joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1574b4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x1574bc
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014080
xor eax, eax
push ebp
push 0x1576f6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x15768d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push dword [ebp - 4]
lea edx, [ebp - 0x20]
mov eax, 0x157708
call fcn.00031d88
push dword [ebp - 0x20]
push 0x157714
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x1c]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x15762f
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x157750
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x1575f1
cmp dword [ebp - 0x10], 4
jne 0x1575f1
mov dword [ebp - 0x18], 1
push 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0x157750
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
jne 0x1575b3
mov byte [ebp - 5], 1
jmp 0x15766b
lea edx, [ebp - 0x28]
mov eax, 0x15775c
call fcn.00031d88
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.000144c4
mov edx, dword [ebp - 0x24]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x15766b
lea edx, [ebp - 0x34]
mov eax, 0x157768
call fcn.00031d88
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
call fcn.000144c4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x15766b
lea edx, [ebp - 0x40]
mov eax, 0x157774
call fcn.00031d88
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x44]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
call fcn.000144c4
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x157694
cmp dword [ebp - 0xc], 0
je 0x157687
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x157b6c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x157b74
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014080
xor eax, eax
push ebp
push 0x157db5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x157d4c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push dword [ebp - 4]
lea edx, [ebp - 0x20]
mov eax, 0x157dc4
call fcn.00031d88
push dword [ebp - 0x20]
push 0x157dd0
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x1c]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x157cee
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x157e0c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x157cb0
cmp dword [ebp - 0x14], 4
jne 0x157cb0
cmp dword [ebp - 0xc], 1
jne 0x157d2a
xor eax, eax
mov dword [ebp - 0xc], eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x157e0c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov byte [ebp - 5], 1
test ebx, ebx
je 0x157d2a
lea edx, [ebp - 0x28]
mov eax, 0x157e18
call fcn.00031d88
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.000144c4
mov edx, dword [ebp - 0x24]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x157d2a
lea edx, [ebp - 0x34]
mov eax, 0x157e24
call fcn.00031d88
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
call fcn.000144c4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x157d2a
lea edx, [ebp - 0x40]
mov eax, 0x157e30
call fcn.00031d88
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x44]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
call fcn.000144c4
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x157d53
cmp dword [ebp - 0x18], 0
je 0x157d46
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
ret
Function at 0x157e3c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x157e44
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014080
xor eax, eax
push ebp
push 0x15807e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x158015
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push dword [ebp - 4]
lea edx, [ebp - 0x20]
mov eax, 0x158090
call fcn.00031d88
push dword [ebp - 0x20]
push 0x15809c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x1c]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x157fb7
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1580d8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x157f79
cmp dword [ebp - 0xc], 4
jne 0x157f79
mov dword [ebp - 0x18], 1
push 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x1580d8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
jne 0x157f3b
mov byte [ebp - 5], 1
jmp 0x157ff3
lea edx, [ebp - 0x28]
mov eax, 0x1580e4
call fcn.00031d88
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.000144c4
mov edx, dword [ebp - 0x24]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x157ff3
lea edx, [ebp - 0x34]
mov eax, 0x1580f0
call fcn.00031d88
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
call fcn.000144c4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x157ff3
lea edx, [ebp - 0x40]
mov eax, 0x1580fc
call fcn.00031d88
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x44]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
call fcn.000144c4
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x15801c
cmp dword [ebp - 0x10], 0
je 0x15800f
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret
Function at 0x1a31ac
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x1a31b4
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x1a3398
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.001a3088
push 0x1a33a8
push 0
call sub.advapi32.dll_OpenEventLogW
mov esi, eax
mov dword [ebx + 0x30], esi
test esi, esi
jne 0x1a3223
call sub.kernel32.dll_GetLastError_1
mov esi, eax
lea edx, [ebp - 4]
mov eax, 0x1a33bc
call fcn.00031d88
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.0002b100
mov edx, dword [ebp - 8]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.001a35f4
jmp 0x1a3340
lea edx, [ebx + 0x38]
mov eax, ebx
call fcn.001a3b30
mov esi, eax
test esi, esi
je 0x1a3266
lea edx, [ebp - 0xc]
mov eax, 0x1a33cc
call fcn.00031d88
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0002b100
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.001a35f4
jmp 0x1a3340
inc dword [ebx + 0x38]
mov eax, dword [0x2a95fc]
mov eax, dword [eax]
mov dx, 0x197
call fcn.00049330
mov eax, dword [0x2a95fc]
mov eax, dword [eax]
xor edx, edx
call fcn.00049858
push 0x1a33dc
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [0x2a90ec]
mov dword [edx], eax
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, dword [0x2a95fc]
mov eax, dword [eax]
mov dx, 0x197
call fcn.0004933c
mov eax, dword [0x2a90ec]
cmp dword [eax], 0
jne 0x1a32f0
lea edx, [ebp - 0x14]
mov eax, 0x1a33e0
call fcn.00031d88
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0002b100
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.001a35f4
jmp 0x1a3340
mov eax, dword [0x2a90ec]
mov eax, dword [eax]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.advapi32.dll_NotifyChangeEventLog
test eax, eax
jne 0x1a333c
call sub.kernel32.dll_GetLastError_1
mov esi, eax
lea edx, [ebp - 0x1c]
mov eax, 0x1a33f0
call fcn.00031d88
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0002b100
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.001a35f4
jmp 0x1a3340
mov byte [ebx + 0x34], 1
cmp byte [ebx + 0x34], 0
je 0x1a335f
lea edx, [ebp - 0x24]
mov eax, 0x1a3400
call fcn.00031d88
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.001a3650
jmp 0x1a337d
lea edx, [ebp - 0x28]
mov eax, 0x1a3400
call fcn.00031d88
mov edx, dword [ebp - 0x28]
mov eax, ebx
call fcn.001a35f4
mov eax, ebx
call fcn.001a3088
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1a339f
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00013c60
ret
Function at 0x102d00cf
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x102d010a

Function at 0x102d0370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
div ecx
test edx, edx
je 0x102d037d
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
in al, dx

Function at 0x102d0390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.102d008f
mov ebx, 0x458d3fa5
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x102d08e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.102d009f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.102d0054
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.102d009f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.102d0054
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.102d009f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.102d0054
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.102d008f
lodsd eax, dword [esi]
enter 0xffffffffffff8a10, 0xffffffffffffff80
movsd dword es:[edi], dword [esi]
int3
Function at 0x102d16a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x400]
sub ecx, eax
mov dword [ebp - 0x400], ecx
call fcn.102d008f
adc esp, dword [ebp + 0x46a33fa]
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0xc]
push eax
lea eax, [ebp - 0x54c]
push eax
call fcn.102d0000
add esp, 0xc
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x54c]
sub ecx, eax
mov dword [ebp - 0x54c], ecx
call fcn.102d008f
add eax, 0x6acc48f2
add al, 0x8b
test dword [eax - 0x74000004], ecx
dec ebp
cld
lea eax, [ecx + eax - 8]
push eax
lea eax, [ebp - 0x684]
push eax
call fcn.102d0000
add esp, 0xc
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x684]
sub ecx, eax
mov dword [ebp - 0x684], ecx
push 4
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 4]
push eax
lea eax, [ebp - 0x678]
push eax
call fcn.102d0000
add esp, 0xc
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x678]
sub ecx, eax
mov dword [ebp - 0x678], ecx
push 4
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x678]
push eax
lea eax, [ebp - 0x38c]
push eax
call fcn.102d0000
add esp, 0xc
mov eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0x678]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x3ac], eax
push 4
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.102d0000
add esp, 0xc
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x6f8], eax
and dword [ebp - 0x700], 0
jmp 0x102d17df
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x38c]
jae 0x102d1831
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0x748]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
not eax
mov ecx, dword [ebp - 0x748]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
jmp 0x102d17d2
and dword [ebp - 0x700], 0
jmp 0x102d1847
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x688]
jae 0x102d1899
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
not eax
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
jmp 0x102d183a
and byte [ebp - 0x714], 0
and byte [ebp - 0x713], 0
mov byte [ebp - 0x712], 0x71
and byte [ebp - 0x711], 0
mov byte [ebp - 0x710], 0xc8
mov byte [ebp - 0x70f], 0xe2
mov byte [ebp - 0x70e], 0xe1
mov byte [ebp - 0x70d], 0xe1
mov byte [ebp - 0x70c], 0xea
mov byte [ebp - 0x70b], 0xc8
mov byte [ebp - 0x70a], 0xe7
mov byte [ebp - 0x709], 0xf6
mov byte [ebp - 0x708], 0xbc
mov byte [ebp - 0x707], 0x8e
call fcn.102d008f
dec ebp
xchg ebx, eax
invalid
Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0xd044ce6
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x5d53017a
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1002a1a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1002a1a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10162cb4]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret