joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d5ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45cfb8
cmp dword [edi], 0
jne 0x43d668
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45cfb4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4574b8
mov ecx, 2
call fcn.00404458
mov edx, 0x43d5c4
lea eax, [esi + 5]
call fcn.0043d5e4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043d5e4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43d63d
mov dword [0x45cfb4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4463f8
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x45d074]
mov ecx, 0x40
call fcn.00404458
mov dword [0x45cfc0], 0xb7e15163
mov ebx, 0x2b
mov eax, 0x45cfc0
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x446426
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x84
mov eax, dword [ebx*4 + 0x45cfc0]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.004462a4
mov esi, eax
mov dword [ebx*4 + 0x45cfc0], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.004462a4
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x2c
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x446496
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x446446
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x446524
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
lea esi, [ebp - 0x38]
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
xor eax, eax
push ebp
push 0x4466f6
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x446565
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x446704
mov eax, ebx
call fcn.004464a4
call fcn.004463f8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x446686
mov edx, esi
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x4577d0]
mov eax, dword [eax + 0xac]
sub dword [esi + 8], eax
mov eax, dword [0x4577d0]
mov eax, dword [eax + 0xa8]
sub dword [esi], eax
mov ebx, 0x14
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
mov eax, dword [esi]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esi], eax
mov eax, dword [esi + 0xc]
add eax, eax
inc eax
imul dword [esi + 0xc]
mov edx, 5
call fcn.004462a4
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 4]
add eax, eax
inc eax
imul dword [esi + 4]
mov edx, 5
call fcn.004462a4
mov dword [ebp - 0x20], eax
mov eax, ebx
add eax, eax
mov edx, dword [0x4577d0]
push dword [edx + eax*4 + 4]
mov eax, dword [esi + 8]
pop edx
sub eax, edx
mov edx, dword [ebp - 0x20]
call fcn.004462c4
xor eax, dword [ebp - 0x24]
mov dword [esi + 8], eax
mov eax, ebx
add eax, eax
mov edx, dword [0x4577d0]
push dword [edx + eax*4]
mov eax, dword [esi]
pop edx
sub eax, edx
mov edx, dword [ebp - 0x24]
call fcn.004462c4
xor eax, dword [ebp - 0x20]
mov dword [esi], eax
dec ebx
test ebx, ebx
jne 0x4465b3
mov eax, dword [0x4577d0]
mov eax, dword [eax + 4]
sub dword [esi + 0xc], eax
mov eax, dword [0x4577d0]
mov eax, dword [eax]
sub dword [esi + 4], eax
mov byte [ebp - 0x1a], 1
mov cx, 1
mov edx, 0xfffffff0
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x1c]
mov edx, esi
mov ecx, 0x10
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
add dword [ebp - 0x10], 0x10
adc dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
cmp edx, 0
jne 0x4466a2
cmp eax, 0x10
jae 0x446584
jmp 0x4466a8
jge 0x446584
call fcn.004464dc
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, 1
sbb edx, 0
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.004376f8
lea edx, [ebp - 0x19]
mov ecx, 1
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
movzx eax, byte [ebp - 0x19]
sub edx, eax
dec edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x446704
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449650
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x4496ec
push 0
mov eax, ebx
call fcn.00407850
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x4496c7
mov ebx, esi
test ebx, ebx
je 0x449699
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00407850
push eax
push 1
push 0
mov eax, edi
call fcn.00407850
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x4496e2
mov ecx, dword [0x4576c0]
mov dl, 1
mov eax, dword [0x4479e8]
call fcn.0041aa70
call fcn.00406488
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x44b1bc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffde8
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00406cf0
test ebx, ebx
jg 0x44b1f9
push 0x105
lea eax, [esp + 0x10]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov dword [esp + 8], eax
lea edx, [esp + 0xc]
mov eax, esi
mov ecx, dword [esp + 8]
call fcn.00406e68
jmp 0x44b259
call sub.kernel32.dll_GetCommandLineW_1
mov dword [esp], eax
mov eax, esp
xor ecx, ecx
xor edx, edx
call fcn.0044b124
dec ebx
test ebx, ebx
je 0x44b222
mov eax, esp
xor ecx, ecx
xor edx, edx
call fcn.0044b124
test al, al
je 0x44b259
jmp 0x44b20c
mov eax, dword [esp]
mov dword [esp + 4], eax
lea ecx, [esp + 8]
lea eax, [esp + 4]
xor edx, edx
call fcn.0044b124
test al, al
je 0x44b259
mov eax, esi
mov edx, dword [esp + 8]
call fcn.004079cc
mov eax, dword [esi]
call fcn.00407850
mov edx, eax
mov eax, esp
xor ecx, ecx
call fcn.0044b124
add esp, 0x218
pop esi
pop ebx
ret

Function at 0x44e970
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x44e9b8
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageW
test eax, eax
je 0x44e9aa
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageW
push 1
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, esi
cmp edi, ebx
jg 0x44e988
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x44fba4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00409f8c
xor eax, eax
push ebp
push 0x44fcde
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.004495b8
xor eax, eax
push ebp
push 0x44fcae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
movzx ebx, word [eax + 0x30]
dec ebx
test ebx, ebx
jl 0x44fc93
inc ebx
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.004495b8
mov eax, dword [ebp - 0x1c]
and eax, 2
cmp eax, 2
jne 0x44fc8b
mov eax, dword [ebp - 0x1c]
and eax, 1
dec eax
jne 0x44fc8b
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.004495b8
lea eax, [ebp - 8]
call fcn.00409f18
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.004495b8
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004495b8
lea eax, [edi + 4]
mov edx, dword [ebp - 8]
call fcn.00409f30
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0044fb0c
inc esi
dec ebx
jne 0x44fc06
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44fcb5
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x4c]
ret
Function at 0xed6470
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x5c6b7
mov dword [ebp - 4], 0xf8c9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0xed64e8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0xed64c1
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0xed64c1
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
lea eax, [eax + edx + 0x20]
mov dword [ebp - 0xc], eax
jmp 0xed64d3
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0xed648b
mov eax, dword [ebp - 0xc]
and eax, 0x7fffffff
mov esp, ebp
pop ebp
ret

Function at 0xed6500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
jmp 0xed6536
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jae 0xed6594
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
call fcn.00ed6470
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0xed6592
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov cx, word [edx + eax*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0xed6596
jmp 0xed652d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xed65a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00403004]
mov esp, ebp
pop ebp
ret
Function at 0xed6f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push 0x214c6981
call fcn.00ed65f0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x104
lea eax, [ebp - 0x2c0]
push eax
call dword [ebp - 0x1c]
push 0x1c368da0
call fcn.00ed65f0
add esp, 4
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x15c]
push ecx
call fcn.00ed6400
add esp, 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x148], 0x2e
mov byte [ebp - 0x147], 0x64
mov byte [ebp - 0x146], 0x6c
mov byte [ebp - 0x145], 0x6c
mov byte [ebp - 0x144], 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.00ed73f0
add esp, 8
lea ecx, [ebp - 0x15c]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.00ed73f0
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.00ed73f0
add esp, 8
push 0x4e1e0843
call fcn.00ed65f0
add esp, 4
mov dword [ebp - 0x1ac], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea edx, [ebp - 0x2c0]
push edx
call dword [ebp - 0x1ac]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffff
je 0xed7075
mov dword [ebp - 0x2c4], 0
push 0x7463a627
call fcn.00ed65f0
add esp, 4
mov dword [ebp - 0x2cc], eax
push 0
lea eax, [ebp - 0x2c4]
push eax
push 0xec00
push 0x404000
mov ecx, dword [ebp - 0x140]
push ecx
call dword [ebp - 0x2cc]
push 0x70ebfb28
call fcn.00ed65f0
add esp, 4
mov dword [ebp - 0x2c8], eax
mov edx, dword [ebp - 0x140]
push edx
call dword [ebp - 0x2c8]
mov byte [ebp - 0x1b8], 0x60
mov byte [ebp - 0x1b7], 0x47
mov byte [ebp - 0x1b6], 0x5c
mov byte [ebp - 0x1b5], 0x56
mov byte [ebp - 0x1b4], 0x5e
mov byte [ebp - 0x1b3], 0x5e
mov byte [ebp - 0x1b2], 1
mov byte [ebp - 0x1b1], 0
mov byte [ebp - 0x1b0], 0x12
mov byte [ebp - 0x1af], 0x32
push 0x32
push 0xa
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x1b8]
push ecx
call fcn.00ed6640
add esp, 0x10
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0
push 0x44
push 0
lea edx, [ebp - 0x1a8]
push edx
call fcn.00ed6620
add esp, 0xc
mov dword [ebp - 0x1a8], 0x44
push 0x10
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00ed6620
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.00ed73f0
add esp, 8
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00ed73e0
add esp, 8
lea edx, [ebp - 0x2c0]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00ed73f0
add esp, 8
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.00ed7350
add esp, 4
push 0xe621d6
call fcn.00ed65f0
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x1a8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call dword [ebp - 4]
push 0x3282227b
call fcn.00ed65f0
add esp, 4
mov dword [ebp - 0x13c], eax
push 0xea60
mov edx, dword [ebp - 0x134]
push edx
call dword [ebp - 0x13c]
mov esp, ebp
pop ebp
ret
Function at 0xed7ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push 0x289fbd13
call fcn.00ed90b0
add esp, 4
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x90], 0x73
mov byte [ebp - 0x8f], 0x63
mov byte [ebp - 0x8e], 0x20
mov byte [ebp - 0x8d], 0x73
mov byte [ebp - 0x8c], 0x74
mov byte [ebp - 0x8b], 0x6f
mov byte [ebp - 0x8a], 0x70
mov byte [ebp - 0x89], 0x20
mov byte [ebp - 0x88], 0
mov byte [ebp - 0x9c], 0x73
mov byte [ebp - 0x9b], 0x63
mov byte [ebp - 0x9a], 0x20
mov byte [ebp - 0x99], 0x64
mov byte [ebp - 0x98], 0x65
mov byte [ebp - 0x97], 0x6c
mov byte [ebp - 0x96], 0x65
mov byte [ebp - 0x95], 0x74
mov byte [ebp - 0x94], 0x65
mov byte [ebp - 0x93], 0x20
mov byte [ebp - 0x92], 0
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x80]
push ecx
call dword [0x10009090]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x80]
push eax
call dword [0x10009070]
push 0
lea ecx, [ebp - 0x80]
push ecx
call dword [ebp - 0x84]
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x80]
push eax
call dword [0x10009090]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x80]
push edx
call dword [0x10009070]
push 0
lea eax, [ebp - 0x80]
push eax
call dword [ebp - 0x84]
mov esp, ebp
pop ebp
ret

Function at 0xed7fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], 0x2e
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0
push 0x3777cccb
call fcn.00ed90b0
add esp, 4
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x1c]
push eax
call dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0xed8044
push 0x94c4c32
call fcn.00ed90b0
add esp, 4
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
push 0x4927ac50
mov edx, dword [ebp - 0x40]
push edx
call fcn.00ed8fc0
add esp, 8
mov dword [ebp - 0x20], eax
push 0x4842adf4
mov eax, dword [ebp - 0x40]
push eax
call fcn.00ed8fc0
add esp, 8
mov dword [ebp - 0x4c], eax
push 0x42f77b2b
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.00ed8fc0
add esp, 8
mov dword [ebp - 0x44], eax
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x76
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
push 0xf01ff
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0x4c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xed80d9
lea ecx, [ebp - 0x3c]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
call dword [0x10009010]
mov eax, dword [ebp - 4]
push eax
call dword [0x1000901c]
mov ecx, dword [ebp - 4]
push ecx
call dword [ebp - 0x44]
mov esp, ebp
pop ebp
ret
Function at 0xed8f30
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x5c6b7
mov dword [ebp - 4], 0xf8c9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0xed8fa8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0xed8f81
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0xed8f81
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
lea eax, [eax + edx + 0x20]
mov dword [ebp - 0xc], eax
jmp 0xed8f93
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0xed8f4b
mov eax, dword [ebp - 0xc]
and eax, 0x7fffffff
mov esp, ebp
pop ebp
ret

Function at 0xed8fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
jmp 0xed8ff6
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jae 0xed9054
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
call fcn.00ed8f30
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0xed9052
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov cx, word [edx + eax*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0xed9056
jmp 0xed8fed
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xed9060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call dword [0x1000903c]
mov esp, ebp
pop ebp
ret
Function at 0xee6870
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x5c6b7
mov dword [ebp - 4], 0xf8c9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0xee68e8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0xee68c1
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0xee68c1
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
lea eax, [eax + edx + 0x20]
mov dword [ebp - 0xc], eax
jmp 0xee68d3
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0xee688b
mov eax, dword [ebp - 0xc]
and eax, 0x7fffffff
mov esp, ebp
pop ebp
ret

Function at 0xee6900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
jmp 0xee6936
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jae 0xee6994
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
call fcn.00ee6870
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0xee6992
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov cx, word [edx + eax*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0xee6996
jmp 0xee692d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xee69a0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
push ebx
push ecx
mov ebx, dword fs:[0x30]
mov ecx, dword [ebx + 0xc]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x14], eax
pop ecx
pop ebx
push 0x3777cccb
mov eax, dword [ebp - 0x14]
push eax
call fcn.00ee6900
add esp, 8
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
push ecx
call dword [ebp - 0x18]
pop ebx
mov esp, ebp
pop ebp
ret