joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e9590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4d756654
push eax
push 0x1013bba0
mov dword [ebp - 0x10], 0x46757462
mov dword [ebp - 0xc], 0x73707373
mov byte [ebp - 8], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013bba0
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e95e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10114380]
lea eax, [ebp - 0x20]
push 0x1a
push eax
push 0x1013c81c
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x7075716a
mov dword [ebp - 0xc], 0x64624573
mov word [ebp - 8], 0x6d
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c81c
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e9640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10114380]
lea eax, [ebp - 0x20]
push 0x1a
push eax
push 0x1013c6a8
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x7075716a
mov dword [ebp - 0xc], 0x64625473
mov word [ebp - 8], 0x6d
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c6a8
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e96a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x54756654
push eax
push 0x1013c1f8
mov dword [ebp - 0x10], 0x62496575
mov dword [ebp - 0xc], 0x666d656f
mov byte [ebp - 8], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c1f8
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e96f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x55756654
push eax
push 0x1013c608
mov dword [ebp - 0x10], 0x44757966
mov dword [ebp - 0xc], 0x73706d70
mov byte [ebp - 8], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c608
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e97a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6d666954
push eax
push 0x1013cc5c
mov dword [ebp - 0x10], 0x6679466d
mov dword [ebp - 0xc], 0x66757664
mov word [ebp - 8], 0x42
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013cc5c
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret
Function at 0x100e98a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6d666954
push eax
push 0x1013cc4c
mov dword [ebp - 0x10], 0x6679466d
mov dword [ebp - 0xc], 0x66757664
mov word [ebp - 8], 0x58
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013cc4c
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e9900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x78706954
push eax
push 0x1013c4e4
mov dword [ebp - 0xc], 0x656f6a58
mov word [ebp - 8], 0x7870
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c4e4
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e99a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x73627554
push eax
push 0x1013c92c
mov dword [ebp - 0x10], 0x73665475
mov dword [ebp - 0xc], 0x66646a77
mov word [ebp - 8], 0x42
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c92c
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e9a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x73627554
push eax
push 0x1013c93c
mov dword [ebp - 0x10], 0x73665475
mov dword [ebp - 0xc], 0x66646a77
mov word [ebp - 8], 0x58
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c93c
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e9b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66737554
push eax
push 0x1013c680
mov dword [ebp - 0xc], 0x43696475
mov word [ebp - 8], 0x756d
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c680
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100e9d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6f567055
push eax
push 0x1013c2dc
mov dword [ebp - 0xc], 0x6570646a
mov word [ebp - 8], 0x66
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c2dc
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret
Function at 0x100ea050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x624e6f56
push eax
push 0x1013b59c
mov dword [ebp - 0x10], 0x656f4271
mov dword [ebp - 0xc], 0x6562704d
mov byte [ebp - 8], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b59c
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x62657156
push eax
push 0x1013c4f0
mov dword [ebp - 0x10], 0x6a586675
mov dword [ebp - 0xc], 0x7870656f
mov byte [ebp - 8], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c4f0
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x52736657
push eax
push 0x1013b5bc
mov dword [ebp - 0x10], 0x7a736676
mov dword [ebp - 0xc], 0x766d6257
mov word [ebp - 8], 0x4266
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b5bc
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x52736657
push eax
push 0x1013b5ac
mov dword [ebp - 0x10], 0x7a736676
mov dword [ebp - 0xc], 0x766d6257
mov word [ebp - 8], 0x5866
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b5ac
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x1013b654
mov dword [ebp - 0x10], 0x426d6276
mov dword [ebp - 0xc], 0x64706d6d
mov byte [ebp - 8], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b654
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x1013bc44
mov dword [ebp - 0x10], 0x476d6276
mov dword [ebp - 0xc], 0x46666673
mov word [ebp - 8], 0x79
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013bc44
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret
Function at 0x100ea450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x1013c050
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov byte [ebp - 8], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c050
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x1013bbb0
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov word [ebp - 8], 0x7946
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013bbb0
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x1013c208
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x42
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c208
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea6a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x1013c22c
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x58
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c22c
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x756a7358
push eax
push 0x1013b98c
mov dword [ebp - 0xc], 0x6d6a4766
mov word [ebp - 8], 0x66
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b98c
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10114180]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x1013bee4
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x4268
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013bee4
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret
Function at 0x100ea7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10114180]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x1013bec8
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x5868
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013bec8
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ea9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x1013b4dc
mov dword [ebp - 0xc], 0x706d4473
mov word [ebp - 8], 0x6674
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b4dc
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100eab80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x1013b4d0
mov dword [ebp - 0xc], 0x66715073
mov word [ebp - 8], 0x6f
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b4d0
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100eac80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x666e6a75
push eax
push 0x1013b510
mov dword [ebp - 0x10], 0x46756654
mov dword [ebp - 0xc], 0x756f6677
mov byte [ebp - 8], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b510
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100ead20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66776278
push eax
push 0x1013b4c4
mov dword [ebp - 0xc], 0x71506f4a
mov word [ebp - 8], 0x6f66
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b4c4
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100eadc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x1013b3ac
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x4267
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b3ac
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret
Function at 0x100eae10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x1013b3b8
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x5867
mov byte [ebp - 6], 0
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013b3b8
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100eae60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x1013c578
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x42
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c578
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret

Function at 0x100eaeb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1012b014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x1013c560
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x58
call fcn.100c2d90
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x1013c560
call fcn.1001f2e6
mov esp, ebp
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x27de7d06
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x34a82c2d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405b6c
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405e37
test bl, 8
mov dword [ebp - 8], eax
je 0x405bab
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4702e8], eax
jmp 0x405d28
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405bc5
test eax, eax
je 0x405cd6
test bl, 2
je 0x405cd6
mov esi, 0x456730
push edi
push esi
call fcn.0040645a
cmp dword [ebp + 8], 0
je 0x405be4
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405bea
push edi
call fcn.00405d7b
cmp word [edi], 0
jne 0x405bfa
cmp word [0x456730], 0x5c
jne 0x405c05
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ccb
cmp word [ebp - 0x22c], 0x2e
jne 0x405c4f
cmp word [ebp - 0x22a], 0
je 0x405cae
cmp word [ebp - 0x22a], 0x2e
jne 0x405c4f
cmp word [ebp - 0x228], 0
je 0x405cae
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.0040645a
test byte [ebp - 0x258], 0x10
je 0x405c7a
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405cae
push dword [ebp + 0xc]
push edi
call fcn.00405b6c
jmp 0x405cae
push dword [ebp - 4]
push edi
call fcn.00405b24
test eax, eax
jne 0x405ca6
cmp dword [ebp - 4], eax
je 0x405c9e
push edi
push 0xfffffffffffffff1
call fcn.004054c2
push 0
push edi
call fcn.00406220
jmp 0x405cae
inc dword [0x4702e8]
jmp 0x405cae
push edi
push 0xfffffffffffffff2
call fcn.004054c2
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405c27
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405cd6
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405d28
cmp dword [ebp - 8], esi
jne 0x405cea
inc dword [0x4702e8]
jmp 0x405d28
push edi
call fcn.0040679d
test eax, eax
je 0x405d28
push edi
call fcn.00405d2f
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405b24
test eax, eax
jne 0x405d20
cmp dword [ebp - 4], esi
je 0x405ce2
push edi
push 0xfffffffffffffff1
call fcn.004054c2
push esi
push edi
call fcn.00406220
jmp 0x405d28
push edi
push 0xffffffffffffffe5
call fcn.004054c2
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4019f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401a50
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x406054]
test esi, esi
jle 0x401b3d
mov edi, dword [0x406058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401a84
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b36
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401a70
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401b7a
lea ebx, [esi + esi*2]
mov esi, dword [0x406058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x406058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b5a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401b2f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401b2f
mov eax, dword [esp + 0x20]
add ebx, dword [0x406058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401b44
add dword [0x406054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401a8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x406058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402040
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402095
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40208e
test esi, esi
je 0x40208e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402070
mov dword [esp], 0x406408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4022b0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4022e8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4022de
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4022ea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022d0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x402aa0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x2e4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x402ad0
add esp, 0x2e4
mov eax, 0xffffffff
pop ebx
pop esi
ret
lea eax, [esp + 0x14]
mov dword [esp], esi
mov dword [esp + 0x14], 0x10003
mov ebx, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
cmovne ebx, dword [esp + 0xcc]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x2e4
mov eax, ebx
pop ebx
pop esi
ret