joyce8/EMBER2024-capa huggingface dataset:
Function at 0x244525
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push dword [esp + 0x38]
mov esi, edx
mov ebp, ecx
push dword [esp + 0x38]
push esi
push ebp
call fcn.0023c8d2
mov dword [esp + 0x30], 0x9092ec
xor edi, edi
mov dword [esp + 0x34], 0xda6272
xor edx, edx
mov dword [esp + 0x38], 0x40a257
mov dword [esp + 0x3c], edi
mov dword [esp + 0x20], 0x30a25f
add dword [esp + 0x20], 0xffff6899
mov eax, dword [esp + 0x20]
push 0x6d
pop ecx
div ecx
xor edx, edx
mov dword [esp + 0x20], eax
xor dword [esp + 0x20], 0x7feb2
mov dword [esp + 0x24], 0xb17d4f
mov eax, dword [esp + 0x24]
push 0x1a
pop ecx
div ecx
mov dword [esp + 0x24], eax
xor dword [esp + 0x24], 0x40e40
mov eax, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
xor edx, eax
mov dword [esp + 0x28], eax
mov eax, edx
mov dword [esp + 0x2c], edx
and eax, 0xfffffffc
mov ecx, edx
add eax, 4
mov ebx, edx
and cl, 3
cmovne ebx, eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, ebx
call fcn.0024bbc9
mov dword [esp + 0x18], eax
pop ecx
test eax, eax
je 0x244623
shr ebx, 2
lea ecx, [esi + ebx*4]
xor ebx, ebx
mov edx, ecx
sub edx, esi
add edx, 3
shr edx, 2
cmp esi, ecx
cmova edx, ebx
test edx, edx
je 0x244618
mov ebx, dword [esp + 0x18]
mov ecx, eax
sub ecx, esi
mov eax, dword [esi]
xor eax, ebx
inc edi
mov dword [ecx + esi], eax
lea esi, [esi + 4]
cmp edi, edx
jb 0x244605
mov eax, dword [esp + 0x14]
test ebp, ebp
je 0x244623
mov ecx, dword [esp + 0x1c]
mov dword [ebp], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x2476cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 0xc]
mov ebx, edx
push dword [ebp + 8]
push ebx
push ecx
call fcn.0023c8d2
mov dword [ebp - 4], 0xe36790
add esp, 0x10
shr dword [ebp - 4], 0xd
xor edx, edx
add dword [ebp - 4], 0x8b1c
imul eax, dword [ebp - 4], 0x3a
push 0x2c
pop ecx
push 0x49
pop esi
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0x212076
mov dword [ebp - 8], 0x253d11
mov eax, dword [ebp - 8]
div ecx
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
div esi
mov dword [ebp - 8], eax
add dword [ebp - 8], 0xffff0adb
xor dword [ebp - 8], 0xffff0dd4
mov dword [ebp - 8], 0xe72f56
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
imul eax, dword [ebp - 8], 0x57
mov dword [ebp - 8], eax
xor dword [ebp - 8], 0xd540738
xor dword [ebp - 8], 0x43c51112
cmp byte [ebx], 0
je 0x2477d6
push edi
mov edi, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], 0x253d11
mov eax, dword [ebp - 8]
div ecx
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
div esi
push 0x2c
mov dword [ebp - 8], eax
add dword [ebp - 8], 0xffff0adb
xor dword [ebp - 8], 0xffff0dd4
mov cl, byte [ebp - 8]
mov esi, dword [ebp - 4]
mov dword [ebp - 8], 0xe72f56
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
imul eax, dword [ebp - 8], 0x57
shl esi, cl
mov dword [ebp - 8], eax
xor dword [ebp - 8], 0xd540738
xor dword [ebp - 8], 0x43c51112
mov cl, byte [ebp - 8]
mov edx, dword [ebp - 4]
movsx eax, byte [ebx]
mov dword [ebp - 4], eax
add dword [ebp - 4], esi
shl edx, cl
add dword [ebp - 4], edx
sub dword [ebp - 4], edi
inc ebx
pop ecx
push 0x49
pop esi
cmp byte [ebx], 0
jne 0x24775c
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x248fa9
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0x14]
mov esi, edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push ecx
call fcn.0023c8d2
mov dword [ebp - 0xc], 0x9e61c2
add esp, 0x18
shr dword [ebp - 0xc], 0xa
add dword [ebp - 0xc], 0x4591
xor dword [ebp - 0xc], 0x8a96a
mov dword [ebp - 8], 0x4993a
add dword [ebp - 8], 0xa9aa
or dword [ebp - 8], 0x6ad70ee0
add dword [ebp - 8], 0xffffcbc8
xor dword [ebp - 8], 0x6ad15791
mov dword [ebp - 4], 0xf8d7c5
shr dword [ebp - 4], 0xd
add dword [ebp - 4], 0xa252
shr dword [ebp - 4], 0x10
xor dword [ebp - 4], 0x5f32
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push 0x2c1
push 0xb03e1c69
push ecx
push 0xbbddc240
call fcn.0024462b
add esp, 0x10
push esi
push dword [ebp + 0xc]
call eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x24f209
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
push dword [esp + 0x38]
mov esi, edx
push dword [esp + 0x38]
push dword [esp + 0x38]
push esi
push ecx
call fcn.0023c8d2
xor eax, eax
mov dword [esp + 0x30], 0x99f0dc
lea edi, [esp + 0x34]
xor edx, edx
stosd dword es:[edi], eax
push 0x74
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp + 0x24], 0x1e0793
lea edi, [esi + 4]
imul eax, dword [esp + 0x24], 0x3e
mov dword [esp + 0x24], eax
shl dword [esp + 0x24], 1
xor dword [esp + 0x24], 0xe82b1e3
mov dword [esp + 0x20], 0xa8534e
xor dword [esp + 0x20], 0xf0f4f619
mov eax, dword [esp + 0x20]
div ecx
mov dword [esp + 0x20], eax
shr dword [esp + 0x20], 4
xor dword [esp + 0x20], 0x2ec10d
mov ecx, dword [esi]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
add esp, 0x10
mov ecx, esi
call fcn.0024bbc9
mov ebx, eax
mov dword [esp + 0x14], ebx
pop ecx
test ebx, ebx
je 0x24f318
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x24f30f
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebp
mov byte [edx - 1], cl
cmp ebp, esi
jb 0x24f2e6
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
pop ebp
mov byte [ebx + eax], 0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
Function at 0x2517f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push edx
push ecx
call fcn.0023c8d2
and dword [esp + 0x38], 0
add esp, 0x14
mov dword [esp + 0x20], 0x3579e
mov dword [esp + 0x34], 0x414bff
imul eax, dword [esp + 0x34], 0x6b
mov dword [esp + 0x34], eax
xor dword [esp + 0x34], 0xc4e5fd7e
xor dword [esp + 0x34], 0xdfaf3eea
mov dword [esp + 0x14], 0x79d45b
add dword [esp + 0x14], 0xffffb53e
xor dword [esp + 0x14], 0x715d8f
mov dword [esp + 0x10], 0x8c6c8a
add dword [esp + 0x10], 0x1049
add dword [esp + 0x10], 0xffff3c3e
xor dword [esp + 0x10], 0x8e999e
mov dword [esp + 0x1c], 0xc270db
xor dword [esp + 0x1c], 0x3930086f
xor dword [esp + 0x1c], 0x39f3c79d
mov dword [esp + 0x18], 0x978a1e
shl dword [esp + 0x18], 9
xor dword [esp + 0x18], 0x2f1df3b9
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esp + 0x34]
add eax, ebx
mov edx, dword [eax + ecx*8 + 0x78]
test edx, edx
je 0x251924
cmp dword [eax + ecx*8 + 0x7c], 0
je 0x251924
lea esi, [edx + ebx]
jmp 0x25191d
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
lea edx, [eax + ebx]
call fcn.002460c1
pop ecx
mov ecx, eax
mov dword [esp + 0x34], ecx
test ecx, ecx
je 0x25192f
mov edi, dword [esi]
mov ebp, dword [esi + 0x10]
add edi, ebx
add ebp, ebx
jmp 0x251914
jns 0x2518ec
movzx eax, ax
jmp 0x2518f1
add eax, 2
add eax, ebx
push dword [esp + 0x18]
mov edx, ecx
mov ecx, dword [esp + 0x20]
push eax
call fcn.00247632
pop ecx
pop ecx
test eax, eax
je 0x25192f
mov ecx, dword [esp + 0x34]
add edi, 4
mov dword [ebp], eax
add ebp, 4
mov eax, dword [edi]
test eax, eax
jne 0x2518e5
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x2518bf
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
jmp 0x251927
Function at 0x252b8f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push ecx
call fcn.0023c8d2
and dword [ebp - 4], 0
add esp, 0x14
mov dword [ebp - 0x10], 0x32e6a6
mov dword [ebp - 0xc], 0xa0181e
mov dword [ebp - 8], 0x5bfe0e
mov dword [ebp + 0x10], 0xdd832b
xor dword [ebp + 0x10], 0xb3285cae
shl dword [ebp + 0x10], 0xe
xor dword [ebp + 0x10], 0x77e1410b
cmp dword [eax + 4], 0x40
jae 0x252be5
xor eax, eax
jmp 0x252c0e
mov ecx, dword [eax]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x252be1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x252be1
movzx edx, word [eax + 0x18]
mov ecx, dword [ebp + 0x10]
push esi
xor esi, esi
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41244f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004122ce

Function at 0x41682b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416199

Function at 0x416836
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004163d4

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x57500428
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x279d348f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x41bb40
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xd0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov dword [0x4be0d8], eax
call fcn.0040e320
call fcn.0048fdcb
call fcn.004124b1
xor ebx, ebx
mov esi, 0x4bdfa0
push ebx
mov ecx, esi
call fcn.0040ed87
call fcn.0040563d
mov edi, 0x4beb4c
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [0x4bdca8]
or eax, dword [0x4bdcac]
jne 0x41bba0
push 0x4bdca8
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push 0x4bdcb0
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
push 0x4bdf00
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
push ebx
push 0x34ca
call fcn.004113bc
push 0xd6fc6
push 0x311f1
lea eax, [ebp - 0x60]
push str._06lu_06lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x60]
push eax
push 0x4a7686
mov ecx, esi
call fcn.0043cc80
lea eax, [ebp - 0x60]
push eax
push str.PECMDVER
mov ecx, esi
call fcn.0043cc80
push str.X86_U
lea ecx, [ebp + 0x68]
call fcn.00445746
push dword [0x4bc0f0]
lea ecx, [ebp + 0x68]
call fcn.0043d411
push dword [ebp + 0x68]
mov ecx, esi
push 0x4a765c
call fcn.0043cc80
push 0x4a7658
push 0x4a7648
mov ecx, esi
call fcn.0043ccd0
push ebx
push 0x34d7
call fcn.004113bc
call fcn.0041121a
push ebx
push 0x34d9
call fcn.004113bc
mov eax, dword [ebp + 0x78]
mov dword [0x4bde84], eax
mov eax, dword [ebp + 0x7c]
mov dword [0x4bc290], eax
call fcn.004380c2
push str.WM_TaskbarRestart
push dword [0x4be100]
mov esi, 0x4bdfa0
push esi
call fcn.0043f6f0
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
add esp, 0x1c
push str.__PID
call edi
push eax
push esi
call fcn.0043f6f0
add esp, 0xc
push str.__PPID
call edi
push eax
call fcn.004049e9
pop ecx
push eax
push esi
call fcn.0043f6f0
push str.__HINST
push dword [0x4bde84]
push esi
call fcn.0043f6f0
add esp, 0x18
push 0x4a75dc
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
push esi
call fcn.0043f6f0
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
add eax, 0x34e2
push ebx
push eax
call fcn.004113bc
movzx eax, word [0x4c1010]
push str.SYSCODEPAGE
push eax
push esi
call fcn.0043f6f0
add esp, 0x14
push 0x20a
lea ecx, [ebp + 0x6c]
call fcn.0043d3c3
push dword [ebp + 0x6c]
mov edi, 0x208
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push dword [ebp + 0x6c]
mov ecx, esi
push 0x4a7214
call fcn.0043ccd0
push dword [ebp + 0x6c]
mov ecx, esi
push 0x4a75b4
call fcn.0043ccd0
mov eax, dword [ebp + 0x6c]
mov word [eax + 4], bx
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurDrv
call fcn.0043ccd0
mov eax, dword [ebp + 0x6c]
push edi
push eax
push ebx
mov word [eax], bx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push dword [ebp + 0x6c]
mov ecx, esi
push str.CurFile
call fcn.0043ccd0
call fcn.004113cc
lea ecx, [ebp + 0x6c]
call fcn.00437884
lea ecx, [ebp + 0x68]
call fcn.00437884
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret
Function at 0x1000a350
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x10186060
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x10186058]
sub esp, 4
test ebx, ebx
je 0x1000a3a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x1000a39e
test esi, esi
je 0x1000a39e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x1000a380
mov dword [esp], 0x10186060
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000ec90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [sym.libcurl.dll_Ordinal_0], 0x5a4d
jne 0x1000ecb5
mov ecx, dword [0x1000003c]
cmp dword [ecx + sym.libcurl.dll_Ordinal_0], 0x4550
lea edx, [ecx + sym.libcurl.dll_Ordinal_0]
je 0x1000ecc0
ret
cmp word [ecx + 0x10000018], 0x10b
jne 0x1000ecb5
push esi
movzx eax, word [ecx + 0x10000014]
push ebx
movzx esi, word [ecx + 0x10000006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, sym.libcurl.dll_Ordinal_0
test si, si
je 0x1000ed08
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x1000ecfe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x1000ed0a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x1000ecf0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x1000f020
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x10186ce0]
mov ebx, dword [esp + 0x44]
test eax, eax
je 0x1000f05a
mov eax, dword [0x10186d1c]
test eax, eax
je 0x1000f05a
mov dword [esp + 4], 0x450fe24c
mov dword [esp], eax
call fcn.1001fb40
mov esi, eax
test ebx, ebx
je 0x1000f05a
cmp word [ebx], 0x5a4d
je 0x1000f068
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x1000f05a
movzx edx, word [eax + 0x14]
movzx edi, word [eax + 6]
lea edx, [eax + edx + 0x18]
test di, di
je 0x1000f05a
xor ecx, ecx
jmp 0x1000f09a
add ecx, 1
add edx, 0x28
cmp ecx, edi
je 0x1000f05a
mov eax, dword [edx]
or eax, 0x20202020
cmp eax, 0x7865742e
jne 0x1000f090
mov eax, dword [edx + 0xc]
mov ebp, dword [edx + 8]
add ebx, eax
sete cl
add eax, dword [esp + 0x40]
mov edi, eax
sete al
or cl, al
jne 0x1000f05a
test ebp, ebp
je 0x1000f05a
mov eax, dword [edi]
cmp dword [ebx], eax
jne 0x1000f05a
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x80
mov dword [esp + 4], ebp
mov dword [esp], ebx
call esi
sub esp, 0x10
test eax, eax
je 0x1000f05a
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea eax, [esp + 0x1c]
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
call esi
sub esp, 0x10
test eax, eax
setne al
movzx eax, al
jmp 0x1000f05c
Function at 0x10010840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov edi, eax
lea esi, [esi]
nop
mov ecx, dword [edi + 0x28]
movzx esi, word [edi + 0x24]
movzx edx, byte [ecx]
test esi, esi
je 0x100108b0
mov ebx, ecx
mov eax, 0x1504
jmp 0x1001089d
lea ebp, [ebx + 1]
xor edx, edx
mov ebx, eax
shl ebx, 5
add eax, ebx
lea ebx, [ebp + 1]
add eax, edx
movzx edx, byte [ebp + 1]
mov ebp, ebx
sub ebp, ecx
cmp ebp, esi
jae 0x100108de
test dl, dl
je 0x10010880
mov ebp, ebx
cmp dl, 0x60
jbe 0x10010885
sub edx, 0x20
movzx edx, dl
jmp 0x10010885
mov eax, 0x1504
test dl, dl
je 0x100108de
lea esi, [esi]
mov ebx, eax
shl ebx, 5
add eax, ebx
cmp dl, 0x60
jbe 0x100108d2
sub edx, 0x20
movzx edx, dl
add ecx, 1
add eax, edx
movzx edx, byte [ecx]
test dl, dl
jne 0x100108c0
cmp dword [esp + 0x18], eax
je 0x10010900
mov edi, dword [edi]
test edi, edi
je 0x100108f3
cmp dword [esp], edi
jne 0x10010860
add esp, 4
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0x10]
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10013840
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x10013879
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x100145b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov edi, eax
lea esi, [esi]
nop
mov ecx, dword [edi + 0x28]
movzx esi, word [edi + 0x24]
movzx edx, byte [ecx]
test esi, esi
je 0x10014620
mov ebx, ecx
mov eax, 0x1504
jmp 0x1001460d
lea ebp, [ebx + 1]
xor edx, edx
mov ebx, eax
shl ebx, 5
add eax, ebx
lea ebx, [ebp + 1]
add eax, edx
movzx edx, byte [ebp + 1]
mov ebp, ebx
sub ebp, ecx
cmp ebp, esi
jae 0x1001464e
test dl, dl
je 0x100145f0
mov ebp, ebx
cmp dl, 0x60
jbe 0x100145f5
sub edx, 0x20
movzx edx, dl
jmp 0x100145f5
mov eax, 0x1504
test dl, dl
je 0x1001464e
lea esi, [esi]
mov ebx, eax
shl ebx, 5
add eax, ebx
cmp dl, 0x60
jbe 0x10014642
sub edx, 0x20
movzx edx, dl
add ecx, 1
add eax, edx
movzx edx, byte [ecx]
test dl, dl
jne 0x10014630
cmp dword [esp + 0x18], eax
je 0x10014670
mov edi, dword [edi]
test edi, edi
je 0x10014663
cmp dword [esp], edi
jne 0x100145d0
add esp, 4
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0x10]
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10014780
Capabilities:
Encode data using xor

Disassembly:
push ebp
pxor xmm2, xmm2
movzx eax, word [0x1003b8f8]
movdqu xmm5, xmmword [0x1003b8f0]
movdqu xmm6, xmmword [0x1003b900]
movdqu xmm4, xmmword [0x1003b910]
movdqu xmm3, xmmword [0x1003b920]
mov ebp, esp
mov edx, dword [ebp + 8]
mov word [edx + 0x58], ax
movzx eax, word [0x1003b8f4]
mov dword [edx], 0
mov word [edx + 0x1d], ax
lea eax, [edx + 0x60]
add edx, 0x460
mov byte [edx - 0x441], 0
mov dword [edx - 0x42c], 0
mov dword [edx - 0x428], 0
mov dword [edx - 0x43c], 0
mov dword [edx + 8], 0xffffffff
mov dword [edx + 0xc], 0xffffffff
mov dword [edx - 0x430], 0x20
mov dword [edx - 0x418], 4
lea esi, [esi]
lea esi, [esi]
movdqa xmm1, xmm5
movdqa xmm0, xmm2
paddd xmm5, xmm6
add eax, 0x10
movdqa xmm7, xmm1
psrld xmm1, 1
pand xmm7, xmm4
psubd xmm0, xmm7
pand xmm0, xmm3
pxor xmm0, xmm1
movdqa xmm1, xmm2
movdqa xmm7, xmm0
psrld xmm0, 1
pand xmm7, xmm4
psubd xmm1, xmm7
pand xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm2
movdqa xmm7, xmm1
psrld xmm1, 1
pand xmm7, xmm4
psubd xmm0, xmm7
pand xmm0, xmm3
pxor xmm0, xmm1
movdqa xmm1, xmm2
movdqa xmm7, xmm0
psrld xmm0, 1
pand xmm7, xmm4
psubd xmm1, xmm7
pand xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm2
movdqa xmm7, xmm1
psrld xmm1, 1
pand xmm7, xmm4
psubd xmm0, xmm7
pand xmm0, xmm3
pxor xmm0, xmm1
movdqa xmm1, xmm2
movdqa xmm7, xmm0
psrld xmm0, 1
pand xmm7, xmm4
psubd xmm1, xmm7
pand xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm2
movdqa xmm7, xmm1
psrld xmm1, 1
pand xmm7, xmm4
psubd xmm0, xmm7
pand xmm0, xmm3
pxor xmm0, xmm1
movdqa xmm1, xmm2
movdqa xmm7, xmm0
psrld xmm0, 1
pand xmm7, xmm4
psubd xmm1, xmm7
pand xmm1, xmm3
pxor xmm0, xmm1
movups xmmword [eax - 0x10], xmm0
cmp eax, edx
jne 0x10014820
pop ebp
ret