joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006ae00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [edi + 0x6efe8d], 0
jne 0x1006af31
cmp byte [edi + 0x6efe8e], 0
jne 0x1006af67
cmp bl, 8
jne 0x1006ae58
lea ecx, [edi + 0x6efe7c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006ae38
sub ecx, edx
test ecx, ecx
jle 0x1006af67
mov byte [ecx + edi + 0x6efe7b], al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp bl, 0xd
jne 0x1006af67
lea ebx, [edi + 0x6efe7c]
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006ae70
sub ecx, edx
cmp ecx, 3
jb 0x1006af67
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006ae87
sub ecx, edx
push ecx
push ebx
call fcn.100535b0
test al, al
je 0x1006af67
mov dword [edi + 0x6efea4], 0
mov byte [edi + 0x6efe8e], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x6efea0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1f4
mov dword [edi + 0x6efe98], eax
lea eax, [ebp - 0x208]
push 0
push eax
mov dword [edi + 0x6efe68], 1
mov dword [edi + 0x6efeb0], 0
call fcn.100b3430
add esp, 0xc
lea eax, [ebp - 0x208]
lea ecx, [ebp - 0x10]
push 2
push eax
call fcn.1004cef0
push 0
lea ecx, [ebp - 0x10]
call fcn.1004d090
push ebx
lea ecx, [ebp - 0x10]
call fcn.1004d110
lea ecx, [ebp - 0x10]
call fcn.1004d1e0
push dword [ebp - 8]
push dword [ebp - 0x10]
call fcn.10052a50
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [edi + 0x6ef884]
call fcn.1005e120
push ecx
push ebx
test al, al
je 0x1006af4f
call fcn.1005e500
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [edi + 0x940]
call fcn.1005d6c0
push ecx
push ebx
lea ecx, [edi + 0x3c4cc0]
call fcn.1005a840
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1006b650
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f54
call fcn.100b2020
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
push 0x640
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
push ecx
call fcn.100b3430
add esp, 0xc
push 0x186a0
push 0
mov edx, dword [ebp - 0x10]
add edx, 0x658
push edx
call fcn.100b3430
add esp, 0xc
push 0x186a0
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x18cf8
push eax
call fcn.100b3430
add esp, 0xc
push 0x190
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x31398
push ecx
call fcn.100b3430
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x23e
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0x6d
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3153c], 0x1a7
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x31540], 0x23d
mov ecx, dword [0x1012f57c]
mov edx, dword [ecx + 0x528]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x10]
add eax, 0xc
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x230]
mov byte [ebp - 0x5c], 0x41
mov byte [ebp - 0x5b], 0x72
mov byte [ebp - 0x5a], 0x69
mov byte [ebp - 0x59], 0x61
mov byte [ebp - 0x58], 0x6c
mov byte [ebp - 0x57], 0
mov edx, dword [0x1012f57c]
mov eax, dword [edx + 0x52c]
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 5
push 0
push 1
push 0
push 1
push 0x64
push 0
push 0xffffffffffffffe8
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x234]
push 0x100e8a8e
jmp loc.10279e08

Function at 0x1006cb70
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov dword [ebp - 0x50], ecx
push 0x100e8a8e
jmp loc.1024d9ea
Function at 0x1006d240
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
push ebx
push esi
mov esi, dword [0x101344d4]
push edi
push 0x100e8a8e
jmp loc.1027155b

Function at 0x1006e8d0
Capabilities:
Hash data using fnv

Disassembly:
mov edx, ecx
jmp 0x1006e8e0
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
ret

Function at 0x1006e920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x1006e94b
mov edx, dword [ebp + 8]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1006e934
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret

Function at 0x1006f660
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
cmp cl, 0xb
nop
clc
stc
cmp dword [ebp + 8], 0
je 0x10245b94
call fcn.1006ea90
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
jmp 0x1003d742
mov eax, dword [edx + 4]
cdq
bswap ecx
mov dword [ebp - 0xc], eax
movsx ecx, bx
xchg cx, cx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
movzx eax, bp
jmp loc.1028d391
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp 0x10028c38
Function at 0x1006fc80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov dword [ebp - 0xac], ecx
push 0x100e8a8e
jmp loc.102ac3c3
Function at 0x10070f60
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov dword [ebp - 0x78], ecx
push 0x100e8a8e
jmp loc.10240cbc

Function at 0x100711f0
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x70
rdtsc
xchg dx, cx
mov byte [ebp - 0xe], 0x65
xchg al, al
mov byte [ebp - 0xd], 0x6e
movsx edx, si
mov ah, 0xc
lahf
mov byte [ebp - 0xc], 0
movsx edx, sp
cwd
mov byte [ebp - 0x30], 0x68
cdq
mov ax, 0xa20c
mov byte [ebp - 0x2f], 0x74
mov byte [ebp - 0x2e], 0x74
cbw
xchg al, dh
bswap ax
mov byte [ebp - 0x2d], 0x70
mov byte [ebp - 0x2c], 0x73
not edx
mov byte [ebp - 0x2b], 0x3a
mov byte [ebp - 0x2a], 0x2f
mov dx, si
seto ch
mov byte [ebp - 0x29], 0x2f
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0x66
movsx eax, sp
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x62
bswap ecx
cwd
mov byte [ebp - 0x24], 0x75
not dl
cwde
movzx ecx, sp
mov byte [ebp - 0x23], 0x6c
mov dx, ax
jmp fcn.1024d579
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp 0x10033df7

Function at 0x100712d0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push 0x100e8a8e
jmp 0x1007efe6
lea esp, [esp + 4]
btc ax, 0x98
xor al, 0x9e
mov eax, dword [0x1012f5f8]
sub dh, 6
mov dx, si
mov ecx, dword [eax + 0xda747c]
xor eax, 0x7b88b99d
bts dx, bx
mov edx, dword [ecx]
movzx ax, ch
mov dword [ebp - 0xc], edx
adc ax, bp
xchg al, ah
mov eax, dword [0x1012f5f8]
cmc
add eax, 0x6c7ff0
mov dword [ebp - 0x10], eax
test ebp, ebx
cmp bh, 0x21
mov dword [ebp - 8], str.Error
jmp loc.1023cc3d

Function at 0x10071350
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x34], ecx
push 0x100e8a8e
jmp 0x1008ece4
lea esp, [esp + 4]
mov cx, ax
setge ah
lahf
mov eax, dword [0x1012f57c]
mov ecx, dword [eax + 0x570]
cwd
jmp loc.1029d43d

Function at 0x100715b0
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100deb77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x2c0
mov dword [ebp - 0x1a4], ecx
push 0x100e8a8e
jmp loc.1024c5e1

Function at 0x10072a80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x94], ecx
push 0x100e8a8e
jmp loc.102a9af6
Function at 0x10072fd5
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov ecx, dword [ebp - 0x928]
mov dword [ebp - 0xb84], ecx
cmp dword [ebp - 0xb84], 0
jmp 0x1004a6f3
sbb ecx, ecx
sal dx, 0xa0
cmc
or ecx, 1
sar dl, cl
mov dword [ebp - 0x92c], ecx
rcl dh, cl
rcr dx, 0x1e
or dh, 8
mov edx, dword [ebp - 0x92c]
test ebp, 0x4dbb949f
mov dword [ebp - 0xb88], edx
test edi, 0x9aa89116
stc
cmp dword [ebp - 0xb88], 0
jne 0x10047b00
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x54]
movsx edx, si
not dl
mov dh, al
mov dword [eax + 0x160], ecx
mov dl, al
mov edx, 0x6e0b1187
mov edx, dword [ebp - 0x10]
bswap ecx
mov eax, dword [ebp - 0x50]
cmovle ecx, ecx
xchg ch, ch
mov dword [edx + 0x168], eax
mov ecx, dword [ebp - 0x10]
cbw
cwde
mov edx, dword [ebp - 0x64]
cwde
mov dword [ecx + 0x164], edx
movzx eax, dx
mov ecx, edi
lahf
mov eax, dword [ebp - 0x10]
mov ch, cl
not cx
jmp 0x10093c15
mov dword [ebp - 0x47c], str.WaterExplosion
cmovl cx, bp
mov ecx, 0x9737c49e
mov ecx, dword [ebp - 0x28]
call fcn.1008a110
mov dword [ebp - 0x478], eax
cdq
mov edx, dword [ebp - 0x478]
shr ecx, cl
mov al, byte [edx]
shld ecx, edi, 0xb9
mov byte [ebp - 0x107], al
cmovp ecx, ebx
ror cx, 0xa4
mov ecx, dword [ebp - 0x47c]
cmp al, byte [ecx]
jne 0x1008d53c
cmp byte [ebp - 0x107], 0
jmp loc.1024edcb
jne 0x10259ec8
mov edx, dword [ebp - 0x10]
lahf
movzx ecx, ax
xchg ch, cl
mov eax, dword [ebp - 0x54]
bswap cx
movzx cx, dh
mov dword [edx + 0x150], eax
movsx ax, bh
seta ah
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x50]
jmp loc.1023d8f1
mov dword [esp + 4], 0x4e8552a0
lea esp, [esp + 4]
call fcn.10268cd3
jmp 0x1000d8fb
sbb edx, edx
bt ax, bp
or edx, 1
mov dword [ebp - 0x930], edx
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0xb8c], eax
cmp esi, ecx
cmp eax, 0x9e91fabe
cmp dword [ebp - 0xb8c], 0
jne 0x10298bb7
mov ecx, dword [ebp - 0x10]
not eax
movsx dx, dh
mov edx, edi
mov edx, dword [ebp - 0x54]
movsx ax, dl
xchg al, al
mov dword [ecx + 0x170], edx
movzx eax, bx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x50]
jmp loc.1028a686
mov ecx, dword [ebp - 0x60]
jmp loc.10282365
mov ecx, dword [ebp - 0x28]
jmp loc.10078c40
jmp 0x1003a33d
mov dword [ebp - 0x474], str.BouncyBomb
xchg ch, ch
mov cl, 0xbf
mov ecx, dword [ebp - 0x28]
jmp 0x1026ba86
call fcn.1008a110
mov dword [ebp - 0x470], eax
test edi, 0x88a98fa8
mov ecx, dword [ebp - 0x470]
mov dl, byte [ecx]
bsr ax, dx
shld ax, bp, 0x30
rcr al, 0xab
mov byte [ebp - 0x19b], dl
mov eax, dword [ebp - 0x474]
cmp dl, byte [eax]
jne 0x1003a322
cmp byte [ebp - 0x19b], 0
jmp 0x1028f6ea
jne 0x1003a322
add dword [ebp - 0x470], 2
test bl, 0xab
clc
add dword [ebp - 0x474], 2
jmp loc.10027056
mov dword [ebp - 0x92c], 0
jmp 0x10240df1
je 0x1027d048
mov ecx, dword [ebp - 0x470]
cmp edi, 0xd7347a8f
mov dl, byte [ecx + 1]
mov byte [ebp - 0x106], dl
bsf ax, dx
xadd ax, ax
mov eax, dword [ebp - 0x474]
cmc
cmp bh, al
stc
cmp dl, byte [eax + 1]
jmp 0x10273367
mov dword [ebp - 0x484], str.BeepBeepDetonator
xchg ch, ch
jmp 0x1022f474
Function at 0x10073000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp loc.1025cb51

Function at 0x10073bd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
sbb al, 0x3e
push 0x20
mov eax, dword [0x1012f5f8]
cmc
cmp cx, di
add eax, 0x530f2a
jmp loc.1029b5f0
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp 0x100141fc

Function at 0x1007bf60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esp, [esp + 4]
btc eax, ebp
adc eax, 0xb1b8d20e
cmp sp, 0x78b1
push 0x23
adc ax, 0xcc17
or al, 0xaa
sal al, 0x9c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x90909090
test edx, ecx
test bp, 0x2186
push eax
add eax, 0xf7a16811
shl eax, cl
mov eax, dword [0x1012f5f8]
jmp loc.102712c6
push ebp
mov ebp, esp
sub esp, 0x868
push 0x100e8a8e
jmp 0x10018cf9

Function at 0x1007cb30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esp, [esp + 4]
mov eax, dword [0x1012f5f8]
test cx, bp
cmp ax, bx
stc
push 5
test dx, di
jmp loc.102a3a4d
push ebp
mov ebp, esp
sub esp, 0x99c
push 0x100e8a8e
jmp 0x10014277

Function at 0x1007e890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 8], ecx
push 0x100e8a8e
jmp loc.1027620a

Function at 0x100802d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xd90
mov dword [ebp - 0x554], ecx
push 0x100e8a8e
jmp loc.1023adeb
Function at 0x10082570
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
call fcn.100394d0
test eax, eax
je 0x10082713
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x10082713
mov edx, dword [0x1015d5b8]
test edx, edx
jne 0x100825c6
movsd xmm0, qword [0x100ece88]
mov dword [eax + 0x88], 0x1e
mov dword [ecx + 0x664], 0x1e
mov dword [0x1012da84], 0x3cfdf3b6
jmp 0x1008270b
cmp edx, 1
jne 0x100825f6
movsd xmm0, qword [0x100ece70]
mov dword [eax + 0x88], 0x10
mov dword [ecx + 0x664], 0x10
mov dword [0x1012da84], 0x3c888889
jmp 0x1008270b
cmp edx, 2
jne 0x10082626
movsd xmm0, qword [str.OeN]
mov dword [eax + 0x88], 0xd
mov dword [ecx + 0x664], 0xd
mov dword [0x1012da84], 0x3c5a740e
jmp 0x1008270b
cmp edx, 3
jne 0x10082656
movsd xmm0, qword [0x100ece50]
mov dword [eax + 0x88], 0xa
mov dword [ecx + 0x664], 0xa
mov dword [0x1012da84], 0x3c23d70a
jmp 0x1008270b
cmp edx, 4
jne 0x10082686
movsd xmm0, qword [0x100ece40]
mov dword [eax + 0x88], 8
mov dword [ecx + 0x664], 8
mov dword [0x1012da84], 0x3c088889
jmp 0x1008270b
cmp edx, 5
jne 0x100826b3
movsd xmm0, qword [0x100ece30]
mov dword [eax + 0x88], 6
mov dword [ecx + 0x664], 6
mov dword [0x1012da84], 0x3be38e39
jmp 0x1008270b
cmp edx, 6
jne 0x100826e0
movsd xmm0, qword [0x100ece28]
mov dword [eax + 0x88], 4
mov dword [ecx + 0x664], 4
mov dword [0x1012da84], 0x3b888889
jmp 0x1008270b
cmp edx, 7
jne 0x10082713
movsd xmm0, qword [0x100ece10]
mov dword [eax + 0x88], 1
mov dword [ecx + 0x664], 1
mov dword [0x1012da84], 0x3a83126f
movsd qword [0x1012dac0], xmm0
xorps xmm0, xmm0
push 0x1021d850
movlpd qword [0x1021d850], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [0x1021d850]
sub ecx, dword [0x1021d848]
mov edx, dword [0x1021d854]
sbb edx, dword [0x1021d84c]
call fcn.100dad60
mov edx, dword [0x1021d844]
mov ecx, dword [0x1021d840]
movsd qword [esp], xmm0
call fcn.100dad60
cmp byte [0x1013d57d], 0
movsd xmm1, qword [esp]
divsd xmm1, xmm0
movsd xmm4, qword [0x1015d600]
movsd xmm2, qword [0x1015d608]
movaps xmm0, xmm1
je 0x1008278c
movaps xmm0, xmm4
subsd xmm0, xmm2
addsd xmm0, xmm1
movsd xmm3, qword [0x1012dac0]
comisd xmm0, xmm3
jb 0x100827f6
movaps xmm0, xmm1
movsd qword [0x1015d618], xmm1
mulsd xmm0, qword [0x100ecf10]
addsd xmm1, xmm4
mov byte [0x1013d57c], 1
addsd xmm2, xmm3
push 0x1021d848
movsd qword [0x1015d610], xmm0
xorps xmm0, xmm0
movsd qword [0x1015d600], xmm1
movsd qword [0x1015d608], xmm2
movlpd qword [0x1021d848], xmm0
movlpd qword [0x1021d850], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esp, ebp
pop ebp
ret
mov byte [0x1013d57c], 0
mov esp, ebp
pop ebp
ret

Function at 0x10086d60
Capabilities:
Encode data using base64
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x8f0
mov dword [ebp - 0x3d4], ecx
push 0x100e8a8e
jmp loc.10280ec6
Function at 0x10089040
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
lea esp, [esp + 4]
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
jmp loc.102a3d1f
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x6f0
push esi
mov esi, dword [0x101483a0]
push edi
push 0x100e8a8e
mov dword [ebp - 0x30], esi
jmp 0x1002cb07

Function at 0x10089fe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dec80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x100ecd48
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1008b3b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dede4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov edx, ecx
push 0
mov dword [ebp - 0x10], edx
call fcn.10089fe0
mov dword [ebp - 4], 0
mov al, byte [ebp + 8]
mov byte [edx + 0x35], al
mov eax, dword [ebp + 0xc]
mov dword [edx], 0x100ecbf0
mov byte [edx + 0x34], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov dword [edx + 0x48], 0
mov byte [ebp - 4], 1
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
mov dword [edx + 0x54], 0
mov byte [ebp - 4], 2
lea ecx, [edx + 0x64]
mov dword [edx + 0x58], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x60], 0
mov dword [ebp + 8], ecx
mov dword [ecx], 0x100ecbd8
mov byte [ebp - 4], 3
lea eax, [ecx + 8]
mov dword [ecx], 0x100ecbc0
mov dword [ecx + 4], eax
mov dword [ecx + 0x30], 0xa
mov dword [ecx + 0x34], 0
mov byte [ebp - 4], 4
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov byte [ebp - 4], 5
lea ecx, [edx + 0xb0]
mov dword [ebp + 0xc], ecx
mov dword [ecx], 0x100ecbd8
mov byte [ebp - 4], 6
lea eax, [ecx + 8]
mov dword [ecx], 0x100ecba8
mov dword [ecx + 4], eax
mov dword [ecx + 0x30], 0xa
mov dword [ecx + 0x34], 0
mov byte [ebp - 4], 7
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov byte [ebp - 4], 8
lea ecx, [edx + 0xfc]
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0x100ecbd8
mov byte [ebp - 4], 9
lea eax, [ecx + 8]
mov dword [ecx], 0x100ecb90
mov dword [ecx + 4], eax
mov dword [ecx + 0x30], 0xa
mov dword [ecx + 0x34], 0
mov byte [ebp - 4], 0xa
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov byte [ebp - 4], 0xb
lea ecx, [edx + 0x148]
mov dword [ebp - 0x18], ecx
mov dword [ecx], 0x100ecbd8
mov byte [ebp - 4], 0xc
lea eax, [ecx + 8]
mov dword [ecx], 0x100ecb78
mov dword [ecx + 4], eax
mov dword [ecx + 0x30], 0xa
mov dword [ecx + 0x34], 0
mov byte [ebp - 4], 0xd
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov byte [ebp - 4], 0xe
mov dword [edx + 4], edx
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x1008b830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
call fcn.1008b690
mov edi, dword [ebp + 8]
push 0
push 0
push edi
call fcn.100c1cf4
push edi
call fcn.100bb840
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1008b87c
push edi
call fcn.100bbac0
add esp, 4
test eax, eax
je 0x1008b87c
push 0
push 0
push 0
push 5
mov ecx, esi
call fcn.1008ba00
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebp
ret 4
push ebx
push 2
push 0
push edi
call fcn.100c1cf4
push edi
call fcn.100c3082
push 0
push 0
push edi
mov ebx, eax
call fcn.100c1cf4
add esp, 0x1c
cmp ebx, 0xffffffff
jne 0x1008b8ba
push 0
push 0
push 0
push 5
mov ecx, esi
call fcn.1008ba00
mov eax, dword [esi + 0x38]
pop ebx
pop edi
pop esi
pop ebp
ret 4
cmp ebx, 0xffffffff
jae 0x1008b8a1
test ebx, ebx
jne 0x1008b8d9
push ebx
push ebx
push ebx
push 0xf
mov ecx, esi
call fcn.1008ba00
mov eax, dword [esi + 0x38]
pop ebx
pop edi
pop esi
pop ebp
ret 4
lea eax, [ebx + 1]
push eax
call fcn.100b0f06
push edi
push ebx
push 1
push eax
mov dword [esi + 0x5c], eax
call fcn.100bc327
add esp, 0x14
mov ecx, esi
cmp eax, ebx
je 0x1008b90f
push 0
push 0
push 0
push 5
call fcn.1008ba00
mov eax, dword [esi + 0x38]
pop ebx
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x5c]
mov byte [ebx + eax], 0
call fcn.1008ba50
mov eax, dword [esi + 0x38]
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x1008d250
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 4]
movsx ax, dh
movsx eax, bp
mov byte [ebp - 0x86c], 0x6b
bswap ax
movsx eax, dx
mov byte [ebp - 0x86b], 0x65
bswap eax
jmp loc.102aa304
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2830
call fcn.100b2020
mov dword [ebp - 4], ecx
push 0x100e8a8e
jmp 0x1004f026

Function at 0x10091d0b
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
push ecx
xchg cl, ch
mov ecx, dword [ebp - 4]
jmp loc.1022ee8c
lea ebx, [ebx + ebx*4 + 0x2486130b]
sub ebx, 0x3502e000
mov ebx, dword [esp + ebx + 0x2c9fcd8f]
mov dword [esp + 8], 0xa4e950a0
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10268cd3
mov cl, ah
push eax
mov ecx, dword [ebp - 8]
jmp 0x10047d8a

Function at 0x1009740c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x20]
call fcn.10268cd3

Function at 0x10099b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 0x100e8a8e
mov ebx, ecx
jmp loc.1026a1ad

Function at 0x100b09b2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.100c5b29
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100b09f5
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100b09f5
sub eax, 1
je 0x100b09f0
sub eax, 1
je 0x100b09ec
xor eax, eax
leave
ret
push 3
jmp 0x100b09f7
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x100bb6b0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100bb6ef
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100bb6ef
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100bb6ef
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100bb6ef
cmp dword [ecx + 0x74], 0xe
jbe 0x100bb6ef
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret