joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fc20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x41fc38
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x41fc8b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x41fc59
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x41fc7c
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 8], eax
jmp 0x41fc50
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x4a04c8], eax
jmp 0x41fc2f
jmp 0x41fc96
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x800
jae 0x41fcce
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x4a00c8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
mov edx, dword [ebp - 0x10]
shr edx, 8
xor edx, dword [ecx*4 + 0x4a04c8]
mov eax, dword [ebp - 4]
mov dword [eax*4 + 0x4a04c8], edx
jmp 0x41fc8d
mov dword [0x4a24c8], fcn.0041ce90
call fcn.0041ecd0
test eax, eax
jne 0x41fceb
mov dword [0x4a24c8], 0x41de30
mov esp, ebp
pop ebp
ret
Function at 0x423d40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x48d710
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call fcn.00424880
push 0x3c
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.00408550
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], str.open
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x38], 0x40
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x48d771
xor eax, eax
jmp 0x48d782
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x48da00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x49e398]
xor eax, ebp
mov dword [ebp - 0x14], eax
call fcn.00465190
mov dword [ebp - 4], str.SoftwareBaiduBaiduSd
mov dword [ebp - 0xc], str.SupplyID
mov dword [ebp - 0x21c], 0x100
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48da94
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48da8e
lea ecx, [ebp - 0x218]
push ecx
push 0x49915c
mov edx, dword [ebp + 8]
push edx
call fcn.004056c0
add esp, 0xc
jmp 0x48da92
xor eax, eax
jmp 0x48daa2
jmp 0x48da98
xor eax, eax
jmp 0x48daa2
call fcn.00464420
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040806d
mov esp, ebp
pop ebp
ret
Function at 0x48dce0
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49398e
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x49e398]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004264e0
mov word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.00408550
add esp, 0xc
mov dword [ebp - 0x228], 0
push 0x104
lea ecx, [ebp - 0x224]
push ecx
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x260]
call fcn.004042f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.004042c0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x244]
push eax
call fcn.0048d920
add esp, 4
push 0x4990e4
lea ecx, [ebp - 0x260]
call fcn.004043f0
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x260]
call fcn.004043d0
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404390
push 0
lea ecx, [ebp - 0x260]
call fcn.00404430
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.00404370
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.00404370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040806d
mov esp, ebp
pop ebp
ret
Function at 0x48e510
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x49e398]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
jne 0x48e531
xor al, al
jmp 0x48e5a1
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x48e547
xor al, al
jmp 0x48e5a1
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48e594
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x48e580
mov byte [ebp - 1], 1
jmp 0x48e594
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48e565
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040806d
mov esp, ebp
pop ebp
ret
Function at 0x48fb20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493df7
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x49e398]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.0043fe10
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404330
mov byte [ebp - 4], 1
lea edx, [ebp - 0x30]
push edx
mov ecx, 0x4a2774
call fcn.00404390
call fcn.0043e970
cmp dword [0x4a265c], 0
jne 0x48fbfa
push 0xed8
call fcn.00408491
add esp, 4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x48fba9
mov ecx, dword [ebp - 0x38]
call fcn.00492180
mov dword [ebp - 0x44], eax
jmp 0x48fbb0
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [0x4a265c], ecx
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [0x4a265c]
add ecx, 8
call fcn.00404390
push 0x497ca8
mov ecx, dword [0x4a265c]
add ecx, 0x24
call fcn.004043b0
mov eax, dword [0x4a265c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x54], ecx
mov ecx, dword [0x4a265c]
call fcn.004929b0
call fcn.0043d140
call fcn.0048f120
test eax, eax
jne 0x48fc5a
cmp dword [0x4a265c], 0
je 0x48fc51
mov ecx, dword [0x4a265c]
call fcn.00491fa0
mov edx, dword [0x4a265c]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x48fc40
push 1
mov ecx, dword [ebp - 0x3c]
call fcn.004068e0
mov dword [ebp - 0x48], eax
jmp 0x48fc47
mov dword [ebp - 0x48], 0
mov dword [0x4a265c], 0
push 0
call fcn.0040b19b
jmp 0x48fc5f
call fcn.0048f3a0
call fcn.0043cb40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00404370
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040806d
mov esp, ebp
pop ebp
ret
Function at 0x492500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x49e398]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x220], ecx
call fcn.00465190
mov dword [ebp - 4], 0x49849c
mov dword [ebp - 0xc], str.InstallDir
mov dword [ebp - 0x21c], 0x100
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49259a
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x492594
lea ecx, [ebp - 0x218]
push ecx
push 0x4984e4
mov edx, dword [ebp + 8]
push edx
call fcn.004056c0
add esp, 0xc
jmp 0x492598
xor eax, eax
jmp 0x4925a8
jmp 0x49259e
xor eax, eax
jmp 0x4925a8
call fcn.00464420
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040806d
mov esp, ebp
pop ebp
ret 4
Function at 0x100adab
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x100e024]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
lea eax, [esi + 0x48]
push edi
push eax
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x358]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x310]
push eax
mov dword [ebp - 0x358], 0x44
call fcn.0100a999
push 0x7f
lea eax, [ebp - 0x104]
push 0x1002cf4
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor edi, edi
lea ebx, [esi + 0x28]
push ebx
lea eax, [ebp - 0x358]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x310]
push eax
mov word [ebp - 6], di
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100ae40
mov dword [ebx], edi
jmp 0x100ae4d
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x100ae55
mov dword [esi + 0x2c], edi
mov edi, 0x80004005
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.01003bf1
leave
ret

Function at 0x100ae75
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x100e024]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
lea eax, [esi + 0x48]
push edi
push eax
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x358]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x310]
push eax
mov dword [ebp - 0x358], 0x44
call fcn.0100a999
push 0x7f
lea eax, [ebp - 0x104]
push 0x1002d14
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor edi, edi
lea ebx, [esi + 0x38]
push ebx
lea eax, [ebp - 0x358]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100af06
mov dword [ebx], edi
jmp 0x100af13
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x100af1b
mov dword [esi + 0x3c], edi
mov edi, 0x80004005
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.01003bf1
leave
ret

Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10016be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0a44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0xffffffff
mov dword [edx + 0x18], 0xf
mov dword [edx + 0x14], 0
mov byte [edx + 4], 0
mov dword [ebp - 4], 0
mov dword [edx + 0x30], 0xf
mov dword [edx + 0x2c], 0
mov byte [edx + 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x38]
lea eax, [ecx + 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov byte [eax], 0
mov byte [ebp - 4], 3
mov al, byte [ebp + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 6
mov dword [ecx + 0xc], 0
mov byte [ecx + 0x10], al
mov dword [ecx + 0x14], 0x201
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 4
mov dword [edx + 0x60], 0xffffffff
mov dword [edx + 0x64], 0x7fffffff
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001a020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1001a051
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1001a040
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10025190
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1f62
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100a7124
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10025244
lea eax, [ebp + 8]
mov dword [ebp + 8], str.bad_locale_name
push eax
lea ecx, [ebp - 0x1c]
call fcn.100ab948
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1c]
push 0x10122efc
push eax
call fcn.100b15bb
push eax
push esi
call fcn.100a6f1b
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10026930
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d20f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.10026860
test al, al
je 0x100269fc
call fcn.10026a60
push eax
lea ecx, [ebp - 0x34]
call fcn.10010920
mov byte [ebp - 4], 1
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10070e30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
call fcn.10010a20
lea ecx, [ebp - 0x4c]
call fcn.1000fb80
mov byte [ebp - 4], 4
call fcn.10043240
mov dl, 1
mov ecx, 0x2718
call fcn.100283b0
call fcn.1000f970
test al, al
je 0x100269cd
push 0
push 0x100545a0
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
call esi
push 0
push 0x100545a0
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100269d6
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.10044580
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4c]
call fcn.10010a20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10026c70
mov dword [ebp - 4], 0xffffffff
call fcn.1005d9a0
mov eax, dword [0x100e79d4]
test eax, eax
je 0x10026a4b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100273e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp edx, 1
jne 0x10027535
mov dword [ebp - 4], 0
call fcn.1000f670
test al, al
jne 0x10027429
call fcn.10052ff0
test al, al
je 0x100275ce
call fcn.10052ff0
test al, al
jne 0x10027535
mov dword [ebp - 4], 0xffffffff
mov dword [0x100e79d4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100e79d0], eax
mov ecx, edi
call fcn.100271c0
call fcn.100275f0
push eax
lea ecx, [ebp - 0x38]
call fcn.10010920
mov esi, eax
mov dword [ebp - 4], 2
call fcn.10027760
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov edx, esi
call fcn.10028ea0
add esp, 4
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.10054b60
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 8
jb 0x100274ac
push dword [ebp - 0x38]
call fcn.100aafe6
add esp, 4
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
xor eax, eax
mov word [ebp - 0x38], ax
mov ecx, edi
call fcn.10054760
mov dword [ebp - 4], 4
call fcn.1000f960
test al, al
je 0x100274dc
call fcn.10043240
call fcn.1000f990
test al, al
je 0x100274ea
call fcn.10043240
call fcn.1000f980
test al, al
je 0x1002754b
call fcn.10052920
test al, al
jne 0x100275ce
call fcn.10043240
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x10026ce0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x10027535
call fcn.10054be0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x10026ce0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.100725f0
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1002758a
mov eax, dword [eax]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x1002759c
call fcn.10054be0
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10012410
jmp 0x10027535
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100417d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x5b505b7b
push 0x5b3e
push 0x100e94e4
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xf
push eax
mov dword [ebp - 0xfc], 0x5b4c5b5d
mov dword [ebp - 0xf8], 0x5b4e5b47
mov dword [ebp - 0xf4], 0x5b735b4a
mov dword [ebp - 0xf0], 0x5b4d5b5b
mov dword [ebp - 0xec], 0x5b5f5b4d
mov dword [ebp - 0xe8], 0x5b5b5b59
mov dword [ebp - 0xe4], 0x5b3e
call fcn.10052700
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10041ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
mov dword [ebp - 0x100], 0x4f2e4f0f
push 0x4f4b
push 0x100e9520
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x100]
push 0xf
push eax
mov dword [ebp - 0xfc], 0x4f394f28
mov dword [ebp - 0xf8], 0x4f3b4f32
mov dword [ebp - 0xf4], 0x4f064f3f
mov dword [ebp - 0xf0], 0x4f384f2e
mov dword [ebp - 0xec], 0x4f2a4f38
mov dword [ebp - 0xe8], 0x4f2e4f2c
mov dword [ebp - 0xe4], 0x4f4b
call fcn.10052700
add esp, 0x10
mov esp, ebp
pop ebp
ret