joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59d249
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0059d06d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x59d3b8
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x59d3b8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x59d36d
jg 0x59d2a5
test eax, eax
je 0x59d363
push 1
push 0x1000
call fcn.00584300
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x59d2c8
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x59d35a
push 0x8000
push ebx
call fcn.005799a2
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x59d2f1
jg 0x59d2ec
cmp ecx, 0x1000
jb 0x59d2f1
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0058a572
add esp, 0x10
cmp eax, 0xffffffff
je 0x59d336
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x59d2ec
jl 0x59d31d
test ecx, ecx
jne 0x59d2de
push dword [ebp - 0xc]
push ebx
call fcn.005799a2
push esi
call fcn.00581ca0
add esp, 0xc
xor ebx, ebx
jmp 0x59d3c6
cmp byte [edi + 0x24], 0
je 0x59d34d
cmp dword [edi + 0x20], 5
jne 0x59d34d
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x59d358
mov ebx, dword [edi + 0x18]
jmp 0x59d35a
xor ebx, ebx
push esi
call fcn.00581ca0
pop ecx
jmp 0x59d3c6
test ecx, ecx
jg 0x59d32f
jl 0x59d36d
test eax, eax
jae 0x59d32f
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005994e6
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x59d38d
cmp byte [edi + 0x1c], 0
je 0x59d32f
jmp 0x59d3be
push ebx
call fcn.0058e774
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x59d32f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x59d3c6
cmp byte [edi + 0x1c], 0
je 0x59d3c3
mov ebx, dword [edi + 0x18]
jmp 0x59d3c6
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005994e6
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5a17c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x5a1894
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x5a1883
jg 0x5a17f8
test edx, edx
je 0x5a1883
call fcn.0046b9b0
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x5a1848
jg 0x5a180e
test esi, esi
je 0x5a1848
cmp ebx, eax
jg 0x5a181d
jl 0x5a1818
cmp edi, esi
jae 0x5a181d
mov esi, edi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [ebp + 8]
call fcn.0053df70
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x5a186a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x5a187d
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x5a17f8
jl 0x5a187d
test edi, edi
jne 0x5a17f8
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x5a18b3
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x5a18b5
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x5a195d
jg 0x5a18cf
test esi, esi
je 0x5a195d
test eax, eax
jl 0x5a190e
jg 0x5a18d9
test ebx, ebx
je 0x5a190e
cmp edi, eax
jg 0x5a18e8
jl 0x5a18e3
cmp esi, ebx
jae 0x5a18e8
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0053df70
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], ebx
sub esi, ebx
sbb edi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x5a1914
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x5a195d
jg 0x5a191e
test esi, esi
je 0x5a195d
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x5a195d
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x5a1949
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [ebp + 8]
call fcn.005ee1a0
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5cda10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.005ce020
add esp, 8
test al, al
je 0x5cda35
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x5cda35
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x5ce020
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x5cf4d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5cf4fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5cf4fb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x5f154d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00478eb0
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00582dc7
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x5f158f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x5f16eb
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00479070
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x68e900]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.005994c8
mov ecx, dword [esi*4 + 0x68e900]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x5f16e4
cmp eax, dword [ecx + edi + 0x24]
jne 0x5f16e4
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5f16e4
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005994c8
add esp, 0x14
test edx, edx
jl 0x5f16e4
jg 0x5f165a
test eax, eax
jb 0x5f16e4
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x5f16e4
jl 0x5f1674
cmp dword [ebp - 0x1008], eax
ja 0x5f16e4
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x5f1692
test ebx, ebx
je 0x5f16cb
cmp ecx, edi
jae 0x5f16cb
mov al, byte [ecx]
cmp al, 0xd
jne 0x5f16ac
lea eax, [edi - 1]
cmp ecx, eax
jae 0x5f16b8
cmp byte [ecx + 1], 0xa
jne 0x5f16b8
inc ecx
jmp 0x5f16b8
movzx eax, al
movsx eax, byte [eax + 0x680270]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x5f1692
cmp edx, ebx
jne 0x5f1692
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x5f16e9
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00478a88
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x1411373e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x6505a86
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100015c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push esi
call fcn.10003361
mov esi, eax
test esi, esi
je 0x10001831
mov ecx, esi
call fcn.10001f10
mov dword [esi + 0x6c4], 1
mov edx, 2
mov word [ebp - 4], 0xbb01
movzx eax, word [ebp - 4]
mov dword [esi + 0x6c0], 0
mov word [esi + 0x622], ax
mov word [esi + 0x620], dx
mov dword [esi + 0x624], 0xc15b1c67
mov eax, dword [esi + 0x6c4]
mov word [ebp - 4], 0xbb01
lea ecx, [eax + 0x62]
inc eax
add ecx, ecx
mov dword [esi + 0x6c4], eax
movzx eax, word [ebp - 4]
xor edi, edi
mov word [esi + ecx*8 + 2], ax
lea ebx, [esi + 0xd4]
mov dword [esi + ecx*8 + 4], 0xadff38c1
lea eax, [esi + 0xe4]
mov word [esi + ecx*8], dx
mov dword [esi + 0x4f8], eax
xor edx, edx
nop dword [eax]
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [edx + eax], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 1], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 2], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 3], cl
add edx, 4
cmp edx, 0x100
jl 0x10001660
mov eax, dword [esi + 0x4f8]
mov byte [eax + 0x110], 0
mov eax, dword [esi + 0x4f8]
add eax, 0x100
push eax
push 0x10
push ebx
call fcn.1000339f
add esp, 0xc
lea eax, [esi + 0x500]
push eax
mov eax, dword [esi + 0x4f8]
add eax, 0x111
push eax
mov eax, dword [esi + 0x48]
call eax
mov eax, dword [esi + 0x600]
xor ebx, ebx
add eax, 0x111
mov dword [esi + 0x4fc], eax
add eax, 0xffffff00
je 0x10001769
mov ecx, dword [esi + 0x4f8]
movzx eax, bl
lea edx, [ecx + ebx]
inc ebx
mov al, byte [eax + ecx]
xor byte [edx + 0x100], al
mov eax, dword [esi + 0x4fc]
sub eax, 0x100
cmp ebx, eax
jb 0x10001744
mov ecx, esi
call fcn.10002100
test eax, eax
je 0x1000178f
mov ecx, esi
call fcn.10001080
test eax, eax
lea ebx, [esi + 0xd4]
lea eax, [esi + 0xe4]
jne 0x10001655
mov eax, dword [esi + 0x6c0]
add eax, 1
mov dword [esi + 0x6c0], eax
js 0x100017a8
cmp eax, dword [esi + 0x6c4]
jl 0x100017b2
mov dword [esi + 0x6c0], 0
mov eax, dword [esi + 0x18]
push 0xafc8
call eax
add edi, 0x2d
lea eax, [esi + 0xe4]
lea ebx, [esi + 0xd4]
cmp edi, 0x708
jl 0x10001655
mov dword [esi + 0x6c4], 1
xor edi, edi
mov word [ebp - 4], 0xbb01
mov edx, 2
movzx eax, word [ebp - 4]
mov dword [esi + 0x6c0], edi
mov word [esi + 0x622], ax
mov word [esi + 0x620], dx
mov dword [esi + 0x624], 0xc15b1c67
mov eax, dword [esi + 0x6c4]
mov word [ebp - 8], 0xbb01
lea ecx, [eax + 0x62]
add ecx, ecx
inc eax
mov dword [esi + 0x6c4], eax
movzx eax, word [ebp - 8]
jmp 0x10001638
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x28], eax
mov edi, ecx
call fcn.100019c0
push 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0x775c3a63
push ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x15], 0x32336d65
push eax
lea eax, [esi + 4]
mov dword [ebp - 0xf], 0x652e646d
push eax
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x1a], 0x7379735c
mov dword [ebp - 0x1f], 0x776f646e
mov word [ebp - 0xb], 0x6578
mov word [ebp - 0x11], 0x635c
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 9], 0
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x1b], 0x73
mov dword [ebp - 0x34], 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
call eax
test eax, eax
jne 0x10001b2c
mov dword [ebp - 0x28], 0x92
jmp 0x10001c04
push 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0xc
push eax
lea eax, [esi + 8]
mov dword [ebp - 0x3c], 0
push eax
mov eax, dword [edi + 0x2c]
lea ebx, [esi + 0xc]
push ebx
mov dword [ebp - 0x38], 1
call eax
test eax, eax
jne 0x10001b64
mov dword [ebp - 0x28], 0x9b
jmp 0x10001c04
lea eax, [ebp - 0x9c]
push 0x44
push eax
call fcn.10003378
xor eax, eax
mov dword [ebp - 0x9c], 0x44
mov word [ebp - 0x6c], ax
mov eax, dword [ebx]
mov dword [ebp - 0x64], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x50]
push 0x10
push eax
mov dword [ebp - 0x70], 0x101
call fcn.10003378
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x50]
add esp, 0x10
test ecx, ecx
push eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x24]
cmovne eax, ecx
push 0
push eax
mov eax, dword [edi + 0x30]
call eax
test eax, eax
jne 0x10001bdc
mov dword [ebp - 0x28], 0xb5
jmp 0x10001c04
mov eax, dword [ebp - 0x4c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x50]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x48]
push 8
push edi
mov dword [esi + 0x24], eax
call fcn.10003409
add esp, 8
test eax, eax
jne 0x10001c37
mov dword [ebp - 0x28], 0xc3
push 2
lea eax, [ebp - 0x28]
mov edx, 6
push eax
movzx eax, byte [esi]
mov ecx, edi
push eax
call fcn.10002570
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.100019c0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100059d0
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
mov dword [eax], edi
mov dword [eax + 4], esi
push 0x10001840
mov dword [esi + 0x14], 1
call fcn.10003460
add esp, 4
push eax
mov eax, dword [edi + 0x20]
push 0
push 0
call eax
mov dword [esi + 0x18], eax
test eax, eax
jne 0x10001c6c
mov dword [eax], 1
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100059d0
mov esp, ebp
pop ebp
ret
Function at 0x10001db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov word [ebp - 0x13], 0x7365
push ebx
push 0x80
push 3
push ebx
push 1
mov esi, ecx
mov dword [ebp - 0x23], 0x73755c3a
push 0x80000000
lea eax, [ebp - 0x24]
mov dword [ebp - 8], 0x696e69
push eax
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1f], 0x5c737265
mov word [ebp - 0x1b], 0x7570
mov dword [ebp - 0xc], 0x2e6e6f69
mov dword [ebp - 0x18], 0x5c63696c
mov dword [ebp - 0x11], 0x70697263
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0xd], 0x74
call eax
mov dword [ebp - 0x28], eax
lea edi, [esi + 0xd4]
cmp eax, 0xffffffff
je 0x10001e62
push ebx
lea ecx, [ebp - 0x2c]
push ecx
push 0x10
push edi
push eax
mov eax, dword [esi + 0x38]
call eax
test eax, eax
je 0x10001e52
cmp dword [ebp - 0x2c], 0x10
mov eax, 1
cmove ebx, eax
push dword [ebp - 0x28]
mov eax, dword [esi + 0x1c]
call eax
test ebx, ebx
jne 0x10001ef3
mov eax, dword [esi + 0xb8]
push edi
call eax
test eax, eax
je 0x10001eb3
xor edx, edx
nop dword [eax]
nop word [eax + eax]
imul ecx, dword [esi + 0x604], 0x343fd
add ecx, 0x269ec3
imul eax, ecx, 0x343fd
movsx ecx, cl
add eax, 0x269ec3
mov dword [esi + 0x604], eax
movsx eax, al
imul ecx, eax
mov byte [edx + edi], cl
inc edx
cmp edx, 0x10
jb 0x10001e80
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x44]
call eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x40]
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001ef3
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 0x3c]
push 0x10
push edi
push ebx
call eax
mov eax, dword [esi + 0x1c]
push ebx
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100059d0
mov esp, ebp
pop ebp
ret
Function at 0x10001f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1a4], eax
push esi
push edi
mov esi, ecx
call fcn.10001db0
lea eax, [esp + 0x1a0]
mov word [esp + 0x1a0], 0x7962
push eax
mov eax, dword [esi + 0x64]
push 0
push 0
push 0
mov dword [esp + 0x1b3], 0x756f4365
mov byte [esp + 0x1b2], 0x74
mov word [esp + 0x1b8], 0x74
mov byte [esp + 0x1b7], 0x6e
call eax
mov edi, eax
test edi, edi
je 0x10001f8d
mov eax, dword [esi + 0x60]
call eax
cmp eax, 0xb7
jne 0x10001fa3
mov eax, dword [esi + 0x1c]
push edi
call eax
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.100059d0
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x84]
push 0x202
call eax
lea eax, [esi + 0xe4]
mov dword [esi + 0x4f8], eax
mov dword [esi + 0x6c8], eax
mov eax, dword [esi + 0x50]
call eax
imul eax, eax, 0x2c31
lea edi, [esi + 0x500]
mov dword [esp + 0xc], 0x1ff
mov dword [esi + 0x604], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push edi
call eax
test eax, eax
jne 0x10001ffa
mov word [edi], 0x3f
mov eax, dword [esi + 0x4c]
push edi
call eax
inc eax
mov dword [esi + 0x6e4], 0xffffffff
mov dword [esi + 0x600], eax
lea eax, [esi + 0x6cc]
push eax
mov eax, dword [esi + 0x54]
call eax
mov ecx, dword [esp + 0x1ac]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.100059d0
mov esp, ebp
pop ebp
ret
Function at 0x10002330
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
push edi
xor edi, edi
mov dword [ebp - 0x230], ebx
mov edx, dword [ebx + 0x6e4]
xor esi, esi
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x22c], ecx
nop dword [eax]
mov eax, dword [ebx + 0x94]
test ecx, ecx
je 0x1000244d
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11c], edx
push ecx
push 0
push 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x120], 1
push ecx
push 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
call eax
test eax, eax
js 0x10002557
jne 0x100023bf
inc edi
jmp 0x100024d4
push 0
mov eax, 5
sub eax, esi
push eax
lea eax, [ebp - 0xc]
add eax, esi
push eax
push dword [ebp - 0x234]
mov eax, dword [ebx + 0x9c]
call eax
test eax, eax
jle 0x10002557
add esi, eax
inc edi
cmp esi, 5
jne 0x100024d4
cmp byte [ebp - 0xc], 0x17
jne 0x10002557
cmp byte [ebp - 0xb], 3
jne 0x10002557
cmp byte [ebp - 0xa], 3
jne 0x10002557
movzx eax, byte [ebp - 9]
mov byte [ebp - 0x227], al
movzx eax, byte [ebp - 8]
mov byte [ebp - 0x228], al
movzx ebx, word [ebp - 0x228]
mov dword [ebp - 0x238], ebx
test ebx, ebx
je 0x10002557
mov ebx, dword [ebp - 0x230]
xor ecx, ecx
mov dword [ebp - 0x22c], ecx
xor esi, esi
jmp 0x100024da
mov ebx, dword [ebp - 0x238]
mov ecx, ebx
sub ecx, esi
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x23c], ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], 1
push ecx
push 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0
call eax
test eax, eax
js 0x10002557
jne 0x1000249b
inc edi
jmp 0x100024ce
mov ecx, dword [ebp - 0x230]
push 0
push dword [ebp - 0x23c]
lea eax, [ecx + 0x6ec]
add eax, esi
push eax
push dword [ebp - 0x234]
mov eax, dword [ecx + 0x9c]
call eax
test eax, eax
jle 0x10002557
add esi, eax
cmp esi, ebx
je 0x100024ea
mov ebx, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x22c]
cmp edi, 0x5a
jge 0x10002557
mov edx, dword [ebp - 0x234]
jmp 0x10002370
mov esi, dword [ebp - 0x238]
xor ebx, ebx
test esi, esi
je 0x10002557
mov edi, dword [ebp - 0x230]
nop dword [eax]
mov eax, dword [edi + 0x6c8]
lea edx, [edi + ebx]
movzx ecx, bl
inc ebx
mov al, byte [ecx + eax]
xor byte [edx + 0x6ec], al
cmp ebx, esi
jb 0x10002500
cmp esi, 2
jb 0x10002557
lea eax, [esi - 2]
mov dword [edi + 0x618], eax
movsx eax, byte [edi + 0x6ec]
mov dword [edi + 0x610], eax
mov al, byte [edi + 0x6ed]
mov byte [edi + 0x614], al
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100059d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100059d0
mov esp, ebp
pop ebp
ret
Function at 0x10002570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
add eax, 7
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x58]
lea ebx, [esi + 0x6cc]
push ebx
call eax
cmp dword [esi + 0x6e8], 0
je 0x100025a9
mov eax, dword [esi + 0x5c]
push ebx
call eax
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
push edi
lea edi, [edx + 2]
cmp edi, 0xffff
ja 0x100025dc
movzx ecx, di
mov eax, ecx
mov word [esi + 0x106eb], 0x317
shr eax, 8
mov byte [esi + 0x106ed], 3
mov byte [esi + 0x106ee], al
mov byte [esi + 0x106ef], cl
mov eax, dword [ebp - 4]
mov byte [esi + 0x106f0], al
mov al, byte [ebp + 8]
mov byte [esi + 0x106f1], al
test edx, edx
je 0x10002605
lea eax, [esi + 0x106f2]
push eax
push edx
push dword [ebp + 0xc]
call fcn.1000339f
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x1000262a
nop dword [eax + eax]
mov eax, dword [esi + 0x6c8]
lea edx, [esi + ebx]
movzx ecx, bl
inc ebx
mov al, byte [ecx + eax]
xor byte [edx + 0x106f0], al
cmp ebx, edi
jb 0x10002610
push dword [ebp - 8]
mov edx, dword [esi + 0x6e4]
lea eax, [esi + 0x106eb]
push eax
push ecx
mov ecx, esi
call fcn.100034b0
mov ecx, dword [esi + 0x5c]
add esp, 0xc
test eax, eax
lea eax, [esi + 0x6cc]
pop edi
push eax
jne 0x10002668
mov dword [esi + 0x6e8], 1
call ecx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call ecx
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret