joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4143d0
Capabilities:
Get disk size

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x18]
sub esp, 0x28
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test byte [0x425020], 8
jne 0x414485
mov eax, dword [0x42f078]
or eax, dword [0x4386f0]
jne 0x414479
mov eax, dword [0x42f080]
test eax, eax
je 0x4144d0
mov edx, dword [0x42f0a4]
mov eax, dword [0x42f0a0]
call dbg.WCMD_filesize64
mov dword [esp], str._n_____Total_files_listed:_n_1_8d__files_2_25s__bytes_n
mov dword [esp + 8], eax
mov eax, dword [0x42f0b0]
mov dword [esp + 4], eax
call dbg.WCMD_output
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call dbg.WCMD_filesize64
mov dword [esp], str._1_8d__directories__2_18s__bytes_free_n_n
mov dword [esp + 8], eax
mov eax, dword [0x42f0ac]
mov dword [esp + 4], eax
call dbg.WCMD_output
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov esi, eax
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.3
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Writing_trailer_for__s_gave__d__ld__n
mov dword [esp + 8], global___func__.6
mov dword [esp + 4], 0x425020
mov dword [esp], 3
call sym._wine_dbg_log.constprop.4
jmp 0x414412
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call dbg.WCMD_filesize64
mov dword [esp], str.__1_18s__bytes_free_n_n
mov dword [esp + 4], eax
call dbg.WCMD_output
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
Function at 0x4191f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x419208
leave
ret
test byte [0x425038], 2
jne 0x41921e
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Out_of_memory_n
mov dword [esp + 8], global___func__.0
mov dword [esp + 4], 0x425038
mov dword [esp], 1
call sym._wine_dbg_log.constprop.11
jmp 0x419211

Function at 0x419250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov dword [ebp - 0x14], 0
test edx, edx
jne 0x419270
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x14]
mov ebx, ecx
mov dword [ebp - 0x18], edx
mov esi, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
jne 0x419264
mov eax, dword [0x43037c]
mov dword [ebp - 0x10], 0
test eax, eax
jne 0x419331
mov edx, dword [0x430360]
test edx, edx
je 0x419360
mov dword [ebp - 0x1c], edx
call dword [sym.imp.kernel32.dll_GetConsoleOutputCP]
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], 0x42999c
mov dword [esp + 0x14], 0xffff
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x1c]
sub esp, 0x20
mov dword [esp + 0xc], edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
add edx, edx
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
jmp 0x419264
mov dword [esp], 0xffff
call dbg.xalloc
mov edx, eax
mov dword [0x430360], eax
test eax, eax
je 0x419264
jmp 0x4192c0
Function at 0x4196d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_ReadConsoleW]
sub esp, 0x14
test eax, eax
jne 0x419748
mov ebx, dword [0x430360]
mov edi, eax
test ebx, ebx
je 0x4197a0
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x419752
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x10]
mov edi, 1
call dword [sym.imp.kernel32.dll_GetConsoleCP]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 0x14]
sub esp, 0x18
mov dword [edx], eax
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xffff
call dbg.xalloc
mov ebx, eax
mov dword [0x430360], eax
test eax, eax
jne 0x41971e
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x423d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x423dd8
cmp byte [ebx + esi - 1], 0xa
je 0x423dac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x430424], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x4243f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x4245b4
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x430424]
cmp dword [edx + 0x24], edi
je 0x4244d7
test byte [0x425050], 8
jne 0x424560
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x425060], 8
jne 0x424523
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x424479
cmp esi, 3
jbe 0x4244e2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x42448a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x42a7a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x424479
mov dword [esp], 0x425060
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x424450
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x424450
mov dword [esp], 0x425050
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x42443b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x424443
mov eax, 0xffffffff
jmp 0x4244d7

Function at 0x424630
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x418f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420de0], ecx
add edx, 1
cmp edx, 0x100
jb 0x418f42
cmp edx, 0x800
jae 0x41902b
mov edi, edi
mov eax, dword [edx*4 + 0x4209e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420de0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x420ddc], eax
jb 0x419000
mov dword [0x420dbc], 0x4196e0
call fcn.00419170
test eax, eax
jne 0x419048
mov dword [0x420dbc], 0x419600
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x10001032
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x10001230
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.PangyaUS.ini
call esi
cmp eax, 0xffffffff
jne 0x10001267
push str.PangyaJP.ini
call esi
cmp eax, 0xffffffff
je 0x10001256
mov eax, 1
pop esi
ret
push str.PangyaTH.ini
call esi
inc eax
neg eax
pop esi
sbb eax, eax
and eax, 2
ret
xor eax, eax
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x930134
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x93013a
pop ebp
sub ebp, 6
sub ebp, 0x530134
jmp 0x930198
add byte [0x25000f00], cl
add byte [ebx], al
add byte [edi + 0x67], cl
adc byte [eax + edi*2], bh
invalid
invalid
jmp 0x9301a1
mov eax, 0x530134
add eax, ebp
add eax, 0x93
mov ecx, 0x61b
mov edx, 0xdcf0b388
xor byte [eax], dl
inc eax
dec ecx
jne 0x9301b8
jmp 0x9301cb
loop 0x930195
loopne 0x930157
cwde
mov byte [eax - 0x5bbb7720], cl
mov byte [ebx + 0x1d77d848], bh
invalid
Function at 0x100023f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
push 0x208
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.1000d390
add esp, 0xc
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
je 0x100024d6
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
lea edi, [ebp - 0x224]
xor al, al
mov ecx, 0x208
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x2c]
shr ecx, 1
add ecx, 1
cmp ecx, 0x103
jbe 0x1000246e
mov dword [ebp - 0x10], 0x103
jmp 0x1000247d
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x2c]
shr eax, 1
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov ecx, eax
call fcn.10002e10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x1c], 0xf5706c6b
jne 0x100024c9
cmp dword [ebp - 0x18], 0xfca1
jne 0x100024c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
jmp 0x100024d8
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x10002430
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100024e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10002507
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10002507
xor eax, eax
jmp 0x10002637
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0x4550
je 0x10002525
xor eax, eax
jmp 0x10002637
mov eax, dword [ebp - 0x18]
add eax, 0x18
mov dword [ebp - 0x20], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx + 0x60]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], 0
mov dword [ebp - 8], 0
jmp 0x1000258d
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, 2
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x18]
jae 0x100025ce
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10002f10
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp + 0xc]
jne 0x100025cc
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp + 0x10]
jne 0x100025cc
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x100025ce
jmp 0x10002572
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jne 0x100025dd
xor eax, eax
jmp 0x10002637
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, dword [ecx + eax + 0x64]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.100023c0
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x10002634
cmp dword [ebp + 0x14], 0
je 0x10002634
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x10002e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x10002e31
or eax, 0xffffffff
or edx, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edi]
xor dl, dl
movzx esi, word [edi]
mov cl, 0x53
mov byte [esp + 0x17], al
mov al, 0x34
mov byte [esp + 0x24], 0x8b
mov bl, 0xd4
test si, si
je 0x10002ed5
mov ecx, 0xd4348b53
mov dword [esp + 0x1c], 0x34afea2b
mov eax, esi
mov ebp, ecx
mov edx, 0x34afea2b
mov dword [esp + 0x18], eax
nop word [eax + eax]
xor esi, esi
movzx eax, ax
and ecx, 0x1ffffff
lea edi, [edi + 2]
shld esi, ecx, 7
shrd ebp, edx, 0x19
shl ecx, 7
shr edx, 0x19
or ecx, ebp
or esi, edx
cdq
xor ecx, eax
xor edx, esi
mov ebx, ecx
mov eax, edx
shrd ebx, eax, 0x18
mov eax, edx
mov esi, ecx
shrd esi, eax, 0x10
mov eax, edx
mov ebp, ecx
mov dword [esp + 0x28], esi
mov esi, ecx
shrd esi, eax, 8
mov eax, dword [esp + 0x18]
mov byte [esp + 0x16], al
movzx eax, word [edi]
mov dword [esp + 0x24], esi
mov esi, eax
mov dword [esp + 0x18], esi
test ax, ax
jne 0x10002e70
mov eax, dword [esp + 0x28]
mov dl, byte [esp + 0x16]
mov dh, byte [esp + 0x17]
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov byte [esp + 0x2a], cl
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x28], dh
mov byte [esp + 0x29], dl
mov byte [esp + 0x2c], al
mov byte [esp + 0x2b], cl
mov eax, dword [esp + 0x28]
mov byte [esp + 0x2d], bl
mov edx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x10002f2f
or eax, 0xffffffff
or edx, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [edi]
xor bh, bh
mov byte [esp + 0xf], bl
mov cl, 0x53
mov byte [esp + 0x10], 0x8b
mov al, 0xd4
mov byte [esp + 0x14], 0x34
test bl, bl
je 0x10002fbb
mov ecx, 0xd4348b53
mov dword [esp + 0x24], 0x34afea2b
mov eax, ecx
mov edx, 0x34afea2b
nop dword [eax]
xor esi, esi
lea edi, [edi + 1]
shrd eax, edx, 0x19
and ecx, 0x1ffffff
mov bh, bl
shld esi, ecx, 7
shr edx, 0x19
or esi, edx
shl ecx, 7
or ecx, eax
movsx eax, bl
mov bl, byte [edi]
cdq
xor ecx, eax
xor edx, esi
mov eax, edx
mov esi, ecx
shrd esi, eax, 0x18
mov eax, edx
mov dword [esp + 0x18], esi
mov esi, ecx
shrd esi, eax, 0x10
mov eax, edx
mov dword [esp + 0x14], esi
mov esi, ecx
shrd esi, eax, 8
mov eax, ecx
mov dword [esp + 0x10], esi
test bl, bl
jne 0x10002f60
mov bl, byte [esp + 0xf]
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov byte [esp + 0x1a], cl
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x1b], cl
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bh
mov byte [esp + 0x19], al
mov eax, dword [esp + 0x14]
mov byte [esp + 0x18], cl
mov edx, dword [esp + 0x18]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov edx, 0x2c
push edi
push 0x56a4
push 0x71b576c
lea ecx, [edx - 0x2b]
call fcn.100027f0
mov ebp, dword [esp + 0x34]
add esp, 8
push ebp
call eax
xor ecx, ecx
mov edx, 2
lea esi, [eax + 0x32]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000b130
add esp, 4
lea ecx, [esi + esi]
mov ebx, eax
mov edx, 0x83
xor al, al
mov edi, ebx
rep stosb byte es:[edi], al
push 0x5741
push 0x4c9b576c
mov ecx, 1
call fcn.100027f0
add esp, 8
push ebp
push ebx
call eax
mov byte [esp + 0x11], 0x28
mov byte [esp + 0x12], 0x31
mov byte [esp + 0x13], 0x4a
mov byte [esp + 0x14], 0x31
mov byte [esp + 0x15], 0x3d
mov byte [esp + 0x16], 0x31
mov byte [esp + 0x17], 0x58
mov byte [esp + 0x18], 0x31
mov byte [esp + 0x19], 0x3c
mov byte [esp + 0x1a], 0x31
mov byte [esp + 0x1b], 0x4b
mov byte [esp + 0x1c], 0x31
mov byte [esp + 0x1d], 0x5a
mov byte [esp + 0x1e], 0x31
mov byte [esp + 0x1f], 0x3e
mov byte [esp + 0x20], 0x31
mov byte [esp + 0x21], 0x67
mov byte [esp + 0x22], 0x31
mov byte [esp + 0x23], 0x4c
mov byte [esp + 0x24], 0x31
mov byte [esp + 0x25], 0x31
mov byte [esp + 0x26], 0x31
mov al, byte [esp + 0x11]
mov byte [esp + 0x27], 0
cmp byte [esp + 0x27], 0
jne 0x10005164
xor ecx, ecx
lea esi, [ecx + 0x7f]
mov al, byte [esp + ecx + 0x11]
movzx eax, al
sub eax, 0x31
lea eax, [eax + eax*8]
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [esp + ecx + 0x11], dl
inc ecx
cmp ecx, 0x16
jb 0x10005144
mov edx, 0x3b
push 0x5745
push 0xa1b576c
lea ecx, [edx - 0x3a]
call fcn.100027f0
add esp, 8
lea ecx, [esp + 0x11]
push ecx
push ebx
call eax
push 0xd2bb
push 0x1c46574d
mov edx, 0x87
mov ecx, 1
call fcn.100027f0
add esp, 8
push ebx
push ebp
call eax
test eax, eax
jne 0x100051c8
push 0xd2bb
push 0x1c46574d
mov edx, 0x87
lea ecx, [eax + 1]
call fcn.100027f0
add esp, 8
push ebx
push ebp
call eax
push ebx
call fcn.1000b150
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x10005f00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
nop dword [eax]
mov eax, dword [0x10055ee4]
test eax, eax
jne 0x10005f4d
push 0xc8
call fcn.1000b130
add esp, 4
test eax, eax
je 0x10005f46
mov word [eax], 0x101
mov dword [eax + 4], 0x1e
mov dword [eax + 8], 5
mov dword [eax + 0x10], 3
jmp 0x10005f48
xor eax, eax
mov dword [0x10055ee4], eax
test byte [eax + 0x10], 1
je 0x10005f5f
cmp dword [ebp + 0x98], 1
sete cl
jmp 0x10005f61
mov cl, 1
mov eax, dword [eax + 0x10]
shr eax, 1
test al, 1
je 0x10005f76
cmp dword [ebp + 0x9c], 2
sete al
jmp 0x10005f78
mov al, 1
test cl, cl
je 0x10005f80
test al, al
jne 0x10005fa3
mov edx, 0x48
push 0xb866
push 0x292b7053
lea ecx, [edx - 0x47]
call fcn.100027f0
add esp, 8
push 0xa
call eax
jmp 0x10005f10
xor eax, eax
mov ecx, dword [eax + 0x10013638]
cmp ecx, 0xffffffff
je 0x10005fb8
test ecx, ecx
jne 0x1000604a
add eax, 0x110
cmp eax, 0x42680
jl 0x10005fa5
mov esi, dword [0x10055c80]
mov eax, dword [0x10055c84]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ebx, [esi + eax*4]
cmp esi, ebx
je 0x1000600b
nop dword [eax]
push 0
push dword [esi]
call edi
mov edx, 0x48
push 0xb866
push 0x292b7053
lea ecx, [edx - 0x47]
call fcn.100027f0
add esp, 8
push 0xa
call eax
add esi, 4
cmp esi, ebx
jne 0x10005fe0
push 0
push dword [ebp + 0x20]
call edi
push 0
push dword [ebp + 0x24]
call edi
push 0
push dword [ebp + 0x28]
call edi
mov esi, dword [ebp + 0x1c]
mov edx, 0x5a
push 0x8f51
push 0xcec26543
lea ecx, [edx - 0x59]
call fcn.100027f0
add esp, 8
push esi
call eax
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x48
push 0xb866
push 0x292b7053
lea ecx, [edx - 0x47]
call fcn.100027f0
add esp, 8
push 0x64
call eax
jmp 0x10005fa3
Function at 0x1000ab20
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x10055ee0]
push ebp
mov ebp, ecx
test eax, eax
jne 0x1000ab8e
push edi
push 0x427
call fcn.1000b130
mov edi, eax
add esp, 4
mov dword [0x10055ee0], edi
test edi, edi
jne 0x1000ab4b
pop edi
pop ebp
pop ecx
ret
push ebx
push esi
mov ebx, 0x1000e0e0
mov dword [esp + 0x10], 0x2c
xor esi, esi
sub ebx, edi
nop
mov eax, esi
lea ecx, [edi + esi]
xor edx, edx
inc esi
div dword [esp + 0x10]
mov al, byte [edx + 0x1000e0b0]
xor al, byte [ebx + ecx]
mov byte [ecx], al
cmp esi, 0x427
jb 0x1000ab60
pop esi
pop ebx
mov eax, edi
mov dword [ebp + 0xc4], 0x427
pop edi
pop ebp
pop ecx
ret