joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001900
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x1000c498], 1
jne 0x1000191f
test byte [0x1000c497], 1
jne 0x1000193e
jmp 0x1000196b
push str.LIBUNWIND_PRINT_APIS
call sym._getenv
add esp, 4
mov byte [0x1000c498], 1
test eax, eax
setne byte [0x1000c497]
je 0x1000196b
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call dbg.fprintf
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sym._fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x1000a3c8]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x10001990
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x1000c498], 1
jne 0x100019aa
test byte [0x1000c497], 1
jne 0x100019c9
jmp 0x100019f5
push str.LIBUNWIND_PRINT_APIS
call sym._getenv
add esp, 4
mov byte [0x1000c498], 1
test eax, eax
setne byte [0x1000c497]
je 0x100019f5
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call dbg.fprintf
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sym._fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [0x1000a3c8]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x10001a10
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x1000c498], 1
jne 0x10001a34
test byte [0x1000c497], 1
jne 0x10001a53
jmp 0x10001a81
push str.LIBUNWIND_PRINT_APIS
call sym._getenv
add esp, 4
mov byte [0x1000c498], 1
test eax, eax
setne byte [0x1000c497]
je 0x10001a81
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call dbg.fprintf
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sym._fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [0x1000a3c8]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001ab0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x1000c498], 1
jne 0x10001acf
test byte [0x1000c497], 1
jne 0x10001aee
jmp 0x10001b1b
push str.LIBUNWIND_PRINT_APIS
call sym._getenv
add esp, 4
mov byte [0x1000c498], 1
test eax, eax
setne byte [0x1000c497]
je 0x10001b1b
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_is_fpreg_cursor_p__regNum_d__n
push eax
call dbg.fprintf
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sym._fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x1000a3c8]
mov ecx, esi
push ebx
call edi
movzx eax, al
pop esi
pop edi
pop ebx
ret

Function at 0x10001b40
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x1000c498], 1
jne 0x10001b5f
test byte [0x1000c497], 1
jne 0x10001b7e
jmp 0x10001bab
push str.LIBUNWIND_PRINT_APIS
call sym._getenv
add esp, 4
mov byte [0x1000c498], 1
test eax, eax
setne byte [0x1000c497]
je 0x10001bab
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_regname_cursor_p__regNum_d__n
push eax
call dbg.fprintf
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sym._fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x38]
mov ecx, edi
call dword [0x1000a3c8]
mov ecx, esi
push ebx
call edi
pop esi
pop edi
pop ebx
ret

Function at 0x10001bd0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x1000c498], 1
jne 0x10001bea
test byte [0x1000c497], 1
jne 0x10001c09
jmp 0x10001c35
push str.LIBUNWIND_PRINT_APIS
call sym._getenv
add esp, 4
mov byte [0x1000c498], 1
test eax, eax
setne byte [0x1000c497]
je 0x10001c35
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_is_signal_frame_cursor_p__n
push eax
call dbg.fprintf
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sym._fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x2c]
mov ecx, edi
call dword [0x1000a3c8]
mov ecx, esi
call edi
movzx eax, al
pop esi
pop edi
ret
Function at 0x10001c50
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
cmp byte [0x1000c498], 1
jne 0x10001c6d
test byte [0x1000c497], 1
jne 0x10001c8c
jmp 0x10001cb8
push str.LIBUNWIND_PRINT_APIS
call sym._getenv
add esp, 4
mov byte [0x1000c498], 1
test eax, eax
setne byte [0x1000c497]
je 0x10001cb8
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_iterate_dwarf_unwind_cache_func_p__n
push eax
call dbg.fprintf
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sym._fflush
add esp, 4
push 0x1000c490
call sym._AcquireSRWLockExclusive_4
mov edi, dword [0x1000c008]
cmp edi, dword [0x1000c00c]
jae 0x10001cff
mov ebx, dword [edi]
mov eax, dword [edi + 4]
mov dword [esp], eax
mov ecx, esi
mov esi, dword [edi + 8]
mov ebp, dword [edi + 0xc]
call dword [0x1000a3c8]
push ebx
push ebp
push esi
mov esi, ecx
push dword [esp + 0xc]
call ecx
add esp, 0x10
add edi, 0x10
cmp edi, dword [0x1000c00c]
jb 0x10001cd0
push 0x1000c490
call sym._ReleaseSRWLockExclusive_4
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100024a0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x1000c496], 1
jne 0x100024b3
movzx eax, byte [0x1000c495]
and al, 1
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sym._getenv
add esp, 4
test eax, eax
setne al
setne byte [0x1000c495]
mov byte [0x1000c496], 1
and al, 1
ret

Function at 0x100024e0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x1000c49a], 1
jne 0x100024f3
movzx eax, byte [0x1000c499]
and al, 1
ret
push str.LIBUNWIND_PRINT_DWARF
call sym._getenv
add esp, 4
test eax, eax
setne al
setne byte [0x1000c499]
mov byte [0x1000c49a], 1
and al, 1
ret
Function at 0x10005720
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1014
call sym.__alloca
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0x1000
push edx
push eax
call sym._K32EnumProcessModules_16
test eax, eax
je 0x1000584a
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x100058b3
shr ecx, 2
mov dword [esp + 8], ecx
jmp 0x10005783
mov edx, dword [esp + 0xc]
inc edx
xor eax, eax
mov ecx, dword [esp + 8]
cmp edx, ecx
je 0x100058b3
mov dword [esp + 0xc], edx
mov esi, dword [esp + edx*4 + 0x14]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x102c]
mov dword [edx], esi
mov dword [esp], esi
movzx ebx, word [esi + eax + 6]
test ebx, ebx
je 0x10005770
add eax, dword [esp]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp + 4], 0
xor ecx, ecx
jmp 0x100057d2
mov ecx, esi
mov eax, ecx
and al, byte [esp + 4]
test al, 1
jne 0x10005846
add ebp, 0x28
dec ebx
je 0x10005770
mov esi, ecx
mov edi, dword [ebp + 0xc]
add edi, dword [esp]
push 8
push str..text
push ebp
call sym._strncmp
add esp, 0xc
test eax, eax
je 0x10005820
push 8
push str..eh_frame
push ebp
call sym._strncmp
add esp, 0xc
test eax, eax
jne 0x100057c0
mov ecx, dword [esp + 0x102c]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp + 4], eax
jmp 0x100057c0
mov eax, dword [ebp + 8]
add eax, edi
mov edx, dword [esp + 0x1028]
cmp edi, edx
setbe cl
cmp eax, edx
seta al
and al, cl
mov ecx, esi
or cl, al
mov eax, ecx
and al, byte [esp + 4]
test al, 1
je 0x100057cc
mov al, 1
jmp 0x100058b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x1000c496], 1
jne 0x10005866
test byte [0x1000c495], 1
jne 0x10005885
jmp 0x100058b1
push str.LIBUNWIND_PRINT_UNWINDING
call sym._getenv
add esp, 4
mov byte [0x1000c496], 1
test eax, eax
setne byte [0x1000c495]
je 0x100058b1
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call dbg.fprintf
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sym._fflush
add esp, 4
xor eax, eax
add esp, 0x1014
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x10006a50
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
call sym._logAPIs
test al, al
je 0x10006a97
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push ebp
push ebx
push edi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call dbg.fprintf
add esp, 0x14
push 2
call esi
add esp, 4
push eax
call sym._fflush
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp sym.libunwind.dll_unw_set_reg
Function at 0x100076a0
Capabilities:
Write file on windows

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp], eax
push 2
call sym.___acrt_iob_func
add esp, 4
push eax
push 1
push 0x1b
push str.Mingw_w64_runtime_failure:_n
call sym._fwrite
add esp, 0x10
push 2
call sym.___acrt_iob_func
add esp, 4
push dword [esp]
push esi
push eax
call dbg.vfprintf
add esp, 0xc
call sym._abort
int3

Function at 0x10007880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x10007891
jmp dword [eax*4 + 0x1000a210]
cmp dword [0x1000c06c], 0
je 0x100079a0
push 0x1000c070
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x1000c088]
test edi, edi
je 0x10007995
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100078db
mov edi, dword [edi + 8]
test edi, edi
je 0x10007995
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x100078d0
test esi, esi
je 0x100078d0
mov ecx, dword [edi + 4]
call dword [0x1000a3c8]
push esi
call ecx
add esp, 4
jmp 0x100078d0
call dbg._fpreset
jmp case.default.0x10007891
cmp dword [0x1000c06c], 0
je case.default.0x10007891
push 0x1000c070
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x1000c088]
test edi, edi
je 0x10007988
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10007947
mov edi, dword [edi + 8]
test edi, edi
je 0x10007988
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x10007940
test esi, esi
je 0x10007940
mov ecx, dword [edi + 4]
call dword [0x1000a3c8]
push esi
call ecx
add esp, 4
jmp 0x10007940
cmp dword [0x1000c06c], 0
jne 0x1000797c
push 0x1000c070
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1000c06c], 1
jmp case.default.0x10007891
push 0x1000c070
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x10007891
push 0x1000c070
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1000c06c]
cmp eax, 1
jne case.default.0x10007891
mov eax, dword [0x1000c088]
test eax, eax
je 0x100079d2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sym._free
add esp, 4
mov eax, esi
test esi, esi
jne 0x100079c0
mov dword [0x1000c088], 0
mov dword [0x1000c06c], 0
push 0x1000c070
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007b00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x1000a1f0]
xor eax, eax
cmp word [esi], 0x5a4d
jne 0x10007b66
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x10007b66
add esi, ecx
cmp word [esi + 0x18], 0x10b
jne 0x10007b66
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x10007b66
mov edx, dword [esp + 0xc]
sub edx, dword [0x1000a1f0]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x10007b56
add esi, 0x28
dec ecx
je 0x10007b66
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x10007b50
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x10007b50
mov eax, esi
pop esi
pop edi
ret

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x100922a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1f236ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 3
mov byte [ebp - 0x26], 0x8a
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 3
mov byte [ebp - 0x23], 0xff
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x21], 5
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0xc
mov byte [ebp - 0x1d], 0x29
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0x1c
mov byte [ebp - 0x1a], 0x42
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0x50
mov byte [ebp - 0x14], 0x56
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0x11], 0x77
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0xf2
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x45
mov byte [ebp - 0xa], 0xff
mov byte [ebp - 9], 0xff
mov byte [ebp - 8], 0xff
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
cmp ecx, 0x20
jne 0x1009236b
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
cmp eax, 0x52
jne 0x1009236b
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x41
jne 0x1009236b
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp ecx, 0x53
jne 0x1009236b
mov al, 1
jmp 0x1009244a
mov dword [ebp - 0x2c], 0
jmp 0x1009237d
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x28]
cmp ecx, 0xff
je 0x100923d7
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x2c]
imul ecx, ecx, 3
movzx edx, byte [ebp + ecx - 0x28]
cmp eax, edx
jne 0x100923d5
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x2c]
imul edx, edx, 3
movzx eax, byte [ebp + edx - 0x27]
cmp ecx, eax
jne 0x100923d5
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 2]
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x26]
cmp edx, ecx
jne 0x100923d5
mov al, 1
jmp 0x1009244a
jmp 0x10092374
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
test eax, eax
jne 0x100923f4
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 1]
cmp edx, 0xfc
jne 0x100923f4
mov al, 1
jmp 0x1009244a
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 3]
test ecx, ecx
jne 0x1009242d
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 4]
cmp eax, 0x30
jne 0x1009242d
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 5]
test edx, edx
jne 0x1009242d
call fcn.100cfb30
xor edx, edx
mov ecx, 0x64
div ecx
cmp eax, 4
jne 0x1009242d
mov al, 1
jmp 0x1009244a
push 6
push 0x1eee644
mov edx, dword [ebp + 8]
push edx
call fcn.1013b2c1
add esp, 0xc
test eax, eax
jne 0x10092448
mov al, 1
jmp 0x1009244a
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1013ad0a
mov esp, ebp
pop ebp
ret
Function at 0x100a8bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1eda2c8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1f236ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.100a8ab0
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100a8ceb
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100af940
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x14], 0x10
jb 0x100a8c65
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov dword [ebp - 0x8c], edx
jmp 0x100a8c6e
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x8c], eax
push 0x1eef86c
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.1013ed6a
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10044170
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100a8ceb
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.1013f061
add esp, 0x10
mov edx, dword [ebp - 0x4c]
push edx
call fcn.1013e9d3
add esp, 4
mov byte [ebp - 0x4d], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100732f0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4d]
jmp 0x100a8d13
mov byte [ebp - 0x4e], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100732f0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1013ad0a
mov esp, ebp
pop ebp
ret 0xc