joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73658c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042a4
xor eax, eax
push ebp
push 0x7366e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [0x841fd0]
cmp byte [eax], 0
je 0x7366c2
mov byte [ebp - 5], 0
mov edx, dword [ebp - 4]
mov eax, 0x7366fc
call fcn.004043d8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x7366c2
mov eax, dword [ebp - 4]
call fcn.004040f0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, 2
cmp eax, dword [ebp - 0x14]
jne 0x7366c2
lea eax, [ebp - 0x124]
push eax
mov edx, dword [ebp - 0x10]
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004042f4
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x120]
mov ecx, 0xff
call fcn.004040cc
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x17]
mov cl, 2
call fcn.00402d1c
mov byte [ebp - 6], 0
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jl 0x73666b
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 2
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx - 1]
xor byte [ebp - 6], al
inc dword [ebp - 0xc]
dec dword [ebp - 0x20]
jne 0x736656
lea ecx, [ebp - 0x124]
xor eax, eax
mov al, byte [ebp - 6]
mov edx, 2
call fcn.004094d8
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x120]
mov ecx, 0xff
call fcn.004040cc
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x1a]
mov cl, 2
call fcn.00402d1c
lea eax, [ebp - 0x17]
lea edx, [ebp - 0x1a]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402dd0
jne 0x7366be
mov byte [ebp - 5], 1
jmp 0x7366c2
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7366ea
lea eax, [ebp - 0x124]
call fcn.00403e74
lea eax, [ebp - 4]
call fcn.00403e74
ret

Function at 0x73b560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov word [ebp - 2], 0xffff
mov eax, dword [0x840bec]
cmp dword [eax], 1
jne 0x73b606
mov byte [ebp - 9], 0
cmp byte [0x951a59], 0
je 0x73b5d8
push 0x951a5c
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 9]
push eax
mov eax, dword [0x951a44]
push eax
call sub.KERNEL32.DLL_ReadFile_1
test eax, eax
jne 0x73b5ef
call sub.KERNEL32.DLL_GetLastError_1
cmp eax, 0x3e5
jne 0x73b5ef
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push 0x951a5c
mov eax, dword [0x951a44]
push eax
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
je 0x73b5ef
mov eax, dword [0x951a6c]
push eax
call sub.KERNEL32.DLL_ResetEvent
jmp 0x73b5ef
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 9]
push eax
mov eax, dword [0x951a44]
push eax
call sub.KERNEL32.DLL_ReadFile_1
cmp dword [ebp - 8], 0
jle 0x73b600
xor eax, eax
mov al, byte [ebp - 9]
mov word [ebp - 2], ax
jmp 0x73b606
mov word [ebp - 2], 0xffff
mov eax, dword [0x840bec]
cmp dword [eax], 2
jne 0x73b626
mov eax, dword [0x8415a0]
mov eax, dword [eax]
mov eax, dword [eax + 0xd34]
call fcn.0055db34
mov word [ebp - 2], ax
mov ax, word [ebp - 2]
mov esp, ebp
pop ebp
ret
Function at 0x73b68c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
cmp byte [0x951a59], 0
je 0x73b6f6
push 0x951a70
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 6]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x951a44]
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x73b719
call sub.KERNEL32.DLL_GetLastError_1
cmp eax, 0x3e5
jne 0x73b719
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
push 0x951a70
mov eax, dword [0x951a44]
push eax
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
je 0x73b719
mov eax, dword [0x951a80]
push eax
call sub.KERNEL32.DLL_ResetEvent
jmp 0x73b719
push 0
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 6]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x951a44]
push eax
call sub.KERNEL32.DLL_WriteFile
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
mov byte [ebp - 7], 1
cmp dword [ebp - 0xc], 0
jne 0x73b737
mov eax, dword [0x841de4]
cmp byte [eax], 0
je 0x73b737
mov eax, 0x73b748
call fcn.0044b3e4
mov al, byte [ebp - 7]
mov esp, ebp
pop ebp
ret

Function at 0x73b764
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042a4
xor eax, eax
push ebp
push 0x73b877
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x841d8c]
mov edx, 0x73b884
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402dd0
jne 0x73b821
mov eax, dword [0x841184]
cmp byte [eax], 0
je 0x73b821
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_CreateEventA
mov edx, dword [0x841d28]
mov dword [edx + 0x10], eax
mov eax, dword [0x841d28]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004040f0
push eax
lea eax, [ebp - 4]
call fcn.004042c0
push eax
mov eax, dword [0x840744]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x73b811
call sub.KERNEL32.DLL_GetLastError_1
cmp eax, 0x3e5
jne 0x73b811
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
mov eax, dword [0x841d28]
push eax
mov eax, dword [0x840744]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
mov eax, dword [0x841d28]
mov eax, dword [eax + 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
jmp 0x73b861
mov eax, dword [0x840bec]
cmp dword [eax], 1
jne 0x73b842
mov eax, dword [ebp - 4]
call fcn.004040f0
push eax
mov eax, dword [ebp - 4]
call fcn.004042b4
pop edx
call fcn.0073b68c
mov eax, dword [0x840bec]
cmp dword [eax], 2
jne 0x73b861
mov eax, dword [0x8415a0]
mov eax, dword [eax]
mov eax, dword [eax + 0xd34]
mov edx, dword [ebp - 4]
call fcn.0055debc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73b87e
lea eax, [ebp - 4]
call fcn.00403e74
ret
Function at 0x73b88c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 6]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x951a48]
push eax
call sub.KERNEL32.DLL_WriteFile
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
mov al, byte [ebp - 7]
mov esp, ebp
pop ebp
ret
Function at 0x746af8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x746b41
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov ecx, 0x1a
cdq
idiv ecx
mov al, byte [edx + 0x83fca8]
mov dl, byte [ebp - 5]
add al, dl
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x746b1a
mov esp, ebp
pop ebp
ret

Function at 0x746b48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x746b94
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov ecx, 0xd
cdq
idiv ecx
mov al, byte [edx + 0x83fcc4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dl, byte [edx + ecx]
xor al, dl
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov byte [edx + ecx], al
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x746b67
mov esp, ebp
pop ebp
ret
Function at 0x7836a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x7836b0
push ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x783896
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00403e74
mov eax, dword [0x8414e8]
mov eax, dword [eax]
mov edx, dword [0x74ecf4]
call fcn.004033ac
test al, al
je 0x78370f
mov eax, dword [0x8414e8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
shl edx, 4
mov ecx, dword [0x840ecc]
mov edx, dword [ecx + edx*8 - 0x1c]
call fcn.00403f0c
mov eax, dword [0x8414e8]
mov eax, dword [eax]
mov edx, dword [0x785a90]
call fcn.004033ac
test al, al
je 0x783748
mov eax, dword [0x8414e8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
imul edx, dword [ebp - 8], 0x17
mov ecx, dword [0x840e58]
mov edx, dword [ecx + edx*4 + 0x34]
call fcn.00403f0c
mov eax, dword [ebp - 0xc]
call fcn.0044c49c
test al, al
jne 0x78386e
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0079cf60
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00403f0c
lea eax, [ebp - 0x10]
call fcn.00403e74
mov edx, dword [ebp - 0xc]
mov eax, 0x7838ac
call fcn.004043d8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jle 0x7837d7
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 8]
inc edx
mov ecx, 0x7d0
mov eax, dword [ebp - 0xc]
call fcn.004042f4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x10]
call fcn.0044c290
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004042f4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0044c290
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00403f0c
lea ecx, [ebp - 0x20]
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.007a594c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00403f0c
mov eax, dword [ebp - 0xc]
mov edx, 0x7838b8
call fcn.00404200
jne 0x783818
lea edx, [ebp - 0x20]
mov eax, dword [0x841518]
call fcn.00405e74
mov eax, dword [ebp - 0x20]
call fcn.0044b3e4
jmp 0x78386e
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0044bf5c
mov edx, dword [ebp - 0x20]
mov eax, 0x7838c4
call fcn.004043d8
test eax, eax
jle 0x783843
mov edx, dword [ebp - 0xc]
mov eax, dword [0x955898]
call fcn.00766b2c
jmp 0x78386e
push 5
push 0
mov eax, dword [ebp - 0x10]
call fcn.004042b4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004042b4
push eax
push 0x7838cc
mov eax, dword [0x955898]
call fcn.00439350
push eax
call sub.SHELL32.DLL_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78389d
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00403e98
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403e98
ret
Function at 0x7874b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 8], eax
jmp 0x7874cf
mov eax, dword [0x8417e4]
mov eax, dword [eax]
call fcn.0042d188
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jl 0x7874c3
pop ecx
pop ecx
pop ebp
ret
Function at 0x79d704
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 4], eax
push 0x4f
push 0x960b99
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov dword [ebp - 8], eax
mov eax, 0x960b98
mov edx, dword [ebp - 8]
call fcn.00402bdc
xor eax, eax
mov al, byte [0x960b98]
cmp byte [eax + 0x960b98], 0x5c
jne 0x79d764
lea eax, [ebp - 0x5c]
push eax
xor ecx, ecx
mov cl, byte [0x960b98]
dec ecx
mov edx, 1
mov eax, 0x960b98
call fcn.004028f0
lea edx, [ebp - 0x5c]
mov eax, 0x960b98
mov cl, 0x50
call fcn.00402d1c
mov eax, dword [ebp - 4]
mov edx, 0x960b98
call fcn.00404094
mov esp, ebp
pop ebp
ret

Function at 0x79d778
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 4], eax
push 0x960b99
push 0x4f
call sub.KERNEL32.DLL_GetTempPathA
mov dword [ebp - 8], eax
mov eax, 0x960b98
mov edx, dword [ebp - 8]
call fcn.00402bdc
xor eax, eax
mov al, byte [0x960b98]
cmp byte [eax + 0x960b98], 0x5c
jne 0x79d7d8
lea eax, [ebp - 0x5c]
push eax
xor ecx, ecx
mov cl, byte [0x960b98]
dec ecx
mov edx, 1
mov eax, 0x960b98
call fcn.004028f0
lea edx, [ebp - 0x5c]
mov eax, 0x960b98
mov cl, 0x50
call fcn.00402d1c
mov eax, dword [ebp - 4]
mov edx, 0x960b98
call fcn.00404094
mov esp, ebp
pop ebp
ret
Function at 0x7ab848
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0
je 0x7ab865
mov eax, dword [ebp - 4]
call fcn.007ab958
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
cmp byte [ebp - 5], 0
je 0x7ab89b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp word [eax], 0x25ff
jne 0x7ab89b
mov eax, dword [ebp - 4]
add dword [eax + 0x1c], 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x1c]
sub eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 0xe9
mov al, byte [ebp - 0xc]
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0x11], al
mov eax, dword [ebp - 0xc]
shr eax, 8
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0x12], al
mov eax, dword [ebp - 0xc]
shr eax, 0x10
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0x13], al
mov eax, dword [ebp - 0xc]
shr eax, 0x18
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov al, byte [eax]
mov edx, dword [ebp - 4]
mov byte [edx + 0x15], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov al, byte [eax + 1]
mov edx, dword [ebp - 4]
mov byte [edx + 0x16], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov al, byte [eax + 2]
mov edx, dword [ebp - 4]
mov byte [edx + 0x17], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov al, byte [eax + 3]
mov edx, dword [ebp - 4]
mov byte [edx + 0x18], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov al, byte [eax + 4]
mov edx, dword [ebp - 4]
mov byte [edx + 0x19], al
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x7ab953
call fcn.0040dff0
mov esp, ebp
pop ebp
ret
Function at 0xe973bb
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00e9743a
jae 0xe973c7
xor ecx, ecx
call fcn.00e9743a
jae 0xe973f1
xor eax, eax
call fcn.00e9743a
jae 0xe97402
mov al, 0x10
call fcn.00e9743a
adc al, al
jae 0xe973e3
jne 0xe9742f
stosb byte es:[edi], al
jmp 0xe973c8
call fcn.00e97446
dec ecx
loop 0xe9740e
mov eax, ebp
call fcn.00e97444
jmp 0xe97430
lodsb al, byte [esi]
shr eax, 1
je 0xe97456
adc ecx, 2
mov ebp, eax
jmp 0xe97430
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00e97444
cmp eax, 0x7d00
jae 0xe9742e
cmp eax, 0x500
jae 0xe9742f
cmp eax, 0x7f
ja 0xe97430
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe973c8
pop ebp
ret 8
Function at 0x10002960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], 0x520050
mov ecx, 0x41
mov dword [ebp - 0x18], 0x440049
push ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x520055
push eax
mov dword [ebp - 0x10], 0x530041
mov dword [ebp - 0xc], 0x4b0048
mov dword [ebp - 8], ecx
call dword [0x1000a0b0]
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.100082b0
add esp, 4
mov dword [ebp - 0x88], 0x4f0053
lea eax, [ebp - 4]
mov dword [ebp - 0x84], 0x540046
mov dword [ebp - 0x80], 0x410057
mov dword [ebp - 0x7c], 0x450052
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x88]
mov dword [ebp - 0x78], 0x4d005c
push eax
push 0x80000001
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x750052
mov dword [ebp - 0x30], 0x4f006e
mov dword [ebp - 0x2c], 0x63006e
mov dword [ebp - 0x28], 0x65
call dword [0x1000a008]
test eax, eax
jne 0x10002ac0
push esi
call dword [0x1000a0b0]
add eax, eax
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [0x1000a004]
push dword [ebp - 4]
neg eax
sbb esi, esi
call dword [0x1000a00c]
lea eax, [esi + 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x24], 0x6c006b
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 0x660069
mov dword [ebp - 0x1c], 0x73002e
mov dword [ebp - 0x18], 0x730079
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], 0x6c006b
mov dword [ebp - 0xc], 0x2e0031
mov dword [ebp - 8], 0x790073
mov dword [ebp - 4], 0x73
call fcn.10002f50
pop edi
pop esi
pop ebx
test eax, eax
jne 0x10003096
lea ecx, [ebp - 0x10]
call fcn.10002f50
test eax, eax
jne 0x10003096
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100030a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], 0x720073
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x730074
mov dword [ebp - 0xc], 0x2e0070
mov dword [ebp - 8], 0x790073
mov dword [ebp - 4], 0x73
mov dword [ebp - 0x44], 0x720073
mov dword [ebp - 0x40], 0x730074
mov dword [ebp - 0x3c], 0x360070
mov dword [ebp - 0x38], 0x2e0034
mov dword [ebp - 0x34], 0x790073
mov dword [ebp - 0x30], 0x73
mov dword [ebp - 0x5c], 0x61004e
mov dword [ebp - 0x58], 0x450076
mov dword [ebp - 0x54], 0x310078
mov dword [ebp - 0x50], 0x2e0035
mov dword [ebp - 0x4c], 0x790073
mov dword [ebp - 0x48], 0x73
mov dword [ebp - 0x2c], 0x61004e
mov dword [ebp - 0x28], 0x450076
mov dword [ebp - 0x24], 0x67006e
mov dword [ebp - 0x20], 0x73002e
mov dword [ebp - 0x1c], 0x730079
mov word [ebp - 0x18], ax
call fcn.10002f50
pop edi
pop esi
pop ebx
test eax, eax
jne 0x10003180
lea ecx, [ebp - 0x44]
call fcn.10002f50
test eax, eax
jne 0x10003180
lea ecx, [ebp - 0x5c]
call fcn.10002f50
test eax, eax
jne 0x10003180
lea ecx, [ebp - 0x2c]
call fcn.10002f50
test eax, eax
jne 0x10003180
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100036d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [eax], ebx
mov dword [ebp - 4], edx
lea ecx, [edi + 0xf]
lea eax, [esi + 0xf]
cmp esi, ecx
ja 0x10003714
cmp eax, edi
jb 0x10003714
mov ebx, edi
mov ecx, esi
sub ebx, esi
mov edx, 0x10
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
dec edx
jne 0x10003700
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
jmp 0x10003724
movdqu xmm1, xmmword [esi]
movdqu xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
mov ecx, dword [ebp + 0xc]
cmp edx, 0x10
jbe 0x10003798
lea eax, [edx - 0x11]
sub edi, esi
shr eax, 4
inc eax
mov dword [ebp + 0x14], eax
push ecx
push ebx
push esi
call fcn.10001020
mov ecx, dword [ebp + 0x10]
lea edi, [edi - 0x10]
movdqu xmm0, xmmword [ebx]
add esi, 0x10
add esp, 0xc
add ebx, 0x10
lea eax, [ecx + 0xf]
movdqu xmmword [ecx], xmm0
cmp esi, eax
ja 0x10003780
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x10003780
mov eax, esi
mov edx, 0x10
lea esp, [esp]
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
dec edx
jne 0x10003770
jmp 0x10003790
movdqu xmm1, xmmword [esi]
movdqu xmm0, xmmword [ecx]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
dec dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
jne 0x10003738
push ecx
push ebx
push esi
call fcn.10001020
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003db0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x694
push ebx
push esi
push edi
mov esi, ecx
call fcn.10003cf0
test eax, eax
je 0x10003fca
call fcn.10003c70
test eax, eax
jne 0x10003fca
push 0xff
lea eax, [esp + 0xa4]
mov dword [esp + 0x1c], 0x770025
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0x6e0069
push eax
mov dword [esp + 0x2c], 0x690064
mov dword [esp + 0x30], 0x250072
mov dword [esp + 0x34], 0x73005c
mov dword [esp + 0x38], 0x730079
mov dword [esp + 0x3c], 0x650074
mov dword [esp + 0x40], 0x33006d
mov dword [esp + 0x44], 0x5c0032
mov dword [esp + 0x48], 0x620077
mov dword [esp + 0x4c], 0x6d0065
mov dword [esp + 0x50], 0x77005c
mov dword [esp + 0x54], 0x69006d
mov dword [esp + 0x58], 0x63
call dword [0x1000a0ac]
push esi
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0x720070
push eax
lea eax, [esp + 0x2a8]
mov dword [esp + 0x5c], 0x63006f
push eax
mov dword [esp + 0x64], 0x730065
mov dword [esp + 0x68], 0x200073
mov dword [esp + 0x6c], 0x610063
mov dword [esp + 0x70], 0x6c006c
mov dword [esp + 0x74], 0x630020
mov dword [esp + 0x78], 0x650072
mov dword [esp + 0x7c], 0x740061
mov dword [esp + 0x80], 0x200065
mov dword [esp + 0x84], 0x630022
mov dword [esp + 0x88], 0x64006d
mov dword [esp + 0x8c], 0x2f0020
mov dword [esp + 0x90], 0x200063
mov dword [esp + 0x94], 0x740073
mov dword [esp + 0x98], 0x720061
mov dword [esp + 0x9c], 0x200074
mov dword [esp + 0xa0], 0x730025
mov dword [esp + 0xa4], 0x22
call dword [0x1000a194]
add esp, 0xc
push 0x40
push 0x3000
push 0x3d
push 0
call dword [0x1000a144]
mov edi, eax
mov dword [edi], 0x3c
mov dword [edi + 4], 0x40
call dword [0x1000a1d4]
mov ebx, dword [0x1000a188]
xor esi, esi
mov dword [edi + 8], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x750072
mov dword [esp + 0x10], 0x61006e
mov dword [esp + 0x14], 0x73
mov dword [edi + 0xc], eax
lea eax, [esp + 0xa0]
mov dword [edi + 0x10], eax
lea eax, [esp + 0x2a0]
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
lea esp, [esp]
push edi
call ebx
test eax, eax
jne 0x10003fd1
inc esi
cmp esi, 0x64
jb 0x10003fb0
push 0x8000
push eax
push edi
call dword [0x1000a104]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [edi + 0x38]
call dword [0x1000a080]
push dword [edi + 0x38]
call dword [0x1000a10c]
push 0
call dword [0x1000a168]
int3
Function at 0x10004200
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x10012a60], 0
jne 0x100042a7
push edi
push 4
push 0x3000
push 0x206
push 0
call dword [0x1000a144]
mov edi, eax
test edi, edi
je 0x100042a0
xor ecx, ecx
lea eax, [edi + 0x203]
cmp edi, 0x1000faa3
ja 0x1000423f
cmp eax, 0x1000f8a0
jae 0x10004278
movdqa xmm1, xmmword [0x10010510]
mov eax, edi
sub eax, 0x1000f8a0
mov edi, edi
movdqu xmm0, xmmword [ecx + 0x1000f8a0]
pxor xmm0, xmm1
movdqu xmmword [eax + ecx + 0x1000f8a0], xmm0
add ecx, 0x10
cmp ecx, 0x200
jb 0x10004250
cmp ecx, 0x204
jae 0x100042a0
push ebx
push esi
mov ebx, 0x1000f8a0
lea edx, [ecx + edi]
mov esi, 0x204
sub ebx, edi
sub esi, ecx
jmp 0x10004290
mov al, byte [ebx + edx]
lea edx, [edx + 1]
xor al, 5
mov byte [edx - 1], al
dec esi
jne 0x10004290
pop esi
pop ebx
mov dword [0x10012a60], edi
pop edi
ret