joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1024cab1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.1024ca1f
jmp 0x1024c3e5
pushal
jmp 0x1024caed
mov eax, dword [esp]
lea eax, [esp + esi]
jmp 0x10212bee
pop edi
jmp 0x1024cbc1
xor eax, eax
jmp 0x10212abc
push 0x16
mov eax, dword [esp]
pop eax
jmp 0x10212abc
mov edi, ebx
jmp 0x1024c3f1
mov edx, esp
movzx ebx, byte [esi + 0x11]
lea edx, [ecx + edx]
push edi
jmp 0x1024c3cf
lea edi, [edi*4]
lea edi, reloc.SHLWAPI.dll_PathFindFileNameA
mov ebx, dword [edi]
pop edi
not dx
jmp 0x1024c7cc
btr ebx, ebx
mov dword [esp], edx
popal
push edi
call fcn.1024c41b
sub esp, 0x1e
mov word [esp + 5], bp
lea esp, [esp + 2]
jmp 0x1024c47c
lea esi, reloc.SHLWAPI.dll_PathFindFileNameA
mov edi, dword [esi]
pop esi
jmp 0x1024c488
push esi
mov esi, edi
lea esi, [esi*4]
jmp 0x1024c466
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
jmp 0x1024c5cd
cmc
pushal
mov eax, 0x2149f795
mov ax, 0xb9d1
lea edi, [ebx + ebx]
jmp 0x1024c431
mov ebx, dword [ebx*4 + reloc.SHLWAPI.dll_PathFindFileNameA]
pushal
push word [esp + 3]
lea esp, [esp + 2]
and ebx, ecx
call fcn.1024c4d9
mov dword [esp], edx
call fcn.1024c572
int1
jne 0x1024c53d
invalid
movzx ebx, byte [esi + 2]
stc
sub esp, 7
lea esp, [esp + 3]
jmp 0x1024c535
mov edi, esi
mov edx, dword [edi]
pop edi
mov edi, ecx
mov edi, 0x9533d449
jmp 0x1024c4a0
shr edx, 0x1e
bswap edx
add esi, 0x10
push edi
jmp 0x1024c611
jne 0x1021293e
je 0x102128ee
call 0x102298ee
sar cl, cl
bsr si, si
mov si, bx
jmp 0x1024ca84
test esi, esi
push esp
push dword [esp + 1]
lea esp, [esp + 8]
je 0x10212aa6
jne 0x1024ca8e
cmp dword [ecx + reloc.SHLWAPI.dll_PathFindFileNameA], edi
sbb byte [ebx + 0x52], bh
int 0x5c
scasd eax, dword es:[edi]
pushal
mov bh, 0xe8
mov dword [esp + 4], eax
popal
jmp 0x1024ca65
push esi
push 0x1021eb70
call fcn.10229a36
push ds
jmp 0x1024cb30
mov byte [esp + 1], dl
mov byte [esp + 2], cl
lea esp, [esp + 4]
jmp 0x1024ca35
lea esp, [esp + 0x20]
push 4
push ebp
jmp 0x1024cb0f
ror dword [ebp + reloc.SHLWAPI.dll_PathFindFileNameA], cl
lea esp, [esp + 4]
push ebx
call esi
salc
call fcn.1024cb64
jbe 0x1024cb0e
popal
add bl, dh
inc edx
js 0x1024cb15
pushal
pop es
bnd jne 0x1024cb9b
mul dword [edi + 2]
int1
add dword [edx - 0x7b], ebp
xor al, 0x85
ror byte [edi], 0x84
pop eax
pop edi
cld
invalid
test eax, eax
je 0x10212a90
call 0x1024cad8
lea esp, [esp + 4]
test eax, eax
jne 0x10212b2a
call fcn.10229cae
call fcn.1024cb7c
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
inc ebx
dec esp
int3
invalid
mov esi, dword [esp]
mov si, 0x9baf
bswap esi
mov esi, dword [esp]
jmp 0x1024e487
pop esi
ret
Function at 0x1036aeaf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 2]
pop word [esp + 5]
sub esp, 0x1c
mov ch, al
xchg ebx, eax
cld
jmp 0x1036ae40
bsf ax, si
cpuid
lea esi, reloc.SHLWAPI.dll_PathFindFileNameA
lea ebx, [edi*4]
mov al, bh
mov dword [esp + 9], esp
jmp 0x1036adcd
add di, 0x6c37
pop esi
lea esp, [esp + 1]
lea edx, [ebp*4]
mov byte [esp], al
mov dl, ah
jmp 0x1036ade3
cpuid
add esp, 7
xchg dword [esp + 3], ecx
pop esi
mov si, di
pop bx
jmp 0x1036ae6e
mov ah, byte [esp + 0x17]
lea esp, [esp + 0xa]
sbb edx, eax
lea esp, [esp + 6]
mov byte [esp], dl
xchg word [esp + 7], cx
jmp 0x1036ae23
mov ax, 0x957d
rcr ah, cl
mov ebx, dword [esp]
mov edx, 0x3947bf7b
jmp 0x1036ae86
pop word [esp]
cld
lea ebp, [ecx*4]
bsf eax, edx
mov byte [esp], bh
pop word [esp]
