joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056e50
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1006a018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov dword [0x1006c59c], eax
mov ebx, dword [edi]
push 4
push ebx
call esi
test eax, eax
jne 0x1003a007
push 4
add ebx, 0xe5
push ebx
call esi
test eax, eax
jne 0x1003a007
mov al, byte [ebx]
test al, al
je 0x1003a007
cmp byte [ebp + 8], 0
jne 0x1003a007
movaps xmm0, xmmword [0x10062b50]
xor ecx, ecx
movups xmmword [ebp - 0x54], xmm0
nop dword [eax]
mov al, byte [ebp - 0x54]
xor byte [ebp + ecx - 0x53], al
inc ecx
cmp ecx, 0xe
jb 0x10039ed0
lea eax, [ebp - 0x53]
mov byte [ebp - 0x45], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.100053b0
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], 0
mov word [ebp - 0x2c], 0x60
lea ecx, [ebp - 0x44]
push eax
mov byte [ebp - 0x2b], 0
call fcn.100053b0
mov byte [ebp - 4], 1
mov ebx, dword [edi + 0x10]
test ebx, ebx
je 0x10039f2a
push 4
push ebx
call esi
test eax, eax
jne 0x10039f2a
lea eax, [ebp - 0x44]
mov ecx, ebx
push eax
call dword [0x10062504]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x10039f40
inc eax
push eax
push dword [ebp - 0x44]
call fcn.10005180
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x44]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100053b0
mov byte [ebp - 4], 2
mov ebx, dword [edi + 0x10]
test ebx, ebx
je 0x10039f74
push 4
push ebx
call esi
test eax, eax
jne 0x10039f74
lea eax, [ebp - 0x44]
mov ecx, ebx
push eax
call dword [0x10062548]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x10039f8a
inc eax
push eax
push dword [ebp - 0x44]
call fcn.10005180
mov ebx, dword [edi + 0x10]
test ebx, ebx
je 0x10039fa2
push 4
push ebx
call esi
test eax, eax
jne 0x10039fa2
mov ecx, ebx
call dword [0x1006250c]
lea eax, [ebp - 0x2b]
mov word [ebp - 0x2c], 0x7d
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x2b], 0
call fcn.100053b0
mov byte [ebp - 4], 3
mov ebx, dword [edi + 0x20]
test ebx, ebx
je 0x10039fd8
push 4
push ebx
call esi
test eax, eax
jne 0x10039fd8
lea eax, [ebp - 0x44]
mov ecx, ebx
push eax
call dword [0x1006254c]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x10039fee
inc eax
push eax
push dword [ebp - 0x44]
call fcn.10005180
mov ecx, edi
call fcn.1003ba90
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1003a007
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10005180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10052ee0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004d7d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057b38
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1006a018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x7c]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x7c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
call fcn.1004d560
lea ecx, [ebp - 0x7c]
call fcn.1004d610
push esi
lea ecx, [ebp - 0x7c]
call fcn.1004d700
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x1004d877
inc ecx
push ecx
push dword [ebp + 8]
call fcn.10005180
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10052ee0
mov esp, ebp
pop ebp
ret

Function at 0x1004da00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
mov ebx, 1
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
add eax, 0x10
mov dword [ebp + 0xc], eax
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.100539f0
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, dword [ebp + 0xc]
adc esi, edx
inc ebx
mov dword [eax], edi
mov dword [eax + 4], esi
add eax, 8
mov dword [ebp + 0xc], eax
cmp ebx, 0x138
jl 0x1004da23
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0x138
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004fe40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057cce
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1006a018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1004fe76
xor ebx, ebx
jmp 0x1004fe7f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1004fec1
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x1004ff00
test esi, esi
jne 0x1004ff04
push 0x1004f6c0
push 0x1006bb18
call fcn.1004f3b0
mov eax, dword [section..data]
add esp, 8
cmp eax, 0xffffffff
je 0x1004fec1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1004feee
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1004feee
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1004ff46
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1004ff2f
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x1004ff04
cmp dword [ebx + 0x18], 0
je 0x1004fe90
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x1004ff6d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1004ff6d
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1004f6e0
cmp dword [ebx + 0x18], 0
jne 0x1004ff50
jmp 0x1004fe90
Function at 0x10050210
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100503e0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100502ed
mov edx, dword [ebp - 4]
cmp edx, dword [0x1006a004]
jb 0x1005025a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1006a008]
ja 0x1005025a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1005022a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1005027f
jmp 0x100502ed
cmp dword [ebp - 0x14], 0x10000
jne 0x100502d3
cmp dword [ebp - 0x18], 0x10000
jb 0x100502d3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100502b6
mov eax, dword [ebp - 8]
jmp 0x100502ef
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100502c6
xor eax, eax
jmp 0x100502ef
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100502e8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100503e0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1005022a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10050300
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10050410
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100503d5
mov edx, dword [ebp - 4]
cmp edx, dword [0x1006a004]
jb 0x10050345
mov eax, dword [ebp - 4]
cmp eax, dword [0x1006a008]
ja 0x10050345
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10050315
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1005036a
jmp 0x100503d5
cmp dword [ebp - 0x14], 0x10000
jne 0x100503be
cmp dword [ebp - 0x18], 0x10000
jb 0x100503be
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100503a1
mov eax, dword [ebp - 8]
jmp 0x100503d7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100503b1
xor eax, eax
jmp 0x100503d7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100503d0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10050410
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10050315
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10050440
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10050830
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1006bb2c], 0
jne 0x1005047d
cmp dword [0x1006bb28], 0
je 0x1005047d
mov eax, dword [0x1006bb28]
mov dword [0x1006bb2c], eax
cmp dword [0x1006bb2c], 0
je 0x100504fa
mov ecx, dword [0x1006bb2c]
cmp dword [ecx + 8], 0
je 0x100504fa
mov edx, dword [0x1006bb2c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x100504fa
mov ecx, dword [0x1006bb2c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x100504fa
mov eax, dword [0x1006bb2c]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x100504c9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x100504d0
xor eax, eax
jmp 0x10050619
mov ecx, dword [0x1006bb2c]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10050619
mov edx, dword [0x1006bb28]
mov dword [0x1006bb2c], edx
jmp 0x10050516
mov eax, dword [0x1006bb2c]
mov ecx, dword [eax + 4]
mov dword [0x1006bb2c], ecx
cmp dword [0x1006bb2c], 0
je 0x10050556
cmp dword [0x1006bb2c], 0
je 0x10050554
mov edx, dword [0x1006bb2c]
cmp dword [edx + 8], 0
je 0x10050554
mov eax, dword [0x1006bb2c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10050554
mov edx, dword [0x1006bb2c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10050554
jmp 0x100504ae
jmp 0x10050508
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10050620
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10050617
mov eax, dword [ebp - 0x18]
mov dword [0x1006bb2c], eax
mov ecx, dword [0x1006bb2c]
mov dword [ecx], 0x52727464
mov edx, dword [0x1006bb2c]
mov dword [edx + 8], 0
mov eax, dword [0x1006bb2c]
mov ecx, dword [0x1006bb28]
mov dword [eax + 4], ecx
mov edx, dword [0x1006bb2c]
mov dword [0x1006bb28], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1006bb2c]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x100505e7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10050607
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x100505de
mov eax, dword [0x1006bb2c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x100504ae
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10051360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006bb28]
mov dword [ebp - 4], eax
jmp 0x10051379
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100513a0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1005139e
call sub.KERNEL32.dll_GetLastError
jmp 0x100513a2
jmp 0x10051370
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10051840
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1006bb38], eax
je 0x10051864
mov eax, 0x10dd
jmp 0x10051a0c
cmp dword [0x1006bb3c], 0
je 0x10051877
mov eax, dword [0x1006bb3c]
jmp 0x10051a0c
cmp dword [ebp + 0xc], 0
jne 0x10051887
mov eax, 0x57
jmp 0x10051a0c
cmp dword [ebp + 8], 0
jne 0x10051897
mov eax, 6
jmp 0x10051a0c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x100518c0
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x1006bb3c], ecx
mov edx, dword [ebp + 8]
mov dword [0x1006bb40], edx
mov eax, dword [ebp - 8]
jmp 0x10051a0c
push 0x18
call fcn.10052ef6
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005191b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x1006bb3c], ecx
cmp dword [ebp - 4], 0
je 0x1005190a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.100534ae
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x1006bb40], ecx
mov eax, dword [ebp - 8]
jmp 0x10051a0c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10051820
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10051820
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1005195b
cmp dword [ebp - 0xc], 0x1e
jbe 0x10051977
mov dword [ebp - 8], 9
cmp dword [0x1006bb30], 0
je 0x10051972
jmp 0x100518e9
jmp 0x100518e0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1005199e
mov dword [ebp - 8], 9
cmp dword [0x1006bb30], 0
je 0x10051999
jmp 0x100518e9
jmp 0x100518e0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x100519c9
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x100518e0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x1006bb48]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1006bb48], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10051a20
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1006bb38], eax
je 0x10051a3d
mov eax, 0x10dd
jmp 0x10051b20
mov eax, dword [0x1006bb48]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10051abc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10051a98
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10051a98
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100508c0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.100534ae
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10051a45
mov dword [0x1006bb48], 0
call fcn.100511a0
mov ecx, dword [0x1006bb44]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10051b0a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100534ae
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10051ad4
mov dword [0x1006bb44], 0
mov dword [0x1006bb38], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10052000
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1006bb3c], 0
je 0x10052019
mov eax, dword [0x1006bb3c]
jmp 0x100520b8
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1005202a
xor eax, eax
jmp 0x100520b8
push 8
call fcn.10052ef6
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10052082
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1005206b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.100534ae
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1006bb3c], eax
mov dword [0x1006bb40], 0
mov eax, dword [ebp - 8]
jmp 0x100520b8
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1005209a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1005204a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1006bb44]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1006bb44], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10019f30
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1001a0f4
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
jmp 0x10019f5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10019f61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10019f50
mov eax, 1
add ebx, ebx
jne 0x10019f73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10019f68
jne 0x10019f84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10019f68
xor ecx, ecx
sub eax, 3
jb 0x10019f98
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1001a00a
mov ebp, eax
add ebx, ebx
jne 0x10019fa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10019fb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10019fd4
inc ecx
add ebx, ebx
jne 0x10019fc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10019fb5
jne 0x10019fd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10019fb5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10019ff4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10019fe5
jmp 0x10019f56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10019ff4
add edi, ecx
jmp 0x10019f56
pop esi
mov edi, esi
mov ecx, 0x4fe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1001a012
cmp byte [edi], 4
jne 0x1001a012
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1001a017
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x1001a086
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a0f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a1f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1001a044
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a1f8]
or eax, eax
je 0x1001a080
mov dword [ebx], eax
add ebx, 4
jmp 0x1001a061
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1001a0b7
cmp al, 0xef
ja 0x1001a0aa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1001a08c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1001a099
mov ebp, dword [esi + 0x1a1fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1001a0eb
sub esp, 0xffffff80
jmp 0x1000ba74
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10001071
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x10001071
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1000105a
jmp 0x10001071
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x100107c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x100107eb
mov edx, dword [ebp + 8]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100107d4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret