joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1001b040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 0x1d], cl
test eax, eax
je 0x10001b08
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 0x1d]
movzx eax, cl
sub eax, 0xe8
je 0x10001bda
sub eax, 1
je 0x10001bda
sub eax, 0x16
jne 0x10001bc1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 1
push 1
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 0x1d], cl
test eax, eax
je 0x10001b66
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 0x1d]
cmp cl, 0x15
je 0x10001b70
cmp cl, 0x25
jne 0x10001bc1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov esi, dword [esi]
test eax, eax
je 0x10001baa
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov ecx, dword [esi]
mov eax, edi
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000243d
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000243d
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov ecx, dword [esi]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x10001c18
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov ecx, dword [ebp - 0x24]
lea eax, [esi + 4]
add eax, ecx
mov ecx, dword [ebp - 8]
mov dword [edi], eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.1000243d
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1001b040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, ecx
lea ecx, [ebp - 0x34]
push edi
push dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov ebx, dword [eax + 8]
call fcn.10001a30
mov esi, dword [ebp - 0x34]
push ecx
mov eax, esp
lea ecx, [ebp - 0x34]
mov dword [eax], esi
call fcn.10001ab0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
add esp, 4
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], esi
push eax
push 0x40
push 1
push esi
call edi
test eax, eax
setne byte [ebp - 0x14]
mov byte [esi], 0xe8
cmp byte [ebp - 0x14], 0
je 0x100020e6
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x20]
call edi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 4
push eax
push 0x40
inc esi
push 4
sub ebx, esi
mov dword [ebp - 0x30], esi
push esi
sub ebx, 4
call edi
test eax, eax
setne byte [ebp - 0x24]
mov dword [esi], ebx
cmp byte [ebp - 0x24], 0
je 0x10002122
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x30]
call edi
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
pop edi
pop esi
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop ebx
call fcn.1000243d
mov esp, ebp
pop ebp
ret 4
Function at 0x100098c8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011cf8
push 0x10011cf0
push str.FlsAlloc
push 0x1e
call fcn.100097e6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100098fc
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f124]
call esi
jmp 0x10009902
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10009946
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011d08
push 0x10011d00
push str.FlsGetValue
push 0x20
call fcn.100097e6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000997d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f124]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000bc45
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000bce2
push ebx
push esi
call fcn.1000bc0e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000ab81
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000bc8f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000bce1
push edi
push eax
call fcn.100094ef
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000bcaf
call fcn.10008f73
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000bce0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000ab81
add esp, 0x20
test eax, eax
jne 0x1000bcce
push edi
call fcn.10008f73
jmp 0x1000bcd6
push ebx
call fcn.10008f73
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000e320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e34d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e34d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x629ac1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313b0
cmp edx, dword [eax]
je 0x629ae3
add eax, 8
inc ecx
cmp eax, 0x631440
jl 0x629ad4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313b0]
jne 0x629c11
mov eax, dword [0x639d40]
cmp eax, 1
je 0x629beb
test eax, eax
jne 0x629b14
cmp dword [0x6312dc], 1
je 0x629beb
cmp edx, 0xfc
je 0x629c11
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x629b4b
lea eax, [ebp - 0x1a4]
push 0x62e958
push eax
call fcn.0062a4a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a930
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629b8e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a930
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62e954
push edi
call fcn.0062c800
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x62e938
push eax
call fcn.0062a4a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062a4b0
lea eax, [ebp - 0xa0]
push 0x62e934
push eax
call fcn.0062a4b0
push dword [esi + 0x6313b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062a4b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x62e90c
push eax
call fcn.0062c774
add esp, 0x2c
pop edi
jmp 0x629c11
lea eax, [ebp + 8]
lea esi, [esi + 0x6313b4]
push 0
push eax
push dword [esi]
call fcn.0062a930
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4fc090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa5000]
push edi
jmp 0x4fc0aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fc0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fc0a0
mov eax, 1
add ebx, ebx
jne 0x4fc0c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fc0d4
jne 0x4fc0f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fc0f3
dec eax
add ebx, ebx
jne 0x4fc0e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fc0b8
add ebx, ebx
jne 0x4fc0ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fc145
xor ecx, ecx
sub eax, 3
jb 0x4fc10b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fc17a
sar eax, 1
mov ebp, eax
jmp 0x4fc116
add ebx, ebx
jne 0x4fc116
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fc0e4
inc ecx
add ebx, ebx
jne 0x4fc124
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fc0e4
add ebx, ebx
jne 0x4fc131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fc126
jne 0x4fc142
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fc126
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fc164
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fc156
jmp 0x4fc0a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fc164
add edi, ecx
jmp 0x4fc0a6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fc182
cmp byte [edi], 0x11
jne 0x4fc182
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fc187
lea edi, [esi + 0xf5000]
mov eax, dword [edi]
or eax, eax
je 0x4fc1ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11fa88]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11fc04]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fc1b4
mov ecx, edi
jns 0x4fc1e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11fc08]
or eax, eax
je 0x4fc1f9
mov dword [ebx], eax
add ebx, 4
jmp 0x4fc1d1
call dword [esi + 0x11fc18]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fc230
cmp al, 0xef
ja 0x4fc223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fc205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fc212
mov ebp, dword [esi + 0x11fc0c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fc264
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x402080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x10001300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
mov dword [esp + 4], eax
jmp fcn.1000540c

Function at 0x10001a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001a63
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001aa4
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10001aa0
jmp 0x10001a90
cmp esi, edx
jae 0x10001aa4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10001a90
cmp esi, edx
jb 0x10001aa8
xor eax, eax
pop esi
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
ret
Function at 0x10001b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x1029bf30]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
mov ebx, dword [esp + 0x50]
push ebp
push esi
push edi
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
push eax
push 0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x4e52454b
mov dword [esp + 0x34], 0x32334c45
mov dword [esp + 0x38], 0x6c6c642e
mov byte [esp + 0x3c], 0
mov dword [esp + 0x40], 0x61427349
mov dword [esp + 0x44], 0x61655264
mov dword [esp + 0x48], 0x72745064
mov byte [esp + 0x4c], 0
call fcn.10002210
mov edi, eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x34]
push eax
push 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x5c], 0x64616f4c
mov dword [esp + 0x60], 0x7262694c
mov dword [esp + 0x64], 0x41797261
mov byte [esp + 0x68], 0
call fcn.10002210
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
add esp, 0x18
cmp dword [ebp + 0x84], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], esi
jbe 0x10001ca8
mov ebp, dword [ebp + 0x80]
push 0x14
add ebp, esi
push ebp
call edi
test eax, eax
jne 0x10001ca8
jmp 0x10001bd0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10001ca8
add eax, esi
push eax
call dword [esp + 0x20]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x10001c93
mov ecx, dword [ebx + 0xc]
lea ecx, [ecx*4 + 4]
push ecx
push dword [ebx + 8]
call fcn.10002500
add esp, 8
mov dword [ebx + 8], eax
test eax, eax
je 0x10001c93
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x14]
mov dword [eax + ecx*4], edx
inc dword [ebx + 0xc]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x10001c32
mov ebx, dword [ebp + 0x10]
lea esi, [eax + ecx]
add ebx, ecx
jmp 0x10001c39
mov esi, dword [ebp + 0x10]
add esi, ecx
mov ebx, esi
mov eax, dword [esi]
test eax, eax
je 0x10001c7a
sub ebx, esi
lea edi, [ebx + esi]
test eax, eax
jns 0x10001c4d
movzx eax, ax
jmp 0x10001c52
add eax, 2
add eax, ecx
push eax
push 0
push edx
call fcn.10002210
add esp, 0xc
mov dword [edi], eax
test eax, eax
je 0x10001c93
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add esi, 4
test eax, eax
jne 0x10001c41
mov edi, dword [esp + 0x18]
push 0x14
add ebp, 0x14
push ebp
call edi
test eax, eax
jne 0x10001ca8
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
jmp 0x10001bd0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call main
add esp, 0x48
ret
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call main
add esp, 0x48
ret
Function at 0x10001cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x1029bf30]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
push ebp
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push 0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x38], 0x4e52454b
mov dword [esp + 0x3c], 0x32334c45
mov dword [esp + 0x40], 0x6c6c642e
mov byte [esp + 0x44], 0
mov dword [esp + 0x28], 0x74726956
mov dword [esp + 0x2c], 0x416c6175
mov dword [esp + 0x30], 0x636f6c6c
mov byte [esp + 0x34], 0
call fcn.10002210
mov edx, dword [ebx]
mov edi, dword [ebx + 4]
movzx ecx, word [edx + 0x14]
mov ebp, eax
xor eax, eax
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0xc], edi
cmp ax, word [edx + 6]
jae 0x10001dc6
push esi
lea esi, [edx + 0x28]
add esi, ecx
mov eax, dword [esi]
test eax, eax
jne 0x10001d87
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x10001daf
mov eax, dword [esi - 4]
add eax, dword [esp + 0x10]
push 4
push 0x1000
push edi
push eax
call ebp
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.10119420
jmp 0x10001dac
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, edi
push eax
call ebp
mov ecx, dword [esi + 4]
push dword [esi]
add ecx, dword [esp + 0x18]
mov edi, eax
push ecx
push edi
call fcn.10118dd0
mov dword [esi - 8], edi
add esp, 0xc
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov eax, dword [eax]
inc ebx
movzx eax, word [eax + 6]
add esi, 0x28
cmp ebx, eax
jl 0x10001d56
pop esi
mov ecx, dword [esp + 0x3c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call main
add esp, 0x34
ret

Function at 0x10001de0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
test ebx, ebx
jle 0x10001e36
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call ebp
mov eax, dword [esp + 0x1c]
mov ecx, 0x68f7
movsx eax, byte [edi + eax]
cdq
idiv ecx
mov eax, dword [esp + 0x14]
push 0
inc edi
add dl, 2
xor byte [esi + eax], dl
call ebp
mov eax, 0xcccccccd
mul esi
shr edx, 2
mov ecx, esi
lea eax, [edx + edx*4]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc esi
and edi, ecx
cmp esi, ebx
jl 0x10001df6
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10001e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
mov eax, dword [0x1029bf30]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
mov ebx, dword [esp + 0x48]
push ebp
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], 0x4e52454b
mov dword [esp + 0x28], 0x32334c45
mov dword [esp + 0x2c], 0x6c6c642e
mov byte [esp + 0x30], 0
mov dword [esp + 0x34], 0x74726956
mov dword [esp + 0x38], 0x466c6175
mov dword [esp + 0x3c], 0x656572
call fcn.10002210
