joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407297
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7df95c], 0
jne 0x4072d5
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072ab
mov dword [ecx*4 + 0x7df958], eax
inc ecx
cmp ecx, 0x100
jl 0x4072a6
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407302
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7df958]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072e3
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0xffffff90
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408e84
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4b505e08
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2b820a81
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40ded8
Capabilities:
Check for software breakpoints

Disassembly:
or bl, ah
scasb al, byte es:[edi]
arpl word [ebx], bx
fistp dword [edx - 0x31]
inc esi
lodsb al, byte [esi]
in eax, 0x8e
imul ecx, ebp, 0x23
pushal
scasd eax, dword es:[edi]
in al, 0x46
rcr bh, 0xef
cmp al, 0xda
invalid

Function at 0x4179e5
Capabilities:
Get common file path

Disassembly:
lea esp, [esp]
lea esp, [esp]
nop
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
call 0x910e468b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4baaa0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
Function at 0x467709
Capabilities:
Encode data using xor

Disassembly:
dec edi
sbb ebx, dword [ecx + esi]
mov esp, 0xe4f58405
aaa
outsb dx, byte [esi]
push edi
or byte [ecx + 0x2c], cl
jno 0x467715
aas
sbb ah, byte fs:[ebx]
in eax, dx
int1
stc
invalid
cdq
inc edx
or dword [eax], ebp
aas
test al, 0x4b
xchg ecx, eax
cmp dword [esp + eax*8 + 0x49cbc93f], ebx
or eax, 0x7c3a6c80
xlatb
xchg byte [ebp + 0xb], ch
cdq
adc byte [ebx + 0x7e0cf33], cl
cld
and dword [ebp + 0x47f0cad0], esi
movsb byte es:[edi], byte [esi]
add eax, 0xdcf03a9e
mov bl, 0xc7
mul dword [ecx + ecx]
pop es
xchg ah, cl
dec edi
das
loopne 0x4676f6
push eax
lahf
sbb dword [esi], 0xf1da9dba
jae 0x467719
sbb al, 0x6f
push edi
loope 0x4676a8
or dh, byte [eax]
and ch, byte [esi + 0x21]
xor dh, byte [esi]
xor byte [eax + 0x70], dl
jo 0x4676c5
scasb al, byte es:[edi]
xor byte [esi], ah
add al, 0xc1
mov al, 0x26
sub byte [ecx], al
mov al, 0x47
imul ecx, dword [esi], 0x3b
js 0x467716
mov dword [eax - 0x5f0f9fed], 0x579ca3b7
retf 0xdd26
Function at 0x47fd08
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
int1
scasb al, byte es:[edi]
invalid
add ebp, esi
xor ah, bh
jp 0x47fc45
lahf
mov bl, 0x89
popfd
inc esi
wait
pop esp
or byte [ecx - 0x80], ch
mov esi, 0xadb8418
call 0x526f1366
xchg esp, eax
inc edi
mov eax, 0xd6a65050
inc edx
push esp
ficomp dword [esi + 0x54]
or eax, 0x48cd5e43
inc dword [edx]
xor eax, 0x337ca5e6
imul byte [ebp - 0x16]
mov ebx, 0x9968a885
sbb al, 0xc
jp 0x47fd37
cmpsd dword [esi], dword es:[edi]
dec ebp
adc eax, 0xa366c76e
aam 0x9b
push ebp
jb 0x47fcab
stc
pop esp
scasb al, byte es:[edi]
out dx, eax
dec edi
iretd
or eax, 0xe1b00e3e
test eax, 0x8e416179
xchg ebx, ebp
and edi, dword [0xceaadc16]
lodsd eax, dword [esi]
jp 0x47fcfe
mov eax, dword [0xc79fa859]
sbb byte [esi + 0x3ecc29c7], bl
dec edi
cwde
lds ebp, [ebx + 0x4a]
sahf
fisttp qword [eax - 0x6335ca96]
and dword [ecx - 0x31], esi
and esp, dword [ebx]
popfd
xchg ebp, eax
jmp 0x47fd70
imul ecx, dword [edx - 0x62], 0xffffffdd
mov byte [edx + 0x35], ch
retf 0x219c
mov esp, 0x2e9ba68c
mov edi, 0x84bba8a7
jecxz 0x47fd61
daa
xchg esi, eax
scasb al, byte es:[edi]
repe scasb al, byte es:[edi]
dec edi
mov dword [0x17014497], eax
call 0x2aa9e5d5
invalid
popal
sub al, bl
popal
sub al, bl
cmp ebp, dword [esi - 0x6d63d8b8]
daa
pushfd
xchg edx, eax
mov dh, 0xff
mov ebx, 0x7ac7ca28
mov dh, 0x17
scasb al, byte es:[edi]
jne 0x47fdbd
cmp dword [ebp + 1], 0x3ae102e4
push ebp
jb 0x47fcf2
loope 0x47fd99
cmp dh, byte [edx]
jp 0x47fd21
pushfd
jns 0x47fd57
push esi
wait
mov cl, 0xec
dec ecx
daa
mov byte [0x27edbf97], al
xor al, 0x13
je 0x47fd51
inc esp
xor dword [0x5baabb35], 0x186b706b
mov eax, dword [0xfe0b27f5]
hlt
and dword [edx], 0x62
mov dl, 0x2f
wait
jnp 0x47fddf
xor dword [ebx - 0x6bf84a6d], ebx
inc ebx
wait
aaa
xor eax, 0x90c71bc4
inc esi
pushal
jns 0x47fdca
inc edi
aas
or esp, dword [ecx]
xchg ebp, eax
out dx, al
in al, 0x4a
xchg ebp, eax
inc esi
xor eax, dword [si]
lodsd eax, dword [esi]
invalid
invalid
invalid
invalid
Function at 0x48c7f6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0048c9e9
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0049753e
xor ebx, ebx
cmp eax, ebx
jne 0x48c9a4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0048c9e9
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0049421d
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4e5b12
add esp, 0x10
test eax, eax
jne 0x48c8bf
push esi
call fcn.00489ea8
mov esi, eax
cmp esi, ebx
pop ecx
je 0x48c8bf
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x48c8aa
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x48c8bf
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48c8b8
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call int.00498a51
cmp byte [esp + 0x13], bl
je 0x48c8ef
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0048ca26
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x48c95f
push 0x14
call 0x4e4d7f
cmp eax, ebx
pop ecx
je 0x48c919
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x48c91b
xor edi, edi
cmp edi, ebx
je 0x48c95f
push esi
push edi
call fcn.0048bf4c
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0048c014
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048c13d
add esp, 0x18
call fcn.0048c9e9
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00496c0b
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48c976
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x48c988
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x48c9cb
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x48c9cb
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0048c014
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048c13d
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4adf1f
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
fisubr word [ebx + 0x48]
cmp al, 0xb1
and ecx, edx
xchg ecx, eax
mov bh, cl
xchg ecx, eax
and dword [ecx + ecx*8 + 0x52], 0x8284e92d
push edx
sub eax, 0x338284e9
sti
push edx
sub eax, 0x338284e9
sti
jo 0x4adf99
xchg edi, eax
insb byte es:[edi], dx
insd dword es:[edi], dx
mov dh, 0x52
xchg dword [ecx], eax
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
jno 0x4adf10
in al, 9
leave
insd dword es:[edi], dx
cli
dec edx
popal
mov eax, dword [0xef211a05]
mov cl, 0xb7
mov edi, 0x8ceb7106
mov ecx, 0x611957b1
mov ch, byte [edi - 0x49c93069]
add byte [edx], ah
mov dh, 0x32
insd dword es:[edi], dx
cmp eax, 0x2bbd0bd4
invalid
salc
push 3
hlt
Function at 0x4c8bb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x86000]
push edi
jmp 0x4c8bca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c8bd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c8bc0
mov eax, 1
add ebx, ebx
jne 0x4c8be3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c8bf4
jne 0x4c8c13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c8c13
dec eax
add ebx, ebx
jne 0x4c8c00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c8bd8
add ebx, ebx
jne 0x4c8c0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c8c65
xor ecx, ecx
sub eax, 3
jb 0x4c8c2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c8c9a
sar eax, 1
mov ebp, eax
jmp 0x4c8c36
add ebx, ebx
jne 0x4c8c36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c8c04
inc ecx
add ebx, ebx
jne 0x4c8c44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c8c04
add ebx, ebx
jne 0x4c8c51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c8c46
jne 0x4c8c62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c8c46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c8c84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c8c76
jmp 0x4c8bc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c8c84
add edi, ecx
jmp 0x4c8bc6
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c8ca2
cmp byte [edi], 0x11
jne 0x4c8ca2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c8ca7
lea edi, [esi + 0xc4000]
mov eax, dword [edi]
or eax, eax
je 0x4c8d1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xdefa8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xdf0fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c8cd4
mov ecx, edi
jns 0x4c8d03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xdf100]
or eax, eax
je 0x4c8d19
mov dword [ebx], eax
add ebx, 4
jmp 0x4c8cf1
call dword [esi + 0xdf110]
mov ebp, dword [esi + 0xdf104]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c8d53
sub esp, 0xffffff80
jmp 0x416310
Function at 0x1000a717
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.1000a7e3
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.1000a812
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xa8]
push ecx
call eax
test eax, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
jne 0x1000a7a3
call fcn.1000a7e3
add esp, 0xc
xor eax, eax
jmp 0x1000a7e0
call fcn.1000a7e3
mov eax, dword [ebp - 0x98]
add esp, 0xc
sub eax, ebx
je 0x1000a7dd
dec eax
je 0x1000a7bd
dec eax
je 0x1000a7cf
jmp 0x1000a79f
cmp dword [ebp - 0xa0], ebx
jne 0x1000a7c9
push 4
jmp 0x1000a7df
jbe 0x1000a7cf
push 5
jmp 0x1000a7df
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x1000a7e0
push 3
pop eax
pop ebx
leave
ret

Function at 0x1000a812
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.1000a7e3
mov eax, dword [0x10018650]
and byte [ebp - 8], 0
add esp, 0xc
cmp eax, 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x1000a875
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10018650], eax
leave
ret
Function at 0x1000a877
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
push esi
push 0x4000000
push 1
push esi
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
mov byte [ebp - 0x1c], 0x5c
mov byte [ebp - 0x1b], 0x5c
mov byte [ebp - 0x1a], 0x2e
mov byte [ebp - 0x19], 0x5c
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x4f
mov byte [ebp - 0x16], 0x53
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x39
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xf], 0x44
call fcn.1000a923
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
jne 0x1000a8e8
mov eax, 0xc357
jmp 0x1000a91f
push ebx
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xc]
push 8
push eax
push esi
push esi
push 2
push edi
call fcn.1000a9ae
push edi
mov ebx, eax
call fcn.1000aa4c
add esp, 0x24
cmp ebx, esi
pop ebx
je 0x1000a91a
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 8]
mov byte [eax], cl
xor eax, eax
jmp 0x1000a91f
mov eax, 0xc358
pop edi
pop esi
leave
ret

Function at 0x1000a923
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.1000a7e3
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.1000a812
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000a97f
leave
ret
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.1000a7e3
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x1000a9ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.1000a7e3
and byte [ebp - 5], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 6], 0x6c
call fcn.1000a812
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000aa1a
leave
ret
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.1000a7e3
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000aa4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.1000a7e3
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6c
call fcn.1000a812
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000aaa8
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.1000a7e3
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x1000aac5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
push esi
push 0x80
push 3
push esi
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x18]
push 0xc0000000
push eax
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0x5c
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x5c
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0x12], 0x53
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xf], 0x54
call fcn.1000a923
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x1000ab5f
push ebx
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 4]
push 4
push eax
push esi
push esi
push 0x80002000
push edi
call fcn.1000a9ae
push edi
mov ebx, eax
call fcn.1000aa4c
add esp, 0x24
cmp ebx, esi
pop ebx
je 0x1000ab58
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
mov byte [eax], cl
xor eax, eax
jmp 0x1000ab64
mov eax, 0xc358
jmp 0x1000ab64
mov eax, 0xc357
pop edi
pop esi
leave
ret
Function at 0x1000ab68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, ax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x1000ab7e
pop es
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
jne 0x1000ab91
add al, 0x55
mov ecx, dword [ebp + 8]
pop esi
mov byte [ecx], al
xor al, al
leave
ret

Function at 0x1000c808
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x14
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.1000a7e3
and byte [ebp - 0x17], 0
add esp, 0xc
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x18], 0x65
call fcn.1000a812
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c870
lea ecx, [ebp - 0x10]
push ecx
call eax
push esi
push 0x14
movzx esi, word [ebp - 0x10]
movzx eax, word [ebp - 0xe]
imul esi, esi, 0xd
add esi, eax
push 0
movzx eax, word [ebp - 0xa]
imul esi, esi, 0x1e
add esi, eax
movzx eax, word [ebp - 8]
imul esi, esi, 0x1a
imul eax, eax, 0x3d
add esi, eax
movzx eax, word [ebp - 6]
add esi, eax
movzx eax, word [ebp - 4]
imul esi, esi, 0x3c
add esi, eax
movzx eax, word [ebp - 2]
imul esi, esi, 0x4d2
add esi, eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000a7e3
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x1000d0be
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x1c]
cmp ecx, 1
jle 0x1000d199
add eax, 0x32
push esi
dec ecx
movzx edx, byte [eax + 1]
movzx esi, byte [eax - 1]
mov edx, dword [edx*4 + 0x1001b554]
xor edx, dword [esi*4 + 0x1001ad54]
movzx esi, byte [eax]
add eax, 0x10
xor edx, dword [esi*4 + 0x1001b154]
movzx esi, byte [eax - 0x12]
xor edx, dword [esi*4 + 0x1001a954]
mov dword [eax - 0x12], edx
movzx edx, byte [eax - 0xb]
movzx esi, byte [eax - 0xc]
mov edx, dword [edx*4 + 0x1001b554]
xor edx, dword [esi*4 + 0x1001b154]
movzx esi, byte [eax - 0xd]
xor edx, dword [esi*4 + 0x1001ad54]
movzx esi, byte [eax - 0xe]
xor edx, dword [esi*4 + 0x1001a954]
mov dword [eax - 0xe], edx
movzx edx, byte [eax - 7]
movzx esi, byte [eax - 8]
mov edx, dword [edx*4 + 0x1001b554]
xor edx, dword [esi*4 + 0x1001b154]
movzx esi, byte [eax - 9]
xor edx, dword [esi*4 + 0x1001ad54]
movzx esi, byte [eax - 0xa]
xor edx, dword [esi*4 + 0x1001a954]
mov dword [eax - 0xa], edx
movzx edx, byte [eax - 3]
movzx esi, byte [eax - 4]
mov edx, dword [edx*4 + 0x1001b554]
xor edx, dword [esi*4 + 0x1001b154]
movzx esi, byte [eax - 5]
xor edx, dword [esi*4 + 0x1001ad54]
movzx esi, byte [eax - 6]
xor edx, dword [esi*4 + 0x1001a954]
dec ecx
mov dword [eax - 6], edx
jne 0x1000d0d3
pop esi
ret