joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030bf0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005985c
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x10078c14]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x10078c14]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x17], 1
call fcn.10002310
mov dword [esp + 0x268], 0
push 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.10030fe0
mov byte [esp + 0x268], 1
mov eax, dword [eax]
mov ecx, 0x10067b5c
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10030c96
test dx, dx
je 0x10030c92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10030c96
add eax, 4
add ecx, 4
test dx, dx
jne 0x10030c70
xor eax, eax
jmp 0x10030c9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne bl
mov byte [esp + 0x268], 0
lea ecx, [esp + 0x1c]
call fcn.10002690
test bl, bl
je 0x10030cc5
push 1
push 0x10067b5c
lea ecx, [esp + 0x1c]
call fcn.1000f200
push 0x10066cd0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.1000edf0
add esp, 0xc
mov byte [esp + 0x268], 2
push 0x1006402c
lea ecx, [esp + 0x1c]
call fcn.10002310
mov byte [esp + 0x268], 3
push 0
call fcn.100414ba
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov eax, dword [esp + 0x18]
add esp, 4
push eax
mov edi, edx
call ebx
cmp eax, 0xffffffff
je 0x10030dc4
test al, 0x10
je 0x10030dc4
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.100423e9
add esp, 8
test eax, eax
mov dword [esp + 0x1c], eax
jl 0x10030dc4
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x48]
push eax
push ecx
lea edx, [esp + 0x20]
push 0x10067b60
push edx
call fcn.100022f0
mov eax, dword [esp + 0x28]
add esp, 0x10
push eax
call ebx
test al, 0x10
jne 0x10030da1
mov eax, esi
sub eax, dword [esp + 0x2c]
push 0
mov ecx, edi
sbb ecx, dword [esp + 0x34]
push 0xe10
push ecx
push eax
call fcn.10043e60
test edx, edx
ja 0x10030d8e
cmp eax, 0x18
jb 0x10030da1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10030da1
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push eax
call fcn.10042519
add esp, 8
test eax, eax
je 0x10030d44
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.10042648
add esp, 4
mov byte [esp + 0x268], 2
lea ecx, [esp + 0x18]
call fcn.10002690
mov byte [esp + 0x268], 0
lea ecx, [esp + 0x20]
call fcn.10002690
mov dword [esp + 0x268], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.10002690
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.100407ea
mov esp, ebp
pop ebp
ret
Function at 0x10034d37
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x10034d60
call fcn.10038d1e
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 8], eax
jne 0x10034d83
push eax
push dword [esi + 4]
call fcn.10034cc2
push esi
push eax
mov ecx, 0x1007ab4c
call fcn.10034977
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x10035689
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x10058156
call fcn.10043016
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1003564b
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.100026f0
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x100356ef
push eax
push dword [esi + 8]
call fcn.10034cc2
push dword [esi + 0xc]
mov ecx, 0x1007ab4c
push eax
call fcn.10034977
mov eax, esi
call fcn.1004307f
ret 0x18

Function at 0x10035707
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x10058156
call fcn.10043016
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.1003564b
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.100026f0
push dword [esi + 8]
mov edi, dword [edi + 8]
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x1003576e
push eax
push dword [esi + 8]
call fcn.10034cc2
push dword [esi + 0xc]
mov ecx, 0x1007ab4c
push eax
call fcn.10034977
mov eax, esi
call fcn.1004307f
ret 0x1c

Function at 0x1003aadc
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x1003aae5
xor eax, eax
jmp 0x1003ab4e
cmp dword [esp + 8], 0
jne 0x1003aaf1
call fcn.10032672
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.100449f8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1003ab2c
push dword [esi + 0x10]
call fcn.1004473d
test eax, eax
pop ecx
jne 0x1003ab2c
mov esi, dword [esi + 0xc]
call fcn.100431fb
push esi
push dword [eax]
push 1
call fcn.10034504
push dword [esi + 0x10]
call fcn.1004476c
test eax, eax
pop ecx
je 0x1003ab4b
push dword [esi + 0x10]
call fcn.10044691
push eax
call fcn.10002600
pop ecx
pop ecx
jmp 0x1003ab1a
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x1003ab57
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x1003ab61
call fcn.10032672
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.10044b2d
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x1003ab8e
mov esi, dword [esi + 0xc]
call fcn.100431fb
push esi
push dword [eax]
push 1
call fcn.10034504
pop esi
ret 8

Function at 0x100407ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10078c14]
jne 0x100407f4
repz ret
jmp fcn.1004533d

Function at 0x10052ecb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10047236
xor ebx, ebx
cmp dword [0x1007d4fc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x10052fa0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x10052f0b
xor eax, eax
jmp 0x10053064
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10052f04
push eax
call fcn.100471d3
mov dword [esp], 0x10063d90
push edi
mov dword [0x1007d4fc], eax
call esi
push eax
call fcn.100471d3
mov dword [esp], 0x10063d7c
push edi
mov dword [0x1007d500], eax
call esi
push eax
call fcn.100471d3
mov dword [0x1007d504], eax
lea eax, [ebp - 8]
push eax
call fcn.1004382c
test eax, eax
pop ecx
pop ecx
je 0x10052f6e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10040e4d
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x10052fa0
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100471d3
cmp eax, ebx
pop ecx
mov dword [0x1007d50c], eax
je 0x10052fa0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100471d3
pop ecx
mov dword [0x1007d508], eax
mov eax, dword [0x1007d508]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x10053019
cmp dword [0x1007d50c], esi
je 0x10053019
push eax
call fcn.1004723f
pop ecx
call eax
cmp eax, ebx
je 0x10052fe6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1007d50c]
call fcn.1004723f
pop ecx
call eax
test eax, eax
je 0x10052fe6
test byte [ebp - 0x18], 1
jne 0x10053019
lea eax, [ebp - 0xc]
push eax
call fcn.10043863
test eax, eax
pop ecx
je 0x10053001
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10040e4d
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x10053010
or dword [ebp + 0x10], 0x200000
jmp 0x1005304a
or dword [ebp + 0x10], 0x40000
jmp 0x1005304a
mov eax, dword [0x1007d500]
cmp eax, esi
je 0x1005304a
push eax
call fcn.1004723f
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1005304a
mov eax, dword [0x1007d504]
cmp eax, esi
je 0x1005304a
push dword [ebp - 4]
push eax
call fcn.1004723f
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1007d4fc]
call fcn.1004723f
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10057c22
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10078c14]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.10057bb7
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.10043430
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x10057c71
cmp dword [ebp - 0x1c], 5
jb 0x10057c89
jmp 0x10057c85
cmp dword [ebp - 0x10], 1
jne 0x10057c89
cmp dword [ebp - 0x1c], 4
ja 0x10057c85
jne 0x10057c89
cmp dword [ebp - 0x18], 0
jbe 0x10057c89
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10063e80
call fcn.10057a8b
test eax, eax
jge 0x10057caa
mov byte [0x1007d65c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100407ea
add ebp, 0x78
leave
ret
Function at 0x10001f03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov edx, dword [eax + 0x20]
mov ebx, dword [eax + 0x1c]
add edx, edi
mov ecx, dword [eax + 0x24]
add ebx, edi
mov eax, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x10001f57
mov eax, dword [edx + esi*4]
add eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10001f5e
mov edx, dword [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10001f3b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ebx + eax*4]
add eax, edi
jmp 0x10001f59

Function at 0x10001fdc
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x1000d3c8
push ecx
mov dword [ebp - 0x10], edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
xor ebx, ebx
push 2
mov edi, eax
push ebx
push edi
call esi
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push ebx
push ebx
push edi
mov dword [ebp - 0xc], eax
call esi
mov esi, dword [ebp - 4]
push edi
push esi
push 1
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x3c]
lea edx, [edi + 0xf8]
add edx, eax
mov dword [ebp - 0xc], edx
movzx ecx, word [eax + edi + 6]
push dword [eax + edi + 0x78]
mov dword [ebp - 8], ecx
mov edx, ecx
lea ecx, [edi + 0xf8]
push esi
add ecx, eax
call fcn.10001f9f
add esp, 0x44
lea esi, [edi + eax]
mov dword [ebp - 0x14], esi
cmp dword [esi + 0x18], ebx
jbe 0x100020ff
push dword [ebp - 0x10]
mov edx, dword [ebp - 8]
push dword [esi + 0x20]
mov ecx, dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.10001f9f
mov edx, dword [ebp - 8]
add eax, edi
mov ecx, dword [ebp - 0xc]
push dword [eax + ebx*4]
push dword [ebp - 4]
call fcn.10001f9f
add esp, 0x10
add eax, edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x100020b4
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x10002073
jmp 0x100020ff
push dword [esi + 0x24]
mov edx, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
call fcn.10001f9f
mov edx, dword [ebp - 8]
add eax, edi
mov ecx, dword [ebp - 0xc]
movzx esi, word [eax + ebx*2]
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 4]
push dword [eax + 0x1c]
push ebx
call fcn.10001f9f
mov edx, dword [ebp - 8]
add eax, edi
mov ecx, dword [ebp - 0xc]
push dword [eax + esi*4]
push ebx
call fcn.10001f9f
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002104
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.10001f03
mov ebx, eax
test edi, edi
je 0x100021c4
test esi, esi
je 0x100021c4
push 0x104
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.10001fdc
mov edi, eax
cmp edi, 0xffffffff
je 0x100021c4
lea eax, [ebp - 0x110]
push 0x1000d3c8
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push 0
mov esi, eax
push edi
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
push 5
lea eax, [ebp - 0xc]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x114]
add esp, 0x28
push eax
push 0x40
push 5
push ebx
call esi
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov al, byte [ebp - 8]
mov byte [ebx + 4], al
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x114]
push 5
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000b214
leave
ret

Function at 0x100021d3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
je 0x10002212
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov dword [edi], 0x8b55ff8b
push eax
push dword [ebp - 8]
mov byte [edi + 4], 0xec
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1000b214
leave
ret

Function at 0x1000221f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
jne 0x10002237
push edi
mov edi, dword fs:[0x30]
mov eax, dword [edi + 8]
ret
push ebx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x1c]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop ebx
jmp 0x10002263
push esi
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, dword [ebp - 4]
je 0x10002269
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp dword [eax + 8], 0
jne 0x1000224d
mov eax, dword [eax + 8]
pop esi
leave
ret
Function at 0x10002cb2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
jne 0x10002d2e
mov eax, dword [ebp - 0x10]
mov ax, word [eax + 0x14]
mov word [ebp - 0xc], ax
movzx eax, word [ebp - 0xc]
test eax, eax
je 0x10002d2e
lea eax, [ebp - 8]
push eax
push 0x40
movzx eax, word [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movzx eax, word [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b214
leave
ret
Function at 0x10004852
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], 0x26
mov byte [ebp - 0x2c], 0x5e
mov byte [ebp - 0x2b], 0x2e
mov byte [ebp - 0x2a], 0x2e
mov byte [ebp - 0x29], 0x3e
mov byte [ebp - 0x28], 0x17
mov byte [ebp - 0x27], 0x43
mov byte [ebp - 0x26], 0x43
mov byte [ebp - 0x25], 0x23
mov byte [ebp - 0x24], 0x23
mov byte [ebp - 0x23], 0x47
mov byte [ebp - 0x22], 0x1b
mov byte [ebp - 0x21], 0x3b
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x23
mov byte [ebp - 0x1e], 0x1f
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x1c], 0x2f
mov byte [ebp - 0x1b], 0x3f
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x5a
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x42
mov byte [ebp - 0x15], 0x47
mov byte [ebp - 0x14], 0x3e
mov byte [ebp - 0x13], 0x5e
mov byte [ebp - 0x12], 0x3e
mov byte [ebp - 0x11], 3
mov byte [ebp - 0x10], 0x5a
mov byte [ebp - 0xf], 0xb
mov byte [ebp - 0xe], 0x6b
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0xb
mov byte [ebp - 9], 0x6b
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0xff
lea ecx, [ebp - 0x2c]
call fcn.10004b85
push 0x26
lea eax, [ebp - 0x2c]
push eax
push 0x10010c18
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
mov eax, 0x10010c18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b214
leave
ret

Function at 0x10004931
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], 0x26
mov byte [ebp - 0x2c], 0x5e
mov byte [ebp - 0x2b], 0x2e
mov byte [ebp - 0x2a], 0x2e
mov byte [ebp - 0x29], 0x3e
mov byte [ebp - 0x28], 0x17
mov byte [ebp - 0x27], 0x43
mov byte [ebp - 0x26], 0x43
mov byte [ebp - 0x25], 0x23
mov byte [ebp - 0x24], 0x23
mov byte [ebp - 0x23], 0x47
mov byte [ebp - 0x22], 0x1b
mov byte [ebp - 0x21], 0x3b
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x23
mov byte [ebp - 0x1e], 0x1f
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x1c], 0x2f
mov byte [ebp - 0x1b], 0x3f
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x5e
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x17], 0x32
mov byte [ebp - 0x16], 0x5e
mov byte [ebp - 0x15], 0x47
mov byte [ebp - 0x14], 0x3e
mov byte [ebp - 0x13], 0x5e
mov byte [ebp - 0x12], 0x3e
mov byte [ebp - 0x11], 3
mov byte [ebp - 0x10], 0x5a
mov byte [ebp - 0xf], 0xb
mov byte [ebp - 0xe], 0x6b
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0xb
mov byte [ebp - 9], 0x6b
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0xff
lea ecx, [ebp - 0x2c]
call fcn.10004b85
push 0x26
lea eax, [ebp - 0x2c]
push eax
push 0x10010c40
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
mov eax, 0x10010c40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b214
leave
ret
Function at 0x10004bce
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
mov edx, dword [ecx]
je 0x10004bff
push esi
push edi
mov edi, dword [ebp + 8]
not edx
xor esi, esi
movzx eax, byte [esi + edi]
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x1000d7d8]
inc esi
cmp esi, dword [ebp + 0xc]
jne 0x10004be2
pop edi
not edx
pop esi
mov dword [ecx], edx
pop ebp
ret 8

Function at 0x10004c0e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10010008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100108ce], 0
push esi
push edi
jne 0x10004ca1
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
push ebx
mov ebx, str.Initialize_class_first
push ebx
call edi
mov esi, eax
mov dword [esp], 0x1000dc18
call edi
add esi, 0x10
add eax, esi
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat]
push 0x1000dc78
push edi
call esi
push 0xa
lea eax, [ebp - 0x10]
push eax
push 0x16
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
push 0x1000dcc0
push edi
call esi
lea eax, [ebp - 0x10]
push eax
push edi
call esi
push 0x1000dcc4
push edi
call esi
add esp, 0x3c
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
pop ebx
jmp 0x10004cd1
mov ecx, dword [0x10010904]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10010904]
lea edi, [eax + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10010904]
lea esi, [eax + 0x30]
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esi]
add edx, dword [edi]
mov ecx, dword [eax + 0x44]
call edx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000b214
leave
ret