joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000eaaf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push ebx
push esi
push edi
mov esi, 0x103
mov word [ebp - 0x1a], 0x4552
xor ebx, ebx
mov word [ebp - 0x1d], 0x5754
push esi
lea eax, [ebp - 0x12b]
mov word [ebp - 0x20], 0x4f53
push ebx
push eax
mov byte [ebp - 0x1e], 0x46
mov word [ebp - 0x18], 0x5c
mov byte [ebp - 0x1b], 0x41
mov word [ebp - 0xc], 0x7325
mov word [ebp - 9], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 0x12c], bl
call fcn.100100d0
add esp, 0xc
push 0x18
pop eax
call fcn.10010e20
mov eax, esp
push 3
push 0x18
push str.NSpeedUpTab
push eax
call fcn.1000eef0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea edi, [esi + 1]
lea eax, [ebp - 0x12c]
push edi
push eax
call fcn.10010df7
lea eax, [ebp - 0x24]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x12c]
push eax
push 0x80000001
call fcn.1000e3d6
add esp, 0x2c
test eax, eax
jne 0x1000ec0d
push esi
lea eax, [ebp - 0x333]
mov byte [ebp - 0x334], bl
push ebx
push eax
call fcn.100100d0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x12], 0x736c61
push eax
lea eax, [ebp - 0x334]
mov word [ebp - 0x14], 0x7668
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call fcn.1000e365
add esp, 0x24
test eax, eax
jne 0x1000ec04
cmp dword [ebp - 0x28], ebx
jbe 0x1000ec04
push esi
lea eax, [ebp - 0x22f]
mov byte [ebp - 0x230], bl
push ebx
push eax
call fcn.100100d0
push dword [ebp + 8]
lea eax, [ebp - 4]
mov word [ebp - 4], 0x6425
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x230]
mov byte [ebp - 2], bl
push edi
push eax
call fcn.10010df7
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.1000e55f
add esp, 0x28
test eax, eax
je 0x1000ec04
push dword [ebp - 0x24]
call fcn.1000e43f
mov eax, dword [ebp + 8]
pop ecx
jmp 0x1000ec16
push dword [ebp - 0x24]
call fcn.1000e43f
pop ecx
push dword [ebp + 8]
call dword [0x1004cbd4]
lea esp, [ebp - 0x340]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000eddb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [ebp + 0xc], 1
jne 0x1000ee90
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.1000e138
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xa], 0x75732074
push ecx
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0x74726f
push ecx
mov dword [ebp - 0xf], 0x6174736e
mov word [ebp - 6], 0x7070
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xb], 0x6e
call fcn.1000e55f
add esp, 0x14
test eax, eax
jne 0x1000eec5
push sym.gphelper.dll__HookSetWindowPos_28
push 0x1004cb90
call fcn.1000ef51
pop ecx
pop ecx
test eax, eax
je 0x1000eec5
push sym.gphelper.dll__HookSetForegroundWindow_4
push 0x1004cb84
call fcn.1000ef51
pop ecx
pop ecx
test eax, eax
je 0x1000eec5
push sym.gphelper.dll__HookSetActiveWindow_4
push 0x1004cbd4
call fcn.1000ef51
pop ecx
pop ecx
test eax, eax
je 0x1000eec5
push sym.gphelper.dll__HookBringWindowToTop_4
push 0x1004cbac
call fcn.1000ef51
pop ecx
jmp 0x1000eec4
cmp dword [ebp + 0xc], 0
jne 0x1000eec5
push 0x1004cb90
call fcn.1000f123
mov dword [esp], 0x1004cb84
call fcn.1000f123
mov dword [esp], 0x1004cbd4
call fcn.1000f123
mov dword [esp], 0x1004cbac
call fcn.1000f123
pop ecx
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000f290
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push ebx
xor ebx, ebx
cmp dword [0x1004cbe4], 0x40
jae 0x1000f383
mov ecx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebp, 0xfff80000
add esi, ecx
add ecx, dword [esp + 0x5c]
push edi
cmp ecx, 0x80000000
lea edi, [esp + 0x30]
push 8
lea eax, [ecx + 0x7ff80000]
cmovb ebp, eax
and dword [esp + 0x30], ebx
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
cmovb edi, eax
cmp edi, ebp
jae 0x1000f380
push 0x1c
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000f35b
cmp dword [esp + 0x20], 0x10000
jne 0x1000f34d
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x1000f351
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x1000f351
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call fcn.1000e1e9
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000f35f
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add edi, eax
cmp edi, ebp
jb 0x1000f2fc
test ebx, ebx
je 0x1000f380
xor eax, eax
cmp dword [eax*4 + 0x1004cc08], 0
je 0x1000f373
inc eax
cmp eax, 0x40
jb 0x1000f361
jmp 0x1000f380
inc dword [0x1004cbe4]
mov dword [eax*4 + 0x1004cc08], ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
Function at 0x1000f3ed
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push ebx
push esi
push dword [ebp + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f47c
test esi, esi
je 0x1000f47c
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000f473
mov dword [ebp - 0x2cc], 0x10001
xor ebx, ebx
jmp 0x1000f45f
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x214], eax
jb 0x1000f47c
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0x214], eax
jae 0x1000f47c
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, 3
jge 0x1000f473
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0x2cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1000f42d
jmp 0x1000f47c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000f484
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
call fcn.1000e19b
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov ebx, eax
call fcn.1000e19b
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x1004cbec], esi
jbe 0x1000f4d1
mov eax, dword [0x1004cbe8]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x1004cbe8]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x1004cbec]
jb 0x1000f4ac
push dword [0x1004cbe8]
call fcn.10010dbf
and dword [0x1004cbe8], 0
and dword [0x1004cbec], 0
pop ecx
push ebx
call fcn.1000e19b
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop esi
pop ebx
ret
Function at 0x1000a570
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x101f71d8], 0x48d
mov dword [ebp - 4], 0
mov dword [0x101f71d4], 0x17cb
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1000a5dd
jmp 0x1000a612
mov eax, 1
mov dword [0x101f71d4], 0xd1
mov dword [ebp - 0x1c], eax
jmp 0x1000a6b5
mov eax, dword [ebp - 0x18]
mov dword [0x101f71d4], 0x97e
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
je 0x1000a62b
jmp 0x1000a6a6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0xe], 0x6c
je 0x1000a5c6
jmp 0x1000a6a6
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1000a5ae
jmp 0x1000a5dd
mov dword [0x101f71d4], 0x1217
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1000a6a6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x22], dx
mov ax, word [ebp - 0x22]
cmp ax, 0x61
jne 0x1000a6a6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1000a6a6
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff7
mov dword [0x101f71d4], 0xc3b
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x64
jne 0x1000a6a6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1000a5fe
xor eax, eax
mov dword [0x101f71d8], 0xcc5
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop ebp
ret
Function at 0x1000a720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x1000a94e
jmp 0x1000a816
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
cmp ecx, edx
mov dword [ebp - 0x24], ecx
je 0x1000a935
jmp 0x1000a88e
xor eax, eax
mov dword [0x101f71d8], 0x1c27
mov dword [ebp - 0x18], eax
jmp 0x1000a94e
mov eax, dword [ebp - 0x28]
mov dword [0x101f71d8], 0x649
mov dword [0x101f71d4], 0x27a
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x1000a94e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x34], eax
mov word [ebp - 0x36], dx
mov word [ebp - 0x38], di
jb 0x1000a7e2
mov ax, word [ebp - 0x36]
mov word [ebp - 0x38], ax
mov ax, word [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x34]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov al, bl
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x3a], al
jne 0x1000a907
jmp 0x1000a8eb
mov dword [0x101f71d8], 0xfffff984
mov dword [0x101f71d4], 0x1d9e
mov ecx, dword fs:[0x18]
mov dword [0x101f71d8], 0xa4f
mov dword [0x101f71d4], 0x1886
mov eax, dword [ecx + 0x30]
mov dword [0x101f71d4], 0x446
mov eax, dword [eax + 0xc]
mov ecx, eax
add ecx, 0x14
mov eax, dword [eax + 0x14]
mov dword [0x101f71d8], 0x1fce
cmp eax, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x40], eax
je 0x1000a776
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov byte [ebp - 0x41], cl
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
jmp 0x1000a88e
mov eax, dword [ebp - 0x24]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x41]
and bh, bl
test bh, 1
mov edi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x28], edi
jne 0x1000a78a
mov eax, dword [ebp - 0x48]
mov cx, word [eax]
shr cx, 1
movzx edx, cx
cmp cx, 0
mov dword [ebp - 0x50], edx
je 0x1000a75e
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1000a7ae
mov eax, dword [ebp - 0x34]
add eax, 1
mov ecx, dword [ebp - 0x50]
cmp eax, ecx
mov dl, byte [ebp - 0x39]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x3a], dl
jb 0x1000a7ae
mov al, byte [ebp - 0x3a]
test al, 1
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x54], ecx
jne 0x1000a919
jmp 0x1000a75e
mov eax, dword [ebp - 0x54]
mov dword [0x101f71d4], 0xffffdcc5
mov dword [0x101f71d8], 0x2352
mov dword [ebp - 0x18], eax
jmp 0x1000a94e
mov dword [0x101f71d8], 0xffffea71
mov dword [0x101f71d4], 0xffffdcc5
jmp 0x1000a776
mov eax, dword [ebp - 0x18]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000aa50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101f71dc], 0
mov dword [0x101f71e0], 0
mov dword [0x101f71ec], 0
mov edi, dword [0x101f71d8]
mov ebx, edi
add ebx, 0x1f87
mov dword [0x101f71d4], ebx
add edi, 0xfffff200
mov dword [0x101f71d8], edi
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x1000abaa
jmp 0x1000abb4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
mov edi, 0x100
add esi, 1
add eax, 0xfffffc52
mov dword [0x101f71d4], 0xdc4
mov ebx, ecx
add ebx, 1
mov dword [ebp - 0x34], eax
mov eax, esi
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x101f71dc], edx
mov esi, dword [ebp - 0x1c]
movzx esi, byte [esi + edx]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x38]
add esi, ecx
mov eax, esi
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x101f71e0], edx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x40]
mov cl, byte [ecx + esi]
mov byte [0x101f71e4], cl
mov edi, dword [ebp - 0x34]
mov dword [0x101f71d4], edi
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x101f71e4]
mov edx, dword [0x101f71e0]
mov byte [edi + edx], cl
mov edx, dword [0x101f71d4]
add edx, 0x109d
mov dword [0x101f71d4], edx
mov edx, dword [0x101f71dc]
movzx edx, byte [edi + edx]
mov ecx, dword [0x101f71e0]
movzx ecx, byte [edi + ecx]
add ecx, edx
mov dword [0x101f71d8], 0x19a1
and ecx, 0xff
mov dword [0x101f71ec], ecx
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x3c]
xor cl, byte [edx + esi]
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], cl
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x44], ebx
je 0x1000abb2
jmp 0x1000abce
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x1000abaa
xor eax, eax
mov ecx, eax
mov edx, eax
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], esi
jmp 0x1000aac2
mov eax, dword [0x101f71dc]
mov ecx, dword [0x101f71e0]
mov edx, dword [0x101f71d8]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], edx
jmp 0x1000aac2
Function at 0x1000b070
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101f71d8], 0xc97
mov dword [0x101f71e0], 0
mov byte [0x101f71e4], 0
mov dword [0x101f71d4], 0x883
mov dword [0x101f71dc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1000b196
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101f71e8], 0
mov dword [0x101f71d8], 0x244a
mov edx, dword [0x101f71e0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x101f71e8], edi
mov dword [0x101f71d4], 0x1147
mov eax, edi
cdq
idiv ecx
mov dword [0x101f71e0], edx
mov dword [0x101f71d8], 0x1720
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x101f71e4], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov dword [0x101f71d4], 0x1aa3
mov cl, byte [0x101f71e4]
mov edx, dword [0x101f71e0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x101f71dc]
add edx, 1
mov dword [0x101f71dc], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1000b0c4
mov eax, dword [0x101f71d4]
add eax, 0xa65
mov dword [0x101f71d4], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101f71dc]
add eax, 1
mov dword [0x101f71dc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000b196
xor eax, eax
mov ecx, dword [0x101f71d4]
add ecx, 0xfffff616
mov dword [0x101f71d4], ecx
mov dword [0x101f71dc], 0
mov dword [ebp - 0x20], eax
jmp 0x1000b0c4
Function at 0x1000b1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x101f71d4], 0x9b4
mov dword [ebp - 0x10], eax
call fcn.1000a1d0
xor ecx, ecx
mov edx, dword [0x101f71d4]
add edx, 0xfffff012
mov dword [0x101f71d8], edx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x101f71d8], 0x159f
mov esi, dword [eax + esi + 0x78]
mov dword [0x101f71d4], 0x1669
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x101f71d8], 0xfffffd24
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x1000b390
jmp 0x1000b2cc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
xor esi, esi
add ecx, 0x15c
mov edi, dword [ebp - 0x24]
mov ebx, dword [edi + eax*4]
mov dword [0x101f71d4], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], esi
jmp 0x1000b2e6
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x101f71d4], 0xfffff26b
mov dword [ebp - 0x28], esi
jmp 0x1000b390
mov eax, 0x1669
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
add edx, esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
jmp 0x1000b276
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x52], cl
mov byte [ebp - 0x53], bl
je 0x1000b350
mov al, byte [ebp - 0x51]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov ah, byte [ebp - 0x52]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
mov byte [ebp - 0x54], ah
mov dword [ebp - 0x58], edx
mov al, byte [ebp - 0x54]
test al, 1
mov ecx, dword [ebp - 0x58]
mov dl, byte [ebp - 0x52]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x53], dl
jne 0x1000b2e6
jmp 0x1000b350
mov al, byte [ebp - 0x53]
test al, 1
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x4c], ecx
jne 0x1000b2a4
mov eax, dword [ebp - 0x40]
add eax, 2
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
jb 0x1000b276
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000b390
mov eax, dword [ebp - 0x28]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000b950
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x63
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0x3f
mov dword [0x101f71d8], 0x1368
mov dword [0x101f71d4], 0xc38
call fcn.1000b4a0
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.1000b7a0
mov dword [0x101f71d8], 0x107
cmp eax, 0
mov dword [ebp - 0x34], eax
jne 0x1000b9e5
xor eax, eax
add esp, 0x4c
pop esi
pop ebp
ret
mov dword [0x101f71d4], 0x193b
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101f71d4], 0xd99
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.1000aed0
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x101f71d8], 0x18f5
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x50], ecx
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x38], ecx
mov dword [0x101f71d4], 0xfffff5d7
add ecx, 0x15ed
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x1000ba8e
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x1000be80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [0x101f71d8]
add edx, 0x1e5a
mov dword [0x101f71d4], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1000bad0
lea ecx, [0x1000ac40]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x54], edx
mov dword [esp + 0x84], 0x142400
mov edx, dword [0x101f71c0]
mov dword [esp + 0x7c], edx
mov edx, dword [0x101f71c4]
mov dword [esp + 0x8c], edx
mov dword [0x101f71d4], 0xfffffbfd
mov edx, dword [0x101f71c8]
mov dword [esp + 0x80], edx
mov edx, dword [0x101f71cc]
mov dword [esp + 0x74], edx
mov edx, dword [0x101f71d0]
mov dword [esp + 0x4c], edx
mov dword [0x101f71d8], 0x2687
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1000bf3b
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x1000bf66
jmp 0x1000bf4a
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x1000bf21
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1000bf3b
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov dword [0x101f71d8], 0x159f
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x60], eax
mov dword [0x101f71d4], 0x983
call fcn.1000a570
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x1000bff8
lea eax, [esp + 0x38]
mov ecx, dword [0x101f71d4]
add ecx, 0x159
mov dword [0x101f71d4], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000b950
mov dword [0x101f71d4], 0x1656
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x101f71d4]
add ecx, 0xfffff4f5
mov dword [0x101f71d4], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4e43ee
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
mov dword [ebp + 0x10], eax
jle 0x4e44b1
mov ecx, dword [ebp + 8]
cmp dword [ebp + 0x14], 4
jl 0x4e44c3
movzx edx, byte [ecx]
shr edx, 2
mov dl, byte [edx + 0x4a415f78]
mov byte [eax], dl
xor edx, edx
mov dl, byte [ecx]
inc eax
and edx, 3
shl edx, 4
cmp esi, 1
jle 0x4e443a
movzx ebx, byte [ecx + 1]
shr ebx, 4
or edx, ebx
movsx edx, byte [edx + 0x4a415f78]
mov byte [eax], dl
inc eax
cmp esi, 2
jle 0x4e4466
movzx ebx, byte [ecx + 2]
xor edx, edx
mov dl, byte [ecx + 1]
shr ebx, 6
and edx, 0xf
shl edx, 2
or edx, ebx
movsx edx, byte [edx + 0x4a415f78]
jmp 0x4e4480
cmp esi, 1
jle 0x4e447d
xor edx, edx
mov dl, byte [ecx + 1]
and edx, 0xf
movsx edx, byte [edx*4 + 0x4a415f78]
jmp 0x4e4480
push 0x3d
pop edx
mov byte [eax], dl
inc eax
cmp esi, 2
jle 0x4e4499
xor edx, edx
mov dl, byte [ecx + 2]
and edx, 0x3f
movsx edx, byte [edx + 0x4a415f78]
jmp 0x4e449c
push 0x3d
pop edx
sub dword [ebp + 0x14], 4
mov byte [eax], dl
sub esi, 3
inc eax
add ecx, 3
test esi, esi
jg 0x4e4409
cmp dword [ebp + 0x14], 0
jle 0x4e44ba
mov byte [eax], 0
sub eax, dword [ebp + 0x10]
pop esi
pop ebx
pop ebp
ret 0x10
or eax, 0xffffffff
jmp 0x4e44bd