joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1f033e60
Capabilities:
Enumerate threads
Resume thread

Disassembly:
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], 0x1c
cmp eax, 0xffffffff
jne 0x1f033ea7
xor eax, eax
add esp, 0x24
ret
lea ecx, [esp + 8]
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1f033ea1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
lea esp, [esp]
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x24], edx
jne 0x1f033ef7
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x14]
je 0x1f033ef7
push eax
push 0
push 2
call edi
mov esi, eax
test esi, esi
je 0x1f033ef7
push esi
call ebx
push esi
call ebp
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x18]
push eax
push ecx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1f033ed0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x24
ret

Function at 0x1f034480
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x4004
call fcn.1f03e9c0
push ebx
mov ebx, dword [esp + 0x4014]
xor eax, eax
test ebx, ebx
je 0x1f0345c4
push esi
mov esi, dword [esp + 0x4014]
mov word [ebx], ax
mov dword [esp + 8], eax
test esi, esi
je 0x1f0344b3
cmp esi, ebx
jne 0x1f0344be
pop esi
xor eax, eax
pop ebx
add esp, 0x4004
ret
push esi
call fcn.1f034140
add esp, 4
cmp word [esi], 0
je 0x1f034578
mov ecx, 0x1f05f994
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1f0344fe
test dx, dx
je 0x1f0344fa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1f0344fe
add eax, 4
add ecx, 4
test dx, dx
jne 0x1f0344d8
xor eax, eax
jmp 0x1f034503
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1f034578
push edi
lea ecx, [esp + 0x2010]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [esp + 0x4014]
test eax, eax
jne 0x1f03453c
lea edx, [esp + 0x10]
push 0x1000
push edx
call fcn.1f0340d0
add esp, 8
lea eax, [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push eax
call edi
mov edx, dword [esp + 0x4020]
lea ecx, [esp + 0xc]
push ecx
push ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
neg esi
lea eax, [esp + 0x2010]
sbb esi, esi
push eax
neg esi
call edi
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x4004
ret
mov eax, dword [esp + 0x4010]
test eax, eax
je 0x1f0345ad
mov edx, ebx
sub edx, eax
jmp 0x1f034590
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1f034590
pop esi
mov eax, 1
pop ebx
add esp, 0x4004
ret
mov ecx, dword [esp + 0x401c]
push ecx
push ebx
call fcn.1f0340d0
add esp, 8
mov eax, 1
pop esi
pop ebx
add esp, 0x4004
ret
Function at 0x1f0363f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0xffffffffffffffff
push 0x1f056718
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x40]
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
call fcn.1f036340
test eax, eax
je 0x1f036528
lea ecx, [esp + 0x10]
call fcn.1f033ad0
mov dword [esp + 0x38], 0
push edi
lea ecx, [esp + 0x14]
call fcn.1f033cf0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
cmp edi, eax
sete cl
mov eax, ecx
mov dword [esp + 0x44], eax
test eax, eax
je 0x1f036502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea edx, [esp + 0x4c]
push edx
push 0x40
push 5
push eax
push edi
call ebx
test eax, eax
jne 0x1f0364b7
mov ecx, dword [ebp]
mov edx, dword [esi]
mov eax, dword [esp + 0x44]
push ebp
push esi
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
call fcn.1f036230
test eax, eax
je 0x1f03653e
mov edx, dword [esi]
lea ecx, [esp + 0x4c]
push ecx
push 0x40
push 5
push edx
push edi
call ebx
test eax, eax
je 0x1f036485
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi]
lea eax, [esp + 0x4c]
push eax
push ecx
push 5
push edx
push edi
call ebx
cmp dword [esp + 0x48], 0
jne 0x1f0364d7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.1f029120
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc
push edi
push 0
push 8
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x1f03646b
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.1f029120
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc
cmp dword [esp + 0x48], 0
je 0x1f03654c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.1f029120
mov ecx, dword [esp + 0x34]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc
Function at 0x1f03dc80
Capabilities:
Enumerate threads
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1f056a48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov ecx, dword [0x1f06e874]
mov eax, dword [esp + 0x78]
push esi
push edi
mov dword [eax], ecx
xor eax, eax
push 1
push 8
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], 0x1c
call fcn.1f02cf40
mov dword [esp + 0x70], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 4
mov edi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1f03dd5f
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1f03dd58
cmp edi, dword [esp + 0x1c]
jne 0x1f03dd49
mov eax, dword [esp + 0x18]
push 0
push eax
mov eax, dword [0x1f0837d0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.1f02dc80
test eax, eax
jne 0x1f03dd49
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0xc], eax
call fcn.1f03dc00
add esp, 4
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x10], eax
call fcn.1f02eb40
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1f03dd04
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x7c]
push ecx
lea ecx, [esp + 0x30]
call fcn.1f02d760
mov edx, dword [esp + 0x78]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], eax
mov esi, ecx
mov dword [esp + 0x70], 0xffffffff
lea ecx, [esp + 0x38]
call fcn.1f02d8d0
lea ecx, [esp + 0x38]
call fcn.1f02d9a0
mov ecx, dword [esp + 0x68]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x1f03de10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 0xc]
mov dword [0x1f06e874], eax
mov eax, dword [0x1f0837c4]
push eax
cmp eax, 0x40
jae 0x1f03de2b
call section..text
jmp 0x1f03de31
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1f0837c4]
push esi
mov esi, eax
mov dword [esp + 0x10], eax
lea eax, [esi + 1]
push eax
push ecx
cmp ecx, 0x40
jae 0x1f03de4f
call fcn.1f001021
jmp 0x1f03de55
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push 0
push 0
mov ecx, 0x1f083e68
call fcn.1f03d410
push 1
mov ecx, 0x1f083e68
call fcn.1f03ddb0
mov eax, dword [0x1f0837cc]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
push 1
push 0
add ecx, eax
call fcn.1f02da00
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
test eax, eax
jbe 0x1f03defc
push ebx
push ebp
mov ebp, eax
push 8
call fcn.1f03e832
mov edx, dword [edi]
mov esi, eax
add esp, 4
mov dword [esi], edx
mov eax, dword [edi + 4]
push 1
push esi
mov ecx, 0x1f083e68
mov dword [esi + 4], eax
call fcn.1f037a40
mov edx, dword [0x1f0837cc]
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + edx + 0x24]
test eax, eax
je 0x1f03deec
mov ebx, dword [esi]
lea ecx, [ecx]
mov ecx, dword [eax]
cmp dword [ecx + 0x18], ebx
je 0x1f03dee0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1f03ded0
jmp 0x1f03deec
mov edx, dword [esi + 4]
mov dword [ecx + 0x1c], edx
mov edx, dword [0x1f0837cc]
add edi, 8
sub ebp, 1
jne 0x1f03de95
mov esi, dword [esp + 0x1c]
pop ebp
pop ebx
jmp 0x1f03df02
mov edx, dword [0x1f0837cc]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call fcn.1f02da70
mov ecx, 0x1f083e68
call fcn.1f0373b0
mov eax, dword [0x1f0837c4]
pop edi
push esi
push eax
cmp eax, 0x40
jae 0x1f03df31
call fcn.1f001021
mov eax, 1
pop esi
ret
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
pop esi
ret
Function at 0x1f03e030
Capabilities:
Enumerate threads

Disassembly:
push 0xffffffffffffffff
push 0x1f056a6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
xor eax, eax
push ebx
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 4
mov ebx, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x1f03e097
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
push edi
push 0x1c
call fcn.1f03e832
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x34], 0
test eax, eax
je 0x1f03e0bf
push 1
mov ecx, eax
call fcn.1f02e500
mov edi, eax
jmp 0x1f03e0c1
xor edi, edi
mov dword [esp + 0x34], 0xffffffff
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1f03e11d
cmp dword [esp + 0x1c], ebx
jne 0x1f03e10e
mov eax, dword [0x1f0837d0]
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
push 0
push ecx
mov ecx, dword [edx + 4]
add ecx, eax
call fcn.1f02dc80
test eax, eax
jne 0x1f03e10e
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + edi]
mov eax, dword [esp + 0x18]
mov edx, dword [edx + 8]
add ecx, edi
push eax
call edx
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1f03e0d8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x1f043eb9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1f06eb84]
jne 0x1f043ec3
repz ret
jmp fcn.1f04bc51
Function at 0x1f04d371
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1f043f3a
and dword [ebp - 4], 0
cmp dword [0x1f0848e0], 0
mov ebx, eax
jne 0x1f04d422
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1f04d4d3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1f04d4d3
push eax
call fcn.1f043ec8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1f0848e0], eax
call esi
push eax
call fcn.1f043ec8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1f0848e4], eax
call esi
push eax
call fcn.1f043ec8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1f0848e8], eax
call esi
push eax
call fcn.1f043ec8
pop ecx
mov dword [0x1f0848f0], eax
test eax, eax
je 0x1f04d422
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1f043ec8
pop ecx
mov dword [0x1f0848ec], eax
mov eax, dword [0x1f0848ec]
cmp eax, ebx
je 0x1f04d47a
cmp dword [0x1f0848f0], ebx
je 0x1f04d47a
push eax
call fcn.1f043f43
push dword [0x1f0848f0]
mov esi, eax
call fcn.1f043f43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1f04d47a
test edi, edi
je 0x1f04d47a
call esi
test eax, eax
je 0x1f04d471
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1f04d471
test byte [ebp - 0xc], 1
jne 0x1f04d47a
or dword [ebp + 0x10], 0x200000
jmp 0x1f04d4b3
mov eax, dword [0x1f0848e4]
cmp eax, ebx
je 0x1f04d4b3
push eax
call fcn.1f043f43
pop ecx
test eax, eax
je 0x1f04d4b3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1f04d4b3
mov eax, dword [0x1f0848e8]
cmp eax, ebx
je 0x1f04d4b3
push eax
call fcn.1f043f43
pop ecx
test eax, eax
je 0x1f04d4b3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1f0848e0]
call fcn.1f043f43
pop ecx
test eax, eax
je 0x1f04d4d3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1f04d4d5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10001fbf
pop dword [ebp - 0x38]
mov eax, 0x5b43adc1
sub eax, 0x4b438e02
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x11863b18
add dword [ebp - 0x48], 0x3ccc0a33
mov dword [ebp - 0x44], 0x7cb5307a
sub dword [ebp - 0x44], 0x4a81e435
mov dword [ebp - 0x40], 0xf133f879
sub dword [ebp - 0x40], 0xa4e7b44b
mov dword [ebp - 0x3c], 0xcb69994d
sub dword [ebp - 0x3c], 0xcb69994d
lea eax, [ebp - 0x48]
push eax
mov eax, 0xf38417dd
sub eax, 0xe3840799
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x945dbd5d
sub dword [ebp - 0x48], 0x1feb5407
mov dword [ebp - 0x44], 0xc1e9ae37
sub dword [ebp - 0x44], 0x807d4cc2
mov dword [ebp - 0x40], 0x60d651cf
add dword [ebp - 0x40], 0x2991a9d
mov dword [ebp - 0x3c], 0xfe4d7b28
sub dword [ebp - 0x3c], 0xfe4d7b28
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x5c76e836
sub eax, 0x4c76d7f6
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38586
push 0
call eax
mov ecx, 0x65464162
add ecx, 0x9aba068a
xor edi, edi
add edi, eax
mov edx, 0x181a1f49
sub edx, 0x8167349
add edx, dword [ebp - 0x38]
mov esi, 0xb3f16e37
add esi, 0x903dcd31
xor dword [ebp - 0x14], ebx
mov ebx, dword [edx]
add dword [ebp - 0xc], eax
xor ebx, esi
mov dword [edi], ebx
mov dword [ebp - 0xc], 0xc4040ecc
add edi, 4
add edx, 0x42cd5254
add edx, 0xbd32adb0
loop 0x100020e3
add eax, 0x11283
xor ebx, ebx
add ebx, eax
add eax, 0xd4585565
add eax, 0x2ba7aaa0
mov ecx, 0x8cac11a7
add ecx, 0x8353ee59
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10008dc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10013568]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x110], 0
mov dword [ebp - 4], 0x100
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0x10001634
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 8], eax
push 0x10001528
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.msvcrt.dll__strcmpi]
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000936d
mov esp, ebp
pop ebp
ret
Function at 0x1001cc50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov byte [ecx], 0
mov edi, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
cmp edx, edi
jae 0x1001cd37
mov ebx, dword [eax]
cmp byte [ebx + edx], 0
jne 0x1001ccb4
xor eax, eax
cmp byte [ebx + edx], 0
jne 0x1001cd37
cmp eax, 0x1000
jae 0x1001cd37
inc edx
inc eax
cmp edx, edi
jb 0x1001cc86
mov eax, edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x44444150
xor esi, esi
mov dword [ebp - 0x10], 0x58474e49
mov dword [ebp - 0xc], 0x44415058
mov dword [ebp - 8], 0x474e4944
mov dword [ebp - 0x18], edx
mov al, byte [ebx + edx]
mov ecx, esi
and ecx, 0xf
cmp al, byte [ebp + ecx - 0x14]
jne 0x1001ccf1
cmp esi, 0x1000
jae 0x1001ccf1
inc edx
inc esi
cmp edx, edi
jb 0x1001ccd5
cmp edx, dword [ebp - 0x18]
je 0x1001ccfc
mov eax, dword [ebp - 0x1c]
mov byte [eax], 1
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
mov edi, dword [ebx + 4]
cmp edx, edi
jae 0x1001cd37
mov ebx, dword [ebx]
xor esi, esi
lea ecx, [ecx]
mov al, byte [ebx + edx]
mov ecx, esi
and ecx, 0xf
cmp al, byte [ebp + ecx - 0x14]
jne 0x1001cd2c
cmp esi, 0x1000
jae 0x1001cd2c
inc edx
inc esi
cmp edx, edi
jb 0x1001cd10
cmp edx, dword [ebp - 0x18]
je 0x1001cd37
mov eax, dword [ebp - 0x1c]
mov byte [eax], 1
mov ecx, dword [ebp - 4]
mov eax, edx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x10029fe0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov word [ebx], ax
mov edi, ecx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
cmp esi, edx
jb 0x1002a011
test esi, esi
jne 0x1002a191
lea eax, [esi + 0xff]
cmp esi, edx
jae 0x1002a191
cmp esi, eax
jae 0x1002a191
cmp byte [esi + edi], 0xcc
je 0x1002a030
inc esi
jmp 0x1002a017
lea eax, [esi + 0x16]
cmp eax, edx
ja 0x1002a191
cmp byte [esi + edi], 0xcc
mov dword [ecx], esi
jne 0x1002a191
cmp byte [esi + edi + 1], 0x5b
jne 0x1002a191
cmp byte [esi + edi + 2], 0xb9
jne 0x1002a191
cmp byte [esi + edi + 5], 0
jne 0x1002a191
mov al, byte [esi + edi + 6]
test al, al
je 0x1002a078
cmp al, 0x11
jne 0x1002a191
cmp byte [esi + edi + 7], 0x80
jne 0x1002a191
lea eax, [edi + 0xb]
mov ecx, 0xfae2
add eax, esi
cmp word [eax], cx
jne 0x1002a191
push 9
push eax
call fcn.1001cbb0
add esp, 8
cmp eax, 0x5a131ac0
jne 0x1002a191
mov al, byte [esi + edi + 8]
mov ecx, 3
lea edx, [ecx - 1]
cmp al, 0x34
jne 0x1002a0f6
cmp byte [esi + edi + 9], 0x19
jne 0x1002a0f6
cmp byte [esi + edi + 0x14], 0xfc
jne 0x1002a0f6
cmp byte [esi + edi - 4], 0xeb
mov eax, 1
mov word [ebx], ax
jne 0x1002a121
cmp byte [esi + edi - 3], 0x11
jne 0x1002a121
cmp byte [esi + edi - 2], 0x33
jne 0x1002a121
cmp byte [esi + edi - 1], 0xd8
jne 0x1002a121
mov eax, dword [ebp + 0x14]
add dword [eax], 0xfffffffc
jmp 0x1002a124
cmp al, 4
jne 0x1002a121
cmp byte [esi + edi + 9], 0x19
jne 0x1002a121
cmp byte [esi + edi + 0x14], 0xc3
jne 0x1002a121
cmp byte [esi + edi - 2], 0x74
mov word [ebx], dx
jne 0x1002a121
cmp byte [esi + edi - 1], 0xf
jne 0x1002a121
mov eax, dword [ebp + 0x14]
add dword [eax], 0xfffffffe
jmp 0x1002a124
mov word [ebx], cx
mov al, byte [esi + edi + 3]
cmp al, 0xad
jne 0x1002a14c
cmp byte [esi + edi + 4], dl
jne 0x1002a14c
mov eax, dword [ebp + 0x10]
mov ecx, 1
mov word [eax], cx
xor eax, eax
cmp word [ebx], 3
setne al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp al, 0xcd
jne 0x1002a16c
cmp byte [esi + edi + 4], 4
jne 0x1002a16c
mov eax, dword [ebp + 0x10]
mov word [eax], dx
xor eax, eax
cmp word [ebx], 3
setne al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp al, 0x9e
jne 0x1002a177
cmp byte [esi + edi + 4], 4
je 0x1002a17c
mov ecx, 4
mov eax, dword [ebp + 0x10]
mov word [eax], cx
xor eax, eax
cmp word [ebx], 3
setne al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ecx
pop ebp
ret
Function at 0x1002b1b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b59fc
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov word [ecx + 0xc], ax
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], eax
mov byte [ecx + 0x48], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002da40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], 0x20454d4b
xor bh, bh
mov dword [ebp - 0x10], 0x6d617865
mov dword [ebp - 0xc], 0x20656c70
mov dword [ebp - 8], 0x656c6966
mov esi, dword [edi + 0xc]
cmp esi, 0x10
jbe 0x1002db01
xor bl, bl
test esi, esi
je 0x1002db01
lea edx, [esi - 1]
mov eax, esi
sub eax, edx
cmp eax, 4
ja 0x1002db01
test bl, bl
jne 0x1002dabe
mov eax, dword [edi + 4]
mov ecx, dword [edi]
sub eax, ecx
cmp eax, 1
jb 0x1002dab1
dec eax
cmp edx, eax
ja 0x1002dab1
cmp byte [ecx + edx], 0x4b
jne 0x1002dab0
mov bl, 1
jmp 0x1002dab1
dec edx
mov ecx, esi
sub ecx, edx
cmp ecx, 4
jbe 0x1002da91
test bl, bl
je 0x1002db01
mov bl, 1
xor ecx, ecx
test bl, bl
je 0x1002daee
mov eax, dword [edi + 4]
mov esi, edx
sub eax, dword [edi]
sub esi, ecx
cmp eax, 1
jb 0x1002dae9
dec eax
cmp esi, eax
ja 0x1002dae9
mov eax, dword [edi]
mov al, byte [eax + esi]
cmp al, byte [ebp + ecx - 0x14]
je 0x1002dae8
xor bl, bl
jmp 0x1002dae9
inc ecx
cmp ecx, 0x10
jb 0x1002dac2
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b37df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bh
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b37df
mov esp, ebp
pop ebp
ret
Function at 0x10030300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5bec
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 0x50]
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x28], 0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [ebp - 4], 1
lea eax, [ecx + 0x70]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 3
lea eax, [ecx + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [ebp - 4], 5
mov eax, 0xffff
mov dword [ecx + 0x48], 0
mov word [ecx + 0x18], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov byte [ecx + 0x1a], 0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret