joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4097b2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov edx, ecx
push ebx
mov ebx, dword [esp + 0x1c]
xor edx, 0x476b
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ebp, eax
push edi
lea edi, [eax + 0x5fe]
xor ebp, 0xb2
add esi, 0x650
mov dword [esp + 0x1c], edi
lea eax, [edx + 0x4029]
mov dword [esp + 0x28], esi
add ebx, 0xfffffd01
cmp ebp, eax
jle 0x4099ef
lea eax, [ecx - 0x3a6]
cmp esi, eax
je 0x4099ca
mov edi, dword [esp + 0x18]
mov eax, esi
xor eax, 0x7a5a
push edi
push eax
mov eax, dword [esp + 0x24]
xor eax, 0x1aa
push eax
lea eax, [ecx - 0x329]
push eax
lea eax, [esi - 0xb05]
push eax
lea eax, [edx + 0x3d31]
push eax
call fcn.004096af
mov ecx, dword [edi + 0x60]
xor ebx, 0x32d
add esp, 0x18
mov dword [esp + 0x24], ebx
mov ebp, eax
cmp ecx, dword [edi + 0x84]
jb 0x409861
mov dword [edi + 0xd0], 0x454300
xor esi, esi
mov ecx, dword [0x58f134]
mov eax, dword [edi + 0xd0]
push 0x10
mov ebx, dword [eax + esi]
add esi, 4
imul ebx, dword [ecx + 0x98]
mov ecx, dword [ecx + 0xd4]
mov eax, dword [0x5af4fc]
mov edx, ebx
shr edx, 0x10
mov byte [eax + ecx], dl
mov edx, ebx
inc dword [0x5af4fc]
mov eax, dword [edi + 0xf8]
xor eax, 0xfff54e18
shr edx, 8
imul eax, dword [0x5af550]
mov dword [0x5af550], eax
mov eax, dword [0x58f134]
mov ecx, dword [eax + 0x100]
mov eax, dword [0x5af444]
add eax, 0xffd5d2d1
add eax, ecx
mov ecx, dword [edi + 0xbc]
or dword [edi + 0xc0], eax
mov eax, dword [edi + 0xd4]
mov byte [ecx + eax], dl
inc dword [edi + 0xbc]
pop eax
sub eax, dword [edi + 0x58]
sub eax, dword [0x5af4d4]
add dword [0x5af54c], eax
mov ecx, dword [edi + 0xbc]
mov eax, dword [edi + 0xd4]
push 0x46
mov byte [ecx + eax], bl
mov ecx, dword [edi + 0x60]
inc dword [edi + 0xbc]
lea eax, [ecx - 0x18d64e]
or dword [edi + 0x100], eax
xor eax, eax
inc eax
sub eax, dword [0x5af574]
add dword [edi + 0xa4], eax
pop eax
sub eax, dword [edi + 0x9c]
add dword [edi + 0x94], eax
mov eax, dword [0x5af524]
add ecx, dword [0x5af4f4]
add eax, 0xffdcbda3
add eax, ecx
mov dword [edi + 0x60], eax
mov eax, dword [0x5af4d4]
add eax, 0xfffffff0
add eax, dword [edi + 0x128]
add dword [edi + 0x7c], eax
cmp esi, 0x6f280
jl 0x409863
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
add eax, 0xfffff9b0
push eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffd69
push eax
lea eax, [ebp - 0x19f]
push eax
mov eax, esi
xor eax, 0x1aa
push eax
lea eax, [esi - 0x5fe]
push eax
push dword [0x58f134]
mov eax, dword [esp + 0x3c]
add eax, 0x711
push eax
call fcn.004090dc
mov dword [edi + 0x98], 0x9eca7691
add esp, 0x1c
mov eax, dword [0x58f134]
mov dword [eax + 0xd0], 0x4cc000
jmp 0x409a1a
mov eax, dword [esp + 0x18]
or esi, ebx
sub esi, dword [eax + 0x20]
cmp dword [eax + 0x88], esi
jb 0x409a1a
lea eax, [ecx - 0x5178]
or eax, edi
cmp edx, eax
jl 0x409a1a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x409a1a
mov edx, dword [esp + 0x18]
mov ecx, dword [0x58f134]
mov eax, dword [edx + 0xfc]
xor eax, ebp
cmp dword [ecx + 0x84], eax
jne 0x409a1a
mov eax, dword [edx + 0x138]
xor eax, dword [ecx + 0x68]
xor eax, 0x46c1
mov dword [ecx + 0x68], eax
pop edi
pop esi
lea eax, [ebp - 0x19f]
pop ebp
pop ebx
ret
Function at 0x40e4ed
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
add eax, 0x5fe
xor dword [esp + 8], 0x2a7
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0xc]
add ebx, 0xffffff83
mov dword [esp + 0xc], eax
add esi, 0xffffbc23
mov eax, ebx
push edi
lea edi, [edx - 0x4442]
xor eax, 0x7dd9
xor edx, 0x4442
cmp edi, eax
jg 0x40e61a
lea eax, [edx + 0x416d]
cmp esi, eax
je 0x40e558
mov eax, dword [esp + 0x1c]
add esi, 0x422b
mov dword [eax + 0xd0], 0x41d290
jmp 0x40e61a
mov eax, dword [0x58f134]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x20]
sub ecx, dword [ebp + 0x128]
sub ecx, edi
cmp dword [eax + 0xe8], ecx
