joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x442004]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0xa8], 0
jne 0x414589
push 0xe2
push str.....CommonCommon.cpp
push str._pRandomDataWriteBuffer___nullptr
call fcn.00421f70
add esp, 0xc
mov edi, dword [ebx + 0x88]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov byte [esp + 0x13], 1
call fcn.0040d2e0
cmp dword [eax + 0x14], 0x10
lea edx, [eax + 0x10]
jb 0x4145ab
mov eax, dword [eax]
mov edx, dword [edx]
mov ecx, eax
push 0
push 0x436d64
call fcn.00409110
mov esi, eax
add esp, 8
mov eax, dword [esp + 0x2c]
cmp eax, 0x10
jb 0x4145d4
inc eax
push eax
push dword [esp + 0x1c]
call fcn.004018c0
test esi, esi
jne 0x414617
test edi, edi
je 0x414719
call fcn.0042059b
and eax, 0x800000ff
jns 0x4145f3
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [ebx + 0xa8]
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jb 0x4145e0
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00419ed2
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.0040d2e0
cmp dword [eax + 0x14], 0x10
jb 0x41462b
mov eax, dword [eax]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 0x2c]
mov edx, eax
mov dword [esp + 0x10], edx
cmp ecx, 0x10
jb 0x41465f
inc ecx
push ecx
push dword [esp + 0x1c]
call fcn.004018c0
mov edx, dword [esp + 0x10]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
cmp edx, 0xffffffff
je 0x41472f
mov eax, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
mov esi, dword [ebx + 0xa8]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x41469d
test edi, edi
je 0x4146dd
test eax, eax
jb 0x4146b0
ja 0x4146a9
cmp edi, 0x10000
jbe 0x4146b0
mov eax, 0x10000
jmp 0x4146b2
mov eax, edi
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
mov eax, dword [esp + 0x30]
jne 0x4146db
test eax, eax
je 0x4146db
mov edx, dword [esp + 0x10]
add esi, eax
mov eax, dword [esp + 0x14]
jmp 0x414693
add esi, eax
mov ecx, dword [ebx + 0x88]
xor edi, edi
mov edx, dword [ebx + 0xa8]
add ecx, edx
mov eax, ecx
sub eax, esi
cmp ecx, esi
sbb ecx, ecx
not ecx
and ecx, eax
jbe 0x41470f
jmp 0x414700
mov al, byte [edx]
lea edx, [edx + 1]
inc edi
mov byte [esi], al
lea esi, [esi + 1]
cmp edi, ecx
jb 0x414700
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00419ed2
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x34]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00419ed2
mov esp, ebp
pop ebp
ret
Function at 0x415f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430928
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x442004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.004080e0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x24]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x21], al
lea eax, [esi + 0x24]
push eax
call fcn.00408640
movzx eax, byte [esi + 0x30]
mov byte [edi + 0x30], al
movzx eax, byte [esi + 0x31]
mov byte [edi + 0x31], al
movzx eax, byte [esi + 0x32]
mov byte [edi + 0x32], al
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41d416
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul ecx, dword [ebp - 0x17af57bb], 0xfffffd5f
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0041d134
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x41d45d
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
invalid
inc ebp

Function at 0x41d52c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
invalid
inc ebp

Function at 0x41d56c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6

Function at 0x41d9c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [edx - 0x3a]
test dword [esi + 0x46fffffc], esi
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0041d17f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041d134
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
Function at 0x41da83
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0041d17f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041d134
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
invalid

Function at 0x426062
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00425f67

Function at 0x42797d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042763d
Function at 0x401000
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x403010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0xa8c]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa8c]
push eax
mov dword [ebp - 0xa8c], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
mov edi, eax
lea eax, [ebp - 0xa38]
push eax
mov dword [ebp - 0xa38], ebx
call esi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x401064
sub eax, ecx
sar eax, 1
mov ecx, eax
mov eax, str._writer
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, bx
jne 0x40107c
sub eax, edx
sar eax, 1
add eax, ecx
lea eax, [eax + eax + 4]
call fcn.00401230
mov edi, esp
mov dword [ebp - 0xa30], edi
call esi
mov edx, edi
movzx ecx, word [eax]
inc eax
mov word [edx], cx
inc eax
inc edx
inc edx
cmp cx, bx
jne 0x4010a1
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4010b2
mov esi, 0x40211c
mov eax, str._writer
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4010ca
mov edi, dword [ebp - 0xa30]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
cmp cx, bx
jne 0x4010de
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR90.dll__wsplitpath]
push 0x402120
push str.soffice
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR90.dll__wmakepath]
add esp, 0x28
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0xa8c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0xa30]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4011b1
push 0xffffffffffffffff
push dword [ebp - 0xa48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xa48]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xa44]
call esi
xor eax, eax
jmp 0x4011f2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push ebx
push ebx
lea ecx, [ebp - 0xa34]
push ecx
push 0x400
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x10
push ebx
push dword [ebp - 0xa34]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0xa34]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
lea esp, [ebp - 0xa98]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040121c
leave
ret 0x10
Function at 0x40121c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403010]
jne 0x401226
repz ret
jmp fcn.004015dc
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40ac1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40ac29
pop dword [ebp - 0x40]
mov eax, 0xb865357b
sub eax, 0xb8248952
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x2d7d503d
add dword [ebp - 0x50], 0x20d4f50e
mov dword [ebp - 0x4c], 0x8bef4d95
add dword [ebp - 0x4c], 0xa643feb0
mov dword [ebp - 0x48], 0xed6628d1
add dword [ebp - 0x48], 0x5ee61b5d
mov dword [ebp - 0x44], 0x870d7292
sub dword [ebp - 0x44], 0x870d7292
lea eax, [ebp - 0x50]
push eax
mov eax, 0xc1c2ff30
sub eax, 0xc1822ee4
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc9df871f
add dword [ebp - 0x50], 0xaa92e237
mov dword [ebp - 0x4c], 0x39f479fe
sub dword [ebp - 0x4c], 0xf8881889
mov dword [ebp - 0x48], 0x8cd4894d
add dword [ebp - 0x48], 0xd69ae31f
mov dword [ebp - 0x44], 0xdf5e6b2d
sub dword [ebp - 0x44], 0xdf5e6b2d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x476c52b1
add eax, 0xb8d47d97
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a48c
push 0
call eax
mov ecx, 0x49ee
mov ebx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x40]
mov edx, 0x249a21ee
add edx, 0x405380b1
sub dword [ebp - 4], eax
mov esi, dword [edi]
xor dword [ebp - 0x14], 0xd8030520
add esi, edx
mov dword [ebp - 0x28], 0xd4324060
mov dword [ebx], esi
sub dword [ebp - 0x20], ecx
add ebx, 4
add edi, 0xc577c8b1
sub edi, 0xc577c8ad
loop 0x40ad3f
add eax, 0x5e84e3e2
sub eax, 0x5e83c957
mov ebx, eax
add eax, 0x719e3b6a
add eax, 0x8e61c49b
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4035ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x4035fc
pop dword [ebp - 0x14]
mov eax, 0x42811932
sub eax, 0x4240e336
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xf4b8a603
add dword [ebp - 0x24], 0x59999f48
mov dword [ebp - 0x20], 0xf66e2765
add dword [ebp - 0x20], 0x3bc524e0
mov dword [ebp - 0x1c], 0x5ef35e88
add dword [ebp - 0x1c], 0xed58e5a6
mov dword [ebp - 0x18], 0xaa53f0fa
sub dword [ebp - 0x18], 0xaa53f0fa
lea eax, [ebp - 0x24]
push eax
mov eax, 0x8d638a75
sub eax, 0x8d231a59
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xd118a073
sub dword [ebp - 0x24], 0x5ca6371d
mov dword [ebp - 0x20], 0xec15ca4f
sub dword [ebp - 0x20], 0xaaa968da
mov dword [ebp - 0x1c], 0x9f3a7f17
sub dword [ebp - 0x1c], 0x3bcb12ab
mov dword [ebp - 0x18], 0xf0c4c4b0
sub dword [ebp - 0x18], 0xf0c4c4b0
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x9bfdb751
sub eax, 0x9bbd4731
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x38505
push 0
call eax
mov ecx, 0xf7f7dc72
add ecx, 0x8086e0f
xor edi, edi
add edi, eax
mov ebx, 0x51e437b8
sub ebx, 0x51a36fb8
add ebx, dword [ebp - 0x14]
mov edx, 0x1543dd03
add dword [ebp - 0x10], 0x94499fc9
mov esi, dword [ebx]
add dword [ebp - 0xc], edi
sub esi, edx
mov dword [edi], esi
xor dword [ebp - 4], eax
add edi, 4
add ebx, 0xdd291d1e
sub ebx, 0xdd291d1a
loop 0x40371a
add eax, 0xe71d5f69
add eax, 0x18e3bd6e
mov ebx, eax
add eax, 0x46dd9349
add eax, 0xb9226cbc
mov ecx, 0x81bb5254
add ecx, 0x7e84adac
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004035ed
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004035ed
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x1000729a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
pop edi
push ebx
or ebx, 0x503e
add ebx, 0xc19e
pop ebx
jmp 0x10007230
push eax
or eax, 0xb0a8
add eax, 0xca8c
sub eax, 0x15053
pop eax
push esi
push edi
add esp, 4
add esi, 0x7fa3
add esi, 0xef91
pop esi
push ebx
push ebx
add esp, 4
sub ebx, 0x9a11
pop ebx
mov dword [ebp - 0xad8], 0
push edx
push ecx
add esp, 4
call 0x1000727f
add byte [edx], bh
xor eax, dword [eax + 0x43]
inc ebp
xor al, 0x50
cmp eax, dword [ebx - 0x3d7efb3c]
wait
dec ebx
add dword [eax], eax
add edx, 0xaf27
call 0x1000729a
add byte [esi + 0x39], al
cmp eax, 0x834e3333
les eax, [edx + ebx*2]
mov byte [ebp - 0x880], 0x45
mov byte [ebp - 0x87f], 0x78
mov byte [ebp - 0x87e], 0x69
mov byte [ebp - 0x87d], 0x74
mov byte [ebp - 0x87c], 0x50
mov byte [ebp - 0x87b], 0x72
mov byte [ebp - 0x87a], 0x6f
mov byte [ebp - 0x879], 0x63
mov byte [ebp - 0x878], 0x65
mov byte [ebp - 0x877], 0x73
mov byte [ebp - 0x876], 0x73
mov byte [ebp - 0x875], 0
push edi
push esi
add esp, 4
call 0x10007303
add byte [esi + 0x3a3a3743], dh
add esp, 4
and edi, 0x1081e
call 0x10007318
add byte [edx], bh
dec ecx
aas
dec ecx
cmp dword ds:[ebx + 0x505f04c4], eax
xor eax, 0xb71e
pop eax
mov edx, 0x6b
mov word [ebp - 0x173c], dx
mov eax, 0x65
mov word [ebp - 0x173a], ax
mov ecx, 0x72
mov word [ebp - 0x1738], cx
mov edx, 0x6e
mov word [ebp - 0x1736], dx
mov eax, 0x65
mov word [ebp - 0x1734], ax
mov ecx, 0x6c
mov word [ebp - 0x1732], cx
mov edx, 0x33
Function at 0x1000885a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax + 0x4e], dl
dec edx
inc eax
push eax
dec ebp
inc ebx
inc ebx
add esp, 4
or edx, 0x8794
or edx, 0x147dd
or edx, 0x11067
pop edx
mov byte [ebp - 0x9dc], 0x56
mov byte [ebp - 0x9db], 0x69
mov byte [ebp - 0x9da], 0x72
mov byte [ebp - 0x9d9], 0x74
mov byte [ebp - 0x9d8], 0x75
mov byte [ebp - 0x9d7], 0x61
mov byte [ebp - 0x9d6], 0x6c
mov byte [ebp - 0x9d5], 0x50
mov byte [ebp - 0x9d4], 0x72
mov byte [ebp - 0x9d3], 0x6f
invalid
invalid

Function at 0x10008971
Capabilities:
Get number of processors

Disassembly:
add esp, 4
add esi, 0xe9aa
and esi, 0x12aa6
pop esi
push ebx
and ebx, 0x9eea
and ebx, 0x7235
pop ebx
cmp dword [ebp - 0xcd4], 0
jne 0x100089a7
mov edx, dword [ebp - 0xcd4]
mov dword [ebp - 0x510], edx

Function at 0x10008a10
Capabilities:
Get number of processors

Disassembly:
push ebx
sub ebx, 0x5ad8
add ebx, 0x1436d
xor ebx, 0x9924
pop ebx
push edx
push ecx
add esp, 4
xor edx, 0x1299
and edx, 0x3f8c
and edx, 0x6126
or edx, 0x3923
pop edx
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push edx
push eax
add esp, 4
jmp 0x10008a1c
xor edx, 0x123fc
sub edx, 0xaa36
pop edx
push edi
push ecx
add esp, 4
or edi, 0x13d20
xor edi, 0xa707
or edi, 0x207a
pop edi
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x104e], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
invalid
invalid

Function at 0x10008cec
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ecx
push edi
add esp, 4
or ecx, 0x40d9
sub ecx, 0x740b
pop ecx
push eax
push ecx
add esp, 4
or eax, 0x1716e
jmp 0x10008c17
pop eax
push ecx
push eax
add esp, 4
or ecx, 0x3c73
pop ecx
cmp dword [ebp - 0x300], 0
jne 0x100094f7
or byte [eax], al
invalid
mov ecx, 0x6b
mov word [ebp - 0x1794], cx
mov edx, 0x65
mov word [ebp - 0x1792], dx
mov eax, 0x72
mov word [ebp - 0x1790], ax
mov ecx, 0x6e
mov word [ebp - 0x178e], cx
mov edx, 0x65
mov word [ebp - 0x178c], dx
mov eax, 0x6c
mov word [ebp - 0x178a], ax
mov ecx, 0x33
mov word [ebp - 0x1788], cx
mov edx, 0x32
mov word [ebp - 0x1786], dx
mov eax, 0x2e
mov word [ebp - 0x1784], ax
mov ecx, 0x64
mov word [ebp - 0x1782], cx
mov edx, 0x6c
mov word [ebp - 0x1780], dx
mov eax, 0x6c
mov word [ebp - 0x177e], ax
xor ecx, ecx
mov word [ebp - 0x177c], cx
push esi
or esi, 0x1805e
pop esi
push edx
push ebx
add esp, 4
sub edx, 0x5f4
add byte [eax], al
call 0x10008cec
add byte [edx + 0x33], cl
xor al, byte [esi + 0x44]
dec ebx
dec edi
inc esi
add esp, 4
xor edx, 0xc4fa
or edx, 0xfa0
pop edx
mov byte [ebp - 0x8ac], 0x4c
invalid
test dword [ebp - 9], edx
Function at 0x100275d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
xor edi, edi
lea eax, [edx + esi]
cmp edx, eax
cmova esi, ebx
test esi, esi
je 0x1002760a
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
movzx eax, word [eax*2 + 0x10112dd0]
xor ecx, eax
inc edx
inc edi
cmp edi, esi
jne 0x100275ef
pop edi
pop esi
mov eax, ecx
pop ebx
ret 4

Function at 0x1002a112
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e75f8
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x100ec3a0
mov dword [esi + 8], eax
mov dword [esi], 0x100f06e4
mov dword [esi + 4], 0x100f0718
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100374c5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100e7ecd
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
lea ecx, [esi + 0x158]
mov dword [esi], 0x100f1f00
mov dword [esi + 4], 0x100f1f34
call fcn.100d1010
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x88c]
test ecx, ecx
je 0x1003750c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x880]
call fcn.100d5dfe
pop ecx
mov ecx, dword [esi + 0x154]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x1003752f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x14c]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x10037546
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x144]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x1003755d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x128]
call fcn.100d5dfe
push dword [esi + 0x11c]
call fcn.100d5dfe
push dword [esi + 0x110]
call fcn.100d5dfe
add esp, 0xc
mov ecx, dword [esi + 0xf8]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x10037598
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x7c]
call fcn.100d5dfe
pop ecx
lea ecx, [esi + 0x5c]
call fcn.100374a6
lea ecx, [esi + 0x3c]
call fcn.100374a6
push dword [esi + 0x30]
call fcn.100d5dfe
push dword [esi + 0x24]
call fcn.100d5dfe
push dword [esi + 0x18]
call fcn.100d5dfe
push dword [esi + 0xc]
call fcn.100d5dfe
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003bc38
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e8082
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x100ec3a0
mov dword [esi + 8], eax
mov dword [esi], 0x100f2c1c
mov dword [esi + 4], 0x100f2c50
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.10002327
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4