joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001357d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100135a5
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push 0x27e8
call fcn.10013619
add esp, 0xc
jmp 0x10013615
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001360d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100135dd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jg 0x1001360b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10013609
push 0xc92
push 0
push 0
push 0
push 0
push 0x1bf5
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100135d2
jmp 0x10013615
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esp, ebp
pop ebp
ret
Function at 0x10022a04
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10022a98
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10022a4b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10022a49
push 0x243c
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10022a96
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10022a79
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x10022a96
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000f22e
mov dword [eax], 1
jmp 0x10022a6e
jmp 0x10022ab4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
push 1
push dword [ebp - 0x28]
call fcn.1001d782
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10022c86
Capabilities:
Delete registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10022cbd
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10022cb1
push 0x243c
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10022cde
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x68a8
call fcn.10014677
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x100234e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10023516
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 1
push 0x2e33
push dword [ebp - 0xc]
push 0x57de
push dword [ebp - 0x10]
call fcn.10023594
add esp, 0x14
jmp 0x10023590
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10023548
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10023546
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10023590
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10023576
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10023590
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1000f22e
and dword [eax], 0
jmp 0x1002356b
mov esp, ebp
pop ebp
ret

Function at 0x100280e6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028134
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002811e
push 0
push 0x12e7
push 0
push 0
push 0x5ac
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10028132
push 0
push 7
push 0x2645
push 0x1348
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x1002815a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 0x42e1
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x3764
call fcn.10020902
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1002f6ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10069087
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x1002f810
cmp byte [ebx + 0x45], 0
je 0x1002f810
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1002f736
xor al, al
jmp 0x1002f812
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.10011dc5
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1002f79b
dec eax
je 0x1002f79f
dec eax
dec eax
je 0x1002f7fd
xor bl, bl
jmp 0x1002f7ff
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x1002f7de
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1004f778
add esp, 0x10
cmp esi, eax
jne 0x1002f797
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x1002f7fd
test esi, esi
jne 0x1002f761
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.10011d64
jmp 0x1002f759
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000f54a
mov al, bl
jmp 0x1002f812
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10064fa5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006e778]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10054738
mov dword [ebp - 0x14], eax
cmp dword [0x1065b6b8], esi
jne 0x10065098
push 0x800
push esi
push 0x1000b010
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10065025
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10065178
push esi
push esi
push 0x1000b010
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10065178
push 0x1000b028
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10065178
push eax
call ebx
push 0x1000b034
push edi
mov dword [0x1065b6b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000b044
push edi
mov dword [0x1065b6bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000b058
push edi
mov dword [0x1065b6c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065b6c8], eax
test eax, eax
je 0x10065095
push 0x1000b074
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065b6c4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100650bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100650b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100650d2
push 4
pop eax
jmp 0x1006517a
cmp dword [ebp - 0x14], esi
je 0x100650d2
push dword [0x1065b6b8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100650b7
mov eax, dword [0x1065b6c4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10065130
cmp dword [0x1065b6c8], edi
je 0x10065130
push eax
call ebx
push dword [0x1065b6c8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10065130
test eax, eax
je 0x10065130
call ecx
test eax, eax
je 0x10065125
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10065125
test byte [ebp - 8], 1
jne 0x10065130
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10065160
mov eax, dword [0x1065b6bc]
cmp eax, edi
je 0x1006515d
push eax
call ebx
test eax, eax
je 0x1006515d
call eax
mov esi, eax
test esi, esi
je 0x1006515d
mov eax, dword [0x1065b6c0]
cmp eax, edi
je 0x1006515d
push eax
call ebx
test eax, eax
je 0x1006515d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065b6b8]
call ebx
test eax, eax
je 0x10065178
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006517a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100528a9
mov esp, ebp
pop ebp
ret
Function at 0x40c6a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40c6b3
pop dword [ebp - 0x30]
mov eax, 0x40c6b3
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3ad32
push 0
mov eax, 0xddc9eb21
sub eax, 0xdd879909
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x9a1d9d5d
sub ecx, 0x9a1d6143
xor esi, esi
add esi, eax
mov edx, 0x975eda21
add edx, 0x68e479df
add edx, dword [ebp - 0x30]
mov ebx, 0xf98eded9
add dword [ebp - 4], 0x42358b67
mov edi, dword [edx]
sub dword [ebp - 0x1c], esi
sub edi, ebx
mov dword [ebp - 0x20], 0xce2f30b4
mov dword [esi], edi
xor dword [ebp - 0x18], 0x92466bbd
add esi, 0x817ec6ce
sub esi, 0x817ec6ca
add edx, 4
loop 0x40c709
add eax, 0xffb793f4
sub eax, 0xffb6b0b9
mov ebx, eax
add eax, 5
mov ecx, 0xc80ae282
sub ecx, 0xc7cae282
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x100029b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.100025c9
push eax
push esi
push dword [ebp + 8]
call fcn.1000257e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100025c9
push eax
push esi
push dword [ebp + 8]
call fcn.1000257e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100025b9
je 0x100029d8
clc
sub byte [eax - 0x8363], cl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid

Function at 0x10002c7b
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10002c90
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10002cae
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10002d0c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10002cf3
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10002cfc
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10002d06
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10002ce8
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10002c72
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10002d59
dec eax
je 0x10002d50
sub eax, 3
je 0x10002d47
mov dword [ebp - 4], 0x40
jmp 0x10002d76
mov dword [ebp - 4], 4
jmp 0x10002d5c
mov dword [ebp - 4], 0x20
jmp 0x10002d5c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10002da8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10002d28
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100025b9
jmp 0x10002e0d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ch, 0xfc
invalid

Function at 0x10002cf0
Capabilities:
Inspect section memory permissions

Disassembly:
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
Function at 0x10002e37
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebx, 0x40fffffc
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.100025c9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000257e
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.100025c9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000257e
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
call [edx - 0x3e47a3a]
invalid
jmp dword [ebx - 0x3e37a3a]
invalid
inc dword [ecx - 0x3e27a3a]
invalid
dec dword [edx - 0x3e17a3a]
invalid
call [ebx - 0x3e07a3a]
invalid
inc dword [edx - 0x3df7a3a]
invalid
dec dword [ebx - 0x3de7a3a]
invalid
jmp dword [esi - 0x3dd7a3a]
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
cld
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.100025c9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000257e
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.100025b9
inc dword [edi]
Function at 0x1000347f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10002597
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
call dword [eax - 0x18]
xor esi, eax
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000257e
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.100025b9
mov esp, dword [edi + 0x468c298]
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x43760d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x43761c
pop dword [ebp - 0x28]
mov eax, 0xc9f1fbbe
sub eax, 0xc9ae85a2
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc2efd5a
add dword [ebp - 0x38], 0x422347f1
mov dword [ebp - 0x34], 0x5827a6b2
sub dword [ebp - 0x34], 0x25f45a6d
mov dword [ebp - 0x30], 0x67eba680
sub dword [ebp - 0x30], 0x1b9f6252
mov dword [ebp - 0x2c], 0xb58f07ad
add dword [ebp - 0x2c], 0x4a70f853
lea eax, [ebp - 0x38]
push eax
mov eax, 0x19a61398
add eax, 0xe69d9e7c
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x1444588b
sub dword [ebp - 0x38], 0x9fd1ef35
mov dword [ebp - 0x34], 0xb6e1c12e
sub dword [ebp - 0x34], 0x75755fb9
mov dword [ebp - 0x30], 0x24a352c0
sub dword [ebp - 0x30], 0xc133e654
mov dword [ebp - 0x2c], 0x6266391d
sub dword [ebp - 0x2c], 0x6266391d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xb4e0150f
sub eax, 0xb49c629f
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x42585
push 0
call eax
mov ecx, 0xf237745d
sub ecx, 0xf2373442
mov edx, eax
mov ebx, 0x464e00
add ebx, dword [ebp - 0x28]
mov esi, 0xc9c7066f
add esi, 0xda53bc03
add dword [ebp - 4], 0xd6a99665
mov edi, dword [ebx]
xor edi, esi
sub dword [ebp - 0x24], ebx
mov dword [edx], edi
add dword [ebp - 0x18], eax
add edx, 4
add ebx, 0x8f1ed526
sub ebx, 0x8f1ed522
loop 0x437738
add eax, 0x55dfa043
sub eax, 0x55dead04
xor ebx, ebx
add ebx, eax
add eax, 0xbbeb848c
add eax, 0x44147b79
mov ecx, 0xf1893c9e
add ecx, 0xeb6c362
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4012e0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
xor edx, edx
cmp edi, edx
je 0x401366
mov ecx, dword [edi]
push ebx
push ebp
mov byte [ecx + 0x16], dl
push esi
mov esi, dword [edi + 4]
mov byte [ecx + 0x17], dl
xor eax, eax
cmp esi, edx
mov byte [ecx + 0x18], dl
mov byte [ecx + 0x19], dl
jle 0x40131f
movzx ebx, byte [ecx + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x4e1fd0]
inc edx
cmp edx, esi
jl 0x401303
xor edx, edx
mov esi, dword [edi + 0xc]
cmp esi, edx
jle 0x40134a
mov edi, dword [edi + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x4e1fd0]
inc edx
cmp edx, esi
jl 0x401330
mov edx, eax
shr edx, 8
mov byte [ecx + 0x16], al
mov byte [ecx + 0x17], dl
mov edx, eax
pop esi
shr edx, 0x10
shr eax, 0x18
pop ebp
mov byte [ecx + 0x18], dl
mov byte [ecx + 0x19], al
pop ebx
pop edi
ret

Function at 0x404700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7a48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x521da0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], ecx
mov byte [esp + 0xc], cl
mov dword [esp + 0x30], ecx
lea ecx, [esp + 8]
push ecx
push eax
mov ecx, esi
call fcn.00402b10
cmp eax, 1
jne 0x404788
lea edx, [esp + 8]
push edx
lea ecx, [esi + 0x17c]
call fcn.004045b0
cmp dword [esp + 0x20], 0x10
jb 0x404781
mov eax, dword [esp + 0xc]
push eax
call fcn.00485196
add esp, 4
mov eax, 1
jmp 0x40479e
cmp dword [esp + 0x20], 0x10
jb 0x40479c
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00485196
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00496795
add esp, 0x2c
ret 4
Function at 0x405700
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xa9cc]
call fcn.0048d1c0
cmp dword [esi + 0x8eb4], 1
jne 0x405721
push 0
push 0
call dword [0x4ce544]
lea ecx, [esi + 0xa8]
pop esi
jmp fcn.00447890
Function at 0x411700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c5982
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call dword [0x4ce778]
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
call dword [0x4ce778]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call dword [0x4ce778]
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 2
call fcn.0043de60
lea ecx, [esi + 0x60]
mov byte [esp + 0x14], 3
call fcn.0043de60
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 4
call fcn.0043de60
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 5
call fcn.0043de60
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x411830
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4c59e6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esi + 0x54]
mov edx, dword [eax + 0x4c]
lea edi, [esi + 0x54]
mov ecx, edi
mov dword [esp + 0x1c], 5
call edx
lea ecx, [esi + 0x2a4]
mov byte [esp + 0x1c], 4
call fcn.00412830
lea ebx, [esi + 0x64]
mov ecx, ebx
mov dword [ebx + 0x24], vtable.ArchiveMap.0
call fcn.0040fbe0
mov ebx, dword [ebx]
push ebx
call fcn.00485196
add esp, 4
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.004903df
mov edi, 0x10
cmp dword [esi + 0x50], edi
jb 0x4118bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00485196
add esp, 4
xor ebx, ebx
mov dword [esi + 0x50], 0xf
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
cmp dword [esi + 0x34], edi
jb 0x4118dd
mov eax, dword [esi + 0x20]
push eax
call fcn.00485196
add esp, 4
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], ebx
lea ecx, [esi + 4]
mov byte [esi + 0x20], bl
mov dword [esp + 0x1c], 0xffffffff
call dword [0x4ce78c]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret