joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8845
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
jle 0x4ea92e
pushal
pushal
jmp 0x5d5ea2
test edx, edx
jmp 0x4e7d40

Function at 0x4e94aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 1
movsx ebx, bl
bswap bx
mov word [esp], 0x4c8d
mov ebx, dword [esp + 0x48]
lea esp, [esp + 0x4c]
jno 0x5932a2
mov esp, ebp
push 0xeda54698
mov ebp, dword [esp + 4]
push dword [esp + 4]
pushfd
mov byte [esp], 0xd4
push ebp
push dword [esp + 0x14]
ret 0x2c
pushal
pushal
call fcn.005be582
pushal
bt bp, sp
mov dword [ebp + 0xc], eax
pushfd
sub ch, 0xfa
mov ecx, dword [ebp + 8]
bsf ax, sp
mov eax, dword [ebp + 0xc]
clc
pushfd
stc
cmp eax, dword [ecx]
mov byte [esp], 0x40
jmp fcn.00569984

Function at 0x4ea021
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x59183d
inc ebx
stc
pushfd
cmp bl, 0x1f
cmp al, al
add edx, eax
mov byte [esp + 0xc], bh
pushfd
test ebx, 0x3c80e177
cmp ebx, edx
push 0xae9d944e
pushfd
mov dword [ebp - 4], ebx
pushal
pushfd
push dword [esp + 8]
jmp 0x5d7bc6

Function at 0x574001
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmc
add esp, 4
pushal
clc
test edi, edi
call fcn.005a2ae5
shld cx, cx, 1
movsx cx, dl
add ch, al
shrd ecx, eax, 8
mov dword [ebp + 0xc], eax
mov dword [esp], ebx
push ebp
pushal
pushfd
lea esp, [esp + 0x28]
call fcn.004ee751
jmp 0x5c8a18
jmp 0x5a1ff0
jmp 0x573ff4

Function at 0x579999
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x20], edi
push dword [esp + 4]
mov byte [esp], bl
lea esp, [esp + 0x24]
jmp 0x59ece4

Function at 0x592296
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
call fcn.00570ff4
pushal
lea edi, [edx*4 - 0xcd5a33]
movzx di, al
mov dword [esp + 0x1c], esi
bswap di
mov edi, eax
pushal
push dword [esp]
mov byte [esp], dh
lea esp, [esp + 0x40]
call fcn.004ee751
dec si
sub bh, ch
mov ebx, dword [ebp - 4]
jmp 0x5d68ea
movsx edx, al
dec ax
lea edx, [ebp*8 + 0x4f5dbd6e]
call fcn.005b24d2
xor ecx, dword [edx + 0x11]
pushfd
lea esp, [esp + 0x2c]
je 0x5914d7
bswap dx
mov eax, eax
cdq
mov edx, dword [ebp + 0xc]
movzx eax, bl
jmp fcn.0056c43a
inc ebp
sbb ebp, ebp
btr bp, 8
dec bp
sub eax, eax
pushal
mov ebp, dword [esp + 0x20]
pushfd
push dword [esp]
push edi
push dword [esp + 0x30]
ret 0x40
mov dword [esp + 4], ebx
lea esp, [esp + 8]
je 0x5d7bd0
jno 0x58972c
lahf
dec ax
movzx edx, word [esi]
movsx eax, dl
pushfd
dec al
movzx eax, word [esi + 2]
mov byte [esp], 0xc7
pushfd
call fcn.004ea021
jmp 0x5729e8
test sp, 0x694c
push 0x99f3d7fd
mov esi, dword [ebp - 8]
cmc
cmp ch, al
add esp, 8
pushal
lea esp, [esp + 0x20]
jmp fcn.0057ba39

Function at 0x594f98
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp dl, cl
bt bx, 9
mov dword [ebp - 8], esi
clc
cmc
clc
mov byte [esp + 8], al
mov dword [ebp - 4], ebx
cmp bh, ch
clc
push edi
test edx, edx
pushfd
push 0xba01ef20
lea esp, [esp + 0x40]
jle 0x5d7bda
call fcn.005971ac

Function at 0x5954ed
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x38]
jl 0x59ecde
sar cx, 1
mov ecx, dword [ebp + 8]
Function at 0x59bc05
Capabilities:
Encode data using xor

Disassembly:
bswap cx
pop ecx
movzx ecx, word [eax + edx*2]
call fcn.0056a61e
cmpsd dword [esi], dword es:[edi]
push ebp
sub byte [ebx + 0x32541722], cl
clc
sbb byte [edx + 0x6ce3a53c], 6
outsd dx, dword [esi]
xchg ecx, eax
cli
inc eax
push eax
salc
aaa
insd dword es:[edi], dx
not byte [ebp + esi*8 - 0x351ec8e1]
and byte [eax], dh
mov byte [0xf0c2610b], al
add byte [edx - 0x257a2dd0], al
stosd dword es:[edi], eax
or dl, ah
add ch, byte [ebx]
pop edi
adc eax, 0x4d7aac35
aad 0x86
dec eax
sub bl, byte [ecx + 0x1f]
mov cl, 0x88
in al, dx
mov dl, 0x38
ja 0x59bc33
outsd dx, dword [esi]
out 0xd4, al
sub dword [ecx], ecx
fisub word [ebp + 0x12045084]
inc esi
mov byte [esi - 0x7c], dl
dec edx
rcr ch, 1
cwde
jle 0x59bc7b
sbb eax, 0x6d0d9503
les esp, [esi - 0xd]
movsd dword es:[edi], dword [esi]
add byte ss:[ebx], bl
into
adc al, 0xf6
lodsd eax, dword [esi]
nop
dec ecx
cli
mov esp, 0xa0662f8a
pop ecx
les eax, [ebx]
xchg ebp, eax
inc ebx
or eax, 0xc66715c0
pop eax
invalid

Function at 0x5a4d91
Capabilities:
Encode data using xor

Disassembly:
shrd ecx, edx, 1
push ebp
adc ebp, ebx
rcr bp, 9
mov ebp, esp
shr ah, cl
movzx ecx, word [edi]
rol ah, 1
shr al, cl
movzx eax, word [edi + 2]
pushfd
mov byte [esp], dh
mov dword [esp], esi
inc si
rol si, 1
rol si, cl
shr si, cl
lea esi, [eax + ecx - 1]
bt di, 5
test bh, 0x63
cmc
call fcn.0057162d
mov dh, 0xe8
push ss
xor eax, 0xeb5414d3
and cl, byte [esp - 0x22]
inc edi
jne 0x5a4db5
and al, 0x85
ret

Function at 0x5b32f1
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xc70001e7
inc esp
and al, 0x2c
add byte [eax], al
add byte [eax], al
mov dword [esp + 0x2c], 0
sub al, 0
add byte [eax], al
add bh, bh
xor al, 0x24
push dword [esp]
push esi
mov word [esp + 4], 0xb20
mov dword [esp + 0x30], 0x5a499a
call fcn.00567575
sub byte [edx + 0x143f7c7d], ah
push esp
je 0x5aa176
pop esp
je 0x5aa1a5
outsd dx, dword [esi]
mov ebp, 0x9a5067cd
mov dl, 0x38
dec eax
out dx, al
dec edi
popal
jns 0x5aa1dc
adc byte [edx], bh
push edx
sal byte [ecx - 0x6b113f21], 1
xor dh, byte [edi - 0x7502cc73]
push eax
neg byte [edi + ebp*2 + 0x48e85eea]
retf 0xe034
ja 0x5aa201
xchg ebx, eax
sub eax, 0xe5df2963
dec ebx
int1
pop esi
push edi
jl 0x5aa241
jg 0x5aa16f
lcall 0x89ca, 0x7bcd1f85
dec ebx
xor al, 0x72
sub byte [edx*4 + 0x3e9832cb], 0xd0
lodsb al, byte [esi]
push ebp
test dword [eax*4 + 0x33c16307], ecx
jg 0x5aa235
lds esi, [edx + 0x58]
dec ch
xor dword [edi - 0xc], esi
sub ecx, esp
les edi, [esi + edx*8]
add al, 0xc
mov dh, 0x69
ficom dword [edx + ebx*2 + 0x3bdc0110]
jmp 0x4e52efb6
xchg ebp, eax
pop ss
pop ds
dec esi
push esp
or edi, dword [ecx]
retf
pop edi
test esp, edx
iretd
mov dword [esp + 0x20], 0xffffffff
movzx di, dl
mov edi, eax
push ecx
mov dword [esp + 0x20], edi
push ebx
pushfd
pushfd
mov dword [esp + 0x28], 0
push ecx
pushfd
jmp 0x5aa173
Function at 0x5ba9dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], ch
inc ecx
call fcn.005ba9dc
push ecx
jmp 0x5790f9
pushal
cmp sp, bp
cmp byte [ecx], al
push dword [esp + 4]
pushfd
mov byte [esp + 0x14], 0x2e
lea esp, [esp + 0x30]
jne 0x57992c
aad 0xa3
rcr eax, 0x19
mov eax, dword [ecx + 1]
pushfd
mov byte [esp], 0x24
add eax, 0x1383dcce
bt bp, 1
xor eax, dword [ecx + 0x19]
push ecx
pushfd
lea esp, [esp + 0xc]
je 0x59555d
call fcn.005c42d1
jmp 0x58d8a6

Function at 0x5ce37f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
call fcn.005aff6f
push 0xffffffffffffff98
mov esi, 0x54127d5d
sar dword [ecx - 0x3c1d3ba5], cl
add eax, 0xc711806e
sub byte [edx + 0x5b], dh
test dword [ebp - 0xa1ac8e1], ebx
wait
cld
lahf
shr ecx, 1
arpl word [ecx], dx
fbstp tbyte [edx - 0x137a7f11]
shl esi, 1
push 0x6c
in al, 0x73
and esi, eax
lodsb al, byte [esi]
bound ebp, qword [eax - 0x1d]
sbb bl, byte [eax - 0x23]
mov esi, dword [eax]
push ss
test al, 0xd6
popal
pop ebx
or dword [esp + esi*4 - 0x6542779e], ebx
xor dword [ebp + 0x3d], esi
je 0x5ce381
sbb edi, esi
jmp [edx - 0x68]
mov eax, 0x579f1933
enter 0xffffffffffff997f, 0x59
invalid
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3192677f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7f485595
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x37eaa24
Capabilities:
Encode data using xor

Disassembly:
jmp 0x37eaa2e
pushal
call 0x37eaa34
pop ebp
sub ebp, 0x10
sub ebp, 0x33eaa24
jmp 0x37eaa4a
mov eax, 0x33eaa24
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c9
mov edx, 0x4832b30b
xor byte [eax], dl
inc eax
dec ecx
jne 0x37eaa61
jmp 0x37eaa74
add dh, 0x80
xor byte [edi], 0xb
or ecx, dword [ebx]
mov cl, dl
or ecx, dword [ebx]
or ecx, dword [eax]
invalid
Function at 0x10007120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053588
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1006c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000724f
cmp byte [ebx + 0x3d], 0
je 0x1000724f
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10007179
xor al, al
jmp 0x10007251
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10006c30
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100071e7
sub eax, 1
je 0x100071eb
sub eax, 2
je 0x10007241
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.10002e80
mov al, bl
jmp 0x10007251
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x10007223
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10034f9e
add esp, 0x10
cmp esi, eax
jne 0x100071d9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x10007241
test esi, esi
jne 0x100071a4
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10006d00
jmp 0x1000719e
lea ecx, [ebp - 0x28]
mov bl, 1
call fcn.10002e80
mov al, bl
jmp 0x10007251
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cc28
mov esp, ebp
pop ebp
ret

Function at 0x100076e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053356
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1006c070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1002d1d6
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10019873
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000bae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
push edi
call fcn.10009e30
push eax
call fcn.10007f30
add esp, 4
xor ecx, ecx
nop dword [eax]
mov eax, ecx
test cl, 1
je 0x1000bb0a
xor eax, 2
shr eax, 1
test al, 1
je 0x1000bb13
xor eax, 2
shr eax, 1
test al, 1
je 0x1000bb1c
xor eax, 2
shr eax, 1
test al, 1
je 0x1000bb25
xor eax, 2
shr eax, 1
test al, 1
je 0x1000bb2e
xor eax, 2
shr eax, 1
test al, 1
je 0x1000bb37
xor eax, 2
shr eax, 1
test al, 1
je 0x1000bb40
xor eax, 2
shr eax, 1
test al, 1
je 0x1000bb49
xor eax, 2
shr eax, 1
mov dword [ecx*4 + 0x1006f980], eax
inc ecx
cmp ecx, 0x100
jb 0x1000bb00
mov esi, 0x10c
or ebx, 0xffffffff
cmp edi, esi
jbe 0x1000bb98
mov eax, dword [ebp - 4]
movsx eax, byte [esi + eax]
push eax
call fcn.10009e30
push eax
call fcn.10007f30
mov eax, dword [ebp - 4]
add esp, 4
movzx ecx, bl
shr ebx, 8
movzx eax, byte [esi + eax]
inc esi
xor ecx, eax
xor ebx, dword [ecx*4 + 0x1006f980]
cmp esi, edi
jb 0x1000bb67
pop edi
not ebx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d3f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006e57c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10076b6c]
cmp eax, dword [ecx + 4]
jle 0x1000d448
push 0x10076b6c
call fcn.1002cd54
add esp, 4
cmp dword [0x10076b6c], 0xffffffff
jne 0x1000d448
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x10076b6c
mov dword [0x10076b68], eax
call fcn.1002cd15
add esp, 4
mov edx, dword [0x10076b68]
push esi
lea esi, [edx + 0x1000]
cmp edx, esi
je 0x1000d473
nop dword [eax]
lea ecx, [edx + 0x1c]
call fcn.1000d3e0
test eax, eax
je 0x1000d477
add edx, 0x20
cmp edx, esi
jne 0x1000d460
xor eax, eax
pop esi
ret
mov eax, edx
pop esi
ret

Function at 0x1000d480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov edi, ecx
call fcn.1000d3f0
mov ebx, eax
xor esi, esi
mov dword [ebp - 4], ebx
nop word [eax + eax]
lea ecx, [esi + edi]
call fcn.1000d1a0
add esi, eax
cmp esi, 5
jl 0x1000d4a0
test esi, esi
jle 0x1000d4d1
mov ecx, ebx
mov edx, esi
mov ebx, edi
sub ebx, ecx
nop dword [eax + eax]
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x1000d4c0
mov ebx, dword [ebp - 4]
lea ecx, [esi + ebx]
lea eax, [edi - 5]
mov byte [ecx], 0xe9
sub esi, ecx
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
mov eax, dword [ebp - 0xc]
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000dd90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 1]
push eax
call fcn.1002ff50
add esp, 0xc
xorps xmm0, xmm0
movq qword [esi + 0x44], xmm0
mov ecx, esi
movups xmmword [esi + 0x4c], xmm0
push dword [ebp + 0xc]
movups xmmword [esi + 0x5c], xmm0
mov byte [esi], 0
push dword [ebp + 8]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
call fcn.10012260
mov ecx, esi
call fcn.10012310
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1000e510
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053e80
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x1006c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x28], 0x64005c
push 0x2800
push eax
push 0x10073de0
mov dword [ebp - 0x24], 0x650073
mov dword [ebp - 0x20], 0x750074
mov dword [ebp - 0x1c], 0x2e0070
mov dword [ebp - 0x18], 0x6c0064
mov dword [ebp - 0x14], 0x6c
call fcn.1002ff50
add esp, 0xc
push 0x10073de0
call fcn.1000ed60
test al, al
je 0x1000e788
mov ecx, 0x10073de0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e591
sub ecx, edx
sar ecx, 1
je 0x1000e788
push 0x100745e0
call fcn.1000e920
test al, al
je 0x1000e788
mov ecx, 0x100745e0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e5c0
sub ecx, edx
sar ecx, 1
je 0x1000e788
push 0x10074de0
call fcn.1000ef90
test al, al
je 0x1000e788
mov ecx, 0x10074de0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e5f0
sub ecx, edx
sar ecx, 1
je 0x1000e788
push 0x100755e0
call fcn.1000f0e0
test al, al
je 0x1000e788
mov ecx, 0x100755e0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e620
sub ecx, edx
sar ecx, 1
je 0x1000e788
push 0x10075de0
lea eax, [ebp - 0x28]
push eax
call fcn.1000e370
test al, al
je 0x1000e788
mov eax, 0x10075de0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e653
sub eax, edx
sar eax, 1
je 0x1000e788
push 0x10073de0
lea ecx, [ebp - 0x40]
call fcn.1000c410
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000de80
push eax
mov ecx, 0x100765e0
call fcn.10002ef0
lea ecx, [ebp - 0x58]
call fcn.10002e80
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000c3d0
push 0x100745e0
lea ecx, [ebp - 0x40]
call fcn.1000c410
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000de80
push eax
mov ecx, 0x100765f8
call fcn.10002ef0
lea ecx, [ebp - 0x58]
call fcn.10002e80
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000c3d0
push 0x10074de0
lea ecx, [ebp - 0x40]
call fcn.1000c410
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000de80
push eax
mov ecx, 0x10076610
call fcn.10002ef0
lea ecx, [ebp - 0x58]
call fcn.10002e80
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000c3d0
push 0x100755e0
lea ecx, [ebp - 0x70]
call fcn.1000c410
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.1000de80
push eax
mov ecx, 0x10076628
call fcn.10002ef0
lea ecx, [ebp - 0x88]
call fcn.10002e80
lea ecx, [ebp - 0x70]
call fcn.1000c3d0
push 0
push 0
push 0x1000e490
call fcn.10038466
add esp, 0xc
mov al, 1
jmp 0x1000e78a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cc28
mov esp, ebp
pop ebp
ret
Function at 0x10010cc0
Capabilities:
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
sub dword [ebp + 0xc], 1
jne 0x10010dd9
push esi
mov esi, dword [ebp + 8]
mov dword [0x1006fd8c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x10010c70
mov dword [ebp - 4], 1
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x10010d13
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x10010d13
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10010d15
xor eax, eax
push esi
mov dword [0x1006fd90], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
mov esi, eax
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push 1
push str.D:P_D_OICI_GA___BG__D_OICI_GA___AN_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x10010d6c
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
jne 0x10010d74
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._GL2UseGameGuard__3HA
push str.core.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10010dbb
lea eax, [ebp + 0xc]
push eax
push 4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10010dbb
lea eax, [ebp + 0xc]
mov byte [esi], 0
push eax
push dword [ebp + 0xc]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10010dc3
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x10002090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc