joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435a1f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x44c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0042a8f0
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0042a8f0
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x435a96
cmp word [ecx], dx
je 0x435a96
mov eax, dword [0x444d24]
push edi
dec eax
push eax
push 0x444c10
call fcn.004359be
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x435b09
cmp word [eax], dx
je 0x435b09
mov eax, dword [edi]
test eax, eax
je 0x435aba
cmp word [eax], dx
je 0x435aba
lea eax, [ebp - 0x10]
push eax
call fcn.004353a1
jmp 0x435ac3
lea eax, [ebp - 0x10]
push eax
call fcn.0043543c
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x435b33
mov eax, dword [0x444c0c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x444900
call fcn.004359be
add esp, 0xc
test al, al
je 0x435b33
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x435afe
cmp word [eax], di
je 0x435afe
lea eax, [ebp - 0x10]
push eax
call fcn.004353a1
pop ecx
jmp 0x435b35
lea eax, [ebp - 0x10]
push eax
call fcn.0043543c
jmp 0x435afb
mov eax, dword [edi]
test eax, eax
je 0x435b20
cmp word [eax], dx
je 0x435b20
lea eax, [ebp - 0x10]
push eax
call fcn.00435356
pop ecx
jmp 0x435b33
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x435bfe
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00435843
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x435bfe
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x435bfe
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x435bfe
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x435b8b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0042d3e6
test ebx, ebx
je 0x435bf9
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0042d3e6
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x435bfe
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x435bfe
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00438fc7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x435c00
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419c0f
leave
ret
Function at 0x43a100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43a12d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43a12d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10003320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051295
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10067040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edx, ebx
cmp dword [ebx + 0x14], 0xf
mov edi, dword [ebx + 0x10]
jbe 0x10003358
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10003374
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10003363
push esi
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.10003dc0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100033a3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x100ddd80], 0x6666666
jne 0x100033ba
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x100ddd7c
mov dword [ebp - 4], 0
push 0x28
mov dword [ebp - 0x18], 0
call fcn.1004d314
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
push ebx
call fcn.100039b0
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], edx
mov dword [ebp - 4], 1
mov ecx, dword [0x100ddd80]
mov ebx, dword [0x100ddd94]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x10063230]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x10063230]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x100ddd78]
comiss xmm2, xmm1
jbe 0x1000349a
divss xmm0, xmm1
call fcn.10001250
call fcn.10050dd0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1000347c
cmp ebx, 0x200
jae 0x1000347a
shl ebx, 3
cmp ebx, ecx
jae 0x1000347c
mov ebx, ecx
push ebx
call fcn.10003ac0
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10003dc0
mov ecx, dword [0x100ddd80]
mov edx, dword [eax]
jmp 0x1000349d
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x100ddd80], ecx
mov dword [edi], edx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [edx + 4], edi
mov eax, dword [0x100ddd90]
mov ecx, dword [0x100ddd84]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x100ddd7c]
jne 0x100034ce
mov dword [ecx + eax*8], edi
jmp 0x100034dd
cmp esi, edx
jne 0x100034d7
mov dword [ecx + eax*8], edi
jmp 0x100034e1
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100034e1
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10003ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0xc
bsr ecx, eax
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x10003aeb
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [0x100ddd7c]
push eax
mov dword [ebp + 8], eax
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x100ddd84
lea eax, [esi + esi]
push eax
call fcn.10003230
lea eax, [esi - 1]
mov dword [0x100ddd94], esi
mov esi, dword [0x100ddd7c]
mov dword [0x100ddd90], eax
mov eax, dword [ebp + 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x10003c19
push ebx
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
jbe 0x10003b50
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x10003b79
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 8]
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x10003b62
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
and ebx, dword [0x100ddd90]
mov ecx, dword [0x100ddd84]
lea ecx, [ecx + ebx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x10003b96
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x10003c0e
mov ebx, dword [ecx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.10003ec0
test al, al
je 0x10003bce
mov ebx, dword [ebx]
cmp ebx, esi
je 0x10003bc6
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x10003c0b
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x10003bee
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.10003ec0
test al, al
jne 0x10003c21
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10003bd5
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov esi, edi
cmp edi, eax
jne 0x10003b34
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x10003c0b
Function at 0x10003c40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x10003c71
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10003230
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10003d7c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x10003cff
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10003d72
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10003d39
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x10003d31
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x10003d6f
cmp edi, edx
je 0x10003d4c
nop dword [eax]
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10003d85
cmp edi, edx
jne 0x10003d40
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10003cb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10003d6f
Function at 0x100055e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1000561e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10005622
cmp edx, esi
jne 0x10005607
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10005642
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10005646
cmp edx, esi
jne 0x1000562b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10005666
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000566a
cmp edx, esi
jne 0x1000564f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a4d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051b4d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10067040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x7e
xor edx, edx
nop
mov al, byte [edx + 0x1005c7a4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000a51d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1000a500
mov byte [ebp - 0x14], 0
mov edx, 0x100dd80a
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10027650
mov dword [ebp - 0x1c], 0x206d6553
mov dword [ebp - 0x18], 0x73616c46
mov word [ebp - 0x14], 0x68
mov edx, 0x100dd806
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.10027650
mov ecx, 0xfa
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + 0x1005c7b4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000a58d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1000a570
mov byte [ebp - 0x14], 0
mov edx, 0x100dd807
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.10027650
mov dword [ebp - 0x1c], 0x206d6553
mov dword [ebp - 0x18], 0x616d7241
mov byte [ebp - 0x14], 0
mov edx, 0x100dd804
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.10027650
mov dword [ebp - 0x1c], 0x206d6553
mov dword [ebp - 0x18], 0x616d7546
mov word [ebp - 0x14], 0x6163
mov byte [ebp - 0x12], 0
mov edx, 0x100dd7fd
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1c]
call fcn.10027650
mov ecx, 0xb5
xor edx, edx
mov al, byte [edx + 0x1005c7c4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000a621
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x1000a604
mov byte [ebp - 0x12], 0
mov edx, 0x100dd7ff
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x20]
call fcn.10027650
mov ecx, 0x3b
xor edx, edx
mov al, byte [edx + str.iYPQI_3b]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000a663
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1000a646
mov byte [ebp - 0x11], 0
mov edx, 0x100dd80b
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.10027650
mov ecx, 0x1c
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + str.owsHN]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000a6ad
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1000a690
mov byte [ebp - 0x14], 0
mov edx, 0x100dd805
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.10027650
mov dword [ebp - 0x1c], 0x776f6853
mov dword [ebp - 0x18], 0x53504620
mov byte [ebp - 0x14], 0
mov edx, 0x100dd809
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.10027650
mov dword [ebp - 0x18], 0x776f6853
mov dword [ebp - 0x14], 0x445548
mov edx, 0x100dd7fe
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x18]
call fcn.10027650
mov dword [ebp - 0x18], 0x63617274
mov dword [ebp - 0x14], 0x737265
mov edx, 0x100dd808
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x18]
call fcn.10027650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d226
mov esp, ebp
pop ebp
ret
Function at 0x1000aa90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x1000aab2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0xd]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x1000aaa0
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x1000adf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x10067040]
xor eax, esp
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x5b2f6143
xor ecx, ecx
mov dword [esp + 8], 0x7f707d7f
mov dword [esp + 0xc], 0x73747777
mov word [esp + 0x10], 0x100
lea eax, [ecx + 0xd]
xor byte [esp + ecx + 4], al
inc ecx
cmp ecx, 0xc
jb 0x1000ae25
mov edx, 0x100670a9
mov byte [esp + 0x11], 0
lea ecx, [esp + 4]
call fcn.10027650
mov dword [esp + 4], 0x7e617b4f
xor ecx, ecx
mov dword [esp + 8], 0x5b5b3268
mov word [esp + 0xc], 0x45
mov byte [esp + 0xe], 1
lea eax, [ecx + 0xd]
xor byte [esp + ecx + 4], al
inc ecx
cmp ecx, 9
jb 0x1000ae63
mov edx, 0x100dd825
mov byte [esp + 0xe], 0
lea ecx, [esp + 4]
call fcn.10027650
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1004d226
mov esp, ebp
pop ebp
ret
Function at 0x1000aea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051c8d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10067040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x2e
xor edx, edx
nop
mov al, byte [edx + 0x1005c8dc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000aeed
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1000aed0
mov byte [ebp - 0x13], 0
mov edx, 0x1008f589
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10027650
mov dword [ebp - 0x1c], 0x206d6553
mov dword [ebp - 0x18], 0x75636552
mov word [ebp - 0x14], 0x6f
mov edx, 0x10068451
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.10027650
mov dword [ebp - 0x1c], 0x6172694d
mov dword [ebp - 0x18], 0x78694620
mov word [ebp - 0x14], 0x61
mov edx, 0x1008f585
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.10027650
mov dword [ebp - 0x1c], 0x73727542
mov dword [ebp - 0x18], 0x6f4d2074
mov word [ebp - 0x14], 0x6564
mov byte [ebp - 0x12], 0
mov edx, 0x1008f58a
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.10027650
mov ecx, 0xdf
xor edx, edx
nop
mov al, byte [edx + 0x1005c8ec]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000afad
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x1000af90
mov byte [ebp - 0x12], 0
mov edx, 0x1008f587
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.10027650
mov ecx, 0xb5
xor edx, edx
mov al, byte [edx + 0x1005c8fc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000afef
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1000afd2
mov byte [ebp - 0x15], 0
mov edx, 0x1008f586
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x20]
call fcn.10027650
mov ecx, 0xe9
xor edx, edx
mov al, byte [edx + 0x1005c908]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000b031
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1000b014
mov byte [ebp - 0x13], 0
mov edx, 0x1008f58d
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.10027650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d226
mov esp, ebp
pop ebp
ret
Function at 0x1000c970
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x10067040]
xor eax, esp
mov dword [esp + 0x3c], eax
movaps xmm0, xmmword [str.Nb_ct2Eur_qo]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], 0
movups xmmword [esp + 0x28], xmm0
mov byte [esp + 0x38], 1
mov al, cl
add al, 0xd
xor byte [esp + ecx + 0x28], al
inc ecx
cmp ecx, 0xf
jb 0x1000c9a6
push 0
lea edx, [esp + 4]
mov byte [esp + 0x3c], 0
lea ecx, [esp + 0x2c]
call fcn.100241c0
add esp, 4
test al, al
je 0x1000ca22
movaps xmm0, xmmword [0x10063110]
xor ecx, ecx
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x18], 0x4376714b
mov dword [esp + 0x1c], 0x454b6144
mov dword [esp + 0x20], 0x50420851
mov word [esp + 0x24], 0x4c
mov byte [esp + 0x26], 1
mov al, cl
add al, 0xd
xor byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x1d
jb 0x1000ca01
lea eax, [esp + 8]
mov byte [esp + 0x26], 0
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.1004d226
mov esp, ebp
pop ebp
ret
Function at 0x1000ca40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051f9d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10067040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0xa1
xor edx, edx
nop
mov al, byte [edx + 0x1005caa4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x34], al
and ecx, 0x800000ff
jns 0x1000ca8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x20
jl 0x1000ca70
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
call fcn.100233c0
add esp, 4
mov ecx, 0x9b
xor edx, edx
mov al, byte [edx + 0x1005cac8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x1000cace
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x11
jl 0x1000cab1
mov byte [ebp - 0x17], 0
mov edx, 0x100dd812
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10027650
mov ecx, 0x69
xor edx, edx
mov al, byte [edx + 0x1005cadc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000cb10
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1000caf3
mov byte [ebp - 0x14], 0
mov edx, 0x100dd81d
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.10027650
mov ecx, 0xd8
xor edx, edx
mov al, byte [edx + 0x1005caec]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000cb52
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1000cb35
mov byte [ebp - 0x15], 0
mov edx, 0x100dd81e
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.10027650
mov ecx, 0x18
xor edx, edx
mov al, byte [edx + str.Npirq_cIG_O]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000cb94
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1000cb77
mov byte [ebp - 0x17], 0
mov edx, 0x100670a8
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x24]
call fcn.10027650
mov dword [ebp - 0x1c], 0x6f747541
mov dword [ebp - 0x18], 0x6d694120
mov byte [ebp - 0x14], 0
mov edx, 0x100dd813
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.10027650
mov dword [ebp - 0x20], 0x206d6941
mov dword [ebp - 0x1c], 0x6f6f6d53
mov word [ebp - 0x18], 0x6874
mov byte [ebp - 0x16], 0
mov edx, 0x100dd81c
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.10027650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d226
mov esp, ebp
pop ebp
ret