joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463505
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46361d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46361d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048ed8e
mov esi, eax
test esi, esi
je 0x46361d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46361d
mov ecx, esi
call fcn.00463490
cmp edi, eax
jge 0x46361d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4635a3
mov dword [esp + 0x34], 1
jmp 0x4635fe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46361d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00462a20
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4683b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x57deec]
xor edx, edx
cmp eax, edx
jne 0x4683d6
xor eax, eax
mov byte [eax + 0x57ddec], al
inc eax
cmp eax, 0x100
jl 0x4683be
mov dword [0x57deec], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x57ddec
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x468467
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x46843a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x468408
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x468470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4684c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4684aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ee80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49b86e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0046f7a0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x53de04
call fcn.0048d0ce
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x46ef13
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048d0ce
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x46ef0c
push 0
mov ecx, eax
call fcn.00465ff0
mov dword [esi + 0xc], eax
jmp 0x46ef15
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x46ef15
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x48f731
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48f769
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048d7e8
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048d7c0
jmp 0x48f775
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x490e27
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x490e69
call fcn.004968db
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x490e69
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x490e60
xor eax, eax
jmp 0x490e71
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00490e77
pop edi
pop esi
pop ebx
ret 4
Function at 0x496e0b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x496e39
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x496e57
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00496d71
jmp 0x496e57
mov eax, dword [esi + 0x14]
test eax, eax
je 0x496e57
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00496d71
test edi, edi
mov eax, edi
jne 0x496e41
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10054de9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10054df8
pop dword [ebp - 0x24]
mov eax, 0x10054df8
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xa4eedf2f
add dword [ebp - 0x34], 0xa963661c
mov dword [ebp - 0x30], 0x2d877599
sub dword [ebp - 0x30], 0xfb542954
mov dword [ebp - 0x2c], 0xc705ad2c
add dword [ebp - 0x2c], 0x85469702
mov dword [ebp - 0x28], 0xb3042177
sub dword [ebp - 0x28], 0xb3042177
lea eax, [ebp - 0x34]
push eax
mov eax, 0x2f380af0
add eax, 0xe0cdf520
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x1055b52d
add dword [ebp - 0x34], 0x641cb429
mov dword [ebp - 0x30], 0xcbb11901
add dword [ebp - 0x30], 0x75bb4874
mov dword [ebp - 0x2c], 0x107e3937
add dword [ebp - 0x2c], 0x52f13335
mov dword [ebp - 0x28], 0xf1def3f2
sub dword [ebp - 0x28], 0xf1def3f2
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x58d5f
push 0
call eax
mov ecx, 0xdcd32c39
add ecx, 0x232d27a4
mov esi, eax
mov edi, 0x64307e63
add edi, 0xabd83d9d
add edi, dword [ebp - 0x24]
mov edx, 0x17dafa4f
sub dword [ebp - 0x1c], esi
mov ebx, dword [edi]
mov dword [ebp - 0x1c], 0xf34a30d2
xor ebx, edx
mov dword [ebp - 0xc], 0x4062bb27
mov dword [esi], ebx
xor dword [ebp - 0x18], 0x9a7c46b9
add esi, 0xae30b822
sub esi, 0xae30b81e
add edi, 0x85912249
add edi, 0x7a6eddbb
loop 0x10054f0a
add eax, 0xb1ff39f2
sub eax, 0xb1fdf7ab
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x611f1f71
nop
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x731a6071
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10001540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x25b]
push edi
push 0x1ff
push 0
push eax
mov byte [ebp - 0x25c], 0
call sub.MSVCR120.dll_memset
mov eax, 0x54
mov dword [ebp - 0x260], 0x200
mov word [ebp - 0x56], ax
mov eax, 0x53
mov word [ebp - 0x5c], ax
mov dword [ebp - 0x54], 0x410057
mov dword [ebp - 0x5a], 0x46004f
lea ecx, [eax + 0x16]
mov dword [ebp - 0x38], 0x43005c
mov eax, 0x65
mov dword [ebp - 0x4c], 0x4d005c
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x268]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x34], 0x790072
push eax
push 0x80000002
mov dword [ebp - 0x28], 0x610072
mov dword [ebp - 0x20], 0x79
mov dword [ebp - 0x44], 0x6f0072
mov dword [ebp - 0x3c], 0x740066
mov dword [ebp - 0x24], 0x680070
mov dword [ebp - 0x48], 0x630069
mov dword [ebp - 0x50], 0x450052
mov dword [ebp - 0x2c], 0x67006f
mov dword [ebp - 0x30], 0x740070
mov dword [ebp - 0x40], 0x6f0073
mov dword [ebp - 8], 0x64
mov dword [ebp - 0x18], 0x680063
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0xe], 0x750047
mov dword [ebp - 0x1c], 0x61004d
mov word [ebp - 0xa], cx
call fcn.100047e0
add esp, 0x20
test eax, eax
jne 0x100016f0
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x264]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x268]
call fcn.10004190
add esp, 0x18
test eax, eax
je 0x100016cf
lea eax, [ebp - 0x268]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x80000002
call fcn.100047e0
add esp, 0x14
test eax, eax
jne 0x100016f0
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x264]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x268]
call fcn.10004190
add esp, 0x18
test eax, eax
jne 0x100016f0
push 0xffffffffffffffff
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.MSVCR120.dll_wcsncpy_s]
push dword [ebp - 0x268]
call fcn.10004870
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret
Function at 0x100017f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc94
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x43
mov dword [ebp - 0x4e], 0x720075
mov word [ebp - 0x50], ax
mov ecx, 0x72
mov eax, 0x52
mov dword [ebp - 0x66], 0x690057
mov word [ebp - 0x80], ax
mov eax, 0x4d
push ebx
push esi
mov word [ebp - 0x7a], ax
mov esi, 0x6f
push edi
mov edi, dword [ebp + 8]
mov eax, 0x65
mov word [ebp - 0x40], ax
mov eax, ecx
push 0x7fc
mov word [ebp - 0x20], ax
lea eax, [ebp - 0xc88]
push 0
push eax
mov dword [ebp - 0x78], 0x630069
mov dword [ebp - 0x84], 0x410057
mov dword [ebp - 0x7e], 0x5c0045
mov dword [ebp - 0x8c], 0x4f0053
mov dword [ebp - 0x72], 0x73006f
mov dword [ebp - 0x6e], 0x66006f
mov dword [ebp - 0x3e], 0x730072
mov dword [ebp - 0x88], 0x540046
mov dword [ebp - 0x58], 0x4e0020
mov dword [ebp - 0x48], 0x6e0065
mov dword [ebp - 0x3a], 0x6f0069
mov dword [ebp - 0x6a], 0x5c0074
mov dword [ebp - 0x54], 0x5c0054
mov dword [ebp - 0x44], 0x560074
mov dword [ebp - 0x5c], 0x730077
mov dword [ebp - 0x62], 0x64006e
mov word [ebp - 0x4a], cx
mov word [ebp - 0x74], cx
mov dword [ebp - 0x36], 0x6e
mov word [ebp - 0x5e], si
mov dword [ebp - 0x1e], 0x64006f
mov dword [ebp - 0x1a], 0x630075
mov dword [ebp - 0x24], 0x50006c
mov dword [ebp - 0x28], 0x610074
mov dword [ebp - 0x16], 0x490074
mov dword [ebp - 0x2c], 0x690067
mov dword [ebp - 0x12], 0x64
mov dword [ebp - 0x30], 0x690044
mov dword [ebp - 0xc8c], 0
call sub.MSVCR120.dll_memset
lea eax, [ebp - 0xc94]
mov dword [ebp - 0xc90], 0x800
push eax
push 0x101
push 0
lea eax, [ebp - 0x8c]
push eax
push 0x80000002
call fcn.100047e0
add esp, 0x20
test eax, eax
jne 0x10001a2a
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0xc8c]
push eax
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0xc94]
call fcn.10004190
add esp, 0x18
test eax, eax
jne 0x10001a1c
push 0x3ff
push eax
mov byte [ebp - 0x48c], al
lea eax, [ebp - 0x48b]
push eax
call sub.MSVCR120.dll_memset
push dword [ebp - 0xc90]
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0xc8c]
push eax
call fcn.10001780
add esp, 0x18
mov dword [ebp - 0xc], 0x730025
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x48c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100019d6
sub eax, edx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x100019ee
xor eax, eax
jmp 0x10001a08
lea eax, [esi + esi]
call fcn.1000a3d0
mov eax, esp
lea ecx, [ebp - 0x48c]
push 3
push esi
push ecx
push eax
call fcn.10008b40
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push edi
call dword [sym.imp.MSVCR120.dll__snwprintf_s]
add esp, 0x14
push dword [ebp - 0xc94]
call fcn.10004870
add esp, 4
lea esp, [ebp - 0xca0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret
Function at 0x10002640
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 0x20
call fcn.10004700
push eax
call fcn.10004aa0
add esp, 0xc
test eax, eax
je 0x100026b7
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call fcn.10004c40
add esp, 0xc
test eax, eax
je 0x100026b7
mov eax, dword [ebp - 0xc]
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push 0x10
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call fcn.100048f0
add esp, 0x18
push dword [ebp - 0x20]
call fcn.10004770
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret
Function at 0x10002b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x1000e084], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [0x1000e088], eax
mov eax, dword [ebp + 0xc]
push 0x3ff
mov dword [0x1000e08c], eax
lea eax, [ebp - 0x867]
push 0
push eax
mov byte [ebp - 0x868], 0
call sub.MSVCR120.dll_memset
push 0x3ff
lea eax, [ebp - 0x467]
mov byte [ebp - 0x468], 0
push 0
push eax
call sub.MSVCR120.dll_memset
lea eax, [ebp - 0x868]
push eax
call fcn.10001020
mov esi, dword [sym.imp.MSVCR120.dll__snprintf_s]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x868]
mov word [ebp - 0x68], 0x4f5c
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x56], 0x6674742e
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x468]
mov dword [ebp - 0x65], 0x61536e65
push 0x400
push eax
mov word [ebp - 0x5b], 0x6269
mov word [ebp - 0x58], 0x646c
mov word [ebp - 0x5d], 0x6d65
mov word [ebp - 0x60], 0x2d73
mov byte [ebp - 0x59], 0x6f
mov byte [ebp - 0x61], 0x6e
mov byte [ebp - 0x5e], 0x53
mov byte [ebp - 0x52], 0
mov byte [ebp - 0x66], 0x70
mov dword [ebp - 0x45], 0x6c756765
mov dword [ebp - 0x49], 0x522d736e
mov word [ebp - 0x3f], 0x742e
mov dword [ebp - 0x4e], 0x536e6570
mov word [ebp - 0x3c], 0x66
mov word [ebp - 0x50], 0x4f5c
mov byte [ebp - 0x4a], 0x61
mov word [ebp - 0x41], 0x7261
mov byte [ebp - 0x3d], 0x74
mov word [ebp - 0x38], 0x4f5c
mov word [ebp - 0x28], 0x742e
mov dword [ebp - 0x2d], 0x696c6174
mov word [ebp - 0x35], 0x6e65
mov byte [ebp - 0x36], 0x70
mov word [ebp - 0x25], 0x66
mov word [ebp - 0x32], 0x6e61
mov byte [ebp - 0x33], 0x53
mov word [ebp - 0x2f], 0x492d
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x29], 0x63
mov byte [ebp - 0x26], 0x74
mov dword [ebp - 0x1e], 0x536e6570
mov dword [ebp - 0x12], 0x6674742e
mov dword [ebp - 0x17], 0x6c6f422d
mov word [ebp - 0x20], 0x4f5c
mov word [ebp - 0x19], 0x736e
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0xe], 0
mov dword [ebp - 0xb], 0x732573
mov byte [ebp - 0xc], 0x25
call esi
lea eax, [ebp - 0x468]
push eax
call fcn.100049a0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x468]
push 0x400
push eax
call esi
add esp, 0x50
lea eax, [ebp - 0x468]
push eax
call fcn.100049a0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x468]
push 0x400
push eax
call esi
lea eax, [ebp - 0x468]
push eax
call fcn.100049a0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x468]
push 0x400
push eax
call esi
lea eax, [ebp - 0x468]
push eax
call fcn.100049a0
mov ecx, dword [ebp - 4]
add esp, 0x3c
xor ecx, ebp
pop esi
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret
Function at 0x10003c50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov cl, byte [edx]
test cl, cl
je 0x10003cf9
movzx ecx, cl
lea edx, [edx + 1]
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10003c63
not eax
pop ebp
ret

Function at 0x10003d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0xe], 0x3233
push eax
mov dword [ebp - 0x13], 0x656e7265
mov byte [ebp - 0xf], 0x6c
mov dword [ebp - 0xb], 0x6c6c64
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0x14], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret

Function at 0x10003dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x61766441
push eax
mov dword [ebp - 0xb], 0x6c6c64
mov word [ebp - 0xd], 0x2e32
mov word [ebp - 0x10], 0x6970
mov byte [ebp - 0xe], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret

Function at 0x10003e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x61706c68
push eax
mov dword [ebp - 0xb], 0x6c6c64
mov word [ebp - 0xe], 0x6970
mov word [ebp - 0x14], 0x7049
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret
Function at 0x10003f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x14], eax
xor esi, esi
call fcn.10003d00
mov edi, eax
test edi, edi
je 0x10003f63
lea eax, [ebp - 0x10]
mov dword [ebp - 0xb], 0x6f646e69
push eax
push edi
mov word [ebp - 6], 0x41
mov dword [ebp - 0x10], 0x646e6946
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 7], 0x77
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003f5c
push dword [ebp - 0x14]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret

Function at 0x10003f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x20], eax
call fcn.10003d00
mov edi, eax
test edi, edi
je 0x10003ff6
lea eax, [ebp - 0x14]
mov dword [ebp - 0xb], 0x41784577
push eax
push edi
mov dword [ebp - 0x14], 0x646e6946
mov dword [ebp - 0x10], 0x646e6957
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003fef
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret

Function at 0x100040f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1000e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x20], eax
xor esi, esi
call fcn.10003d90
mov edi, eax
test edi, edi
je 0x10004175
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x61507265
push eax
push edi
mov word [ebp - 0x12], 0x6c61
mov dword [ebp - 0x17], 0x63657053
mov dword [ebp - 0x10], 0x646c6f46
mov dword [ebp - 0x1c], 0x65474853
mov word [ebp - 7], 0x5768
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 5], 0
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 8], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000416e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a3b2
mov esp, ebp
pop ebp
ret