je 0x40e619
mov ecx, dword [esp + 0x18]
mov eax, edi
and eax, 0x41df
cmp ecx, eax
jle 0x40e619
lea eax, [ecx + 0x4442]
xor edi, ebx
add eax, ebx
sub ecx, ebx
push eax
mov eax, dword [esp + 0x18]
add eax, edx
push eax
mov eax, dword [ebp + 0x12c]
push ecx
push edi
mov edi, dword [esp + 0x24]
or eax, edi
push eax
mov eax, edx
or eax, ebx
xor eax, 0x43c5
push eax
mov eax, dword [ebp + 0x84]
or eax, edx
push eax
mov eax, dword [ebp + 0xfc]
or eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 0x88]
or ebx, 0x476b
or eax, dword [0x5af4b4]
push ebx
push eax
mov eax, dword [ebp + 0xd8]
and eax, 0x46c1
push eax
imul eax, dword [ebp + 0x38], 0x46c1
push eax
mov eax, dword [ebp + 0x84]
imul eax, dword [0x5af470]
xor eax, edi
push eax
mov eax, dword [0x5af578]
xor eax, 0x422b
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
pop edi
lea eax, [esi - 0x4c]
pop esi
pop ebx
ret
Function at 0x41c400
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
add edx, 0xfffffe16
push esi
push edi
mov edi, dword [esp + 0x24]
lea esi, [ecx + 0xf7]
lea eax, [ecx + 0x65]
mov dword [esp + 0xc], esi
add ebx, 0x6ac
mov dword [esp + 0x14], edx
add edi, 0x4b
cmp esi, eax
jl 0x41c5bc
mov eax, edx
xor eax, 0x5d
cmp edi, eax
jne 0x41c56d
push ebp
mov ebp, dword [esp + 0x1c]
xor esi, esi
mov eax, dword [0x5af510]
mov ebx, dword [esi + eax]
add esi, 4
mov eax, dword [0x58f134]
imul ebx, dword [0x5af4d8]
mov ecx, dword [eax + 0xd4]
mov eax, dword [ebp + 0xbc]
mov edx, ebx
shr edx, 8
mov byte [ecx + eax], dl
inc dword [ebp + 0xbc]
mov ecx, dword [ebp + 0xbc]
mov eax, dword [ebp + 0xd4]
mov byte [ecx + eax], bl
inc dword [ebp + 0xbc]
mov ecx, dword [ebp + 0x38]
mov eax, dword [ebp + 0xa4]
add ecx, 0xffffff9f
add eax, ecx
xor dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0x60]
xor eax, dword [0x5af484]
xor eax, 0xdc876
add dword [ebp + 0x60], eax
mov eax, dword [ebp + 0xe4]
sub eax, 0x74ad6
add dword [ebp + 0x110], eax
mov eax, dword [ebp + 0x134]
sub eax, dword [0x5af540]
add eax, 0x1ba74f
imul eax, dword [ebp + 0x2c]
mov dword [ebp + 0x2c], eax
mov ecx, dword [0x58f134]
mov eax, dword [ebp + 0x30]
sub dword [ecx + 0x70], eax
mov eax, dword [0x5af4f4]
sub eax, dword [0x5af464]
sub eax, 0x1bf779
add dword [ebp + 0x24], eax
mov eax, dword [0x5af528]
xor dword [0x5af574], eax
mov eax, dword [ebp + 0x74]
xor eax, 0x15ed17
or dword [ebp + 0xa4], eax
mov eax, dword [ebp + 0x10c]
sub eax, 0x1597d6
or dword [ebp + 0x7c], eax
cmp esi, 0xbf400
jl 0x41c450
mov esi, dword [esp + 0x10]
mov eax, edi
xor eax, 0x5b9
sub esi, 0x2f5
push eax
push ebp
push dword [esp + 0x20]
lea eax, [esi + 0x4c]
xor edi, 0x215
push eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffd90
push eax
push edi
call fcn.0041bf57
add esp, 0x18
pop ebp
jmp 0x41c5bc
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0xf0]
xor eax, 0x43dd
cmp dword [edx + 0x5c], eax
je 0x41c5bc
mov ecx, dword [0x58f134]
mov eax, dword [ecx + 0x34]
add eax, edi
xor eax, esi
cmp dword [ecx + 0xf0], eax
jbe 0x41c5bc
mov ecx, dword [edx + 0x120]
imul eax, edi, 0x46c1
xor ecx, ebx
sub eax, dword [edx + 0xd8]
xor ecx, 0x43c5
mov dword [edx + 0xd8], eax
mov dword [edx + 0x120], ecx
xor esi, 0x21a
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
Function at 0x41c660
Capabilities:
Allocate or change rwx memory

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add eax, 0xfffffcaf
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
lea esi, [ecx - 0x4442]
mov dword [esp + 0x28], eax
lea ebx, [ecx - 0x217]
lea eax, [esi + 0x41df]
mov dword [esp + 0x20], esi
xor edx, 0x669
lea ebp, [ecx + 0x47]
xor edi, 0x41df
cmp ebx, eax
jle 0x41c844
mov esi, dword [esp + 0x2c]
lea eax, [edi + 0x422b]
cmp edx, eax
jg 0x41c7a1
mov ecx, dword [0x58f134]
mov eax, dword [ecx + 0xb4]
cmp eax, dword [esi + 0x120]
jne 0x41c6e4
mov eax, dword [esi + 0x84]
xor eax, dword [esi + 0x58]
sub eax, dword [esi + 0x30]
add dword [esi + 0xfc], eax
jmp 0x41c70e
mov eax, dword [ecx + 0x9c]
push 0x40
add eax, 0x2fba
push eax
push dword [esi + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [eax + 0x3800]
mov eax, dword [0x58f134]
mov dword [eax + 0xdc], ecx
mov eax, dword [esp + 0x28]
add eax, 0x5c1
push eax
lea eax, [ebx + 0x448]
push eax
push esi
mov eax, edi
xor eax, 0x422b
push eax
lea eax, [edi + 0x4442]
push eax
mov eax, ebp
xor eax, 0x5d
push eax
call fcn.0041c5c9
mov eax, dword [esi + 0x60]
add esp, 0x18
sub eax, 0x18d64e
cmp dword [esi + 0x80], 0x162a1
mov dword [esi + 0xbc], eax
jb 0x41c76e
mov eax, dword [esi + 0x58]
sub eax, dword [esi + 0x134]
sub eax, dword [esi + 0x84]
add dword [esi + 0x8c], eax
jmp 0x41c779
mov eax, dword [esi + 0xdc]
mov dword [0x5af514], eax
mov eax, dword [0x58f134]
cmp dword [eax + 0x8c], 0xd0d3
je 0x41c844
mov eax, dword [esi + 0x58]
add eax, 0x3a76
mov dword [esi + 0x118], eax
jmp 0x41c844
mov eax, dword [0x5af4c4]
mov ecx, dword [esp + 0x28]
xor eax, edx
sub eax, 0x4029
push eax
mov eax, dword [0x5af540]
add eax, ebp
xor eax, dword [esi + 0xfc]
push eax
mov eax, dword [esi + 0xe4]
or eax, dword [esi + 0x80]
or eax, ecx
sub ecx, edi
push eax
push ecx
mov eax, edi
or eax, edx
push eax
mov eax, dword [esi + 0xf0]
xor eax, dword [esp + 0x34]
push eax
mov eax, dword [esi + 0x88]
and eax, dword [esi + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x5af4c4]
imul eax, edi
or eax, ebx
xor ebx, 0x46c1
push eax
mov eax, dword [0x58f134]
or ebx, edi
mov eax, dword [eax + 0xe4]
add eax, 0x44d4
or eax, edi
xor edi, dword [esp + 0x2c]
push eax
mov eax, dword [0x5af53c]
or eax, dword [esp + 0x30]
xor eax, dword [esi + 0x10c]
push eax
mov eax, dword [esp + 0x2c]
add eax, 0xffffbb2c
imul eax, eax, 0x3c66
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
pop edi
pop esi
lea eax, [ebp + 0x1ea]
pop ebp
pop ebx
ret
Function at 0x100066a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x100547c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x1005822b
call fcn.100258c2
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002589f
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10029890
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002589f
push edx
mov ecx, ebp
push eax
lea edx, [0x10006748]
call fcn.1002584b
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100258f4
add esp, 0x10
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret

Function at 0x1000b180
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x10058103
call fcn.100258c2
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea ecx, [ebp + 8]
call fcn.1000eb90
mov ecx, eax
call fcn.10003980
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002589f
test eax, eax
je 0x1000b1d9
mov dword [ebp - 8], 1
jmp 0x1000b1e0
mov dword [ebp - 8], 0
movzx eax, byte [ebp - 8]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret

Function at 0x1000f5c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x100547c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x1005822b
call fcn.100258c2
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002589f
mov eax, dword [ebp + 0xc]
push eax
push 0x90
mov ecx, dword [ebp + 8]
push ecx
call fcn.10029e10
add esp, 0xc
mov esi, esp
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1002589f
push edx
mov ecx, ebp
push eax
lea edx, [0x1000f668]
call fcn.1002584b
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100258f4
add esp, 0x10
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret
Function at 0x100103b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x10058315
call fcn.100258c2
mov eax, dword [0x1005766c]
mov dword [ebp - 4], eax
jmp 0x100103e1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100103fa
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100103f8
mov eax, dword [ebp - 4]
jmp 0x1001047e
jmp 0x100103d9
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1002589f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001047b
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x1001043d
mov edx, dword [ebp - 4]
mov eax, dword [0x1005766c]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1005766c], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret
Function at 0x10011c40
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x100583de
call fcn.100258c2
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10011890
add esp, 4
test eax, eax
jne 0x10011ca6
mov dword [ebp - 4], 9
jmp 0x10011d33
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x10011d33
mov dword [ebp - 8], 0
jmp 0x10011cc4
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10011d33
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1002589f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10011d31
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1002589f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.100122f0
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1002589f
jmp 0x10011cbb
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret

Function at 0x100125e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x100583de
call fcn.100258c2
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10012695
mov dword [ebp - 4], 0
jmp 0x1001261d
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x10012678
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1002589f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012676
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1002589f
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1002589f
jmp 0x10012614
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x10056668]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1002589f
pop esi
add esp, 8
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret
Function at 0x10012b90
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x10058453
call fcn.100258c2
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10012bea
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10012bea
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10012bea
xor eax, eax
jmp 0x10012c2b
mov dword [ebp - 4], 1
jmp 0x10012bfc
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10012c26
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x10012c24
xor eax, eax
jmp 0x10012c2b
jmp 0x10012bf3
mov eax, 1
add esp, 4
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret
Function at 0x10017ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push edi
lea edi, [ebp - 0x50]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10058772
call fcn.100258c2
mov byte [ebp - 0x44], 0x41
mov byte [ebp - 0x43], 0x80
mov byte [ebp - 0x42], 0x8b
mov byte [ebp - 0x41], 0x82
mov byte [ebp - 0x40], 0x83
mov byte [ebp - 0x3f], 0x45
mov byte [ebp - 0x3e], 0x84
mov byte [ebp - 0x3d], 0x88
mov byte [ebp - 0x3c], 0x85
mov byte [ebp - 0x3b], 0x85
mov byte [ebp - 0x3a], 0x4b
mov byte [ebp - 0x39], 0x87
mov byte [ebp - 0x38], 0x4d
mov byte [ebp - 0x37], 0x48
mov byte [ebp - 0x36], 0x4f
mov byte [ebp - 0x35], 0x8c
mov byte [ebp - 0x34], 0x50
mov byte [ebp - 0x33], 0x43
mov byte [ebp - 0x32], 0x8f
mov byte [ebp - 0x31], 0x59
mov byte [ebp - 0x30], 0x81
mov byte [ebp - 0x2f], 0x58
mov byte [ebp - 0x2e], 0x89
mov byte [ebp - 0x2d], 0x8d
mov byte [ebp - 0x2c], 0x8e
mov byte [ebp - 0x2b], 0x8a
mov byte [ebp - 0x2a], 0x90
mov byte [ebp - 0x29], 0x91
mov byte [ebp - 0x28], 0x92
mov byte [ebp - 0x27], 0x93
mov byte [ebp - 0x26], 0x94
mov byte [ebp - 0x25], 0x95
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x23], 0x97
mov byte [ebp - 0x22], 0xa2
mov byte [ebp - 0x21], 0x99
mov byte [ebp - 0x20], 0x9a
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x9b
mov byte [ebp - 0x1d], 0x9f
mov byte [ebp - 0x1c], 0x9c
mov byte [ebp - 0x1b], 0x9d
mov byte [ebp - 0x1a], 0x6b
mov byte [ebp - 0x19], 0x9e
mov byte [ebp - 0x18], 0xaf
mov byte [ebp - 0x17], 0xae
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0xa3
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0xa6
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x81
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0xe], 0x89
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0xc], 0xa5
mov byte [ebp - 0xb], 0xa1
mov byte [ebp - 0xa], 0xa7
mov byte [ebp - 9], 0xa8
mov byte [ebp - 8], 0xa9
mov byte [ebp - 7], 0xaa
mov byte [ebp - 6], 0xab
mov byte [ebp - 5], 0xac
mov dword [ebp - 0x4c], 0
jmp 0x10017bf2
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp + 0xc]
jae 0x10017c74
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x4c]
mov al, byte [edx]
mov byte [ebp - 0x4d], al
movzx ecx, byte [ebp - 0x4d]
cmp ecx, 0xb8
jne 0x10017c17
mov byte [ebp - 0x4d], 0xe5
jmp 0x10017c27
movzx edx, byte [ebp - 0x4d]
cmp edx, 0xa8
jne 0x10017c27
mov byte [ebp - 0x4d], 0xc5
movzx eax, byte [ebp - 0x4d]
cmp eax, 0xc0
jl 0x10017c4e
movzx ecx, byte [ebp - 0x4d]
cmp ecx, 0xff
jg 0x10017c4e
movzx edx, byte [ebp - 0x4d]
mov al, byte [ebp + edx - 0x104]
mov byte [ebp - 0x4d], al
jmp 0x10017c64
movzx ecx, byte [ebp - 0x4d]
cmp ecx, 0x20
jl 0x10017c60
movzx edx, byte [ebp - 0x4d]
cmp edx, 0x7e
jle 0x10017c64
mov byte [ebp - 0x4d], 0x3f
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x4c]
mov cl, byte [ebp - 0x4d]
mov byte [eax], cl
jmp 0x10017be9
push edx
mov ecx, ebp
push eax
lea edx, [0x10017c94]
call fcn.1002584b
pop eax
pop edx
pop edi
add esp, 0x50
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret
Function at 0x1001b710
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x100587ac
call fcn.100258c2
mov dword [ebp - 4], 0
jmp 0x1001b737
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jae 0x1001b75a
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
imul ecx, dword [ebp + 8], 0x1000193
mov dword [ebp + 8], ecx
jmp 0x1001b72e
mov eax, dword [ebp + 8]
add esp, 4
cmp ebp, esp
call fcn.1002589f
mov esp, ebp
pop ebp
ret

Function at 0x1002895f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10028980
jl 0x10028977
test edi, edi
jne 0x10028980
xor eax, eax
xor edx, edx
jmp 0x10028a41
cmp dword [ebx + 0x38], 0
je 0x10028995
push eax
push edi
push dword [ebp + 8]
call fcn.10028a47
jmp 0x10028a41
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100289dc
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x100289dc
cmp eax, edi
jb 0x100289b6
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.10029890
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x100289e2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x10028a36
mov ecx, ebx
call fcn.1002808c
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10028a21
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.10031c15
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x10028a36
jmp 0x100289f4
test edx, edx
je 0x10028a36
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10031c15
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x1003003e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1003007d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003007d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003007d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1003007d
cmp dword [ecx + 0x74], 0xe
jbe 0x1003007d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100365b7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004bfd8
push 0x1004bfd0
push str.FlsAlloc
push 0x1f
call fcn.1003647f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100365eb
push dword [ebp + 8]
mov ecx, esi
call dword [0x10046188]
call esi
jmp 0x100365f1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4