joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100042f8
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
lea edx, [esi + 0x1f]
movzx ecx, byte [edx - 1]
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
mov dword [ebp + edi*4 - 0x150], ecx
inc edi
lea edx, [edx + 4]
cmp edi, 0x10
jl 0x1000430e
push 0x40
lea ecx, [ebp - 0x148]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
dec edx
jne 0x10004345
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
rol edx, 5
mov ecx, esi
not ecx
and ecx, eax
mov eax, edi
and eax, esi
or ecx, eax
mov eax, dword [ebp - 4]
add edx, ecx
add edx, dword [ebp + ebx*4 - 0x150]
add eax, 0x5a827999
add edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, edi
mov edi, esi
ror edi, 2
mov esi, dword [ebp - 8]
push 0x14
inc ebx
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jl 0x10004378
mov dword [ebp - 0x10], esi
mov ebx, esi
rol edx, 5
xor eax, edi
xor eax, ebx
add edx, eax
add edx, dword [ebp + ecx*4 - 0x150]
mov eax, dword [ebp - 4]
add eax, 0x6ed9eba1
add edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
ror edi, 2
inc ecx
cmp ecx, 0x28
jl 0x100043c0
push 0x28
pop esi
rol edx, 5
mov ecx, edi
or ecx, ebx
and ecx, eax
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0xc]
add ecx, dword [ebp + esi*4 - 0x150]
add edx, 0x8f1bbcdc
add edx, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 8]
ror edi, 2
add edx, ecx
inc esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp esi, 0x3c
jl 0x100043f9
mov esi, dword [ebp + 8]
push 0x3c
pop ecx
rol edx, 5
add edx, dword [ebp - 4]
xor eax, edi
xor eax, ebx
add eax, 0xca62c1d6
add eax, dword [ebp + ecx*4 - 0x150]
add edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, edi
mov edi, ebx
ror edi, 2
mov ebx, dword [ebp - 8]
inc ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp ecx, 0x50
jl 0x1000443c
add dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
add dword [esi + 4], ebx
add dword [esi + 8], edi
add dword [esi], edx
add dword [esi + 0x10], eax
xor eax, eax
pop edi
mov word [esi + 0x1c], ax
pop esi
pop ebx
leave
ret 4
Function at 0x100046cb
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1004e39b
call fcn.1004e1f0
sub esp, 0x94
push ebx
push esi
push edi
mov ebx, ecx
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0xa0], ecx
lea edi, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x10], esp
push 0x54
stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ecx
call fcn.10038c70
and dword [ebp - 0x14], 0
xor eax, eax
mov byte [ebp - 0x34], 0
lea edi, [ebp - 0x33]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x2801
stosb byte es:[edi], al
call fcn.10031a71
and dword [ebp - 4], 0
push 0x10059f40
push dword [ebp + 0xc]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], esi
call fcn.1003322d
add esp, 0x1c
test eax, eax
jne 0x10004818
push eax
push 0x80
push 3
push eax
push 1
push eax
push dword [ebp + 0xc]
call dword [0x10052140]
mov edi, eax
test edi, edi
jne 0x10004785
mov edi, 0x10059f44
push edi
call fcn.1000191f
pop ecx
push eax
push edi
lea ecx, [ebx + 4]
call fcn.10001f26
jmp 0x10004818
push 0
push edi
call dword [0x1005213c]
push edi
call dword [0x10052138]
lea eax, [ebp - 0xa0]
push eax
call fcn.10004241
mov edi, 0x2800
jmp 0x100047b6
push eax
push esi
lea eax, [ebp - 0xa0]
push eax
call fcn.10004281
push dword [ebp - 0x14]
push edi
push 1
push esi
call fcn.1003343a
add esp, 0x10
test eax, eax
jne 0x100047a8
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.10004540
push dword [ebp - 0x14]
call fcn.10033552
push esi
call fcn.10033272
pop ecx
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call fcn.100045d5
jmp 0x10004840
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x1000482b
push dword [ebp - 0x14]
call fcn.10033552
pop ecx
push esi
call fcn.10033272
mov ecx, dword [ebp + 8]
mov dword [esp], 0x10059df8
call fcn.10001d63
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x1000cd56
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x1004ecd5
call fcn.1004e1f0
sub esp, 0x404
push ebx
push esi
mov eax, ecx
push edi
lea ebx, [eax + 0x18]
push 0xf
xor edx, edx
pop ecx
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x10], edx
mov dword [ebp - 0x10], eax
mov byte [ebx], dl
lea esi, [eax + 0x30]
mov dword [ebp - 4], edx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], edx
mov byte [esi], dl
lea edi, [eax + 0x48]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x10], edx
mov byte [edi], dl
mov byte [ebp - 4], 2
push 0x3ef
mov dword [eax], edx
mov dword [eax + 8], 3
mov dword [eax + 0x10], 0xe10
mov dword [eax + 4], 0x258
mov dword [eax + 0xc], 1
push edx
lea eax, [ebp - 0x3ff]
push eax
mov dword [ebp - 0x410], 0x676e6574
mov dword [ebp - 0x40c], 0x362e7568
mov dword [ebp - 0x408], 0x2e383631
mov dword [ebp - 0x404], 0x6576696c
mov byte [ebp - 0x400], dl
call fcn.10038c70
lea eax, [ebp - 0x410]
push eax
call fcn.1000191f
add esp, 0x10
mov ecx, esi
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.10001f26
mov esi, 0x1005b50c
push esi
call fcn.1000191f
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.10001f26
mov esi, 0x1005b520
push esi
call fcn.1000191f
pop ecx
push eax
push esi
mov ecx, edi
call fcn.10001f26
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000d91b
Capabilities:
Reference 114dns dns server

Disassembly:
mov eax, 0x1004eef9
call fcn.1004e1f0
sub esp, 0x68
push ebx
push esi
push edi
xor esi, esi
push 0x10065a40
mov dword [ebp - 0x24], esi
call dword [0x100522d0]
test eax, eax
jne 0x1000d951
mov ecx, dword [ebp + 8]
push 0x10059df8
call fcn.1000c0f3
jmp 0x1000daff
mov eax, dword [eax + 0xc]
mov ebx, dword [0x100522c8]
mov edi, dword [eax]
push 0x1005b5f4
call ebx
cmp dword [edi], eax
je 0x1000d981
push 0x1005b600
call ebx
cmp dword [edi], eax
je 0x1000d981
push 0x10059f74
call ebx
cmp dword [edi], eax
jne 0x1000da9b
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x5c]
call fcn.100168f9
lea eax, [ebp - 0x20]
push eax
push ecx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x10065a40
push 0x1005b60c
mov byte [ebp - 4], 3
call ebx
push eax
lea ecx, [ebp - 0x5c]
call fcn.1001696a
push 0x10065a40
push 0x1005b61c
call fcn.1000191e
add esp, 8
test eax, eax
je 0x1000da78
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
sub eax, ecx
cdq
mov dword [ebp - 0x14], 0x18
idiv dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1000da43
mov edx, esi
cmp dword [ecx + 0x14], 0x10
jb 0x1000da10
mov eax, dword [ecx]
jmp 0x1000da12
mov eax, ecx
inc edx
push eax
push edx
push 0x1005b638
mov dword [ebp - 0x1c], edx
call fcn.1000191e
add esp, 0xc
cmp dword [ecx + 0x14], 0x10
jb 0x1000da2d
mov ecx, dword [ecx]
push ecx
call ebx
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [edi], eax
mov dword [ebp - 0x18], ecx
cmp edx, dword [ebp - 0x20]
jne 0x1000da06
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub eax, ecx
cdq
idiv dword [ebp - 0x14]
mov edx, eax
test edx, edx
je 0x1000da78
cmp dword [ecx + 0x14], 0x10
jb 0x1000da5f
mov eax, dword [ecx]
jmp 0x1000da61
mov eax, ecx
push eax
inc esi
push esi
push 0x1005b64c
call fcn.1000191e
add ecx, dword [ebp - 0x14]
add esp, 0xc
cmp esi, edx
jne 0x1000da55
cmp dword [ebp - 0x4c], 0
je 0x1000da87
push dword [ebp - 0x4c]
call fcn.10033272
pop ecx
lea ecx, [ebp - 0x30]
call fcn.1000920b
lea ecx, [ebp - 0x3c]
call fcn.1000920b
or dword [ebp - 4], 0xffffffff
push 0x1005b5f4
call ebx
cmp dword [edi], eax
je 0x1000dac2
mov esi, dword [edi]
push 0x1005b600
call ebx
cmp esi, eax
je 0x1000dac2
test esi, esi
je 0x1000dac2
push 0x10059f74
call ebx
cmp dword [edi], eax
jne 0x1000dacb
push 0x1005b65c
call ebx
mov dword [edi], eax
push dword [edi]
call dword [0x100522c4]
push eax
lea ecx, [ebp - 0x74]
call fcn.10001d63
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x60], 0x10
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
call fcn.1000c0f3
lea ecx, [ebp - 0x74]
call fcn.10001d92
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x100165a3
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1004ecaa
call fcn.1004e1f0
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
lea eax, [esi + 0x44]
push eax
lea ecx, [edi + 0x44]
call fcn.10002d1c
and dword [ebp - 4], 0
lea eax, [esi + 0x5c]
push eax
lea ecx, [edi + 0x5c]
call fcn.10002d1c
lea eax, [esi + 0x74]
push eax
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 1
call fcn.10002d1c
lea eax, [esi + 0x8c]
push eax
lea ecx, [edi + 0x8c]
mov byte [ebp - 4], 2
call fcn.10002d1c
lea eax, [esi + 0xa4]
push eax
lea ecx, [edi + 0xa4]
mov byte [ebp - 4], 3
call fcn.10002d1c
lea eax, [esi + 0xbc]
push eax
lea ecx, [edi + 0xbc]
mov byte [ebp - 4], 4
call fcn.10002d1c
lea eax, [esi + 0xd4]
push eax
lea ecx, [edi + 0xd4]
mov byte [ebp - 4], 5
call fcn.10002d1c
mov byte [ebp - 4], 6
lea eax, [esi + 0xec]
push eax
lea ecx, [edi + 0xec]
call fcn.10002d1c
lea eax, [esi + 0x104]
push eax
lea ecx, [edi + 0x104]
mov byte [ebp - 4], 7
call fcn.10002d1c
lea eax, [esi + 0x11c]
push eax
lea ecx, [edi + 0x11c]
mov byte [ebp - 4], 8
call fcn.10002d1c
lea eax, [esi + 0x134]
push eax
lea ecx, [edi + 0x134]
mov byte [ebp - 4], 9
call fcn.10002d1c
lea eax, [esi + 0x14c]
push eax
lea ecx, [edi + 0x14c]
mov byte [ebp - 4], 0xa
call fcn.10002d1c
lea eax, [esi + 0x164]
push eax
lea ecx, [edi + 0x164]
mov byte [ebp - 4], 0xb
call fcn.10002d1c
lea eax, [esi + 0x17c]
push eax
lea ecx, [edi + 0x17c]
mov byte [ebp - 4], 0xc
call fcn.10002d1c
lea eax, [esi + 0x194]
push eax
lea ecx, [edi + 0x194]
mov byte [ebp - 4], 0xd
call fcn.10002d1c
lea eax, [esi + 0x1ac]
push eax
lea ecx, [edi + 0x1ac]
mov byte [ebp - 4], 0xe
call fcn.10002d1c
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10017e84
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1004f744
call fcn.1004e1f0
sub esp, 0x10
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0x1005c3ac
mov dword [edi + 0x50], 0x1005c3b8
and dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], 0x1005c3dc
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.10018696
mov dword [ebp - 4], 2
mov eax, dword [edi]
push 4
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x1005c354
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [esi], 0x1005c314
call fcn.10032e08
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10017f1f
push 1
call fcn.10031cd4
pop ecx
mov dword [ebx], eax
xor edx, edx
jmp 0x10017f23
xor edx, edx
mov ebx, edx
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], ebx
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], edx
mov eax, dword [esi + 0x20]
mov dword [eax], edx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
mov eax, dword [esi + 0xc]
mov dword [eax], edx
mov eax, dword [esi + 0x1c]
mov dword [eax], edx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword [esi], 0x1005c364
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], 4
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x1001bed6
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push esi
push eax
push 0xf01ff
call dword [0x1005209c]
push eax
call dword [section.libvxf1_6]
test eax, eax
je 0x1001bf46
lea eax, [ebp - 0xc]
push eax
push 0x1005c544
xor esi, esi
push esi
call dword [0x10052008]
test eax, eax
je 0x1001bf3d
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [0x10052004]
test eax, eax
jne 0x1001bf46
push dword [ebp - 4]
call dword [0x10052138]
pop esi
leave
ret

Function at 0x1001c087
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x1004fa12
call fcn.1004e1f0
sub esp, 0x4c
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x58], 0x6f767270
mov dword [ebp - 0x54], 0x53484339
mov dword [ebp - 0x50], 0x50634f4a
mov dword [ebp - 0x4c], 0x78366249
mov dword [ebp - 0x48], 0x58555652
mov dword [ebp - 0x44], 0x71307a51
mov dword [ebp - 0x40], 0x45444742
mov dword [ebp - 0x3c], 0x4e4c3237
mov dword [ebp - 0x38], 0x6175645a
mov dword [ebp - 0x34], 0x54596665
mov dword [ebp - 0x30], 0x385f4b35
mov dword [ebp - 0x2c], 0x4146342d
mov dword [ebp - 0x28], 0x6d696c68
mov dword [ebp - 0x24], 0x676e6b6a
mov dword [ebp - 0x20], 0x4d793174
mov dword [ebp - 0x1c], 0x77337357
mov byte [ebp - 0x18], 0x21
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.1000c63b
mov dword [esi], eax
lea eax, [ebp - 0x17]
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.1000c7eb
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1001e6f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004fd96
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x10064830]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi + 4], eax
mov eax, dword [0x10169a24]
mov dword [edi], 0x1005c844
mov dword [edi + 8], 1
mov dword [edi + 0xc], 5
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xffffffff
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
test al, 1
jne 0x1001e786
or eax, 1
mov dword [0x10169a24], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call dword [0x10052064]
mov eax, dword [ebp - 0x30]
mov dword [0x10169a28], eax
mov byte [ebp - 4], 0
jmp 0x1001e78b
mov eax, dword [0x10169a28]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0xa
mov dword [edi + 0x28], 0x28
mov dword [edi + 0x2c], 0x7530
mov dword [edi + 0x30], 0x2710
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 3
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov eax, dword [0x10064258]
mov ecx, 0x10064258
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x5c], eax
xor eax, eax
lea esi, [edi + 0x64]
sub esp, 0xc
mov ecx, esi
mov word [edi + 0x60], ax
call fcn.1001ea80
push 0x1000
lea eax, [edi + 0x148]
mov dword [edi + 0x144], 0
push eax
call dword [0x10052174]
push 0
push 0
push 0
mov dword [edi + 0x16c], esi
mov esi, dword [0x10052094]
push 0
mov dword [edi + 0x164], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0x170], eax
call esi
mov dword [edi + 0x174], eax
mov dword [edi + 0x178], 0
mov dword [edi + 0x17c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10021be0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 8], esi
cmp dword [esi + 0xc], ebx
jbe 0x10021ca6
push edi
lea esp, [esp]
push 0
push 0
push esi
push 0x10022d40
push 0
push 0
call fcn.10035df7
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x10021c89
mov eax, dword [esi + 0x64]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x10021c59
mov ecx, dword [esi + 0x60]
lea edx, [ebp - 4]
cmp ecx, edx
ja 0x10021c59
mov edi, edx
sub edi, ecx
sar edi, 2
cmp eax, dword [esi + 0x68]
jne 0x10021c48
push ecx
lea ecx, [esi + 0x60]
call fcn.10015d4a
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x10021c70
mov eax, dword [esi + 0x60]
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
jmp 0x10021c70
cmp eax, dword [esi + 0x68]
jne 0x10021c67
push ecx
lea ecx, [esi + 0x60]
call fcn.10015d4a
mov eax, dword [esi + 0x64]
test eax, eax
je 0x10021c70
mov dword [eax], edi
add dword [esi + 0x64], 4
mov esi, dword [ebp - 8]
inc ebx
cmp ebx, dword [esi + 0xc]
jb 0x10021c00
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [0x10052148]
push eax
mov dword [esi + 0x5c], 8
call dword [0x10052080]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002cb30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100509d8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10064830]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0x6f767270
mov dword [ebp - 0x50], 0x53484339
mov dword [ebp - 0x4c], 0x50634f4a
mov dword [ebp - 0x48], 0x78366249
mov dword [ebp - 0x44], 0x58555652
mov dword [ebp - 0x40], 0x71307a51
mov dword [ebp - 0x3c], 0x45444742
mov dword [ebp - 0x38], 0x4e4c3237
mov dword [ebp - 0x34], 0x6175645a
mov dword [ebp - 0x30], 0x54596665
mov dword [ebp - 0x2c], 0x385f4b35
mov dword [ebp - 0x28], 0x4146342d
mov dword [ebp - 0x24], 0x6d696c68
mov dword [ebp - 0x20], 0x676e6b6a
mov dword [ebp - 0x1c], 0x4d793174
mov dword [ebp - 0x18], 0x77337357
mov byte [ebp - 0x14], 0x21
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1000c63b
mov dword [esi], eax
lea eax, [ebp - 0x13]
push eax
lea eax, [ebp - 0x54]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1000c7eb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10035de8
mov esp, ebp
pop ebp
ret
Function at 0x4164d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4164e0
pop dword [ebp - 0x18]
mov eax, 0xeff942d1
add eax, 0x1048220f
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3ea38
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xbf3af8ec
sub ecx, 0xbf3aaf46
mov ebx, eax
mov esi, 0x438200
add esi, dword [ebp - 0x18]
mov edi, 0x7e01ef2a
add dword [ebp - 0xc], ecx
mov edx, dword [esi]
xor dword [ebp - 8], ecx
xor edx, edi
xor dword [ebp - 4], 0x4b734ed8
mov dword [ebx], edx
mov dword [ebp - 4], 0x6fb8a66b
add ebx, 0x291643c8
sub ebx, 0x291643c4
add esi, 0xad2031c5
sub esi, 0xad2031c1
loop 0x41652e
add eax, 0x1196b
mov ebx, eax
add eax, 0x11c01c4d
add eax, 0xee3fe3b8
mov ecx, 0xf09ac241
add ecx, 0xfa53dbf
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x40c530
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c552
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c548
mov eax, 1
add ebx, ebx
jne 0x40c56b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c560
jne 0x40c57c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c560
xor ecx, ecx
sub eax, 3
jb 0x40c590
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c602
mov ebp, eax
add ebx, ebx
jne 0x40c59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c5a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c5cc
inc ecx
add ebx, ebx
jne 0x40c5b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c5ad
jne 0x40c5c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c5ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c5ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c5dd
jmp 0x40c54e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c5ec
add edi, ecx
jmp 0x40c54e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c654
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c609
mov ecx, edi
jns 0x40c638
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc054]
or eax, eax
je 0x40c64e
mov dword [ebx], eax
add ebx, 4
jmp 0x40c626
call dword [esi + 0xc064]
mov ebp, dword [esi + 0xc058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c688
sub esp, 0xffffff80
jmp 0x40a3cc