jmp 0x1036ae58
push word [esp]
std
push word [esp + 4]
xchg byte [esp + 3], ch
cmc
pushfd
jmp 0x1036aed1
stc
mov ebx, edi
mov word [esp + 3], dx
xchg byte [esp + 1], dh
setl bl
cpuid
jmp 0x1036aebb
mov esi, dword [esp + 2]
pushfd
add edi, edx
jmp 0x1036ae0b
mov ah, byte [esp + 4]
sub bh, 0xe
and ah, ah
pop si
push word [esp + 1]
jmp 0x1036af20
cpuid
sub cl, al
rdtsc
std
xchg ebx, ebp
bsr eax, esp
jmp 0x1036ae98
cmp bl, 0xad
mov di, 0xde61
mov si, 0xbc8b
rdtsc
setns cl
bswap ebp
jmp 0x1036aeff

Function at 0x1036affc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, esi
setns ah
lea ebx, [esi*4]
jmp 0x1036b01b

Function at 0x1036b1cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ah, dl
clc
stc
stc
jmp 0x1036b1d8
mov byte [esp + 0x24], dl
mov bx, 0xe330
cmc
mov byte [esp + 0x15], bh
mov bp, word [esp + 2]
btc ebx, esi
jmp 0x1036b2c2
push di
xchg word [esp + 0xd], si
rdtsc
push word [esp + 1]
xchg edx, edi
push dword [esp + 0x22]
bts bx, sp
jmp 0x1036b220
Function at 0x1036b56f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 8], dx
xor si, bx
mov byte [esp + 2], ah
xchg byte [esp + 9], dh
jmp 0x1036b51d
cld
lea edi, [ecx + ebp]
setge cl
lea edx, [ecx*4]
not ch
shr dx, 4
jmp 0x1036b4d3
and bx, 0x7c99
mov esi, esp
dec bh
push eax
xchg cx, ax
lea esi, [esi*4]
jmp 0x1036b4e9
lea ebx, [ecx + ebp]
xchg byte [esp + 8], ch
rdtsc
mov edi, dword [esp + 0xa]
lea esi, [ebp*4]
mov ax, word [esp + 7]
jmp 0x1036b559
bswap edi
pop cx
xchg byte [esp + 8], bh
lea edx, [esp + eax]
lea eax, [edi*4]
mov al, byte [esp + 0xa]
jmp 0x1036b508
not bp
xchg dword [esp + 9], edi
bsr cx, dx
mov bx, 0x902e
jmp 0x1036b581
lea ecx, [ebp + 0x7a]
push dword [esp + 0xa]
rdtsc
mov ebp, dword [esp + 0xc]
mov ax, di
jmp 0x1036b541
xchg ch, al
mov cx, word [esp + 6]
lea edi, reloc.SHLWAPI.dll_PathFindFileNameA
sub esp, 0x13
xchg ebx, eax
cpuid
jmp 0x1036b76e
lea eax, reloc.SHLWAPI.dll_PathFindFileNameA
cld
call fcn.1036b67d
inc di
xchg bl, al
mov word [esp + 2], bx
not cx
setl al
jmp 0x1036b7bf
mov al, cl
cpuid
mov bx, bp
cmc
pop dword [esp]
lea ebx, [edx*4]
jmp 0x1036b7ee
mov byte [esp + 3], dh
stc
mov edi, 0x21be7c55
adc esi, 0x7deb2e41
pop si
mov esi, 0x39d305c6
jmp 0x1036b7a2
lea esp, [esp + 1]
mov word [esp], ax
xchg dl, bl
mov dl, 0xd2
cpuid
jmp 0x1036b843
mov bp, word [esp + 3]
mov dword [esp], edx
mov eax, dword [esp + 1]
pop bx
push word [esp]
not ecx
jmp 0x1036b7d8
bts edx, ebx
shl bp, 0xf
bt ax, si
xchg dword [esp + 5], edi
pop word [esp + 5]
mov word [esp + 0xc], si
jmp 0x1036b854
mov bx, bp
rcl bp, cl
dec esi
mov dl, 0x61
bts ebp, esi
sub esp, 0xf
jmp 0x1036b81e
xchg dword [esp + 4], edx
pushfd
rol ch, 6
add cx, ax
mov word [esp + 4], bp
neg bh
jmp 0x1036b89b
pop dword [esp]
setge al
pop ebx
bswap ebx
call fcn.1036c2f9
sbb byte [ebp + 0x14a7540d], bl
insb byte es:[edi], dx
jg 0x1036b829
lea ebp, [edi*4]
sub al, 0xbd
add byte [eax], al
add byte [eax], al
mov ebp, 0xc3ba1df4
bswap ebp
mov esi, 0xe0caaa46
lea esp, [esp + 0xa]
mov eax, edi
jmp 0x1036b885

Function at 0x1036b8ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ecx
rdtsc
jmp 0x1036b95b
lea esi, [eax + edi]
push word [esp + 0x15]
rdtsc
xchg byte [esp + 1], dh
sub esp, 0x15
cmc
jmp 0x1036b8f1
lea ebx, reloc.SHLWAPI.dll_PathFindFileNameA
lea edx, [esi + ebp]
rdtsc
pushfd
mov dword [esp + 0xd], edi
add esp, 7
jmp 0x1036b914

Function at 0x1036bb11
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, esi
rdtsc
jmp 0x1036bb35
rdtsc
not cl
sub esp, 0x18
lea esp, [esp + 0x58]
lea edi, [eax + edx]
jmp 0x1036bb6f
lea ebp, [edi + 0xb6]
xchg ebp, ebx
sub esp, 0x1e
mov ax, si
jmp 0x1036bbae
sub esp, 0x15
pop ebp
add esp, 0xe
mov di, 0x35e1
mov word [esp], ax
bswap eax
jmp 0x1036bb59
lea edi, reloc.SHLWAPI.dll_PathFindFileNameA
lea eax, [esi*4]
lea ecx, [esp + ecx]
xchg word [esp + 0xb], dx
bt ebx, esp
not edi
jmp 0x1036bb98
Function at 0x10374f0c
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
push eax
jmp 0x1036b08b
call fcn.1036b090
movzx ebx, word [eax + 0x3c]
jmp 0x10374f28
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x10374f9a
lea esp, [esp + 8]
jmp 0x10374ef6
cmp word [ebx], 0x4550
jmp 0x10374f77
stc
sub esp, 0xc
pop dword [esp + 2]
add ebx, eax
lea esp, [esp + 8]
jmp 0x10374f12
je 0x1036af51
jne 0x10374fa0
lea ecx, reloc.SHLWAPI.dll_PathFindFileNameA
sbb eax, 0xa66b0c9e
dec esi
insd dword es:[edi], dx
arpl word [esi], ax
cmc
add dword [ebp - 0xc], esi
push 0xd
cld
add esp, dword [ecx - 0x60]
jecxz 0x10374faa
je 0x1036da54
test byte [edx + ecx*4 + 0x2dffff], dh
add byte [ecx], al
add cl, ch
dec edi
invalid
sub eax, 0x10000
jmp 0x10374ef9
xor byte [ecx + 0x3ebb4829], bh
sbb byte [edx + 0x649a6f08], bl
jp 0x10374fb7
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
out dx, eax
push eax
rol byte [esi + 0x21], 1
shl byte [edx], 1
into
dec ebp
frstor dword [edi + edx*2 + reloc.SHLWAPI.dll_PathFindFileNameA]
sub esp, esi
add ebp, dword [edx + reloc.SHLWAPI.dll_PathFindFileNameA]
xor byte [eax + 0x3ccdaa34], 0x8e
cmpsb byte [esi], byte es:[edi]
and dword [ecx - reloc.SHLWAPI.dll_PathFindFileNameA], esi
invalid
Function at 0x10002890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x7341734d
push 0x7324
push 0x10121cb4
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xd
push eax
mov dword [ebp - 0xfc], 0x7354735c
mov dword [ebp - 0xf8], 0x734b7348
mov dword [ebp - 0xf4], 0x73417356
mov dword [ebp - 0xf0], 0x7341730a
mov dword [ebp - 0xec], 0x7341735c
mov dword [ebp - 0xe8], 0x7324
call fcn.10047780
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1000b680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c3ee4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0xffffffff
mov dword [edx + 0x18], 0xf
mov dword [edx + 0x14], 0
mov byte [edx + 4], 0
mov dword [ebp - 4], 0
mov dword [edx + 0x30], 0xf
mov dword [edx + 0x2c], 0
mov byte [edx + 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x38]
lea eax, [ecx + 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov byte [ebp - 4], 3
mov al, byte [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 6
mov dword [ecx + 0xc], 0
mov byte [ecx + 0x10], al
mov dword [ecx + 0x14], 0x201
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 4
mov dword [edx + 0x60], 0xffffffff
mov dword [edx + 0x64], connect
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000eff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1000f021
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1000f010
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1001b8b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5912
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.1009a3e6
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1001b964
lea eax, [ebp + 8]
mov dword [ebp + 8], str.bad_locale_name
push eax
lea ecx, [ebp - 0x1c]
call fcn.1009ec08
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1c]
push 0x10110fa0
push eax
call fcn.100a487b
push eax
push esi
call fcn.1009a1e0
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x3e493e6f
push 0x3e3a
push 0x10121f98
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xb
push eax
mov dword [ebp - 0xfc], 0x3e483e5f
mov dword [ebp - 0xf8], 0x3e083e09
mov dword [ebp - 0xf4], 0x3e5e3e14
mov dword [ebp - 0xf0], 0x3e563e56
mov dword [ebp - 0xec], 0x3e3a
call fcn.10047780
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1001d940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x935091b
push 0x950
push 0x1012209c
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xd
push eax
mov dword [ebp - 0xfc], 0x93e0922
mov dword [ebp - 0xf8], 0x93c0935
mov dword [ebp - 0xf4], 0x9620963
mov dword [ebp - 0xf0], 0x934097e
mov dword [ebp - 0xec], 0x93c093c
mov dword [ebp - 0xe8], 0x950
call fcn.10047780
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1001dab0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5b48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp edx, 1
jne 0x1001dc05
mov dword [ebp - 4], 0
call fcn.10002f10
test al, al
jne 0x1001daf9
call fcn.10048070
test al, al
je 0x1001dc9e
call fcn.10048070
test al, al
jne 0x1001dc05
mov dword [ebp - 4], 0xffffffff
mov dword [0x10120b04], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x10120b00], eax
mov ecx, edi
call fcn.1001d890
call fcn.1001dcc0
push eax
lea ecx, [ebp - 0x38]
call fcn.10004670
mov esi, eax
mov dword [ebp - 4], 2
call fcn.1001de30
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov edx, esi
call fcn.1001f640
add esp, 4
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.10049be0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 8
jb 0x1001db7c
push dword [ebp - 0x38]
call fcn.1009e2a8
add esp, 4
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
xor eax, eax
mov word [ebp - 0x38], ax
mov ecx, edi
call fcn.100497e0
mov dword [ebp - 4], 4
call fcn.100032a0
test al, al
je 0x1001dbac
call fcn.10038130
call fcn.10003480
test al, al
je 0x1001dbba
call fcn.10038130
call fcn.100033e0
test al, al
je 0x1001dc1b
call fcn.100479a0
test al, al
jne 0x1001dc9e
call fcn.10038130
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x1001d3b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x1001dc05
call fcn.10049c60
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x1001d3b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.10065570
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1001dc5a
mov eax, dword [eax]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x1001dc6c
call fcn.10049c60
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10006560
jmp 0x1001dc05
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ed60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c760f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x44], 0xf
mov dword [ecx + 0x40], 0
mov byte [ecx + 0x30], 0
mov byte [ebp - 4], 4
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10034c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x734c7347
push 0x7324
push 0x101224e8
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xb
push eax
mov dword [ebp - 0xfc], 0x734b7356
mov dword [ebp - 0xf8], 0x73417349
mov dword [ebp - 0xf4], 0x7340730a
mov dword [ebp - 0xf0], 0x73487348
mov dword [ebp - 0xec], 0x7324
call fcn.10047780
add esp, 0x10
mov esp, ebp
pop ebp
ret