joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100029d0
Capabilities:
Get disk information

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c390
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x348
mov eax, dword [0x100500f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x354], eax
mov esi, ecx
mov dword [ebp - 0x358], esi
mov dword [ebp - 0x350], esi
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x350], esi
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 0xf
mov byte [ebp - 0x34c], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x120], 0
test eax, eax
je 0x10002bcf
mov ecx, eax
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002a70
sub ecx, edx
je 0x10002bcf
lea eax, [ebp - 0x120]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x10002bcf
mov ax, word [0x1004ab2c]
lea edi, [ebp - 0x120]
mov word [ebp - 0x334], ax
movzx eax, byte [0x1004ab2e]
mov byte [ebp - 0x332], al
mov al, byte [ebp - 0x120]
mov dword [ebp - 0x350], 0
nop dword [eax]
mov byte [ebp - 0x334], al
lea eax, [ebp - 0x228]
push 0x104
push eax
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x10002b81
lea esi, [ebp - 0x228]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10002b00
sub esi, ecx
cmp esi, 0x104
jae 0x10002b81
push esi
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x354]
call fcn.10022090
xor ecx, ecx
add esp, 0xc
test eax, eax
sete cl
mov dword [ebp - 0x350], ecx
test eax, eax
jne 0x10002b87
mov eax, dword [ebp - 0x354]
add eax, esi
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x330]
push str._s_s
push eax
call fcn.10003e40
lea ecx, [ebp - 0x330]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002b65
sub ecx, edx
lea eax, [ebp - 0x330]
push ecx
push eax
lea ecx, [ebp - 0x34c]
call fcn.10003d00
mov ecx, dword [ebp - 0x350]
mov al, byte [edi]
inc edi
test al, al
jne 0x10002b87
test ecx, ecx
jne 0x10002b9c
mov al, byte [edi]
test al, al
jne 0x10002ad0
mov eax, dword [ebp - 0x358]
movups xmm0, xmmword [ebp - 0x34c]
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x33c]
movq qword [eax + 0x10], xmm0
jmp 0x10002bfc
movups xmm0, xmmword [ebp - 0x34c]
mov dword [esi], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x33c]
movq qword [esi + 0x10], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001a6ea
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10002df0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1004cf18
push 0x1001bb60
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100500f8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
push 0x28
push ecx
call dword [0x10052014]
test eax, eax
js 0x10002e5c
lea eax, [ebp - 0x24]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10002e67
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x10002eb3
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
push 0
push 0
push 0
lea eax, [ebp - 0x34]
push eax
push 0
push dword [ebp - 0x38]
call dword [0x10052024]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10002eaa
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1001a6ea
mov esp, ebp
pop ebp
ret
Function at 0x10003680
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x102c
call fcn.1001b5f0
mov eax, dword [0x100500f8]
xor eax, esp
mov dword [esp + 0x1028], eax
push ebx
push esi
push edi
push 0x100
lea eax, [esp + 0x48]
mov dword [esp + 0x34], 0x11c
push 0
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.1001cb10
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [esp + 0x146], ax
mov dword [esp + 0x148], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 6
xor ecx, ecx
mov dword [esp + 0x44], 0
push eax
mov word [esp + 0x154], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x100037d9
mov eax, dword [0x10052010]
test eax, eax
je 0x100037d9
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push ecx
push 0
push 0
push 0x2000000
push 0
call eax
test eax, eax
jne 0x10003873
nop dword [eax]
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x1000376c
xor ecx, ecx
jmp 0x1000378b
push 0
push 0x18
lea eax, [esp + 0x1c]
push eax
push 0
push edx
call dword [0x10052028]
mov edx, dword [esp + 0x2c]
xor ecx, ecx
test eax, eax
cmovns ecx, dword [esp + 0x24]
call fcn.10002ed0
mov ecx, dword [0x1005203c]
cmp ecx, dword [0x10052040]
je 0x100037ad
mov eax, dword [esp + 0x2c]
mov dword [ecx], eax
add dword [0x1005203c], 4
jmp 0x100037b8
lea eax, [esp + 0x2c]
push eax
push ecx
call fcn.10004000
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x2000000
push dword [esp + 0x3c]
call dword [0x10052010]
test eax, eax
je 0x10003760
jmp 0x10003873
lea eax, [esp + 0x2c]
push eax
push 0x1000
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x100037f7
call fcn.1000a390
xor edi, edi
test dword [esp + 0x2c], 0xfffffffc
jbe 0x10003873
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [esp + edi*4 + 0x30], 0
je 0x10003867
mov esi, dword [esp + edi*4 + 0x30]
call ebx
cmp esi, eax
je 0x10003867
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x10003867
mov ecx, dword [esp + edi*4 + 0x30]
mov edx, esi
call fcn.10002ed0
mov eax, dword [0x1005203c]
cmp eax, dword [0x10052040]
je 0x1000385c
mov dword [eax], esi
add dword [0x1005203c], 4
jmp 0x10003867
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.10004000
mov eax, dword [esp + 0x2c]
inc edi
shr eax, 2
cmp edi, eax
jb 0x10003810
call fcn.100035d0
mov ecx, dword [esp + 0x1034]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001a6ea
mov esp, ebp
pop ebp
ret
Function at 0x100039b1
Capabilities:
Create thread

Disassembly:
jae 0x10003957
jmp 0x10003952
call fcn.10003959
jae 0x10003952
add esp, 4
jmp 0x1000395e
dec dword [esp]
jno 0x10003963
jns 0x1000394e
jp 0x10003967
add esp, 4
popf
jmp 0x1000396e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10003987
jne 0x10003987
call 0x1fc06cdb
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.100025b0
clc
jae 0x100039a2
mov esp, ebx
pushf
push 0xa
jae 0x100039af
jmp 0x100039aa
call 0x100039b1
jae 0x100039aa
add esp, 4
jmp 0x100039b6
dec dword [esp]
jno 0x100039bb
jns 0x100039a6
jp 0x100039bf
add esp, 4
popf
jmp 0x100039c6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100039df
jne 0x100039df
fdivr qword [ebx + eax - 0x15]
add ebx, esp
jl 0x100039e4
jmp 0x100039e6
je 0x100039e1
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10003a00
jne 0x100039ff
call 0x93042a87
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10003a0e
jne 0x10003a0e
call 0x106a3a7c
push 0
push 0
push 0
push 0x10003890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003a31
call fcn.1000a390
xor eax, eax
test eax, eax
je 0x10003a3a
jne 0x10003a39
call 0x93042ac1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10003a48
jmp 0x10003a4a
je 0x10003a45
clc
jae 0x10003a4f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10003a54
jne 0x10003a54
pop eax
pushf
push 0xa
jae 0x10003a61
jmp 0x10003a5c
call 0x10003a63
jae 0x10003a5c
add esp, 4
jmp 0x10003a68
dec dword [esp]
jno 0x10003a6d
jns 0x10003a58
jp 0x10003a71
add esp, 4
popf
jmp 0x10003a78
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10003a91
jne 0x10003a91
call 0x1fc06de5
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c550
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xdd0
mov eax, dword [0x100500f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebx + 0xc]
mov dword [ebp - 0x20], 0x65737973
push eax
push dword [ebx + 8]
lea eax, [ebp - 0xd00]
mov dword [ebp - 0x1c], 0x2e327272
push eax
mov dword [ebp - 0x18], 0x747874
call dword [sym.imp.USER32.dll_wvsprintfA]
push 0
call fcn.10023275
add esp, 4
mov dword [ebp - 0xd08], eax
lea eax, [ebp - 0xd08]
mov dword [ebp - 0xd04], edx
push eax
call fcn.1002356e
movaps xmm0, xmmword [0x1004bc90]
add esp, 4
movups xmm2, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov word [ebp - 0x24], 0x20
movups xmmword [ebp - 0x44], xmm0
movaps xmm0, xmmword [0x1004bca0]
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 0xc
add eax, 0x76c
push eax
movd eax, xmm1
inc eax
push eax
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
push eax
movd eax, xmm2
psrldq xmm2, 8
push eax
movd eax, xmm0
push eax
movd eax, xmm2
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.10004340
push 0xb0
lea eax, [ebp - 0xdb8]
push 0
push eax
call fcn.1001cb10
add esp, 0x24
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xdb8]
push 0xa
push eax
call fcn.10006260
lea edx, [ebp - 0x530]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xdb8]
call fcn.100073f0
lea edx, [ebp - 0xd00]
mov ecx, eax
call fcn.100073f0
mov ecx, eax
call fcn.10007680
push eax
call fcn.10007930
add esp, 4
lea ecx, [ebp - 0xdb4]
call fcn.10006a10
test eax, eax
jne 0x10004f97
mov eax, dword [ebp - 0xdb8]
lea ecx, [ebp - 0xdb8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10004cc0
lea ecx, [ebp - 0xdb8]
call fcn.10004fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001a6ea
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100050c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c5ad
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x100500f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x118], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005130
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10003d00
mov ecx, dword [ebp - 0x118]
lea eax, [ebp - 0x12c]
mov edi, dword [ebp - 0x12c]
lea ebx, [ebp - 0x12c]
mov edx, dword [ebp - 0x11c]
lea esi, [ebp - 0x12c]
cmp ecx, 0x10
cmovae eax, edi
cmovae ebx, edi
add eax, edx
cmp ecx, 0x10
cmovae esi, edi
cmp esi, eax
je 0x100051b6
sub ebx, esi
mov edi, eax
nop dword [eax]
movsx eax, byte [esi]
push eax
call fcn.1001f2fd
mov byte [ebx + esi], al
add esp, 4
inc esi
cmp esi, edi
jne 0x10005190
mov edx, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp + 0x1c]
lea eax, [ebp - 0x12c]
mov esi, dword [ebp + 8]
cmp ecx, 0x10
push edx
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 8]
cmovae eax, edi
cmp ebx, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.10007b20
mov ecx, dword [ebp - 0x118]
add esp, 0xc
cmp eax, 0xffffffff
setne byte [ebp - 0x12d]
cmp ecx, 0x10
jb 0x10005220
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x10005210
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005289
push ecx
push edi
call fcn.1001ac3f
mov ebx, dword [ebp + 0x1c]
add esp, 8
mov esi, dword [ebp + 8]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp ebx, 0x10
jb 0x10005267
lea ecx, [ebx + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1000525d
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005289
push ecx
push esi
call fcn.1001ac3f
add esp, 8
mov al, byte [ebp - 0x12d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a6ea
mov esp, ebp
pop ebp
ret
call fcn.1002233d
int3
Function at 0x10005840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10005872
jl 0x10005865
