joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4076fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
movsd xmm0, qword [0x43bdf2]
movsd qword [ecx + 0xd], xmm0
movups xmm0, xmmword [str.NuUom_pWidwNfRebthoo]
movups xmmword [ecx], xmm0
nop
test eax, eax
nop
mov edi, str.01:51:58
mov ebp, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 2
push edi
push 0x63
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 3
push edi
push 0x65
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 4
push edi
push 0x66
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 5
push edi
push 0x67
push ebp
call fcn.00404723
add esp, 0x10
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
push 6
push edi
push 0x68
push ebp
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 9
push edi
push 0x6c
push ebp
call fcn.00404723
add esp, 0x10
nop
xor ebx, ebx
nop
test eax, eax
nop
push 0xa
push edi
push 0x6d
push ebp
call fcn.00404723
add esp, 0x10
nop
mov eax, ebx
and al, 1
xor byte [esi + ebx], al
nop
test eax, eax
nop
push 0xb
push edi
push 0x6e
push ebp
call fcn.00404723
add esp, 0x10
nop
inc ebx
cmp ebx, 0x14
jne 0x4077a8
nop
test eax, eax
nop
mov edi, str.01:51:58
mov esi, str.tracing_app_routine_sb__d_:_st__s_:_ln__d__n
push 0xc
push edi
push 0x6f
push esi
call fcn.00404723
add esp, 0x10
nop
nop
test eax, eax
nop
push 0xd
push edi
push 0x70
push esi
call fcn.00404723
add esp, 0x10
nop
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4087b9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov esi, dword [0x443ee0]
imul ebp, ecx, 0x2c
mov eax, dword [esi + ebp]
movzx ecx, byte [esi + ebp + 0x14]
xor edx, edx
and ecx, 1
sete dl
lea edx, [edx + edx*4]
lea edi, [eax + edx]
add edi, 0xfffffffb
lea eax, [ecx + ecx + 5]
mov ecx, esp
push ecx
push 0x40
mov dword [esp + 0x10], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40882c
lea ecx, [esi + ebp]
add ecx, 0x14
test ebx, ebx
mov dword [esp + 4], ecx
je 0x408833
mov byte [edi], 0xe9
mov eax, dword [esi + ebp + 4]
sub eax, edi
add eax, 0xfffffffb
mov dword [edi + 1], eax
test byte [ecx], 1
mov edx, esp
je 0x408854
add esi, ebp
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x408854
mov eax, 0xa
jmp 0x40888e
test byte [ecx], 1
lea eax, [esi + ebp + 0xc]
mov edx, esp
jne 0x40884a
mov cl, byte [eax + 4]
mov byte [edi + 4], cl
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x408854
mov ecx, dword [eax]
mov eax, dword [eax + 3]
mov dword [edi + 3], eax
mov dword [edi], ecx
push edx
push dword [esp + 4]
mov esi, dword [esp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp + 4]
mov al, byte [edx]
and bl, 1
mov ecx, ebx
add cl, bl
and al, 0xf9
or al, cl
shl bl, 2
or bl, al
mov byte [edx], bl
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408896
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
test eax, eax
je 0x4088e6
mov esi, ecx
cmp dword [ecx + 8], 0
je 0x4088d7
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call ebp
test eax, eax
je 0x4088cf
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x4088b0
mov eax, dword [esi]
push eax
push 0
push dword [0x443edc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40bdf0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
call fcn.0040d5d0
test al, al
je 0x40be24
push 2
call dword [0x443ca8]
add esp, 4
push ebx
push edi
push esi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.0040b6b0
add esp, 0x14
pop esi
pop edi
pop ebx
jmp fcn.0040d6d0

Function at 0x40cff0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x40d001
jmp dword [eax*4 + 0x43d300]
cmp dword [0x443f34], 0
je 0x40d103
push 0x443f38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x443f50]
test edi, edi
je 0x40d0f8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d04b
mov edi, dword [edi + 8]
test edi, edi
je 0x40d0f8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40d040
test esi, esi
je 0x40d040
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x40d040
cmp dword [0x443f34], 0
jne 0x40d080
push 0x443f38
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x443f34], 1
jmp case.default.0x40d001
call fcn.0040adc0
jmp case.default.0x40d001
cmp dword [0x443f34], 0
je case.default.0x40d001
push 0x443f38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x443f50]
test edi, edi
je 0x40d153
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d0d7
mov edi, dword [edi + 8]
test edi, edi
je 0x40d153
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40d0d0
test esi, esi
je 0x40d0d0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x40d0d0
push 0x443f38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x443f34]
cmp eax, 1
jne case.default.0x40d001
mov eax, dword [0x443f50]
test eax, eax
je 0x40d132
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.0042fc3c
add esp, 4
mov eax, esi
test esi, esi
jne 0x40d120
mov dword [0x443f50], 0
mov dword [0x443f34], 0
push 0x443f38
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x40d001
push 0x443f38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40d280
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x430004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x40d2e6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x40d2e6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x40d2e6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x40d2e6
mov edx, dword [esp + 0xc]
sub edx, dword [0x430004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x40d2d6
add esi, 0x28
dec ecx
je 0x40d2e6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x40d2d0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x40d2d0
mov eax, esi
pop esi
pop edi
ret
Function at 0x40d520
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
cmp byte [0x444f03], 1
jne 0x40d53e
cmp byte [0x444f02], 0
jne 0x40d55d
jmp 0x40d578
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f03], 1
test eax, eax
setne byte [0x444f02]
je 0x40d578
push 2
call dword [0x443ca8]
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.0040d610
add esp, 0x10
mov dword [esi], 0x43d4ec
mov dword [esi + 4], 0x444ef8
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.0040e1f0
xor eax, eax
pop esi
pop edi
ret

Function at 0x40d5d0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x444f03], 1
jne 0x40d5e4
cmp byte [0x444f02], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x444f02]
mov byte [0x444f03], 1
ret

Function at 0x40d630
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x444f03], 1
jne 0x40d654
cmp byte [0x444f02], 0
jne 0x40d673
jmp 0x40d68f
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f03], 1
test eax, eax
setne byte [0x444f02]
je 0x40d68f
push 2
call dword [0x443ca8]
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.0040d610
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x40d6c2
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d6d0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x444f03], 1
jne 0x40d6f7
cmp byte [0x444f02], 0
jne 0x40d716
jmp 0x40d732
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f03], 1
test eax, eax
setne byte [0x444f02]
je 0x40d732
push 2
call dword [0x443ca8]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.0040d610
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
mov edi, 0xffffe672
test al, al
je 0x40d7c2
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
push ebx
call edi
xor edi, edi
cmp ebx, 0xffffffff
jne 0x40d7c2
mov eax, dword [esi]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov eax, esp
mov ecx, esi
push eax
call ebx
mov eax, dword [esi]
mov ebx, dword [eax + 0x34]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0
call ebx
cmp dword [esp + 0x10], 0
je 0x40d7c2
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0xfffffffffffffffe
call ebx
mov ebx, eax
add ebx, dword [esp + 0x10]
mov eax, dword [esi]
mov ebp, dword [eax + 0x10]
mov ecx, ebp
call dword [section..00cfg]
mov ecx, esi
push ebx
push 0xfffffffffffffffe
call ebp
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40d7d0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x444f03], 1
jne 0x40d7ea
cmp byte [0x444f02], 0
jne 0x40d809
jmp 0x40d823
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f03], 1
test eax, eax
setne byte [0x444f02]
je 0x40d823
push 2
call dword [0x443ca8]
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.0040d610
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x40d840
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x444f03], 1
jne 0x40d85a
cmp byte [0x444f02], 0
jne 0x40d879
jmp 0x40d893
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f03], 1
test eax, eax
setne byte [0x444f02]
je 0x40d893
push 2
call dword [0x443ca8]
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.0040d610
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x40d8b0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x444f03], 1
jne 0x40d8cf
cmp byte [0x444f02], 0
jne 0x40d8ee
jmp 0x40d909
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f03], 1
test eax, eax
setne byte [0x444f02]
je 0x40d909
push 2
call dword [0x443ca8]
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.0040d610
add esp, 0x10
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x40d930
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x444f03], 1
jne 0x40d94a
cmp byte [0x444f02], 0
jne 0x40d969
jmp 0x40d983
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f03], 1
test eax, eax
setne byte [0x444f02]
je 0x40d983
push 2
call dword [0x443ca8]
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.0040d610
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x40d9a0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x444f03], 1
jne 0x40d9c4
cmp byte [0x444f02], 0
jne 0x40d9e3
jmp 0x40d9ff
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f03], 1
test eax, eax
setne byte [0x444f02]
je 0x40d9ff
push 2
call dword [0x443ca8]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.0040d610
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40dea0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x444f01], 1
jne 0x40deb4
cmp byte [0x444f00], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x444f00]
mov byte [0x444f01], 1
ret
Function at 0x4110b0
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x101c
call fcn.0040b3c4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x411212
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x411269
shr ecx, 2
cmp ecx, 2
mov eax, 1
cmovae eax, ecx
mov dword [esp + 0xc], eax
mov bl, 1
mov dword [esp + 0x10], ecx
jmp 0x41112a
mov edx, dword [esp + 0x14]
inc edx
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setb bl
xor eax, eax
cmp edx, dword [esp + 0xc]
je 0x411269
mov byte [esp + 3], bl
mov dword [esp + 0x14], edx
mov esi, dword [esp + edx*4 + 0x1c]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x1034]
mov dword [edx], esi
mov dword [esp + 8], esi
movzx esi, word [esi + eax + 6]
test esi, esi
je 0x411110
add eax, dword [esp + 8]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp + 4], 0
xor ebx, ebx
jmp 0x411176
add ebp, 0x28
dec esi
je 0x411110
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 8]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x4111b0
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x4111e0
test bl, 1
jne 0x4111ff
jmp 0x411170
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1030]
cmp eax, ecx
movzx eax, bl
mov ebx, eax
mov edx, 1
cmova ebx, edx
cmp edi, ecx
cmova ebx, eax
test bl, 1
jne 0x4111ff
jmp 0x411170
mov ecx, dword [esp + 0x1034]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp + 4], eax
test bl, 1
je 0x411170
mov eax, dword [esp + 4]
and al, 1
je 0x411170
movzx eax, byte [esp + 3]
jmp 0x411269
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x444f01], 1
jne 0x41122e
cmp byte [0x444f00], 0
jne 0x41124d
jmp 0x411267
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x444f01], 1
test eax, eax
setne byte [0x444f00]
je 0x411267
push 2
call dword [0x443ca8]
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.0040d610
add esp, 0xc
xor eax, eax
and al, 1
add esp, 0x101c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10006d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b3fd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100a3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0xf
xor edx, edx
nop
mov al, byte [edx + str.Aui4Vvuj]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10006d9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10006d80
mov byte [ebp - 0x15], 0
mov edx, 0x100e3eec
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10021b70
mov dword [ebp - 0x1c], 0x46206f4e
mov dword [ebp - 0x18], 0x6873616c
mov byte [ebp - 0x14], 0
mov edx, 0x100e3ee8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.10021b70
mov dword [ebp - 0x18], 0x46206f4e
mov word [ebp - 0x14], 0x676f
mov byte [ebp - 0x12], 0
mov edx, 0x100e3ee9
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.10021b70
mov ecx, 0xb5
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x1009eca4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10006e2d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10006e10
mov byte [ebp - 0x14], 0
mov edx, 0x100e3ee6
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.10021b70
mov dword [ebp - 0x1c], 0x53206f4e
mov dword [ebp - 0x18], 0x656b6f6d
mov byte [ebp - 0x14], 0
mov edx, 0x100bcd77
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1c]
call fcn.10021b70
mov ecx, 0xb0
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + 0x1009ecb4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10006e9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10006e80
mov byte [ebp - 0x15], 0
mov edx, 0x100e3ee5
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x20]
call fcn.10021b70
mov ecx, 0x96
xor edx, edx
mov al, byte [edx + 0x1009ecc0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10006edf
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x10006ec2
mov byte [ebp - 0x12], 0
mov edx, 0x100e3eed
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.10021b70
mov ecx, 0x5b
xor edx, edx
mov al, byte [edx + 0x1009ecd0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10006f21
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10006f04
mov byte [ebp - 0x15], 0
mov edx, 0x100e3ee7
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.10021b70
mov dword [ebp - 0x1c], 0x776f6853
mov dword [ebp - 0x18], 0x53504620
mov byte [ebp - 0x14], 0
mov edx, 0x100e3eeb
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.10021b70
mov dword [ebp - 0x1c], 0x776f6853
mov dword [ebp - 0x18], 0x445548
mov edx, 0x100e3ee4
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x1c]
call fcn.10021b70
mov dword [ebp - 0x1c], 0x63617274
mov dword [ebp - 0x18], 0x737265
mov edx, 0x100e3eea
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x1c]
call fcn.10021b70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100497a0
mov esp, ebp
pop ebp
ret
Function at 0x100072e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x10007302
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x60]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x100072f0
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x10007310
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b4bd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100a3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0x69766e49
mov dword [ebp - 0x18], 0x6c626973
mov word [ebp - 0x14], 0x65
mov edx, 0x100e3ef5
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10021b70
mov dword [ebp - 0x1c], 0x43206f4e
mov dword [ebp - 0x18], 0x70696c
mov edx, 0x100e3ef4
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.10021b70
mov dword [ebp - 0x1c], 0x65657053
mov dword [ebp - 0x18], 0x61482064
mov word [ebp - 0x14], 0x6b63
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.1001de00
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x30]
mov dword [esp], 0x3f800000
lea ecx, [ebp - 0x2c]
push 0x1009ed14
push eax
lea eax, [ebp - 0x18]
mov word [ebp - 0x2c], 0x83
push eax
push 0x100e3ef8
xor edx, edx
mov byte [ebp - 0x2a], 0
mov dword [ebp - 0x30], 0x5dc
mov dword [ebp - 0x18], 0
call fcn.10020c10
mov dword [ebp - 0x28], 0x706d754a
mov dword [ebp - 0x24], 0x63614820
mov word [ebp - 0x20], 0x6b
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push eax
call fcn.1001de00
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], 0x1002223
xor ecx, ecx
lea eax, [ecx - 0x60]
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 2
jb 0x10007423
push ecx
mov dword [esp], 0x3f800000
lea eax, [ebp - 0x18]
push 0x1009ed14
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 0x29], 0
push eax
push 0x100e3efc
xor edx, edx
mov dword [ebp - 0x18], 0x7d0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], 0
call fcn.10020c10
add esp, 0x14
mov dword [ebp - 0x28], 0x20796c46
mov dword [ebp - 0x24], 0x6b636148
mov byte [ebp - 0x20], 0
mov edx, 0x100e3ef6
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.10021b70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100497a0
mov esp, ebp
pop ebp
ret