joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb540f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0xb540fe
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0xb5414b
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00b56f10
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.00b53939
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.00b539d7
test eax, eax
jne 0xb541a7
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00b56f10
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.00b53939
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.00b56990
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.00b56990
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00b539d7
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0xb541ac
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0xb541e3
test edi, edi
je 0xb541e3
call fcn.00b540f0
test eax, eax
jne 0xb541e8
push 0x20
mov edx, esi
mov ecx, esi
call fcn.00b53939
push 0x20
push esi
push edi
call fcn.00b56990
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0xb53963
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0xb5429b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0xb54335
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0xb54335
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.00b4f97e
mov dword [esp + 0xc], eax
test eax, eax
jne 0xb5433a
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0xb542fb
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00b54285
mov ecx, ebx
mov esi, eax
call fcn.00b54285
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0xb542d5
jmp 0xb54320
mov ecx, dword [esp + 0x10]
jmp 0xb54320
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00b54285
mov ecx, ebx
mov esi, eax
call fcn.00b54285
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0xb54301
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0xb5433a
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0xb6c166
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00b6bfe5

Function at 0xb6fb3f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00b6f4ad

Function at 0xb6fb4a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00b6f6e8
Function at 0x5ec51a
Capabilities:
Encode data using xor

Disassembly:
mov ecx, esi
mov cx, word [esp + 3]
jmp 0x5ec532
mov ecx, esi
clc
jmp 0x5ec523
jae 0x5ec504
mov ecx, esi
mov cx, word [esp + 3]
jmp 0x5ec532
lea esp, [esp + 4]
dec dl
cmc
jo 0x5ec56d
xor dh, byte [ecx + 0x1a]
jno 0x5ec557
sbb byte [0x9527d48d], 0xcc
outsb dx, byte [esi]
cld
wait
jbe 0x5ec53a
inc esi
jno 0x5ec5bd
mov ch, 0x2b
mov ebx, dword [esp]
btc cx, di
mov bl, 0x89
lea ecx, [edx + 0x2b]
ficom dword [esi + 0x60]

Function at 0x5ecbd1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf05d9f74
jmp 0x5ecdbc
pushal
mov byte [esp + 8], bh
lea esp, [esp + 0xc]
pushal
push dword [esp + 0xb]
jmp 0x5ecc69
ja 0x5ecce9
mov dword [esp + 0x34], eax
push sp
call fcn.005ecc09
push eax
mov dword [esp + 0x34], eax
push sp
call fcn.005ecc1f
jle 0x5ecd0b
jg 0x5ecd0b
mov edi, 0x35c6a333
lea esp, reloc.MSVCRT.dll_strncpy
mov byte [ebx + 0x23d0b121], dh
nop
loopne 0x5eccf4
call 0x5ecd21
adc dword [eax], eax
add byte [eax], al
xor byte [edi + 0x19a15237], ah
dec esi
fmul dword [esi + 0x29]
fsubr dword [ebp + esi*4 - 0x5c]
xlatb
or dword ds:[ebp + 0x66], edx
push ecx
mov dword [esp + 0x38], esp
pushal
pop word [esp + 0xf]
jmp 0x5ecd34
pop dword [esp + 0x10]
mov dword [esp + 1], ecx
lea esp, [esp + 2]
mov dword [esp + 0x4c], ebp
jmp 0x5ecd6f
jmp 0x5ecd8c
mov dword [esp + 0x48], esi
push bp
mov word [esp], di
mov byte [esp], cl
push word [esp]
js 0x5ecd59
mov dword [esp + 0x48], edi
jmp 0x5ecdd5
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
pushfd
jmp 0x5eca53
lea ecx, [esi*4]
bswap eax
lea eax, [ebp*4]
jmp 0x5ecdf1
lea esp, [esp + 0x48]
jmp 0x5ecd94
mov ebp, dword [esp + 0x2c]
sub esp, 5
jg 0x5ece19
mov ebx, 0x7678b9da
jmp 0x5ece31
bt edx, ebp
jo 0x5ecddb
jno 0x5ecddb
mov ebx, 0x7678b9da
mov si, word [esp + 4]
mov dx, 0x32c6
lea esp, [esp + 1]
jmp 0x5ece1b
jmp 0x5ecdf8
lea edi, [esp + 4]
cpuid
not dx
mov esi, 0xd8a45682
xchg dh, dl
jmp 0x5ece56
mov si, word [esp + 4]
mov dx, 0x32c6
lea esp, [esp + 1]
jmp 0x5ece1b
sub esp, 0xbc
mov esi, esp
call fcn.005ece40
jge 0x5ece81
jl 0x5ece81
dec dx
jg 0x5ecee0
jle 0x5ecf07
stosb byte es:[edi], al
or byte [esi + 0x258f08f9], bl
movsd dword es:[edi], dword [esi]
xor eax, 0x541baf5c
invalid
mov ecx, ebp
mov eax, dword [esp]
mov ax, word [esp]
xchg bl, dh
rdtsc
call 0x5ece94
pop eax
rdtsc
bswap ebx
dec ax
not dx
xchg dword [esp], ecx
jmp 0x5ececa
cmc
neg dh
xchg dx, ax
xchg dword [esp], ecx
cmc
and ax, 0x8b0d
jmp 0x5ecef6
mov dl, byte [esp]
bsr edx, edi
xchg bx, ax
lea ecx, [ecx - 0x2c]
mov eax, dword [esp]
mov eax, dword [esp]
jmp 0x5eceb4
xchg ah, bh
ror ebx, cl
xchg bl, al
and ah, 0xd4
setp dh
jmp 0x5ecf56
bswap edx
bswap eax
lea eax, [esp - 0xb1]
push dword [esp]
ret 4
xchg ah, bh
ror ebx, cl
xchg bl, al
jmp 0x5ecfbb
neg eax
inc ebp
mov ebx, ebp
sub esp, 0x1a
jno 0x5ecf38
jo 0x5ecf22
and ah, 0xd4
setp dh
jmp 0x5ecf56
Function at 0x5ecd21
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf05d9f74
jmp 0x5ecdbc
pushal
mov byte [esp + 8], bh
lea esp, [esp + 0xc]
pushal
push dword [esp + 0xb]
jmp 0x5ecc69
ja 0x5ecce9
mov dword [esp + 0x34], eax
push sp
call fcn.005ecc09
push eax
mov dword [esp + 0x34], eax
push sp
call fcn.005ecc1f
jle 0x5ecd0b
jg 0x5ecd0b
mov edi, 0x35c6a333
lea esp, reloc.MSVCRT.dll_strncpy
mov byte [ebx + 0x23d0b121], dh
nop
loopne 0x5eccf4
call 0x5ecd21
adc dword [eax], eax
add byte [eax], al
xor byte [edi + 0x19a15237], ah
dec esi
fmul dword [esi + 0x29]
fsubr dword [ebp + esi*4 - 0x5c]
xlatb
or dword ds:[ebp + 0x66], edx
push ecx
mov dword [esp + 0x38], esp
pushal
pop word [esp + 0xf]
jmp 0x5ecd34
pop dword [esp + 0x10]
mov dword [esp + 1], ecx
lea esp, [esp + 2]
mov dword [esp + 0x4c], ebp
jmp 0x5ecd6f
jmp 0x5ecd8c
mov dword [esp + 0x48], esi
push bp
mov word [esp], di
mov byte [esp], cl
push word [esp]
js 0x5ecd59
mov dword [esp + 0x48], edi
jmp 0x5ecdd5
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
pushfd
jmp 0x5eca53
lea ecx, [esi*4]
bswap eax
lea eax, [ebp*4]
jmp 0x5ecdf1
lea esp, [esp + 0x48]
jmp 0x5ecd94
mov ebp, dword [esp + 0x2c]
sub esp, 5
jg 0x5ece19
mov ebx, 0x7678b9da
jmp 0x5ece31
bt edx, ebp
jo 0x5ecddb
jno 0x5ecddb
mov ebx, 0x7678b9da
mov si, word [esp + 4]
mov dx, 0x32c6
lea esp, [esp + 1]
jmp 0x5ece1b
jmp 0x5ecdf8
lea edi, [esp + 4]
cpuid
not dx
mov esi, 0xd8a45682
xchg dh, dl
jmp 0x5ece56
mov si, word [esp + 4]
mov dx, 0x32c6
lea esp, [esp + 1]
jmp 0x5ece1b
sub esp, 0xbc
mov esi, esp
call fcn.005ece40
jge 0x5ece81
jl 0x5ece81
dec dx
jg 0x5ecee0
jle 0x5ecf07
stosb byte es:[edi], al
or byte [esi + 0x258f08f9], bl
movsd dword es:[edi], dword [esi]
xor eax, 0x541baf5c
invalid
mov ecx, ebp
mov eax, dword [esp]
mov ax, word [esp]
xchg bl, dh
rdtsc
call 0x5ece94
pop eax
rdtsc
bswap ebx
dec ax
not dx
xchg dword [esp], ecx
jmp 0x5ececa
cmc
neg dh
xchg dx, ax
xchg dword [esp], ecx
cmc
and ax, 0x8b0d
jmp 0x5ecef6
mov dl, byte [esp]
bsr edx, edi
xchg bx, ax
lea ecx, [ecx - 0x2c]
mov eax, dword [esp]
mov eax, dword [esp]
jmp 0x5eceb4
xchg ah, bh
ror ebx, cl
xchg bl, al
and ah, 0xd4
setp dh
jmp 0x5ecf56
bswap edx
bswap eax
lea eax, [esp - 0xb1]
push dword [esp]
ret 4
xchg ah, bh
ror ebx, cl
xchg bl, al
jmp 0x5ecfbb
neg eax
inc ebp
mov ebx, ebp
sub esp, 0x1a
jno 0x5ecf38
jo 0x5ecf22
and ah, 0xd4
setp dh
jmp 0x5ecf56

Function at 0x995983
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cx
cpuid
not eax
mov al, 0x68
push word [esp + 0x19]
jmp 0x9959ac
neg ebp
mov bx, 0x4c24
pop dword [esp + 0x10]
jmp 0x99596d
Function at 0x995e9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x995edf
mov word [esp + 1], sp
pop di
ror ah, cl
std
rdtsc
mov bp, 0xa862
jmp 0x995ec9

Function at 0x99614c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, reloc.MSVCRT.dll_strncpy
pop dx
jmp 0x996194

Function at 0x996759
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00996010
stc
bsr dx, bp
mov ebx, eax
mov esi, dword [esp + 0x14]
cmc
cld
jmp 0x996764
pop word [esp + 0xf]
bsf ax, sp
jmp 0x996743
mov ch, dh
lea ebp, [eax*4]
mov byte [esp + 0xf], al
bt bp, ax
dec ecx
not dx
jmp 0x9967a4
push word [esp + 8]
bsr eax, ebx
pop ebp
lea edx, [esp - 0xd2]
jmp 0x9967d2
sub esp, 0xa
sub esp, 0xe
bsr ebx, eax
add esp, 0x27
pop word [esp + 6]
mov cx, word [esp + 5]
jmp 0x99678e
mov word [esp + 0x11], sp
xchg word [esp + 0x12], dx
rdtsc
add esp, 0x10
jmp 0x996855
xchg dword [esp], ecx
mov si, ax
sub esp, 0x12
xchg edi, esi
pop word [esp + 8]
pop cx
jmp 0x9967bc
mov si, 0x562f
mov cl, bl
cmc
pushfd
shl esi, cl
or ch, 0x23
jmp 0x99683a
sub esp, 0x19
not edx
mov dword [esp + 0x25], esp
xchg edx, ebx
pushal
lea esp, [esp + 0x50]
jmp 0x996812
lea esi, [esi*4]
btc ax, sp
rdtsc
mov cl, byte [esp + 2]
std
jmp 0x99686a
xchg ecx, eax
mov di, 0x1fb5
mov word [esp + 1], cx
setl bl
sub esp, 0x12
bswap ebp
jmp 0x996828
mov word [esp], dx
mov di, word [esp + 1]
mov edx, ecx
lea ecx, [eax + edx]
clc
setge al
jmp 0x996a3f
lea edx, [eax*4]
mov edx, dword [esp]
rdtsc
jmp 0x9968ce
pop cx
push cx
seto dl
add esp, 6
mov edx, ebp
cpuid
jmp 0x9968a8
aad 0xf
mov byte [0xbe66daeb], al
push ds
inc ecx
mov si, 0x411e
call fcn.00996979
jle 0x9968c9
add ax, si
push ds
pushal
in eax, dx
jge 0x9968e5
not dword [edi]
jl 0x996934
salc
inc ecx
ret
add esp, 0
lea esp, [esp + 1]
neg al
mov di, 0x282e
pushfd
xchg dword [esp], ecx
jmp 0x9968be
push ebx
call 0x996956
xor edi, dword [ebp + reloc.MSVCRT.dll_strncpy]
add ecx, dword [esi + reloc.MSVCRT.dll_strncpy]
lahf
out 0x11, al
lea esp, [esp + 4]
pushfd
mov dword [esp], eax
call fcn.00996927
mov dword [esp], esp
push di
lea esp, [esp + 2]
jmp 0x9969b0
mov word [esp + 1], sp
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x14], edi
jmp 0x99698e
lea esp, [esp + 0x14]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x9969d8
push ebp
pushal
pop word [esp + 8]
lea esp, [esp + 2]
mov dword [esp + 0x18], esi
push esp
jmp 0x996961
push eax
jmp 0x99600b
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x9969c2
not dx
bsf eax, esp
xchg dx, si
cpuid
cmc
mov ax, 0xb9e4
jmp 0x9968e8
not bl
mov word [esp], bp
cpuid
xchg word [esp + 1], bp
mov dx, 0x11e9
setae bl
jmp 0x9969f7

Function at 0x996979
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 0xb]
mov dword [esp], ebp
cmc
push dword [esp + 3]
lea esp, [esp + 8]
popfd
jmp 0x996949
sub esp, 9
lea esp, [esp + 3]
lea esp, [esp + 0x28]
popal
sub esp, 0x13
pop dword [esp]
jmp 0x9968fb
mov edx, dword [esp]
mov dx, word [esp + 4]
sub esp, 0x1f
pop word [esp + 0xb]
neg cx
jmp 0x996913
Function at 0x100013e3
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [0x10072168]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, 0x65c2937b
xor eax, eax
lock cmpxchg dword [esi], ecx
je 0x1000141e
push 0
push 0x1004907c
push 3
push esi
call sym.absl.dll__SpinLockWait_base_internal_absl__YAIPAU__atomic_I___1_std__HQBUSpinLockWaitTransition_12_W4SchedulingMode_12__Z
add esp, 0x10
test eax, eax
jne 0x100014cd
lea eax, [ebp - 0x10]
mov dword [eax], 0xffffffff
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000144d
movsd xmm0, qword [0x10049050]
jmp 0x100014ac
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], eax
lea edi, [ebp - 0x1c]
mov dword [edi], 4
push edi
push edx
push ecx
push eax
push str.MHz
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x10001443
cmp dword [ebp - 0x14], 4
jne 0x10001443
cmp dword [ebp - 0x1c], 4
jne 0x10001443
movss xmm0, dword [ebp - 0x18]
orpd xmm0, xmmword [0x10049030]
subsd xmm0, qword [0x10049040]
mulsd xmm0, qword [0x10049048]
movsd qword [0x10072008], xmm0
mov eax, 0xdd
xchg dword [esi], eax
cmp eax, 0x5a308d2
jne 0x100014cd
push 1
push esi
call fcn.10001dca
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10045530
add esp, 0x14
pop esi
pop edi
pop ebp
ret
Function at 0x1000a640
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
lea ecx, [eax*4]
lea edx, [edx + edx*2]
cmp ecx, edx
jbe 0x1000a664
xor eax, eax
jmp 0x1000a7f3
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
lea edx, [ebx + eax]
cmp eax, 3
mov dword [ebp - 0x14], edx
jb 0x1000a6c9
lea eax, [edx - 3]
cmp eax, ebx
jbe 0x1000a6c9
mov dword [ebp - 0x10], eax
mov esi, dword [ebx]
bswap esi
mov eax, esi
shr eax, 0x1a
mov al, byte [ecx + eax]
mov byte [edi], al
mov eax, esi
shr eax, 0x14
and eax, 0x3f
mov al, byte [ecx + eax]
mov byte [edi + 1], al
mov eax, esi
shr esi, 0xe
and esi, 0x3f
mov edx, ecx
mov cl, byte [ecx + esi]
mov byte [edi + 2], cl
mov ecx, edx
shr eax, 8
and eax, 0x3f
mov al, byte [edx + eax]
mov byte [edi + 3], al
mov eax, dword [ebp - 0x10]
add edi, 4
add ebx, 3
cmp ebx, eax
jb 0x1000a682
xor eax, eax
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp - 0x14]
sub esi, ebx
cmp esi, 3
ja case.default.0x1000a6e1
add edx, dword [ebp + 0x10]
sub edx, edi
jmp dword [esi*4 + 0x1004d0b4]
cmp edx, 2
jb 0x1000a7f3
mov dword [ebp - 0x10], edx
movzx edx, byte [ebx]
mov ebx, ecx
mov ecx, edx
shr ecx, 2
mov cl, byte [ebx + ecx]
mov byte [edi], cl
shl edx, 4
and edx, 0x30
mov cl, byte [ebx + edx]
mov byte [edi + 1], cl
cmp byte [ebp + 0x1c], 0
je 0x1000a7eb
mov ecx, dword [ebp - 0x10]
and ecx, 0xfffffffe
cmp ecx, 2
je 0x1000a7f3
mov word [edi + 2], 0x3d3d
jmp 0x1000a7c5
cmp edx, 3
jb 0x1000a7f3
mov dword [ebp - 0x10], edx
mov esi, ecx
movzx ecx, word [ebx]
rol cx, 8
movzx edx, cx
mov ecx, edx
shr ecx, 0xa
mov cl, byte [esi + ecx]
mov byte [edi], cl
mov ecx, edx
shr ecx, 4
and ecx, 0x3f
mov cl, byte [esi + ecx]
mov byte [edi + 1], cl
and edx, 0xf
mov cl, byte [esi + edx*4]
mov byte [edi + 2], cl
cmp byte [ebp + 0x1c], 0
je 0x1000a7e6
cmp dword [ebp - 0x10], 3
je 0x1000a7f3
mov byte [edi + 3], 0x3d
jmp 0x1000a7c5
cmp edx, 4
jb 0x1000a7f3
movzx edx, byte [ebx]
movzx eax, word [ebx + 1]
rol ax, 8
movzx eax, ax
mov ebx, ecx
mov ecx, edx
shr ecx, 2
mov cl, byte [ebx + ecx]
mov byte [edi], cl
and edx, 3
shl edx, 0x10
or edx, eax
shr edx, 0xc
mov cl, byte [ebx + edx]
mov byte [edi + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
mov cl, byte [ebx + ecx]
mov byte [edi + 2], cl
and eax, 0x3f
mov al, byte [ebx + eax]
mov byte [edi + 3], al
add edi, 4
jmp case.0x1000a6e1.0
push esi
push str.Logic_problem__szsrc___zu
push 0xac
push 0x1004d08c
push 3
call sym.absl.dll__RawLog_raw_logging_internal_absl__YAXW4LogSeverity_2_PBDH1ZZ
add esp, 0x14
jmp case.0x1000a6e1.0
add edi, 3
jmp case.0x1000a6e1.0
add edi, 2
sub edi, dword [ebp + 0x10]
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001bc80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test al, 0x50
call fcn.1001b9e6
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1001b99b
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1001bcc4
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1001b9d6
push es
sbb eax, 0x458d5ef1
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x1001be20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x1001be71
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], pe_nt_image_headers32
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1001b9d6
outsb dx, byte [esi]
fisttp qword [ebp + 0x7c858d6e]
invalid

Function at 0x1001c0f0
Capabilities:
Inspect section memory permissions

Disassembly:
or byte [eax], al
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je sym.absl.dll__ReaderLockWhenWithTimeout_Mutex_absl__QAE_NABVCondition_2_VDuration_2__Z
or byte [eax + ecx], 1
Function at 0x1001c110
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1001c0ad
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1001c0cb
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1001c129
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
or byte [eax], al
add byte [eax], al
inc eax
cmp dword [ebp + 8], ebx
je 0x1001c119
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1001c123
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1001c105
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1001c08f
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1001c176
dec eax
je 0x1001c16d
sub eax, 3
je 0x1001c164
mov dword [ebp - 4], 0x40
jmp 0x1001c193
mov dword [ebp - 4], 4
jmp 0x1001c179
mov dword [ebp - 4], 0x20
jmp 0x1001c179
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1001c1c5
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
invalid
invalid
push dword [esi - 0x60]
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001ce00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
stc
invalid
inc dword [ebx - 0x6ff43]
invalid
invalid
jge 0x1001ce2c
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1001cdd6
call fcn.1001b9d6
adc ebp, dword [ebx - 0x3f]
xlatb
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.1001b9d6
fmul qword [esi]
mov esi, 0xd4858d04
clc
invalid
Function at 0x1001f3f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x10072168]
xor eax, ebp
mov dword [esp + 0x28], eax
xor edi, edi
push edi
call sym.absl.dll___0SpinLock_base_internal_absl__QAE_W4SchedulingMode_12__Z
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], ebx
pcmpeqd xmm0, xmm0
mov ebx, esp
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
mov dword [ebx + 0x20], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmovb eax, ecx
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], 0x10
mov dword [esi + 0xa0], 0x20
mov dword [esi + 0xa4], edi
lea eax, [esi + 4]
mov dword [esi + 4], edi
xor eax, 0xb37cc16a
mov dword [esi + 8], eax
mov dword [esi + 0xc], esi
pxor xmm0, xmm0
movdqu xmmword [esi + 0x14], xmm0
movdqu xmmword [esi + 0x24], xmm0
movdqu xmmword [esi + 0x34], xmm0
movdqu xmmword [esi + 0x44], xmm0
movdqu xmmword [esi + 0x54], xmm0
movdqu xmmword [esi + 0x64], xmm0
movdqu xmmword [esi + 0x74], xmm0
movdqu xmmword [esi + 0x80], xmm0
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.10045530
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10026290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.absl.dll__ParseDuration_absl__YA_NVstring_view_1_PAVDuration_1__Z
Function at 0x1002ca2a
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x1002ca78
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1002ca52
cmp edx, 1
je 0x1002ca99
cmp edx, 2
je 0x1002ca90
cmp edx, 3
jne 0x1002caa4
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x1003b690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
cvtss2sd xmm0, dword [ebp + 8]
pop ebp
jmp fcn.1003b6a4