test ecx, ecx
jne 0x10005872
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10005932
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10006d00
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100058de
jg 0x1000589d
test esi, esi
je 0x100058de
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x100058b5
mov eax, dword [esp + 0x10]
jl 0x100058af
cmp eax, esi
jae 0x100058b5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1001c590
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100058ff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1000591b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10005884
jl 0x1000591b
test ecx, ecx
jne 0x10005884
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10005971
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10005971
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1001c590
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x100059e0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x10005997
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x100059c9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1002392b
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x100059f4
cmp edi, eax
ja 0x100059a5
test ecx, ecx
je 0x100059e0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1002392b
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c7e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100500f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1001a8f5
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10019a28
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100080c8
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x100080c6
jmp 0x100080c1
call fcn.100080c8
jae 0x100080c1
add esp, 4
jmp 0x100080cd
dec dword [esp]
jno 0x100080d2
jns 0x100080bd
jp 0x100080d6
add esp, 4
popf
jmp 0x100080dd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100080f6
jne 0x100080f6
call 0x1fc0b44a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10008120
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100500f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x10008138
pop esi
inc edx
pushf
push 0xa
Function at 0x10008147
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x10008145
jmp 0x10008140
call fcn.10008147
jae 0x10008140
add esp, 4
jmp 0x1000814c
dec dword [esp]
jno 0x10008151
jns 0x1000813c
jp 0x10008155
add esp, 4
popf
jmp 0x1000815c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10008175
jne 0x10008175
inc edx
jl 0x1000817a
jmp 0x1000817c
je 0x10008177
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10008196
jne 0x10008195
call 0x9304721d
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x100081a4
add eax, 0x1750374
jne 0x100081a4
call 0x35e4c76e
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x1000820f
jg 0x1000819e
pushf
push 0xa
jae 0x1000821c
jmp 0x10008217
call 0x1000821e
jae 0x10008217
add esp, 4
jmp 0x10008223
dec dword [esp]
jno 0x10008228
jns 0x10008213
jp 0x1000822c
add esp, 4
popf
jmp 0x10008233
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000824c
jne 0x1000824c
invalid
jl 0x10008251
jmp 0x10008253
je 0x1000824e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000826d
jne 0x1000826c
call 0x930472f4
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000827b
jne 0x1000827b
call 0x9b5be0de
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a6ea
mov esp, ebp
pop ebp
ret
Function at 0x10008614
Capabilities:
Create thread

Disassembly:
jae 0x10008526
jmp 0x10008521
call fcn.10008528
jae 0x10008521
add esp, 4
jmp 0x1000852d
dec dword [esp]
jno 0x10008532
jns 0x1000851d
jp 0x10008536
add esp, 4
popf
jmp 0x1000853d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10008556
jne 0x10008556
call 0x1fc0b8aa
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10008120
clc
jae 0x10008571
retf
pushf
push 0xa
jae 0x1000857e
jmp 0x10008579
call 0x10008580
jae 0x10008579
add esp, 4
jmp 0x10008585
dec dword [esp]
jno 0x1000858a
jns 0x10008575
jp 0x1000858e
add esp, 4
popf
jmp 0x10008595
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100085ae
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x358
jne 0x100085ae
jns 0x1000862b
jl 0x100085b3
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x100085b5
je 0x100085b0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100085cf
jne 0x100085ce
call 0x93047656
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100085dd
jne 0x100085dd
call 0xffb34c9
push dword [ebx]
rol byte [ebp + 0x750374c0], 0
call 0x10008090
xor eax, eax
test eax, eax
je 0x100085eb
jne 0x100085ea
call 0x93047672
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
lcall 0x7002, 0x73f8fb74
lcall 0x669a, 0x1750374
pushfd
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100085f9
jmp 0x100085fb
je 0x100085f6
clc
jae 0x10008600
jo 0x1000859a
je 0x10008605
jne 0x10008605
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10008612
jmp 0x1000860d
call 0x10008614
jae 0x1000860d
add esp, 4
jmp 0x10008619
dec dword [esp]
jno 0x1000861e
jns 0x10008609
jp 0x10008622
add esp, 4
popf
jmp 0x10008629
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10008642
jne 0x10008642
call 0x1fc0b996
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10008290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10008320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100083d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret