx]
mov bl, byte [ecx + 1]
inc edx
shl al, 2
inc ecx
shr bl, 4
and bl, 3
or bl, al
mov byte [esi], bl
mov esi, dword [esp + 0x18]
inc esi
cmp edx, ebp
mov dword [esp + 0x18], esi
jae 0x101558fb
mov al, byte [ecx + 1]
mov cl, byte [ecx]
shr al, 2
and al, 0xf
mov edx, esi
shl cl, 4
or al, cl
mov byte [edx], al
mov eax, dword [esp + 0x10]
push eax
call fcn.10155540
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
call fcn.10155540
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret