joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ee80
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x17b4
call fcn.100b2020
mov dword [ebp - 0x10], ecx
push 0x100e8a8e
jmp 0x1004b5a8
lea esp, [esp + 4]
rcr dh, 0x97
mov eax, dword [ebp - 0x10]
bt ecx, esp
mov dword [eax], 0
shr ch, 0x3f
sal ax, 0xbf
mov ecx, dword [ebp - 0x10]
and eax, 0x81b46b1e
jmp loc.10299173

Function at 0x1001645a
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
lea ecx, [ecx + eax*2 + 0x1624012b]
dec eax
mov dword [esp + edx], 0x959f70a0
ror ecx, 3
sal word [esp + edx*2], 0x87
or al, byte [esp + edx*2]
inc eax
inc ecx
rol ecx, 1
lea eax, [eax*4 - 0x5ffb95da]
call fcn.10233d2c
mov eax, 0x95adc916
ror ax, 0xa5
sbb esi, 3
not eax
mov ecx, dword [esi + eax - 0x6a5249b7]
btc eax, eax
xor ecx, ebx
mov edx, eax
call fcn.10042b2a

Function at 0x100188e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x90
push 0x100e8a8e
jmp loc.10242eaa

Function at 0x10018f60
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
push edi
mov ebx, ecx
push 0x100e8a8e
mov dword [ebp - 0x24], ebx
jmp 0x100295ea
lea esp, [esp + 4]
jmp loc.1027e765
Function at 0x10020120
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd87d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
lea eax, [ebx + 0x68]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], eax
mov dword [ebx], 0x100ea06c
mov dword [ebx + 0x10], 0x100ea064
push esi
push edi
mov dword [eax], 0x100ea050
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x100ea054
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov byte [eax + 0x40], 0
mov dword [ebp - 4], 1
lea esi, [ebx + 0x18]
mov eax, dword [ebx]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x100ea058
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, ebx
push ecx
push esi
call fcn.10022410
mov dword [ebp - 4], 4
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax + 0x10], 0x100ea05c
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx + 0xc], eax
mov dword [ebp - 4], 6
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x100ea060
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + ebx - 4], eax
mov dword [ebp - 4], 7
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x100ea074
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.10021fd0
mov byte [ebp - 4], 8
mov dword [esi], 0x100ea0b4
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10024730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ddfef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.1009c934
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x100247d6
push eax
push esi
call fcn.1009c7f2
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.1009a3a6
int3
Function at 0x100258b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov ecx, dword [0x1012f578]
call fcn.10039520
mov dword [ebp - 8], eax
mov eax, dword [0x1012f57c]
mov ecx, dword [eax + 0x528]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 4
push edx
mov eax, dword [ebp - 8]
push eax
call dword [ebp - 0xc]
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x67
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x55
mov byte [ebp - 0x19], 0x49
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x42
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0
mov ecx, dword [0x1012f57c]
mov edx, dword [ecx + 0x52c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, 8
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
push 5
push 0
push 1
push 0
push 1
push 0x2bc
push 0
imul eax, dword [0x10129a90], 0xfffffff4
cdq
mov ecx, 0x48
idiv ecx
push eax
mov edx, dword [ebp - 8]
push edx
call dword [ebp - 0x10]
push 0x96ff0000
mov eax, dword [ebp - 4]
add eax, 0x927e4
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [0x1012f580]
call fcn.1003e130
push 0x9600ff00
mov edx, dword [ebp - 4]
add edx, 0x927e8
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x1012f580]
call fcn.1003e130
push 0x960000ff
mov ecx, dword [ebp - 4]
add ecx, 0x927ec
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x1012f580]
call fcn.1003e130
push 0x96ef00ff
mov eax, dword [ebp - 4]
add eax, 0x927f0
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [0x1012f580]
call fcn.1003e130
push 0x9600deff
mov edx, dword [ebp - 4]
add edx, 0x927f4
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x1012f580]
call fcn.1003e130
push 0x96ff9a00
mov ecx, dword [ebp - 4]
add ecx, 0x927f8
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x1012f580]
call fcn.1003e130
mov eax, dword [ebp - 4]
mov byte [eax], 1
mov esp, ebp
pop ebp
ret

Function at 0x10025f70
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp loc.102375b0

Function at 0x1002689d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
pushfd
mov dword [esp + 4], 0x97332aa0
lea esp, [esp + 4]
call fcn.10268cd3
jne 0x1006d4c5
cmp byte [ebp - 0x123], 0
jmp loc.1023a84b
sbb ecx, ecx
xor dx, si
or ecx, 1
mov dword [ebp - 0x96c], ecx
add edx, esp
xchg edx, edx
btr dx, sp

Function at 0x10027690
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push esi
mov dword [ebp - 0x20], ecx
push 0x100e8a8e
jmp fcn.102a7689
Function at 0x10027db0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x54], ecx
push 0x100e8a8e
jmp 0x100331a6
lea esp, [esp + 4]
sal eax, cl
bt ecx, ecx
nop
btr ax, cx
mov eax, dword [ebp - 0x54]
bt cx, 0xb
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x1025f77a
mov edx, dword [ebp - 0x54]
clc
cmp dword [edx + 0x3e818], 0
jmp loc.1026d638
nop
jmp loc.100184e1

Function at 0x10028200
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov dword [ebp - 0x1c], ecx
push 0x100e8a8e
jmp loc.10251094

Function at 0x100285f0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x27b4
call fcn.100b2020
mov dword [ebp - 0xc], ecx
push 0x100e8a8e
jmp fcn.10277c8a

Function at 0x10028ae0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
mov dword [ebp - 0x1cc], ecx
mov eax, dword [0x1012f5f8]
add eax, 0x28e13c
cmp dword [ebp + 8], eax
jne loc.10029762
push 0x100e8a8e
jmp 0x1002938a
lea esp, [esp + 4]
mov cl, 0x1d
not cl
mov ecx, dword [0x1012f578]
jmp fcn.1025f6fb

Function at 0x10029770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x10], ecx
push 0x100e8a8e
jmp loc.1024af7e

Function at 0x10029920
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.1008b3b0
mov dword [ebp - 4], 0
rol eax, 0x1e
neg ax
inc al
movzx eax, byte [ebp + 0x10]
test eax, eax
jmp loc.1022927c
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100de1c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xae4
mov dword [ebp - 0x30], ecx
push 0x100e8a8e
jmp 0x10072baa
lea esp, [esp + 4]
movzx ecx, sp
push 0
movsx cx, bh
bswap ecx
push 1
bswap cx
not cx
lea ecx, [ebp - 0x320]
jmp 0x1001806b

Function at 0x1002a9a0
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70c
push 0x100e8a8e
jmp loc.10276476

Function at 0x1002bd82
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov ebx, esi
mov ecx, 0
sub ebx, ecx
lea esp, [esp + 4]
jmp 0x100935c8
ror edx, 2
call fcn.1023a99d
cmp dword [ebp - 4], 7
jne 0x102421df
mov al, 1
jmp fcn.100860cb
mov ebp, 0xaa21fc03
xor ebp, ebp
lea ebp, [0x1002bd8f]
sbb esi, 4
mov edx, dword [esi]
mov eax, 0x6a18f828
xor edx, ebx
lea ecx, [eax + eax*4 - 0x60665241]
shl cx, 0xea
bswap edx
sal eax, 0xfc
js 0x10090b7c
call fcn.10003fa0
add esp, 0xc
lea eax, [esp + 0x60]
jmp loc.1024f99c
xor al, al
jmp fcn.100860cb
Function at 0x10035f50
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0x100ea1d0
push 0xdb17ac19
pushfd
shr dword [esp + 4], 0x55
mov dword [esp + 4], 0xb7953886
shr word [esp + 4], 0xa7
push ecx
js 0x10035f6e
mov dword [esp + 8], 0x77612ca0
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10268cd3

Function at 0x100376d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
cmp dword [ebp + 0xc], 1
mov edx, ecx
push ebx
sete al
mov dword [ebp - 0x10], edx
push esi
mov byte [edx + 0x48], al
lea ebx, [edx + 4]
mov eax, dword [ebp - 0x10]
lea esi, [edx + 8]
mov dword [edx + 0xc], ebx
lea ecx, [edx + 0x18]
mov dword [edx + 0x10], esi
mov byte [edx + 0x3d], 0
mov dword [edx + 0x20], ecx
push edi
lea edi, [edx + 0x14]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [edx + 0x1c], edi
add edx, 0x24
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp + 0xc]
mov dword [esi], 0
mov esi, dword [ebp + 8]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
test esi, esi
je 0x100377a6
lea eax, [ebp - 0x14]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], 0
push eax
push esi
call fcn.100bb42a
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
jmp 0x100377a9
mov edx, dword [ebp - 0x10]
mov ecx, dword [0x1022820c]
mov eax, dword [0x10228208]
pop edi
mov dword [edx + 0x4c], esi
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [edx + 0x40], eax
mov dword [edx + 0x38], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x1003a6c0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x4c8
push esi
push edi
mov edi, ecx
push 0x100e8a8e
mov dword [ebp - 4], edi
jmp fcn.1023c5f3

Function at 0x1003b580
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x4a8
push esi
push edi
push 0x100e8a8e
mov esi, ecx
jmp 0x10087b0f
lea esp, [esp + 4]
cmp dh, 0x11
clc
cmp byte [esi], 0
jmp loc.1028e9b8
Function at 0x1003bb30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
cwde
jmp loc.10294c7c
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [0x1012f580]
sub esp, 0xa8
cmp byte [eax], 0
push esi
push edi
jne 0x1003bd28
push 0x100e8a8e
jmp 0x1000cdf1
cmp byte [eax + 1], 0
je 0x1003bdea
push 0x100e8a8e
jmp loc.10254eac
cmp dword [ebp + 0xc], 4
jne 0x1003bfd9
cmp dword [0x101344cc], 0
je 0x1003be02
call fcn.100486f0
mov ecx, dword [0x101344bc]
test ecx, ecx
je 0x1003be11
call fcn.10025b70
mov ecx, dword [0x101483a4]
test ecx, ecx
je 0x1003bfd9
cmp dword [ecx + 0x10], 0
je 0x1003bfd9
lea eax, [ecx + 0x4c]
test eax, eax
je 0x1003bfd9
cmp dword [ecx + 0x18], 0
je 0x1003bfd9
call fcn.10039570
mov edi, eax
test edi, edi
je 0x1003bfd9
call fcn.10039690
add edi, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x5c], edi
xor eax, eax
mov edi, dword [edi]
test edi, edi
je 0x1003bfba
mov eax, dword [0x1012f5f8]
cmp dword [eax + 0xda46e4], 0
je 0x1003bfb6
xor eax, eax
mov esi, 0x1013d580
mov dword [esp + 0x1c], eax
nop word [eax + eax]
push 0x10
push esi
call fcn.100c1f1e
add esp, 8
test eax, eax
je 0x1003beb3
lea eax, [edi + 0x1eb968]
push esi
push eax
call fcn.100bb22d
add esp, 8
test eax, eax
je 0x1003bec7
inc dword [esp + 0x1c]
add esi, 0x3a
cmp esi, 0x1013d920
jl 0x1003be90
jmp 0x1003bfb6
imul eax, dword [esp + 0x1c], 0x3a
mov edx, dword [eax + 0x1013d5b6]
mov esi, dword [eax + 0x1013d5b2]
mov dword [esp + 0x10], edx
mov eax, dword [edi + 0x1eba70]
sub eax, 0x271
je 0x1003bfb6
cmp byte [edi + 0x1ebe44], 1
jne 0x1003bfb6
lea eax, [edi + 0x1ebb00]
mov dword [esp + 0x1c], eax
lea ecx, [edi + 0x1ebb04]
mov dword [esp + 0x94], ecx
cmp esi, 0xffffffff
je 0x1003bf68
movss xmm0, dword [edi + 0x1ebafc]
movss dword [esp + 0x98], xmm0
movss xmm0, dword [eax]
lea eax, [esp + 0x98]
push esi
mov esi, dword [esp + 0x1c]
push eax
push esi
push dword [ebp + 8]
movss dword [esp + 0xac], xmm0
movss xmm0, dword [ecx]
movss dword [esp + 0xb0], xmm0
call fcn.100065c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x10]
jmp 0x1003bf6c
mov esi, dword [esp + 0x18]
cmp edx, 0xffffffff
je 0x1003bfb6
movss xmm0, dword [edi + 0x1ebafc]
movss dword [esp + 0xa4], xmm0
movss xmm0, dword [eax]
lea eax, [esp + 0xa4]
addss xmm0, dword [0x100ecf34]
push edx
push eax
push esi
push dword [ebp + 8]
movss dword [esp + 0xb8], xmm0
movss xmm0, dword [ecx]
movss dword [esp + 0xbc], xmm0
call fcn.100065c0
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x5c]
inc eax
add edi, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], edi
cmp eax, 0x10
jl 0x1003be63
push ecx
call fcn.10008340
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1003d5b0
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [0x1012f580]
sub esp, 0x7c
cmp byte [eax], 0
push esi
jne 0x1003d794
push 0x100e8a8e
jmp fcn.1027316a
cmp byte [eax + 1], 0
jne 0x1003d993
cmp dword [ebp + 0x20], 0
jl 0x1003d993
cmp byte [0x1012f5ff], 1
jne 0x1003d993
push 0x100e8a8e
pushfd
push ebx
mov ebx, 0xe0bbd3a
bswap ebx
push edi
mov edi, 0x95b8dc28
shr bx, 0xe1
push dword [esp + edi + 0x6a4723e0]
popfd
mov dword [esp + 8], 0x5aeb4da0
mov ebx, dword [esp + ebx*2 - 0x757a0b0a]
lea edi, [edi + edi*2 - 0x1ceaf757]
not di
mov edi, dword [esp + edi + 0x5bc09d22]
call fcn.10249475
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1003da6b
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov dword [esp + edx*4], ebp
ret
lea esi, [esi + edx - 0x53b0c4d1]
mov ecx, dword [esp + edx - 0x53b0c4c8]
shr cx, 0x46
movzx ecx, byte [esi + edx - 0x53b0c4d0]
mov dword [esp + edx - 0x53b0c4c8], edx
pop edx
sal byte [esp + 7], 0xa6
xor cl, bl
mov edx, 0x321c7f0b
sal edx, 0x95
adc cl, 0xa0
bt edx, edx
jae 0x1009683d
movaps xmm0, xmmword [ebp - 0xb40]
call fcn.10270d95
inc byte [esp + 7]
rol cl, 1
or dx, dx
adc cl, 0xb7
dec dl
neg cl
bts edx, 0x2a
not edx
sal byte [esp + edx*2 - 0x3d3ff5ff], 0xa4
inc cl
dec word [esp + edx - 0x1e9ffb00]
xor bl, cl
pop edx
sal edx, 0x90
lea ecx, [esp + ecx + 4]
rol dword [esp + edx - 0x40cf0000], 0x2b
mov word [ecx + edx - 0x40cf0000], ax
mov ecx, dword [esp + edx - 0x40cf0000]
sal edx, 0xb8
jp 0x100281e7
call dword [ebp - 0x74]
jmp fcn.1000c722

Function at 0x1003e390
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x558
push esi
push edi
push 0x100e8a8e
mov edi, ecx
jmp loc.102576c7
Function at 0x10041bf0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x1025f312
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
cmp dword [0x1012ea90], 6
push esi
mov esi, ecx
jl 0x10041d70
movaps xmm0, xmmword [0x100ed7b0]
movaps xmm2, xmmword [0x100ed050]
movups xmm3, xmmword [0x100ed030]
movaps xmmword [ebp - 0x10], xmm0
mov edx, dword [ebp - 0x10]
nop word [eax + eax]
movd xmm0, eax
lea ecx, [eax + 4]
pshufd xmm1, xmm0, 0
paddd xmm1, xmm2
movd xmm0, edx
pshufb xmm1, xmm3
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm0, ymm1, ymm0
vpmovzxwd zmm0, ymm0
vpmovdb xmm1, zmm0
movd xmm0, dword [eax + 0x10129a98]
xorps xmm1, xmm0
movd xmm0, ecx
movd dword [eax + 0x10129a98], xmm1
lea ecx, [eax + 8]
pshufd xmm1, xmm0, 0
paddd xmm1, xmm2
movd xmm0, edx
pshufb xmm1, xmm3
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm0, ymm1, ymm0
vpmovzxwd zmm0, ymm0
vpmovdb xmm1, zmm0
movd xmm0, dword [eax + 0x10129a9c]
xorps xmm1, xmm0
movd xmm0, ecx
movd dword [eax + 0x10129a9c], xmm1
lea ecx, [eax + 0xc]
pshufd xmm1, xmm0, 0
paddd xmm1, xmm2
movd xmm0, edx
pshufb xmm1, xmm3
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm0, ymm1, ymm0
vpmovzxwd zmm0, ymm0
vpmovdb xmm1, zmm0
movd xmm0, dword [eax + 0x10129aa0]
xorps xmm1, xmm0
movd xmm0, ecx
movd dword [eax + 0x10129aa0], xmm1
pshufd xmm1, xmm0, 0
paddd xmm1, xmm2
movd xmm0, edx
pshufb xmm1, xmm3
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm0, ymm1, ymm0
vpmovzxwd zmm0, ymm0
vpmovdb xmm1, zmm0
movd xmm0, dword [eax + 0x10129aa4]
xorps xmm1, xmm0
movd dword [eax + 0x10129aa4], xmm1
add eax, 0x10
cmp eax, 0x3de0
jb 0x10041c40
cmp eax, 0x3de9
jae 0x10041d87
nop word [eax + eax]
movzx ecx, al
imul ecx, ecx, 0x8b
xor byte [eax + 0x10129a98], cl
inc eax
cmp eax, 0x3de9
jb 0x10041d70
push 0x100e8a8e
jmp 0x10016418

Function at 0x10041db0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x5b8
push esi
push edi
push 0x100e8a8e
mov edi, ecx
jmp loc.10245542
Function at 0x10042b2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ecx
rol dl, 0xc1
mov dword [esp + edx - 0x6ad2496f], edx
sal byte [esp + eax - 0x6ad249b6], 1
not ecx
lea edx, [edx*8 + 0x5206be89]
inc ecx
bswap ecx
xor ebx, ecx
add edx, edx
lea edi, [edi + edx - 0x51321406]
ror ax, 0x8e
mov dword [edi + eax - 0x6ad226dd], ecx
bts eax, 0xa5
lea esi, [esi + edx - 0x51321406]
mov ecx, edx
jb 0x10240a7a
setb cl
mov ecx, dword [eax + esi - 0x6ad226fd]
jae 0x1026617f
add cl, 0x10
call fcn.10235482
lea esi, [eax + esi - 0x14]
xchg ecx, eax
xor cx, cx
xor edx, ebx
rol al, 0xa6
push eax
inc edx
xor ax, 0xddbc
bswap edx
btc ecx, ecx
bt ecx, eax
xor eax, ecx
rol edx, cl
shl cl, cl
adc word [esp + eax - 0xddfb], 0xaa22
shr dword [esp + eax - 0xddfd], cl
bswap edx
not edx
sar ecx, cl
rol edx, 3
xor ebx, edx
not eax
add ebp, edx
pop ecx
push eax
sal dword [esp + ecx - 0x2a888010], 0x6c
mov dword [esp + ecx - 0x2a888010], ebp
ret
rol ax, 0xee
call fcn.102a2a5e
Function at 0x100463e0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
lea esp, [esp + 4]
jmp loc.1028437e
push ebp
mov ebp, esp
sub esp, 0x268
push esi
push edi
push 0x100e8a8e
mov esi, ecx
jmp 0x1000dc1e

Function at 0x100477a0
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100de6f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1684
call fcn.100b2020
mov dword [ebp - 0x18], ecx
push 0x100e8a8e
jmp 0x1006b845
lea esp, [esp + 4]
push 0xfa0
nop
push 0
movzx eax, cx
add eax, 0xa79511a5
rol al, cl
mov eax, dword [ebp - 0x18]
test dx, si
clc
add eax, 0x60
jmp loc.10289e7c