joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003000e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
or dword [ebp - 8], 0xffffffff
and dword [ebp - 4], 0
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x24], 0x73
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x24], 0x70
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x24], 0x53
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x24], 0x6f
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x24], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0x15
mov byte [ebp + eax - 0x24], 0x68
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x24], 0x43
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x24], 0x70
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x24], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x24], 0x32
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x24], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x24], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x24], 0x6c
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x24], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x16
mov byte [ebp + eax - 0x24], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0x17
mov byte [ebp + eax - 0x24], 0x74
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x24], 0x65
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x24], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x24], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x18
mov byte [ebp + eax - 0x24], 0
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x24], 0x68
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x24], 0x54
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x24], 0x72
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x24], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x24], 0x33
lea eax, [ebp - 0x24]
push eax
call fcn.1003015a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10030153
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1003015a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x72
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x33
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x6e
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x64
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x32
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x4b
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x2e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret

Function at 0x100301fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 8], 0xffffffff
and dword [ebp - 4], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x47
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x61
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x54
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x43
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x68
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x64
lea eax, [ebp - 0x1c]
push eax
call fcn.1003015a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100302e3
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10030302
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [ebp + 0xc], 1
jne 0x100303b7
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.1002fc38
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xa], 0x75732074
push ecx
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0x74726f
push ecx
mov dword [ebp - 0xf], 0x6174736e
mov word [ebp - 6], 0x7070
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xb], 0x6e
call fcn.1002f411
add esp, 0x14
test eax, eax
jne 0x100303ec
push sym.gphelper.dll__HookSetWindowPos_28
push 0x10061764
call fcn.10031305
pop ecx
pop ecx
test eax, eax
je 0x100303ec
push sym.gphelper.dll__HookSetForegroundWindow_4
push 0x10061758
call fcn.10031305
pop ecx
pop ecx
test eax, eax
je 0x100303ec
push sym.gphelper.dll__HookSetActiveWindow_4
push 0x1006179c
call fcn.10031305
pop ecx
pop ecx
test eax, eax
je 0x100303ec
push sym.gphelper.dll__HookBringWindowToTop_4
push 0x10061778
call fcn.10031305
pop ecx
jmp 0x100303eb
cmp dword [ebp + 0xc], 0
jne 0x100303ec
push 0x10061764
call fcn.100315b9
mov dword [esp], 0x10061758
call fcn.100315b9
mov dword [esp], 0x1006179c
call fcn.100315b9
mov dword [esp], 0x10061778
call fcn.100315b9
pop ecx
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10030564
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push ebx
push esi
push edi
mov edi, 0x103
mov word [ebp - 0x1a], 0x4552
xor ebx, ebx
mov word [ebp - 0x1d], 0x5754
push edi
lea eax, [ebp - 0x12b]
mov word [ebp - 0x20], 0x4f53
push ebx
push eax
mov byte [ebp - 0x1e], 0x46
mov word [ebp - 0x18], 0x5c
mov byte [ebp - 0x1b], 0x41
mov word [ebp - 0xc], 0x7325
mov word [ebp - 9], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 0x12c], bl
call fcn.10001830
add esp, 0xc
push 0x18
pop eax
call fcn.10009c20
mov esi, esp
call fcn.10001115
push eax
push 0x18
mov ecx, esi
call fcn.10001119
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea esi, [edi + 1]
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.10002a2f
lea eax, [ebp - 0x24]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x12c]
push eax
push 0x80000001
call fcn.1002f7b9
add esp, 0x2c
test eax, eax
jne 0x100306c2
push edi
lea eax, [ebp - 0x333]
mov byte [ebp - 0x334], bl
push ebx
push eax
call fcn.10001830
lea eax, [ebp - 0x28]
mov dword [ebp - 0x12], 0x736c61
push eax
lea eax, [ebp - 0x334]
mov word [ebp - 0x14], 0x7668
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call fcn.1002f8b0
add esp, 0x24
test eax, eax
jne 0x100306b9
cmp dword [ebp - 0x28], ebx
jbe 0x100306b9
push edi
lea eax, [ebp - 0x22f]
mov byte [ebp - 0x230], bl
push ebx
push eax
call fcn.10001830
push dword [ebp + 8]
lea eax, [ebp - 4]
mov word [ebp - 4], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x230]
mov byte [ebp - 2], bl
push esi
push eax
call fcn.10002a2f
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.1002f411
add esp, 0x28
test eax, eax
je 0x100306b9
push dword [ebp - 0x24]
call fcn.1002f6e4
mov eax, dword [ebp + 8]
pop ecx
jmp 0x100306cb
push dword [ebp - 0x24]
call fcn.1002f6e4
pop ecx
push dword [ebp + 8]
call dword [0x1006179c]
lea esp, [ebp - 0x340]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100306da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push ebx
push esi
push edi
mov edi, 0x103
mov dword [ebp - 0x1f], 0x5754464f
xor ebx, ebx
mov byte [ebp - 0x20], 0x53
push edi
lea eax, [ebp - 0x12b]
mov word [ebp - 0x18], 0x5c
push ebx
push eax
mov word [ebp - 0x1b], 0x5241
mov byte [ebp - 0x19], 0x45
mov dword [ebp - 0xb], 0x732573
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0x12c], bl
call fcn.10001830
add esp, 0xc
push 0x18
pop eax
call fcn.10009c20
mov esi, esp
call fcn.10001115
push eax
push 0x18
mov ecx, esi
call fcn.10001119
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea esi, [edi + 1]
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.10002a2f
lea eax, [ebp - 0x24]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x12c]
push eax
push 0x80000001
call fcn.1002f7b9
add esp, 0x2c
test eax, eax
jne 0x10030834
push edi
lea eax, [ebp - 0x333]
mov byte [ebp - 0x334], bl
push ebx
push eax
call fcn.10001830
lea eax, [ebp - 0x28]
mov word [ebp - 0x11], 0x736c
push eax
lea eax, [ebp - 0x334]
mov byte [ebp - 0xf], bl
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
mov word [ebp - 0x14], 0x7668
push eax
push dword [ebp - 0x24]
mov byte [ebp - 0x12], 0x61
call fcn.1002f8b0
add esp, 0x24
test eax, eax
jne 0x1003082b
cmp dword [ebp - 0x28], ebx
jbe 0x1003082b
push edi
lea eax, [ebp - 0x22f]
mov byte [ebp - 0x230], bl
push ebx
push eax
call fcn.10001830
push dword [ebp + 8]
lea eax, [ebp - 4]
mov word [ebp - 4], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x230]
mov byte [ebp - 2], bl
push esi
push eax
call fcn.10002a2f
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.1002f411
add esp, 0x28
test eax, eax
je 0x1003082b
push dword [ebp - 0x24]
call fcn.1002f6e4
xor eax, eax
pop ecx
inc eax
jmp 0x1003083d
push dword [ebp - 0x24]
call fcn.1002f6e4
pop ecx
push dword [ebp + 8]
call dword [0x10061758]
lea esp, [ebp - 0x340]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003084c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1d], 0x52415754
mov edi, 0x103
mov word [ebp - 0x1f], 0x464f
push edi
lea eax, [ebp - 0x12b]
mov word [ebp - 0x18], 0x5c
push ebx
push eax
mov byte [ebp - 0x19], 0x45
mov byte [ebp - 0x20], 0x53
mov dword [ebp - 0xc], 0x73257325
mov byte [ebp - 8], bl
mov byte [ebp - 0x12c], bl
call fcn.10001830
add esp, 0xc
push 0x18
pop eax
call fcn.10009c20
mov esi, esp
call fcn.10001115
push eax
push 0x18
mov ecx, esi
call fcn.10001119
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea esi, [edi + 1]
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.10002a2f
lea eax, [ebp - 0x24]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x12c]
push eax
push 0x80000001
call fcn.1002f7b9
add esp, 0x2c
test eax, eax
jne 0x100309a6
push edi
lea eax, [ebp - 0x333]
mov byte [ebp - 0x334], bl
push ebx
push eax
call fcn.10001830
lea eax, [ebp - 0x28]
mov word [ebp - 0x11], 0x736c
push eax
lea eax, [ebp - 0x334]
mov word [ebp - 0x14], 0x7668
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
mov byte [ebp - 0xf], bl
push eax
push dword [ebp - 0x24]
mov byte [ebp - 0x12], 0x61
call fcn.1002f8b0
add esp, 0x24
test eax, eax
jne 0x1003099d
cmp dword [ebp - 0x28], ebx
jbe 0x1003099d
push edi
lea eax, [ebp - 0x22f]
mov byte [ebp - 0x230], bl
push ebx
push eax
call fcn.10001830
push dword [ebp + 8]
lea eax, [ebp - 4]
mov word [ebp - 3], 0x64
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x25
push esi
push eax
call fcn.10002a2f
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.1002f411
add esp, 0x28
test eax, eax
je 0x1003099d
push dword [ebp - 0x24]
call fcn.1002f6e4
xor eax, eax
pop ecx
inc eax
jmp 0x100309c1
push dword [ebp - 0x24]
call fcn.1002f6e4
pop ecx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x10061764]
lea esp, [ebp - 0x340]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x100309d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
call fcn.1002f658
test eax, eax
je 0x10030a14
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x6957676e
push ecx
push eax
mov dword [ebp - 9], 0x6f546f54
mov word [ebp - 5], 0x70
mov dword [ebp - 0xd], 0x776f646e
mov word [ebp - 0x14], 0x7242
mov byte [ebp - 0x12], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030a1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
call fcn.1002f658
test eax, eax
je 0x10030a5c
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 9], 0x69576576
mov dword [ebp - 0xd], 0x69746341
mov byte [ebp - 1], bl
mov word [ebp - 0x10], 0x6553
mov byte [ebp - 0xe], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10030a63
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
call fcn.1002f658
test eax, eax
je 0x10030aac
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0x776f64
push ecx
push eax
mov dword [ebp - 0xf], 0x72676572
mov word [ebp - 0xb], 0x756f
mov dword [ebp - 8], 0x6e695764
mov dword [ebp - 0x13], 0x6f467465
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 9], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10030ab3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
call fcn.1002f658
test eax, eax
je 0x10030af6
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0x736f5077
push ecx
push eax
mov word [ebp - 0xd], 0x6957
mov word [ebp - 0x10], 0x6553
mov word [ebp - 0xa], 0x6f64
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 4], bl
mov byte [ebp - 0xb], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10030df2
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.100301fc
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 8], eax
push 0xf
call fcn.100301fc
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
and dword [ebp - 4], 0
jmp 0x10030e21
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [0x1006174c]
jae 0x10030e52
mov eax, dword [ebp - 4]
mov ecx, dword [0x10061748]
push dword [ecx + eax*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 4]
mov ecx, dword [0x10061748]
push dword [ecx + eax*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10030e1a
push dword [0x10061748]
call fcn.10002a4e
pop ecx
and dword [0x10061748], 0
and dword [0x1006174c], 0
push dword [ebp - 8]
call fcn.100301fc
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret
Function at 0x10030e7f
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
push dword [ebp + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10030f59
cmp dword [ebp - 4], 0
je 0x10030f59
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x10030f4c
mov dword [ebp - 0x2dc], 0x10001
and dword [ebp - 8], 0
lea eax, [ebp - 0x2dc]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10030f4a
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jb 0x10030f46
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0xc], eax
jae 0x10030f46
cmp dword [ebp - 8], 3
jge 0x10030f2c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x10030f44
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
jmp 0x10030f4a
jmp 0x10030f48
jmp 0x10030f4a
jmp 0x10030ed3
jmp 0x10030f59
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10031004
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push edi
and dword [ebp - 0xc], 0
cmp dword [0x10061740], 0x40
jae 0x10031148
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x80000000
jae 0x10031037
mov dword [ebp - 0x18], 1
jmp 0x10031042
mov eax, dword [ebp - 0x10]
sub eax, 0x7fff0000
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x80000000
jae 0x10031067
mov eax, dword [ebp - 0x14]
add eax, 0x7ff80000
mov dword [ebp - 0x1c], eax
jmp 0x1003106e
mov dword [ebp - 0x1c], 0xfff80000
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
and dword [ebp - 0x5c], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x14]
jae 0x10031106
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100310af
jmp 0x10031106
cmp dword [ebp - 0x28], 0x10000
jne 0x100310fb
cmp dword [ebp - 0x2c], 0x6c
jb 0x100310fb
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x40]
jb 0x100310fb
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 1]
xor edx, edx
div dword [ebp - 0x40]
imul eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
push 0x20
push 0x3000
push 0x6c
push dword [ebp - 4]
call fcn.1002fb6a
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100310fb
jmp 0x10031106
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
jmp 0x10031092
cmp dword [ebp - 0xc], 0
je 0x10031148
and dword [ebp - 8], 0
jmp 0x10031119
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x40
jae 0x10031148
mov eax, dword [ebp - 8]
cmp dword [eax*4 + 0x100617a0], 0
jne 0x10031146
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax*4 + 0x100617a0], ecx
mov eax, dword [0x10061740]
inc eax
mov dword [0x10061740], eax
jmp 0x10031148
jmp 0x10031112
mov eax, dword [ebp - 0xc]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x5b210c3
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6771600f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x100043c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006534f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1009a8a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x1000449c
je 0x10004497
cmp eax, 0x80000000
je 0x10004497
test eax, eax
jne 0x100044a3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Heap::constructor_void_]
mov eax, dword [0x1009bddc]
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000444b
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.10054d40
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_class_ScCore::Variant____thiscall_ScCore::Variant::operator_unsigned_short_int_const__]
mov eax, dword [0x1009bddc]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x1000447c
mov eax, dword [ebp - 0x10]
lea ecx, [ecx + eax*4]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100044bf
xorps xmm0, xmm0
jmp 0x100044ba
cmp eax, 0x40000000
je 0x100044af
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100044b6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10054d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10054d4f
pop dword [ebp - 0x10]
mov eax, 0xf3eca5c0
sub eax, 0xe3e75871
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x4f65b554
sub dword [ebp - 0x20], 0x1137009
mov dword [ebp - 0x1c], 0x23f135a5
add dword [ebp - 0x1c], 0xe4216a0
mov dword [ebp - 0x18], 0x8027a3d5
add dword [ebp - 0x18], 0xcc24a059
mov dword [ebp - 0x14], 0x2410895b
sub dword [ebp - 0x14], 0x2410895b
lea eax, [ebp - 0x20]
push eax
mov eax, 0x2da5039b
add eax, 0xe2620c69
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x61997c26
add dword [ebp - 0x20], 0x12d8ed30
mov dword [ebp - 0x1c], 0x92e7f4bc
sub dword [ebp - 0x1c], 0x517b9347
mov dword [ebp - 0x18], 0x2f035efe
add dword [ebp - 0x18], 0x346c0d6e
mov dword [ebp - 0x14], 0xbf49efd3
add dword [ebp - 0x14], 0x40b6102d
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x68cb1bf
add eax, 0x97a5e49
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x45eea
push 0
call eax
mov ecx, 0x45d9
mov ebx, eax
mov esi, 0x100ac600
add esi, dword [ebp - 0x10]
mov edi, 0xc84851ec
sub edi, 0xfa2ccdf0
xor dword [ebp - 8], esi
mov edx, dword [esi]
sub dword [ebp - 0xc], 0x35aade2a
xor edx, edi
sub dword [ebp - 8], 0x2f56fb6f
mov dword [ebx], edx
sub dword [ebp - 0xc], 0x2abca755
add ebx, 4
add esi, 0x6bfbb3e5
sub esi, 0x6bfbb3e1
loop 0x10054e65
add eax, 0x9cc10f64
sub eax, 0x9cc0052d
mov ebx, eax
add eax, 0xedb8b2e4
sub eax, 0xedb8b2df
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret