joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10d4f20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x10d5032
mov esi, dword [esp + 0x28]
test esi, esi
je 0x10d5032
cmp dword [esp + 0x2c], 0
je 0x10d5032
push esi
call fcn.010dc930
add esp, 4
test eax, eax
je 0x10d4f8a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x10d4f91
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x10d4f70
jmp 0x10d4f93
mov ebx, 0x1505
jmp 0x10d4f93
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x10d503a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x10d4ff7
call fcn.010d5c50
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x10d5032
push ecx
call fcn.010dc930
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x10d50ad
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x10d5058
inc edi
dec esi
je 0x10d4fac
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x10d4fb1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x10d5050
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.010dc930
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x10d5050
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.010dc950
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x10d5050
mov eax, 0xffffffff
jmp 0x10d5032
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x10d50c8
inc edi
dec esi
je 0x10d4ff2
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x10d4ff7
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x10d50c0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.010dc930
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x10d50c0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.010dc950
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x10d50c0
jmp 0x10d4ff7
Function at 0x10d59a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x10d5b8a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x10d5b8a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x10d5b8a
cmp dword [ecx], 0
jne 0x10d5b8a
push esi
call fcn.010dc930
add esp, 4
test eax, eax
je 0x10d5a0a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x10d5a11
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x10d59f0
jmp 0x10d5a13
mov edi, 0x1505
jmp 0x10d5a13
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x10d5ae4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x10d5a71
call fcn.010d5c50
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x10d5b8a
push esi
call fcn.010dc930
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.010d5ba0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.010dc930
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x111e008]
add esp, 4
test eax, eax
je 0x10d5b85
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.010dc7c0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x10d5b8a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x10d5b08
inc ebx
dec edx
je 0x10d5a2c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x10d5a31
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x10d5b00
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.010dc930
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x10d5b00
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.010dc950
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x10d5b00
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.010d4ad0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x10d5ad9
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10d6c40
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x10d6de2
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x10d6ddb
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x10d6cd0
add ebp, dword [esp + 8]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x10d6ddb
xor eax, eax
cmp edx, 8
mov dword [esp], edx
jb 0x10d6d4a
mov eax, edx
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 6]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, edi
lea ebx, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x10d6cf0
add ebp, ebx
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], ebx
jbe 0x10d6c98
mov ebx, edx
mov edx, eax
or edx, 1
test bl, 1
mov dword [esp + 4], esi
jne 0x10d6d80
mov ebx, ebp
cmp dword [esp], edx
je 0x10d6c90
jmp 0x10d6d9d
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
add edi, eax
mov eax, edi
and eax, ecx
xor ecx, edi
lea ecx, [ecx + eax*2]
mov eax, edx
cmp dword [esp], edx
je 0x10d6c90
mov edx, dword [esp]
sub edx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + eax]
add esi, edi
mov edi, esi
and edi, ecx
xor ecx, esi
lea ecx, [ecx + edi*2]
movzx edi, byte [ebx + eax + 1]
add edi, esi
mov esi, edi
and esi, ecx
xor ecx, edi
lea ecx, [ecx + esi*2]
add eax, 2
cmp edx, eax
jne 0x10d6db0
jmp 0x10d6c90
shl ecx, 0x10
or ecx, edi
jmp 0x10d6de7
mov ecx, 1
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10d6e00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10d6e54
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x10d6e56
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
not eax
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x111bc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x111bc50]
not eax
inc esi
cmp edx, esi
jne 0x10d6e20
jmp 0x10d6e56
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x10dcf00
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.01114070
test al, al
je 0x10dd0ee
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0110b8f0
test al, al
je 0x10dd0e9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x5e97646b
mov dword [esp + 8], 0x27cbe76
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x10dcf86
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.010dd100
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x10dcf60
mov dword [esp + 4], 0x8e29e3a3
mov dword [esp + 8], 0x9421c2b9
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x10dcfe6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.010dd190
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x10dcfc0
test esi, esi
je 0x10dd086
mov dword [esp + 4], 0x21262747
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x10dd036
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.010dd220
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x10dd010
mov dword [esp + 4], 0x49a71d73
mov dword [esp + 8], 0xe3f8ec2a
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x10dd086
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.010dd2a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x10dd060
mov dword [esp + 4], 0x92939091
mov dword [esp + 8], 0x9e9f9c9d
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x10dd0d6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.010dd320
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x10dd0b0
call fcn.010dea30
test al, al
je 0x10dd0e9
call fcn.010e1c50
call fcn.010dffd0
call fcn.01115500
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10df950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push eax
mov ebx, esp
sub esp, 0xc
mov dword [esi + 8], esp
push eax
mov dword [esi + 0x18], esp
push eax
mov dword [esi + 0x2c], esp
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x60], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x1123b5c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x10dfa1e
sar edx, 1
lea edi, [esi + 0x30]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x111e9b4]
Function at 0x10dffe0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov edi, dword [0x1123b50]
mov dword [esp + 0x38], 0x832d81cd
mov dword [esp + 0x3c], 0x872f853e
mov dword [esp + 0x40], 0x8b268924
mov dword [esp + 0x44], 0x8fe18d2d
mov dword [esp + 0x48], 0x93fc91e5
mov dword [esp + 0x4c], 0x97f695e4
mov dword [esp + 0x50], 0x9bcd99f0
mov dword [esp + 0x54], 0x9f309d35
mov dword [esp + 0x58], 0xe34de144
mov dword [esp + 0x5c], 0xe755e553
mov dword [esp + 0x60], 0xeba4e988
mov dword [esp + 0x64], 0xef8eedb8
mov dword [esp + 0x68], 0xf382f181
mov dword [esp + 0x6c], 0xf786f59a
mov dword [esp + 0x70], 0xfb9af983
mov dword [esp + 0x74], 0xff57fdab
mov dword [esp + 0x78], 0xc3b4c16e
mov dword [esp + 0x7c], 0xc7bdc5b0
mov dword [esp + 0x80], 0xcb72c9a8
mov dword [esp + 0x84], 0xcfbacdba
mov dword [esp + 0x88], 0xd3b2d1b9
mov dword [esp + 0x8c], 0xd766d595
mov dword [esp + 0x90], 0xdb76d968
mov dword [esp + 0x94], 0xdf89dd79
mov dword [esp + 0x98], 0x23802185
mov dword [esp + 0x9c], 0x278f256f
mov dword [esp + 0xa0], 0x2b45299c
mov dword [esp + 0xa4], 0x2f5d2d59
mov dword [esp + 0xa8], 0x335c3147
mov dword [esp + 0xac], 0x37403547
mov dword [esp + 0xb0], 0x3b523958
mov dword [esp + 0xb4], 0x3f763d77
mov dword [esp + 0xb8], 0x34f0154
mov dword [esp + 0xbc], 0x76a0548
mov dword [esp + 0xc0], 0xba60968
mov dword [esp + 0xc4], 0xfa50da5
mov dword [esp + 0xc8], 0x137211b5
mov dword [esp + 0xcc], 0x17b31553
mov dword [esp + 0xd0], 0x1bb119bb
mov dword [esp + 0xd4], 0x1f771db3
mov dword [esp + 0xd8], 0x63216100
mov dword [esp + 0xdc], 0x67d465cc
mov dword [esp + 0xe0], 0x6bc769c7
mov dword [esp + 0xe4], 0x6f016dc9
mov dword [esp + 0xe8], 0x73037101
mov dword [esp + 0xec], 0x7718750d
mov dword [esp + 0xf0], 0x7b147908
mov dword [esp + 0xf4], 0x7f107d0c
mov dword [esp + 0xf8], 0x43224130
mov dword [esp + 0xfc], 0x47e74517
mov dword [esp + 0x100], 0x4beb49ee
mov dword [esp + 0x104], 0x4fe74dfe
mov dword [esp + 0x108], 0x5327513f
mov dword [esp + 0x10c], 0x57215527
mov dword [esp + 0x110], 0x5b295936
mov dword [esp + 0x114], 0x5f5e5d2a
mov dword [esp + 0x118], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xe3
ja 0x10e026d
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x38]
push dword [esp + 4]
push eax
call fcn.010e1570
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x38], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe4
jb case.default.0x10e0291
mov ebx, dword [esp + 0x464]
mov esi, dword [esp + 0x460]
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call edi
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x111ea44]
Function at 0x10e1c50
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x110
mov esi, esp
push eax
push eax
mov dword [esi + 0x10], esp
sub esp, 0x24
mov dword [esi + 0xc], esp
push eax
mov dword [esi + 0x28], esp
push eax
mov dword [esi + 0x48], esp
sub esp, 0x68
mov dword [esi + 4], esp
sub esp, 0x10
mov dword [esi + 8], esp
sub esp, 0x208
mov dword [esi + 0x80], esp
push eax
mov dword [esi + 0x44], esp
sub esp, 8
mov dword [esi + 0x38], esp
sub esp, 8
mov dword [esi + 0x74], esp
sub esp, 8
mov dword [esi + 0x84], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x70], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x6c], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x68], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x64], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x60], eax
mov esp, eax
push eax
sub esp, 0x64
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
sub esp, 0xfc
mov dword [esi + 0x20], esp
sub esp, 0xc
mov dword [esi + 0x18], esp
sub esp, 8
mov dword [esi + 0x5c], esp
sub esp, 0x24
mov dword [esi + 0x3c], esp
push eax
mov dword [esi + 0x30], esp
push eax
mov dword [esi + 0x58], esp
sub esp, 0x68
mov dword [esi + 0x24], esp
sub esp, 0xc
mov dword [esi + 0x40], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x2c], eax
mov esp, eax
push eax
sub esp, 0xc
mov dword [esi + 0x78], esp
sub esp, 0x800
mov dword [esi + 0x14], esp
sub esp, 0x80
mov ebx, esp
sub esp, 0x44
mov dword [esi + 0x7c], esp
sub esp, 0x10
mov dword [esi + 0x34], esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x111f2b0]
Function at 0x10ecbe0
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x10ecc00
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x10ecc20
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x10ecc40
mov eax, 0xffffffff
jmp 0x10ecc49
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.010dc790
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x10ecc81
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x10ecc70
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [ebp]
test cx, cx
je 0x10eccb1
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x10ecca0
mov word [ebx], 0
lea ecx, [esp + 4]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x20], eax
push eax
call fcn.01119220
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x111f9d0]
Function at 0x10ecfa0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa58
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x10ecfc0
sar esi, 1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x1124e94]
mov ebx, dword [esp + 0x28]
mov edi, 0xffffffff
test ebx, ebx
jns 0x10ecff4
mov eax, 0xffffffff
jmp 0x10ecff7
lea eax, [ebx + ebx]
push eax
call fcn.010dc790
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x1c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x1124e94]
mov eax, dword [esp + 0x28]
mov ecx, eax
add ecx, 0xd
js 0x10ed02c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.010dc790
add esp, 4
mov esi, eax
mov dword [esp + 0x108], 0x13e611f4
mov dword [esp + 0x10c], 0x1f8d1dfd
mov dword [esp + 0x110], 0x1b3a1984
mov dword [esp + 0x114], 0x7eb05fa
mov dword [esp + 0x118], 0x3910192
mov dword [esp + 0x11c], 0xf990de5
mov dword [esp + 0x120], 0xb0a099e
mov dword [esp + 0x124], 0
mov dword [esp + 0x6c8], 0
mov eax, dword [esp + 0x6c8]
cmp eax, 0x1f
ja 0x10ed0f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x6c8]
movzx eax, byte [esp + eax + 0x108]
push dword [esp + 0x6c8]
push eax
call fcn.010f1dc0
add esp, 8
mov ecx, dword [esp + 0x6c8]
mov byte [esp + ecx + 0x108], al
inc dword [esp + 0x6c8]
mov eax, dword [esp + 0x6c8]
cmp eax, 0x20
jb 0x10ed0b0
mov eax, dword [esp + 0x14]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x10ed121
mov eax, dword [esp + 0x14]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x10ed110
mov word [eax], 0
movzx ecx, word [esp + 0x108]
test cx, cx
je 0x10ed151
lea edx, [esp + 0x10a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x10ed140
mov word [eax], 0
lea eax, [esp + 0x548]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.01119220
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x111fc48]
Function at 0x10f4010
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x10f4030
cmp eax, 0xffffffdd
jge 0x10f4047
mov eax, 0xffffffff
jmp 0x10f404a
add eax, 0x22
push eax
call fcn.010dc790
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x93019134
mov dword [esp + 0x1c], 0x9f099d00
mov dword [esp + 0x20], 0x9b3b990a
mov dword [esp + 0x24], 0x872b852b
mov dword [esp + 0x28], 0x832e8124
mov dword [esp + 0x2c], 0x8f208d21
mov dword [esp + 0x30], 0x8b178929
mov dword [esp + 0x34], 0xf76af560
mov word [esp + 0x38], 0xf1f0
mov dword [esp + 0x3a], 0
mov byte [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x26
ja 0x10f40eb
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.010f4eb0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x27
jb 0x10f40c0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x10f4111
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10f4100
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x10f4141
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x10f4130
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x97b0b7f
mov dword [esp + 0x1c], 0x535078e
mov dword [esp + 0x20], 0x18a037f
mov dword [esp + 0x24], 0x1d651f8c
mov dword [esp + 0x28], 0x19971b6e
mov dword [esp + 0x2c], 0x1567176f
mov dword [esp + 0x30], 0x11271366
mov dword [esp + 0x34], 0x2d1b2f25
mov dword [esp + 0x38], 0x29482b1a
mov dword [esp + 0x3c], 0x25ab27a3
mov dword [esp + 0x40], 0x21ac235f
mov dword [esp + 0x44], 0x3d4f3f7d
mov dword [esp + 0x48], 0x39b63b4e
mov dword [esp + 0x4c], 0x35be3743
mov dword [esp + 0x50], 0x316533b8
mov dword [esp + 0x54], 0x4d0d4f4c
mov dword [esp + 0x58], 0x494a4b7a
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x10f4226
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.010f4f40
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x10f4200
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x10f4550
push ecx
push esi
call fcn.010f5330
add esp, 0x10
jmp dword [0x1120040]