mov dword [esp + 0x18], eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x28]
push eax
push 0
mov dword [esp + 0x4c], 0x74726956
mov dword [esp + 0x50], 0x506c6175
mov dword [esp + 0x54], 0x65746f72
mov word [esp + 0x58], 0x7463
mov byte [esp + 0x5a], 0
call fcn.10002210
mov edx, dword [ebx]
mov dword [esp + 0x20], eax
movzx ecx, word [edx + 0x14]
xor eax, eax
add esp, 0x18
xor ebp, ebp
cmp ax, word [edx + 6]
jae 0x10001f8f
push esi
lea esi, [edx + 0x3c]
push edi
add esi, ecx
lea esp, [esp]
mov ecx, dword [esi]
mov eax, ecx
mov edi, ecx
shr eax, 0x1d
shr edi, 0x1e
mov ebx, ecx
and eax, 1
and edi, 1
shr ebx, 0x1f
test ecx, 0x2000000
je 0x10001f30
push 0x4000
push dword [esi - 0x14]
push dword [esi - 0x1c]
call dword [esp + 0x20]
jmp 0x10001f77
lea eax, [edi + eax*2]
lea eax, [ebx + eax*2]
mov edi, dword [eax*4 + 0x10187080]
test ecx, 0x4000000
je 0x10001f4b
or edi, 0x200
mov ebx, dword [esi - 0x14]
mov eax, ebx
test eax, eax
jne 0x10001f69
test cl, 0x40
je 0x10001f5e
mov eax, dword [edx + 0x20]
jmp 0x10001f65
test cl, cl
jns 0x10001f77
mov eax, dword [edx + 0x24]
test eax, eax
je 0x10001f77
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push dword [esi - 0x1c]
call dword [esp + 0x20]
mov eax, dword [esp + 0x18]
inc ebp
mov edx, dword [eax]
add esi, 0x28
movzx eax, word [edx + 6]
cmp ebp, eax
jl 0x10001f00
pop edi
pop esi
mov ecx, dword [esp + 0x44]
pop ebp
pop ebx
xor ecx, esp
call main
add esp, 0x40
ret
Function at 0x10002210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x1029bf30]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x44]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x4e52454b
mov dword [esp + 0x30], 0x32334c45
mov dword [esp + 0x34], 0x6c6c642e
mov byte [esp + 0x38], 0
mov dword [esp + 0x1c], 0x64616f4c
mov dword [esp + 0x20], 0x7262694c
mov dword [esp + 0x24], 0x41797261
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x100022a0
push edi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call main
add esp, 0x28
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x100022c7
push ebx
call dword [esp + 0x14]
test eax, eax
jne 0x100022c7
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call main
add esp, 0x28
ret
push edi
push eax
call esi
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call main
add esp, 0x28
ret

Function at 0x10002450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
mov eax, dword [0x1029bf30]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x10]
push eax
push 0
mov dword [esp + 0x18], 0x4e52454b
mov dword [esp + 0x1c], 0x32334c45
mov dword [esp + 0x20], 0x6c6c642e
mov byte [esp + 0x24], 0
mov dword [esp + 0x34], 0x50746547
mov dword [esp + 0x38], 0x65636f72
mov dword [esp + 0x3c], 0x65487373
mov word [esp + 0x40], 0x7061
mov byte [esp + 0x42], 0
call fcn.10002210
mov edi, eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov dword [esp + 0x34], 0x70616548
mov dword [esp + 0x38], 0x65657246
mov byte [esp + 0x3c], 0
call fcn.10002210
add esp, 0x18
mov esi, eax
push ebx
push 0
call edi
push eax
call esi
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call main
add esp, 0x30
ret
Function at 0x10002500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
mov eax, dword [0x1029bf30]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
push edi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [esp + 0x20], 0x4e52454b
mov dword [esp + 0x24], 0x32334c45
mov dword [esp + 0x28], 0x6c6c642e
mov byte [esp + 0x2c], 0
mov dword [esp + 0x48], 0x50746547
mov dword [esp + 0x4c], 0x65636f72
mov dword [esp + 0x50], 0x65487373
mov word [esp + 0x54], 0x7061
mov byte [esp + 0x56], 0
call fcn.10002210
mov edi, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x24]
push eax
push 0
mov dword [esp + 0x48], 0x70616548
mov dword [esp + 0x4c], 0x6c416552
mov dword [esp + 0x50], 0x636f6c
call fcn.10002210
mov dword [esp + 0x28], eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
push 0
mov dword [esp + 0x48], 0x70616548
mov dword [esp + 0x4c], 0x6f6c6c41
mov word [esp + 0x50], 0x63
call fcn.10002210
add esp, 0x24
mov ebp, eax
push esi
test ebx, ebx
je 0x100025ea
push ebx
push 0
call edi
push eax
call dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call main
add esp, 0x40
ret
push 0
call edi
push eax
call ebp
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call main
add esp, 0x40
ret