joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100140d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029295
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1003d500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 7
mov ecx, dword [edi + 0x10]
jbe 0x10014110
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
lea eax, [ecx + ecx]
mov esi, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x1001413a
mov edx, dword [ebp - 0x14]
mov edi, eax
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10014123
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
push esi
push edi
lea eax, [ebp - 0x18]
mov ecx, edx
push eax
call fcn.100030e0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1001416a
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x4924924
je 0x1001429f
add eax, 4
mov dword [ebp - 0x20], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.1001d6e4
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [eax + 8], xmm0
mov dword [eax + 0x18], 0
add esp, 4
mov dword [eax + 0x1c], 0
lea ecx, [eax + 8]
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [ecx], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ecx + 0x10], xmm0
xorps xmm0, xmm0
mov word [edi], ax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
movups xmmword [ecx + 0x18], xmm0
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmmword [ecx + 0x18], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x28], xmm0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1002c3d0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1002c3d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x10014272
mov ecx, edi
call fcn.10018a00
mov eax, dword [ebp - 0x1c]
mov ecx, edi
push esi
add eax, 8
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100030e0
mov ecx, dword [eax]
jmp 0x10014275
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
push esi
mov ecx, edi
call fcn.1000fbc0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.1001af6a
int3
Function at 0x100145b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029360
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1003d500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1001d6e4
mov edi, eax
add esp, 4
test edi, edi
je 0x1001465d
push 1
mov dword [ebp - 4], 0
call fcn.1001c9c3
add esp, 4
mov dword [edi + 4], eax
jmp 0x1001465f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.100183b0
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x1003e5f0]
mov ecx, dword [0x1003e5f4]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018b80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x10018d1c
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x10018bbb
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x10018be4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10018bd0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10003d70
push 0x38
push edi
call fcn.1001d714
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10018c49
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10018c00
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10018c38
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10018c5b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x10018c5e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x10018d0f
nop dword [eax]
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x10018c7e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x10018ca4
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10018c90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10003d70
push 0x38
push edi
call fcn.1001d714
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10018cf9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10018cb8
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x10018c70
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10019610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029b0d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1003d500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1001d6e4
mov edi, eax
add esp, 4
test edi, edi
je 0x100196ad
push 1
mov dword [ebp - 4], 0
call fcn.1001c9c3
add esp, 4
mov dword [edi + 4], eax
jmp 0x100196af
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10014420
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1001970a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1001970a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10019726
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10019749
cmp byte [ebp + 0xc], 0
je 0x10019735
push esi
call fcn.1001cf02
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10019755
mov esi, str.ios_base::badbit_set
jmp 0x10019765
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10019790
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10015930
push 0x10036578
lea eax, [ebp - 0x28]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x1001bec9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1001bef0
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1001bef3
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1001bea5
pop esi
leave
ret 8

Function at 0x1001eb80
Capabilities:
Get process heap force flags

Disassembly:
call fcn.1001eab0
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x1001ebaa
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x1001ebb6
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x1001ebc0
Capabilities:
Get process heap force flags

Disassembly:
call fcn.1001eab0
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x1001ebea
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x1001f020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x1003d500]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1001f047
mov ecx, 5
int 0x29
push 2
call fcn.1001e5ec
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1001f152
test esi, esi
jne 0x1001f152
push 2
call fcn.1001e5ec
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001db1c
mov esp, ebp
pop ebp
ret
Function at 0x10022110
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x1003d500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002220b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x1002220b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x1002216a
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x10022148
jmp 0x1002220b
cmp edx, 0x200
jae 0x10022271
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x1002220b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x1002220a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x1002220a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x10022253
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x100221f0
pop edi
mov eax, dword [0x1003ecd8]
test eax, eax
jne 0x10022231
push str.setlocale
call fcn.10024170
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002222c
or eax, 0xffffffff
mov dword [0x1003ecd8], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x1002225f
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001db1c
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x1002220a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1001db1c
mov esp, ebp
pop ebp
ret
call fcn.1001e716
int3
Function at 0x10022ba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.10022bd0
mov esi, dword [ebp + 8]
test al, al
je 0x10022bbe
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10022be0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100271e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002720d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002720d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x405f7f
pop dword [ebp - 0x24]
mov eax, 0x405f7f
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x9aa49c8d
add dword [ebp - 0x34], 0xb3ada8be
mov dword [ebp - 0x30], 0x805b6476
add dword [ebp - 0x30], 0xb1d7e7cf
mov dword [ebp - 0x2c], 0xa389b772
sub dword [ebp - 0x2c], 0x573d7344
mov dword [ebp - 0x28], 0xa288d07c
sub dword [ebp - 0x28], 0xa288d07c
lea eax, [ebp - 0x34]
push eax
mov eax, 0xa0c2be57
add eax, 0x5f7e8239
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xffedf5c6
sub dword [ebp - 0x34], 0x8b7b8c70
mov dword [ebp - 0x30], 0x3f1885b4
sub dword [ebp - 0x30], 0xfdac243f
mov dword [ebp - 0x2c], 0xae021dc2
sub dword [ebp - 0x2c], 0x4a92b156
mov dword [ebp - 0x28], 0xd3e8de16
add dword [ebp - 0x28], 0x2c1721ea
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xd4a5acb0
add eax, 0x2b9b938c
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3b64b
push 0
call eax
mov ecx, 0x99e29143
sub ecx, 0x99e246e1
mov edi, eax
mov ebx, 0x1c1278cb
add ebx, 0xe42f4735
add ebx, dword [ebp - 0x24]
mov edx, 0x10d87695
add edx, 0x89f9acfe
mov dword [ebp - 4], 0xfd32f563
mov esi, dword [ebx]
xor dword [ebp - 0x14], 0x9f906f98
xor esi, edx
xor dword [ebp - 0x10], edi
mov dword [edi], esi
add dword [ebp - 0x10], esi
add edi, 0xf59cb82e
sub edi, 0xf59cb82a
add ebx, 0x4eaaa5ff
add ebx, 0xb1555a05
loop 0x40609c
add eax, 0x11c5b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd701342b
sub ecx, 0xd6c1342b
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630
Function at 0x10005da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10092460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.10087ac1
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10006970
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10005df4
jmp dword [ecx*4 + 0x10005f5c]
mov al, byte [esi]
test al, al
je 0x10005e22
cmp al, 0x20
je 0x10005e0e
cmp al, 0xa1
jne 0x10005e22
cmp byte [esi + 1], al
jne 0x10005e22
test al, 0x80
je 0x10005e1a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10005e22
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10005e01
test ecx, ecx
je case.default.0x10005df4
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10005df4
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10005e68
cmp dl, 0xa1
jne 0x10005e5c
cmp byte [eax + 1], 0xa1
jne 0x10005e5c
test ecx, ecx
jne 0x10005e54
mov edi, eax
mov ecx, 1
inc eax
jmp 0x10005e7c
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x10005e96
jmp 0x10005e7c
cmp dl, 0x20
jne 0x10005e7a
test ecx, ecx
jne 0x10005e73
mov edi, eax
mov ecx, 1
jmp 0x10005e7c
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x10005e3c
cmp ecx, 1
jne case.default.0x10005df4
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10005df4
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10005df4
mov al, byte [esi]
test al, al
je 0x10005eee
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10005ed4
mov cl, byte [esi + 1]
test cl, cl
je 0x10005eee
cmp al, 0xa1
jne 0x10005ec4
cmp cl, al
je 0x10005ed1
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10006c40
inc esi
jmp 0x10005ee6
cmp al, 0x20
je 0x10005ee6
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10006c80
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10005ead
push 0
lea ecx, [esp + 0x14]
call fcn.10006c80
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1000fdc0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x10005f21
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x10099508
call fcn.10006b70
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10087a53
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret