joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1e2e23c7
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x117b6e3b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x100040c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
movzx eax, byte [0x1005d273]
test eax, eax
je 0x1000414d
mov dword [ebp - 0xc], 0
jmp 0x100040e6
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x100
jge 0x10004146
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 8
jmp 0x10004107
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x10004137
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x1000412d
mov edx, dword [ebp - 4]
shr edx, 1
xor edx, 0xedb88320
mov dword [ebp - 4], edx
jmp 0x10004135
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
jmp 0x100040fe
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx*4 + 0x100745d0], edx
jmp 0x100040dd
mov byte [0x1005d273], 0
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x100041c0
mov edx, dword [0x10073f2c]
add edx, 1
mov dword [0x10073f2c], edx
cmp dword [0x10073f2c], 0x1388
jbe 0x10004191
mov dword [0x10073f2c], 0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
shr eax, 8
and eax, 0xffffff
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
xor edx, dword [ebp - 8]
and edx, 0xff
xor eax, dword [edx*4 + 0x100745d0]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x10004154
jmp 0x101ee147
Function at 0x100069d0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0
push 0
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10006a02
xor al, al
jmp 0x10006b2b
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf00000
jb 0x10006a2b
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x10006b2b
push 0x1000
call fcn.1001a524
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10006a4e
xor al, al
jmp 0x10006b2b
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10006a80
cmp dword [ebp - 0x1c], 0x1000
je 0x10006a99
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.1001a82a
add esp, 4
xor al, al
jmp 0x10006b2b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10006ac3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.1001a82a
add esp, 4
xor al, al
jmp 0x10006b2b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x4550
je 0x10006af0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.1001a82a
add esp, 4
xor al, al
jmp 0x10006b2b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x34]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.1001a82a
add esp, 4
mov dword [ebp - 4], 0
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006b40
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0
push 0
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10006b72
xor al, al
jmp 0x10006c9b
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf00000
jb 0x10006b9b
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x10006c9b
push 0x1000
call fcn.1001a524
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10006bbe
xor al, al
jmp 0x10006c9b
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10006bf0
cmp dword [ebp - 0x1c], 0x1000
je 0x10006c09
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.1001a82a
add esp, 4
xor al, al
jmp 0x10006c9b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10006c33
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.1001a82a
add esp, 4
xor al, al
jmp 0x10006c9b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x4550
je 0x10006c60
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.1001a82a
add esp, 4
xor al, al
jmp 0x10006c9b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x34]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.1001a82a
add esp, 4
mov dword [ebp - 4], 0
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000f260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], ecx
jmp fcn.100cdfee
Function at 0x1000ff20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10051b80
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x1005b030]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx + 4]
cmp byte [eax + 0x31], 0
mov edi, ecx
jne 0x1000ff76
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
cmp dword [eax + 0xc], ecx
jae 0x1000ff6c
mov eax, dword [eax + 8]
jmp 0x1000ff70
mov edi, eax
mov eax, dword [eax]
cmp byte [eax + 0x31], 0
je 0x1000ff62
mov esi, dword [ebx]
mov edx, dword [ebx + 0x18]
mov dword [esp + 0x14], edx
test esi, esi
je 0x1000ff87
cmp esi, esi
je 0x1000ff8c
call fcn.1001a81a
cmp edi, dword [esp + 0x14]
je 0x1000ff9c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp ecx, dword [edi + 0xc]
jae 0x10010002
lea edx, [esp + 0x18]
push edx
call fcn.10010950
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x68], 0
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x40], ecx
call fcn.10011490
push edi
push esi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ebx
mov byte [esp + 0x78], 1
call fcn.100105d0
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x68], 0
call fcn.1000f960
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0xffffffff
call fcn.1000f960
test esi, esi
jne 0x1001002d
call fcn.1001a81a
cmp edi, dword [esi + 0x18]
jne 0x10010015
call fcn.1001a81a
lea eax, [edi + 0x10]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esi]
jmp 0x1001000b

Function at 0x10015520
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov ecx, dword [0x10055970]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
and edx, 4
jne 0x1001555f
push 0
push 0
push 0
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x10015576
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1001a152
Capabilities:
Hash data with crc32

Disassembly:
stc
pushal
test al, 1
pushfd
pushfd
push dword [esp + 0xc]
jmp fcn.101b463e

Function at 0x1001a52f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005b030]
jne 0x1001a539
repz ret
jmp fcn.1001c356

Function at 0x100251fd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001c94c
and dword [ebp - 4], 0
cmp dword [0x1005df7c], 0
mov ebx, eax
jne 0x100252ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002535f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1002535f
push eax
call fcn.1001c8da
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1005df7c], eax
call esi
push eax
call fcn.1001c8da
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1005df80], eax
call esi
push eax
call fcn.1001c8da
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1005df84], eax
call esi
push eax
call fcn.1001c8da
pop ecx
mov dword [0x1005df8c], eax
test eax, eax
je 0x100252ae
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001c8da
pop ecx
mov dword [0x1005df88], eax
mov eax, dword [0x1005df88]
cmp eax, ebx
je 0x10025306
cmp dword [0x1005df8c], ebx
je 0x10025306
push eax
call fcn.1001c955
push dword [0x1005df8c]
mov esi, eax
call fcn.1001c955
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10025306
test edi, edi
je 0x10025306
call esi
test eax, eax
je 0x100252fd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100252fd
test byte [ebp - 0xc], 1
jne 0x10025306
or dword [ebp + 0x10], 0x200000
jmp 0x1002533f
mov eax, dword [0x1005df80]
cmp eax, ebx
je 0x1002533f
push eax
call fcn.1001c955
pop ecx
test eax, eax
je 0x1002533f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1002533f
mov eax, dword [0x1005df84]
cmp eax, ebx
je 0x1002533f
push eax
call fcn.1001c955
pop ecx
test eax, eax
je 0x1002533f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1005df7c]
call fcn.1001c955
pop ecx
test eax, eax
je 0x1002535f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10025361
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002a3b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x394
mov eax, dword [0x1005b030]
xor eax, esp
mov dword [esp + 0x390], eax
push ebx
push ebp
mov ebp, dword [esp + 0x3a8]
push esi
mov esi, dword [esp + 0x3a4]
push edi
mov edi, dword [esp + 0x3ac]
mov eax, 0x53
xor ebx, ebx
push 0x103
mov word [esp + 0x1c], ax
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x19d]
mov ecx, 0x4e
mov edx, 0x43
push ebx
push eax
mov word [esp + 0x28], cx
mov word [esp + 0x2c], dx
mov byte [esp + 0x1a4], bl
call fcn.1001c860
mov ecx, dword [str._s_s]
mov dl, byte [0x100558f8]
push edi
push ebp
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], ecx
push eax
lea ecx, [esp + 0x1b0]
push ecx
mov byte [esp + 0x48], dl
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x103
lea edx, [esp + 0xb5]
push ebx
push edx
mov byte [esp + 0xbc], bl
call fcn.1001c860
lea eax, [esp + 0x1c0]
add esp, 0x28
lea edi, [eax + 1]
jmp 0x1002a470
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002a470
sub eax, edi
push eax
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x1a0]
push ecx
call fcn.10049d90
push 0x103
lea edx, [esp + 0x2ad]
push ebx
push edx
mov byte [esp + 0x2b4], bl
call fcn.1001c860
push 0x63
lea ecx, [esp + 0x4d]
xor eax, eax
push ebx
push ecx
mov byte [esp + 0x38], bl
mov word [esp + 0x39], ax
mov byte [esp + 0x54], bl
call fcn.1001c860
mov edi, dword [esp + 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0x24
add edi, 0x13868
push edi
push 0x64
lea eax, [esp + 0x38]
push eax
mov edx, 0x30
lea ecx, [esp + 0x1c]
mov word [esp + 0x1c], dx
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0xa8]
push eax
call ebx
push edi
push 0x104
lea ecx, [esp + 0x2a4]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xa8]
push ecx
call ebx
push edi
push 3
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xa8]
push edx
call ebx
lea eax, [esp + 0x30]
push eax
call fcn.1001ae19
lea ecx, [esp + 0x2a0]
xor eax, 0x2e3f851c
push ecx
mov dword [esi], eax
call fcn.1001ae03
cdq
mov dword [esi + 0xc], edx
lea edx, [esp + 0x18]
mov dword [esi + 8], eax
push edx
lea eax, [esp + 0x20]
push eax
call fcn.10027a65
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 4]
push 0x14
push ecx
call fcn.100319e0
mov ecx, dword [esp + 0x3b8]
add esp, 0x18
xor edx, edx
cmp eax, dword [esi]
pop edi
sete dl
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, edx
call fcn.1001a52f
add esp, 0x394
ret 0xc
Function at 0x1002fc50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1005b030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1002fe5c
mov byte [ebp - 0x2c], 0x47
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x4d
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x75
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x46
mov byte [ebp - 0x22], 0x69
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x4e
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x6d
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x45
mov byte [ebp - 0x1a], 0x78
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x40], 0x45
mov byte [ebp - 0x3f], 0x6e
mov byte [ebp - 0x3e], 0x75
mov byte [ebp - 0x3d], 0x6d
mov byte [ebp - 0x3c], 0x50
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x6f
mov byte [ebp - 0x39], 0x63
mov byte [ebp - 0x38], 0x65
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x73
mov byte [ebp - 0x35], 0x4d
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x75
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10073e58], eax
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10073e54], eax
cmp dword [0x10073e58], 0
je 0x1002fe5c
cmp dword [0x10073e54], 0
je 0x1002fe5c
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x108], 0
mov eax, 1
jmp 0x1002ff30
mov eax, dword [ebp - 0x44]
mov dword [eax + 0x108], 1
xor eax, eax
jmp 0x1002ff30
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a52f
mov esp, ebp
pop ebp
ret

Function at 0x10030590
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
test eax, eax
je 0x100305b8
mov dword [ebp - 4], 1
jmp 0x100305bf
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x1003068f
mov al, 1
jmp 0x1003075a
xor al, al
jmp 0x1003075a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030770
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
je 0x1003078e
mov byte [ebp - 1], 1
jmp 0x10030792
mov byte [ebp - 1], 0
movsx eax, byte [ebp - 1]
test eax, eax
je 0x10030864
mov al, 1
jmp 0x1003092a
xor al, al
jmp 0x1003092a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10031440
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1003155d
xor eax, eax
jmp 0x100315a2
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x128
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100315a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 8]
jne 0x1003158e
mov eax, 1
jmp 0x100315a2
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 8], eax
jmp 0x10031576
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10031700
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100569d8
push 0x1001fa00
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x1005b030]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x10031780
mov al, byte [ebp - 0x19]
jmp 0x10031819
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100319e0
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
push 0x3fc
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.1001c860
add esp, 0xc
xor edi, edi
mov ebx, edi
mov esi, 8
mov edi, edi
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, 1
je 0x10031a27
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x10031a29
shr ebx, 1
dec esi
test esi, esi
jg 0x10031a10
mov dword [esp + edi*4 + 0xc], ebx
inc edi
cmp edi, 0x100
jl 0x10031a07
mov ebx, dword [esp + 0x414]
xor edi, edi
or esi, 0xffffffff
test ebx, ebx
je 0x10031a7d
push ebp
mov ebp, dword [esp + 0x414]
inc edi
dec ebx
cmp edi, 0x1e
jbe 0x10031a64
push 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [ebp]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [esp + ecx*4 + 0x10]
inc ebp
test ebx, ebx
jne 0x10031a53
pop ebp
mov eax, esi
pop edi
not eax
pop esi
xor eax, 0x2e3f851c
pop ebx
add esp, 0x400
ret