joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f95a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push ebx
xor bl, bl
push ebp
mov ebp, dword [esp + 0xc]
test edx, edx
je 0x4f965a
mov eax, dword [esp + 0x10]
push esi
mov esi, ebp
sub esi, eax
cmp edx, 0x20
jb 0x4f963f
push edi
mov edi, edx
xorps xmm3, xmm3
and edi, 0xffffffe0
xorps xmm2, xmm2
add eax, 0x10
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + ebp]
add ecx, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [esi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp ecx, edi
jb 0x4f95d3
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd ebx, xmm2
pop edi
cmp ecx, edx
jae 0x4f9653
mov eax, dword [esp + 0x14]
add eax, ecx
sub edx, ecx
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or bl, cl
sub edx, 1
jne 0x4f9643
pop esi
pop ebp
movzx eax, bl
pop ebx
ret
pop ebp
movzx eax, bl
pop ebx
ret
Function at 0x4fad20
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
or esi, 0xffffffff
test ebx, ebx
je 0x4fad67
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
sub ebp, edi
nop dword [eax]
mov eax, dword [edi + ebp]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
mov ecx, esi
not ecx
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
neg edx
or edx, ecx
and esi, edx
sub ebx, 1
jne 0x4fad40
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4fc0c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebp
push ebx
xorps xmm0, xmm0
mov dword [esp + 8], 0
movlpd qword [esp + 0x14], xmm0
mov eax, 1
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x40
push edi
mov edi, eax
xor ebx, ebx
and edi, 1
neg edi
adc ebx, ebx
and edi, dword [esp + 0x28]
neg ebx
mov ecx, edi
and edi, dword [esp + 0x14]
xor ecx, eax
mov esi, ebx
and esi, dword [esp + 0x2c]
mov eax, esi
and esi, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
shrd ecx, eax, 1
shr eax, 1
add ecx, edi
mov dword [esp + 0x14], ecx
adc eax, esi
and ebx, 0x80000000
shrd ebp, edx, 1
mov dword [esp + 0x10], eax
xor eax, eax
shr edx, 1
add ebp, eax
mov eax, ecx
adc edx, ebx
sub dword [esp + 0x18], 1
jne 0x4fc0f1
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
add esp, 0x14
ret

Function at 0x4fcdfb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x4fce3a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4fce3a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4fce3a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4fce3a
cmp dword [ecx + 0x74], 0xe
jbe 0x4fce3a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x504056
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5040f3
push ebx
push esi
call fcn.0050401f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00503f68
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5040a0
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5040f2
push edi
push eax
call fcn.00504c56
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5040c0
call fcn.00502b91
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5040f1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00503f68
add esp, 0x20
test eax, eax
jne 0x5040df
push edi
call fcn.00502b91
jmp 0x5040e7
push ebx
call fcn.00502b91
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5053d9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5afef8
push 0x5afef0
push str.FlsAlloc
push 0x1e
call fcn.0050529a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x50540d
push dword [ebp + 8]
mov ecx, esi
call dword [0x50f418]
call esi
jmp 0x505413
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x505457
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5aff08
push 0x5aff00
push str.FlsGetValue
push 0x20
call fcn.0050529a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x50548e
push dword [ebp + 8]
mov ecx, esi
call dword [0x50f418]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]
Function at 0x50a910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50a93d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50a93d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x50d3d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x50d44a
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x50d485
cmp dword [esp + 4], 0
je 0x50d46c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x50d4a8
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x5b7ad4]
nop word cs:[eax + eax]
nop
mov dword [esi + 8], eax
lock cmpxchg dword [0x5b7ad4], esi
jne 0x50d430
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x50d47c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x50d4eb
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x50d470
mov edi, dword [esp]
jmp 0x50d47c
mov edi, dword [esi]
jmp 0x50d47b
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x5467ac
push 0x5467e0
push eax
call fcn.0050d520
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x54680c
mov dword [esp + 0x10], 0x546804
mov dword [esp + 0x14], 1
mov dword [esp + 8], 0
mov dword [esp + 0x18], str._rustc_90c541806f23a127002de5b4038be731ba1458calibrarycore_src_strpattern.rs
mov dword [esp + 0x1c], 0
call fcn.0050ae80
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x546804
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], str._rustc_90c541806f23a127002de5b4038be731ba1458calibrarycore_src_strpattern.rs
mov dword [esp + 0x1c], 0
call fcn.0050d580
ud2
Function at 0x50d9b0
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea ecx, [esp + 4]
push dword [esp + 0x44]
call fcn.00415430
add esp, 4
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x50d9f0
mov eax, dword [0x545980]
mov edx, dword [0x545984]
cmp dword [esp + 8], 0
mov dword [esi + 8], edx
mov dword [esi + 4], eax
mov dword [esi], 1
jne 0x50da5f
jmp 0x50da69
mov edi, dword [esp + 4]
mov ebx, dword [esp + 8]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push eax
push ecx
push 0
push edi
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x50da40
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x50da54
mov ecx, dword [esp]
movzx eax, word [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x50da69
mov ecx, edi
mov edx, 1
call fcn.004147c0
add esp, 0x34
pop esi
pop edi
pop ebx
ret
Function at 0x401600
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0xc26904], 0x400
push esi
push edi
jne 0x401645
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 4]
push edx
mov word [ebp - 4], ax
mov word [ebp - 2], cx
mov eax, dword [ebp - 4]
push eax
push ecx
push str.kayed
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
lea eax, [ebp - 0x24]
call fcn.00401710
lea esi, [ebp - 0x24]
call fcn.00401730
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebx, dword [ebp - 4]
xor esi, esi
call edi
cmp esi, 0x2af2a3
jle 0x401663
cmp ebx, 0x78abdb45
jne 0x40166c
inc esi
cmp esi, 0x1c5d
jl 0x401651
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
lea ebx, [ebx]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, 0x206d47
jg 0x40169d
inc esi
cmp esi, 0x4f6a4
jl 0x401680
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
push 0
call edi
cmp esi, 0x2b259d
jle 0x4016bc
cmp ebx, 0x785074d5
jne 0x4016c5
inc esi
cmp esi, 0x11915
jl 0x4016a8
mov ecx, dword [0x80830c]
mov dword [0xc26904], ecx
call fcn.00401370
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov edi, 0x3078f
pop ebx
cmp dword [0xc26904], 0x51f
jne 0x4016f4
push 0
push 0
call esi
sub edi, 1
jne 0x4016e2
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40609c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x807b80]
jne 0x4060a6
repz ret
jmp fcn.004080a8
Function at 0x406cf7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402cbf
and dword [ebp - 4], 0
cmp dword [0x808cfc], 0
mov ebx, eax
jne 0x406da8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406e59
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je GetStringTypeA
push eax
call fcn.00402c4d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x808cfc], eax
call esi
push eax
call fcn.00402c4d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x808d00], eax
call esi
push eax
call fcn.00402c4d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x808d04], eax
call esi
push eax
call fcn.00402c4d
pop ecx
mov dword [0x808d0c], eax
test eax, eax
je 0x406da8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402c4d
pop ecx
mov dword [0x808d08], eax
mov eax, dword [0x808d08]
cmp eax, ebx
je 0x406e00
cmp dword [0x808d0c], ebx
je 0x406e00
push eax
call fcn.00402cc8
push dword [0x808d0c]
mov esi, eax
call fcn.00402cc8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406e00
test edi, edi
je 0x406e00
call esi
test eax, eax
je 0x406df7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406df7
test byte [ebp - 0xc], 1
jne 0x406e00
or dword [ebp + 0x10], 0x200000
jmp 0x406e39
mov eax, dword [0x808d00]
cmp eax, ebx
je 0x406e39
push eax
call fcn.00402cc8
pop ecx
test eax, eax
je 0x406e39
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406e39
mov eax, dword [0x808d04]
cmp eax, ebx
je 0x406e39
push eax
call fcn.00402cc8
pop ecx
test eax, eax
je 0x406e39
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x808cfc]
call fcn.00402cc8
pop ecx
test eax, eax
je 0x406e59
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406e5b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002f90
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x10002fb4
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x10003020
push 0
push 0
call fcn.100a98a7
add esp, 0x18
mov dword [esi + 8], eax
pop esi
ret

Function at 0x10002fd0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0xc], eax
je 0x10003018
cmp byte [ebp + 8], 0
je 0x10003018
mov eax, dword [esi + 8]
test eax, eax
je 0x10003018
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003018
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
pop esi
pop ebp
ret 8
Function at 0x10005af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x48]
push esi
movups xmmword [ebp - 0x48], xmm0
mov esi, dword [ebp + 0x8c]
movups xmm0, xmmword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x90]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x4c], esi
mov dword [edi + 0x40], esi
movups xmm0, xmmword [ebp + 0x28]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp + 0x4c]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [ebp + 0x5c]
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp + 0x6c]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp + 0x7c]
movups xmmword [ebp - 0x5c], xmm0
test esi, esi
jle 0x10005c74
cmp esi, 0x40
jb 0x10005c5d
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x49]
add edx, edi
cmp edi, ecx
ja 0x10005b97
lea ecx, [ebp - 0x48]
cmp edx, ecx
jae 0x10005c5d
lea ecx, [ebp + esi - 0x8d]
cmp edi, ecx
ja 0x10005bb0
lea ecx, [ebp - 0x8c]
cmp edx, ecx
jae 0x10005c5d
mov ecx, esi
push ebx
and ecx, 0x8000003f
jns 0x10005bc0
dec ecx
or ecx, 0xffffffc0
inc ecx
mov ebx, esi
lea edx, [edi + 0x20]
sub ebx, ecx
mov dword [ebp - 0x98], edx
mov esi, edi
lea ecx, [ebp - 0x38]
sub esi, ecx
sub ecx, edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x7c]
sub ecx, edi
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x48]
lea ecx, [ebp - 0x38]
add edx, eax
movups xmm1, xmmword [ebp + eax - 0x8c]
add ecx, eax
pxor xmm1, xmm0
movups xmm0, xmmword [ecx]
movups xmmword [esi + ecx], xmm1
mov ecx, dword [ebp - 0x94]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x6c]
movups xmmword [edx - 0x10], xmm1
movups xmm1, xmmword [ebp + eax - 0x28]
add eax, 0x40
pxor xmm1, xmm0
movups xmm0, xmmword [edi + edx]
movups xmmword [edx], xmm1
movups xmm1, xmmword [ecx + edx]
pxor xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
mov edx, dword [ebp - 0x98]
cmp eax, ebx
jl 0x10005bf0
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
pop ebx
cmp eax, esi
jge 0x10005c74
mov cl, byte [ebp + eax - 0x8c]
xor cl, byte [ebp + eax - 0x48]
mov byte [edi + eax], cl
inc eax
cmp eax, esi
jl 0x10005c61
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x10009b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114e04
mov dword [ebp - 0x24], 0x6f0043
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x70006d
mov dword [ebp - 0x1c], 0x740075
mov edx, 0x11
mov dword [ebp - 0x18], 0x720065
sub esi, eax
mov dword [ebp - 0x14], 0x31005a
mov dword [ebp - 0x10], 0x2e0034
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x10009bee
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009bee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009bd0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114e04
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10009c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x10114d84
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x520070
mov dword [ebp - 0x14], 0x730065
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x650076
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x10009c93
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009c93
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009c75
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114d84
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10009d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x10114d5c
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x520070
mov dword [ebp - 0x14], 0x730065
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x650076
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x10009dc3
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009dc3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009da5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114d5c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x10009df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114db0
mov dword [ebp - 0x28], 0x740055
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6c0069
mov dword [ebp - 0x20], 0x5c0073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x750067
sub esi, eax
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x680064
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x10009e6e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009e6e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009e50
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114db0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10009e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114ddc
mov dword [ebp - 0x28], 0x740055
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6c0069
mov dword [ebp - 0x20], 0x5c0073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x750067
sub esi, eax
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x680064
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x10009f0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10009f0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10009ef0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114ddc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x1000b3e0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000ba00
push 0
push 0
call fcn.100a98a7
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x100168a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0360
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10111404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1007f3e5
mov edi, eax
add esp, 4
test edi, edi
je 0x1001694b
push 1
mov dword [ebp - 4], 0
call fcn.1005b5b3
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10018d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10114fc8
mov dword [ebp - 0x1c], 0x720068
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x770073
mov dword [ebp - 0x14], 0x72006f
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0064
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10018dde
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018dde
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018dc0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10114fc8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10018e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x34], 0x650054
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x34]
mov eax, 0x10115114
mov dword [ebp - 0x30], 0x6d0061
mov dword [ebp - 0x2c], 0x690056
mov edx, 0x18
mov dword [ebp - 0x28], 0x770065
sub esi, eax
mov dword [ebp - 0x24], 0x720065
mov dword [ebp - 0x20], 0x44005f
mov dword [ebp - 0x1c], 0x730065
mov dword [ebp - 0x18], 0x74006b
mov dword [ebp - 0x14], 0x70006f
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffe6]
test ecx, ecx
je 0x10018e91
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018e91
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018e73
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10115114
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret