joyce8/EMBER2024-capa huggingface dataset:
Function at 0x580630
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x664a78
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x580669
inc eax
mov dword [esi + 0x10], eax
jmp 0x58077c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x58067d
mov eax, 0xffffffc7
jmp 0x58077e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x58068e
cmp dword [esi + 8], eax
jne 0x58067d
cmp dword [esi + 8], eax
jne 0x5806a7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x5806a7
mov eax, 0xffffffc7
jmp 0x58077e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x5806bb
push eax
mov ecx, ebx
call fcn.0057fe60
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00548680
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x5806ec
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.005486a0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0057f5d0
test eax, eax
mov dword [esp + 0x38], eax
je 0x58071f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xb3a278
call fcn.00548880
mov eax, dword [esp + 0x38]
jmp 0x58077e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00580490
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x580763
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.005804b0
mov esi, eax
test esi, esi
jne 0x580793
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00580490
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x580735
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xb3a278
call fcn.00548880
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xb3a278
call fcn.00548880
mov eax, esi
jmp 0x58077e
Function at 0x5897b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6650a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [0x66a710]
push 0
lea ecx, [esp + 0x20]
call fcn.0065a68d
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00589150
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0065a5bb
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.00656d11
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.00656d11
push 1
push 0
push 0
mov ecx, esi
call fcn.00656cb9
push 1
push 0
push 1
mov ecx, esi
call fcn.00656cb9
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0065a6ff
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x589930
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6650c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0065a68d
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00589150
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0065a5bb
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x66a710]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x5899f4
cmp dword [esp + 0x40], 1
jne 0x5899f2
cmp ecx, eax
jge 0x5899f4
mov eax, ecx
cmp eax, 0xc8
jge 0x589a00
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.005897b0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x66a70c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0065a6ff
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x5a1347
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x665ea6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x14]
call fcn.00652547
mov eax, dword [0xc498c0]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x48], eax
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp ebx, edi
mov byte [esp + 0x18], 1
mov dword [esi], 0xb3f4ac
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
je 0x5a13a4
push ebx
call dword [0x66a3d4]
inc eax
push eax
call fcn.00653665
add esp, 4
mov dword [esi + 4], eax
push ebx
push eax
call dword [0x66a3a8]
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x4c], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x5ac684
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x5ac83d
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x5ac7b6
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x5ac7b6
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x5ac79d
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x5ac79d
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.005ad8f0
mov ebp, eax
test ebp, ebp
je 0x5ac795
push ebp
mov ecx, esi
call fcn.005aece0
test eax, eax
je 0x5ac795
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x5ac795
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x5ac756
xor eax, eax
jmp 0x5ac75e
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.005af680
inc ebx
xor ebp, ebp
jmp 0x5ac6e7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x5ac6c0
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.005adc00
test eax, eax
pop ebx
je 0x5ac83d
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.005ad8f0
mov edi, eax
cmp edi, ebp
je 0x5ac83d
push edi
mov ecx, esi
call fcn.005aece0
test eax, eax
je 0x5ac83d
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.005ade40
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.005adeb0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.005af680
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x5b69e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6671a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0xb404cc
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.00651926
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.00651926
mov edi, dword [0x66a6c8]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0xb404b8
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [0x66a5b8]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x66a07c]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.005b7500
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret

Function at 0x636200
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
sbb ecx, edx
mov dh, 0x4e
jns 0x63620d
je 0x63626d
salc
mov ecx, 0x1c0747ee
lodsb al, byte [esi]
pop es
sbb al, 0xac
add dword [ebx - 0x41], esp
or al, 0x64
jp 0x6361a0
pop eax
xchg esi, eax
dec ebx
adc al, dl
adc byte [ecx - 0x59], dh
inc esp
xor bl, bh
dec ebx
dec ebp
sub byte [esi + 0xc], dl
and al, 0xc3
inc esi
jp 0x636259
nop
xchg ecx, eax
pop edx
aaa
fcomp dword [esi]
sbb ecx, edx
mov dword [0xb5dd218f], eax
shr dword [ecx + 5], 0x16
popal
movsb byte es:[edi], byte [esi]
push ss
and dl, byte [ecx]
push edx
adc cl, byte [eax]
or eax, 0x48492e91
idiv dword [eax - 0x773a1d10]
and dword [eax - 0x2fa4e51a], esp
invalid
cmp al, cl
stc
push es
jl 0x6362b8
outsd dx, dword [esi]
mov dword [edi - 0x4d], ecx
xor al, 0x89
and eax, 0xab9bf9e1
Function at 0x6382d3
Capabilities:
Encode data using xor

Disassembly:
sahf
push 0xe93b3288
cdq
pop es
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
ror byte [ebx], 1
mov byte [0xc3d1fec0], al
xchg ebp, eax
bound edi, qword [ebx - 0x14]
outsd dx, dword cs:[esi]
dec eax
mov ah, 0xa7
test dword [ebx], edx
int 7
invalid
out 0xe2, eax
mov ebx, 0xc9e31dee
jo 0x63821b
push ds
sub al, 0x51
std
push eax
fisub word [edi - 0x32]
std
push eax
xchg byte [eax + 0x7004026d], dh
or ebp, dword [0xef358d08]
dec esp
cmp byte [edi + 0x298eed93], dh
scasd eax, dword es:[edi]
call 0xc513344e
aam 0x11
pop ebp
cmp byte [edx + edi - 0x7da53105], cl
and al, 0xbb
lodsd eax, dword [esi]
popal
or byte [eax], dh
jge 0x63831a
xchg byte [edi + edx*4 + 0x2f67dadf], dl
cdq
sub dl, byte [ecx + 0x4a829636]
mov ch, 0x40
inc eax
xchg ebp, eax
mov ah, bh
mov dword [0xbe72f576], eax
jo 0x638266
cmp esp, ebp
fdiv qword [edi]
into
pop ecx
cmp al, 0xec
lodsb al, byte [esi]
pop edi
sbb cl, cl
inc esp
xchg edx, eax
and dword [edi + 0x16], 0x5b88bf1
mov eax, 0x8403f305
movsd dword es:[edi], dword [esi]
invalid
pop edi
mov cl, 0xf9
mov cl, 0xf9
pushal
fld xword [0xa983ae71]
add edx, esp
mov eax, dword [0x4af352bc]
push edx
dec edx
pop esp
mov dword [ecx], edx
mov edi, 0x1fa055ea
xor eax, 0x160c3752
mov al, byte [0x5235651f]
aaa
or al, 0x16
rol byte [0x9f265f7d], cl
mov al, byte [0xe66cf2e0]
stosb byte es:[edi], al
pushfd
daa
xor eax, 0xe0549fd1
imul esi, dword [esi - 0x6024bb28], 0xffffff90
js 0x6382ee
idiv byte [edx + 0x17]
jg 0x6382db
add eax, 0xe1ff7646
pop esp
mov cl, byte [ebx - 0x46909140]
daa
lodsd eax, dword [esi]
mov ebp, 0x194c4100
or byte [ecx - 0x3699ba64], al
inc edi
aaa
push ds
pop ebx
add eax, ebx
push ebp
and bh, 0x3d
jge 0x6382e8
sub bl, byte [edi + 0x6d]
sub dword [esp + ecx*2], ebx
pushal
mov eax, dword [0x67cba937]
push esi
arpl word [ebx + 0x35c86b34], dx
imul edi, ebp, 0xf4dd5d5
mov dword [0x68d5ede5], eax
adc dword [ecx], ebp
inc esp
fld xword [edi + ebx*2 + 0x49]
dec ecx
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
invalid
Function at 0x4068b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068dc
xor eax, eax
test eax, eax
je 0x4068ef
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068ef
xor ecx, ecx
jmp 0x4068f2
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a15
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a5dec], 0
push esi
jne 0x406a4c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a26
mov dword [ecx*4 + 0x7a5de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a21
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a7d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a5de8]
xor eax, esi
inc ecx
dec edx
jne 0x406a5f
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x100167a
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001af0
call fcn.01001804
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1002370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1001435
cmp eax, esi
jne 0x1001428
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001438
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100140f
xor esi, esi
inc esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x100144b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100147a
mov eax, dword [0x100236c]
test eax, eax
jne 0x1001474
mov dword [0x100236c], esi
push 0x10010d0
push 0x10010c4
call fcn.01001371
pop ecx
pop ecx
test eax, eax
je 0x100147a
jmp 0x100159e
mov dword [0x1002034], esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x100149e
push 0x10010c0
push 0x10010b8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x10014ab
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002374], ebx
je 0x10014cc
push 0x1002374
call fcn.01001779
pop ecx
test eax, eax
je 0x10014cc
push ebx
push 2
push ebx
call dword [0x1002374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100159e
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1001536
cmp cx, bx
je 0x10014f1
cmp dword [ebp - 0x1c], ebx
jne 0x1001536
movzx ecx, word [eax]
cmp cx, bx
je 0x1001506
cmp cx, 0x20
ja 0x1001506
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x10014f1
test byte [ebp - 0x40], 1
je 0x1001512
movzx ecx, word [ebp - 0x3c]
jmp 0x1001515
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1002030], eax
cmp dword [0x1002024], ebx
jne 0x100157b
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1001547
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x10014db
cmp dword [0x1002034], ebx
jne 0x1001589
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002030]
jmp 0x10015aa
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001849
ret
call fcn.01001951
jmp 0x10013d2
Function at 0x66247490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [esp + 8], 0x662a504d
mov dword [esp + 4], 0x662a5053
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
mov dword [esp + 8], 0x662a5060
mov dword [esp + 4], 0x662a5078
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
mov dword [esp + 8], 0x662a5085
mov dword [esp + 4], 0x662a5091
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
mov dword [esp + 8], 0x662a509e
mov dword [esp + 4], 0x662a50bc
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
mov dword [esp + 4], 0x662a50c9
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
mov dword [esp + 4], 0x662a50d7
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
call 0x6624d0d4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x662a50e6
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
mov dword [esp], 0
call fcn.66261b28
mov dword [esp + 8], eax
mov dword [esp + 4], 0x662a50f3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
call fcn.66261d60
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0x662a5100
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
mov dword [ebp - 0xc], 0
jmp 0x662475b4
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
test eax, eax
je 0x662475b0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x662a5109
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
add dword [ebp - 0xc], 1
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.66261d6a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6624758c
mov dword [esp + 4], 0x662a510d
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
call fcn.6625d09a
test eax, eax
je 0x662475f2
mov ebx, 0x79
jmp 0x662475f7
mov ebx, 0x6e
call fcn.6625d088
test eax, eax
je 0x66247607
mov eax, 0x79
jmp 0x6624760c
mov eax, 0x6e
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x662a510f
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
mov dword [esp], 0
call fcn.6625e318
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 2
je 0x66247651
cmp eax, 3
je 0x6624765a
cmp eax, 1
jne 0x66247663
mov dword [ebp - 0x10], 0x662a5121
jmp 0x6624767f
mov dword [ebp - 0x10], 0x662a512a
jmp 0x6624767f
mov dword [ebp - 0x10], 0x662a512f
jmp 0x6624767f
mov dword [esp + 8], 0x662a529f
mov dword [esp + 4], 0x148
mov dword [esp], 0x662a5044
call fcn.6624c8aa
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x662a5136
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call eax
add esp, 0x24
pop ebx
pop ebp
ret