joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1001f87f
pop dword [ebp - 4]
mov eax, 0xfce2ed56
sub eax, 0xece0f4d7
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x43359
push 0
mov eax, 0x1465d21d
add eax, 0xfb9d8ebf
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0xe293a87f
sub ecx, 0xe2935560
xor edi, edi
add edi, eax
mov ebx, 0xf12aac99
add ebx, 0x1ed91167
add ebx, dword [ebp - 4]
mov esi, 0x8e66575c
add esi, 0xe42a65e
mov edx, dword [ebx]
xor edx, esi
mov dword [edi], edx
add edi, 0xf5a99e89
add edi, 0xa56617b
add ebx, 0x816f59ab
sub ebx, 0x816f59a7
loop 0x1001f8e0
add eax, 0xc9fba3e7
add eax, 0x36059b68
mov ebx, eax
add eax, 0x428baac6
add eax, 0xbd74553f
mov ecx, 0xdc98c7e5
add ecx, 0x3367381b
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001f870
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001f870
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x10001760
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1004b7a0
push 0x10018c50
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1004f054]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, dword [0x10051b4c]
lea edx, [ebp - 0x30]
push edx
push 0x28
push ecx
call eax
test eax, eax
js 0x100017cd
lea eax, [ebp - 0x38]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x100017d8
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x10001825
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 4
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [0x10051b5c]
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push dword [ebp - 0x30]
call eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000181c
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10017373
mov esp, ebp
pop ebp
ret
Function at 0x100022c0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x102c
call fcn.10018410
mov eax, dword [0x1004f054]
xor eax, esp
mov dword [esp + 0x1028], eax
push ebx
push esi
push edi
push 0x100
lea eax, [esp + 0x48]
mov dword [esp + 0x34], 0x11c
push 0
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.10019c10
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [esp + 0x146], ax
mov dword [esp + 0x148], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 6
xor ecx, ecx
mov dword [esp + 0x44], 0
push eax
mov word [esp + 0x154], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1000241b
mov eax, dword [0x10051b48]
test eax, eax
je 0x1000241b
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0
push 0
push 0x2000000
push 0
call eax
test eax, eax
jne 0x100024b3
nop dword [eax]
mov edx, dword [esp + 0x10]
test edx, edx
jne 0x100023ac
xor ecx, ecx
jmp 0x100023cc
mov eax, dword [0x10051b60]
lea ecx, [esp + 0x18]
push 0
push 0x18
push ecx
push 0
push edx
call eax
mov edx, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
cmovns ecx, dword [esp + 0x28]
call fcn.10001850
mov ecx, dword [0x10051b74]
cmp ecx, dword [0x10051b78]
je 0x100023ee
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
add dword [0x10051b74], 4
jmp 0x100023f9
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.10002c50
mov eax, dword [0x10051b48]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x2000000
push dword [esp + 0x20]
call eax
test eax, eax
je 0x100023a0
jmp 0x100024b3
lea eax, [esp + 0x10]
push eax
push 0x1000
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x100024cd
xor edi, edi
test dword [esp + 0x10], 0xfffffffc
jbe 0x100024b3
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop word [eax + eax]
cmp dword [esp + edi*4 + 0x30], 0
je 0x100024a7
mov esi, dword [esp + edi*4 + 0x30]
call ebx
cmp esi, eax
je 0x100024a7
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x100024a7
mov ecx, dword [esp + edi*4 + 0x30]
mov edx, esi
call fcn.10001850
mov eax, dword [0x10051b74]
cmp eax, dword [0x10051b78]
je 0x1000249c
mov dword [eax], esi
add dword [0x10051b74], 4
jmp 0x100024a7
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.10002c50
mov eax, dword [esp + 0x10]
inc edi
shr eax, 2
cmp edi, eax
jb 0x10002450
call fcn.10002210
mov ecx, dword [esp + 0x1034]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10017373
mov esp, ebp
pop ebp
ret
call fcn.1000a1e0
int3
Function at 0x10003a50
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x1004f054]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x48], 0x224
lea eax, [esp + 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10003c09
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
lea eax, [esp + 0x48]
push eax
push esi
call edi
test eax, eax
je 0x10003bca
nop word [eax + eax]
mov ecx, 0x7d
xor edx, edx
mov al, byte [edx + 0x10048f44]
xor al, cl
inc ecx
mov byte [esp + edx + 0x18], al
and ecx, 0x800000ff
jns 0x10003ae4
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x10003ac7
lea eax, [esp + 0x18]
mov byte [esp + 0x25], 0
push eax
lea eax, [esp + 0x16c]
or ebx, 1
push eax
call fcn.10018fe0
add esp, 8
test eax, eax
jne 0x10003b3b
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x676f7250
push eax
lea eax, [esp + 0x16c]
mov dword [esp + 0x18], 0x6d6172
push eax
or ebx, 2
call fcn.10018fe0
add esp, 8
test eax, eax
jne 0x10003b3b
mov al, 1
jmp 0x10003b3d
xor al, al
test bl, 2
je 0x10003b4e
xorps xmm0, xmm0
and ebx, 0xfffffffd
movq qword [esp + 0x10], xmm0
and ebx, 0xfffffffe
mov dword [esp + 0x20], 0
mov word [esp + 0x24], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
test al, al
je 0x10003bba
mov edx, 0xc1
xor eax, eax
mov cl, byte [eax + 0x10048f54]
xor cl, dl
inc edx
mov byte [esp + eax + 0x28], cl
and edx, 0x800000ff
jns 0x10003b91
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x1e
jl 0x10003b74
lea eax, [esp + 0x168]
mov byte [esp + 0x46], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10003c1e
lea eax, [esp + 0x48]
push eax
push esi
call edi
test eax, eax
jne 0x10003ac0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x48], 0x224
lea eax, [esp + 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
jne 0x10003aa6
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10017373
mov esp, ebp
pop ebp
ret
call fcn.1000e930
int3
Function at 0x10005560
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b840
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1004f054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10017643
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10015ea3
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x4c], 0
mov eax, dword [0x10051ba4]
mov ecx, dword [0x10051ba8]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b860
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10017643
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10015ea3
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006c10
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10006bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0
Function at 0x10008320
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x20]
call fcn.10008520
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp - 0x20]
mov dword [edi], ebx
cmp dword [ebp - 0x54], ebx
jbe 0x1000843d
nop
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
jne 0x10008434
cmp dword [ebp - 0x2c], 0x1000
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ebx
jne 0x10008431
cmp dword [ebp - 0x28], 1
je 0x10008431
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x5c]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10008431
mov eax, dword [ebp - 8]
mov edi, 0
mov ecx, dword [ebp + 8]
sub eax, ecx
mov dword [ebp - 0x10], eax
je 0x1000842e
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
mov edx, dword [ebp - 0xc]
lea eax, [esi + edi]
mov esi, ecx
sub esi, 4
jb 0x100083e5
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x100083ea
add edx, 4
add eax, 4
sub esi, 4
jae 0x100083d4
cmp esi, 0xfffffffc
je 0x10008417
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x10008418
cmp esi, 0xfffffffd
je 0x10008417
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x10008418
cmp esi, 0xfffffffe
je 0x10008417
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x10008418
cmp esi, 0xffffffff
je 0x10008417
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
jne 0x10008418
inc ebx
mov esi, dword [ebp - 0x20]
inc edi
mov ecx, dword [ebp + 8]
cmp edi, dword [ebp - 0x10]
jb 0x100083c7
mov edi, dword [ebp + 0xc]
mov dword [edi], ebx
mov ebx, dword [ebp - 0x14]
jmp 0x10008431
mov edi, dword [ebp + 0xc]
add ebx, dword [ebp - 0x5c]
cmp ebx, dword [ebp - 0x54]
jb 0x10008360
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x20]
xor esi, esi
cmp dword [edi], esi
cmovg esi, ebx
test edx, edx
je 0x1000847d
mov ecx, dword [ebp - 0x18]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x10008473
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008486
push ecx
push edx
call fcn.1001798d
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1001f428
int3

Function at 0x100084f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10008490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000851a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
call fcn.1000a1e0
int3

Function at 0x1000a280
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000a1f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0
Function at 0x1000e610
Capabilities:
Create thread

Disassembly:
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x1000e5f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0

Function at 0x1000e660
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000e640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0

Function at 0x1000e690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c580
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x1004f054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x1004a200]
xor eax, eax
movups xmmword [ebp - 0x1b0], xmm0
mov dword [ebp - 0x130], 0x2d237ff0
movaps xmm0, xmmword [0x1004a1c0]
movups xmmword [ebp - 0x1a0], xmm0
mov word [ebp - 0x12c], 0x7e28
movaps xmm0, xmmword [0x1004a210]
movups xmmword [ebp - 0x190], xmm0
mov byte [ebp - 0x12a], 0
movaps xmm0, xmmword [0x1004a220]
movups xmmword [ebp - 0x180], xmm0
movaps xmm0, xmmword [0x1004a1e0]
movups xmmword [ebp - 0x170], xmm0
movaps xmm0, xmmword [0x1004a1d0]
movups xmmword [ebp - 0x160], xmm0
movaps xmm0, xmmword [0x1004a190]
movups xmmword [ebp - 0x150], xmm0
movaps xmm0, xmmword [0x1004a1f0]
movups xmmword [ebp - 0x140], xmm0
nop word [eax + eax]
mov cl, byte [ebp - 0x1b0]
xor byte [ebp + eax - 0x1af], cl
inc eax
cmp eax, 0x85
jb 0x1000e750
push str._nBanned_Just_Current_RunikAc_Server
lea eax, [ebp - 0x1af]
mov byte [ebp - 0x12a], 0
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.1000ec00
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x128], 0
add esp, 0xc
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x128], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000e7b5
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.10002a00
lea eax, [ebp - 0x128]
mov dword [ebp - 4], 0
push eax
xor edx, edx
push 1
push 0
lea ecx, [edx + 0x3c]
call fcn.1000dde0
mov edx, dword [ebp - 0x114]
add esp, 0xc
cmp edx, 0x10
jb 0x1000e826
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000e81c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e83f
push edx
push ecx
call fcn.1001798d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017373
mov esp, ebp
pop ebp
ret
call fcn.1001f428
int3

Function at 0x1000e870
Capabilities:
Create thread

Disassembly:
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10012550
call fcn.10011a80
push 0
push 0
push 0
push 0x1000e850
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0
Function at 0x1000e8d0
Capabilities:
Create thread

Disassembly:
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10012710
call fcn.10011a80
push 0
push 0
push 0
push 0x1000e8b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0

Function at 0x1000e930
Capabilities:
Create thread

Disassembly:
push ecx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10012390
call fcn.10011a80
push 0
push 0
push 0
push 0x1000e910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1000a1e0
int3

Function at 0x1000e990
Capabilities:
Create thread

Disassembly:
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x1000e970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0

Function at 0x1000e9e0
Capabilities:
Create thread

Disassembly:
push ecx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100128d0
call fcn.10011a80
push 0
push 0
push 0
push 0x1000e9c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1000a1e0
int3

Function at 0x1000ea40
Capabilities:
Create thread

Disassembly:
call fcn.10012a90
call fcn.10011a80
push 0
push 0
push 0
push 0x1000ea20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0

Function at 0x1000eab0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000ea70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0

Function at 0x1000eb20
Capabilities:
Create thread

Disassembly:
push ecx
call fcn.10012e10
call fcn.10011a80
push 0
push 0
push 0
push 0x1000eb00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1000a1e0
int3

Function at 0x1000eb80
Capabilities:
Create thread

Disassembly:
call fcn.10012fd0
call fcn.10011a80
push 0
push 0
push 0
push 0x1000eb60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp fcn.1000a1e0
Function at 0x1000ee10
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x10051318
call fcn.10019c10
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x1000ee3b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x1000ee46
bts eax, 6
shr ecx, 1
test cl, 1
je 0x1000ee51
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000ee5c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x1000ee67
bts eax, 3
shr ecx, 1
test cl, 1
je 0x1000ee72
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000ee7d
bts eax, 1
test cl, 2
je 0x1000ee86
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x1000ef1f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x1000ef10
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x10051318], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x1000ee30
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ef50
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1004f054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x100496b4
push eax
or ebx, 0xffffffff
call fcn.100211a1
add esp, 8
mov dword [ebp - 0x408], eax
test eax, eax
jne 0x1000ef96
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017373
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax + eax]
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.100209d1
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x1000efed
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10051318]
sub edx, 1
jne 0x1000efc5
mov eax, dword [ebp - 0x408]
cmp edi, 0x400
je 0x1000efa0
push dword [ebp - 0x408]
call fcn.1001fddc
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.10017373
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f070
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000f020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
call fcn.1001f7a9
int3
Function at 0x1000fa20
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
mov esi, dword [eax + 0xc]
mov eax, dword [esi + 0xc]
add esi, 0xc
cmp eax, esi
je 0x1000fa45
test eax, eax
je 0x1000fa45
mov ecx, dword [eax + 0x18]
cmp edx, ecx
je 0x1000fa49
mov eax, dword [eax]
cmp eax, esi
jne 0x1000fa34
xor al, al
pop esi
ret
mov edx, dword [0x10051b7c]
pop esi
mov dword [edx], ecx
mov ecx, dword [eax + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0x30]
mov dword [edx + 0x18], ecx
movzx ecx, word [eax + 0x2c]
mov word [edx + 0x14], cx
movzx ecx, word [eax + 0x2e]
mov word [edx + 0x16], cx
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x10], ecx
movzx ecx, word [eax + 0x24]
mov word [edx + 0xc], cx
mov ax, word [eax + 0x26]
mov word [edx + 0xe], ax
mov al, 1
ret