joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x710c57
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x7109ec
sub ebx, ebx
add eax, 1
call fcn.00710c9b
sub ebx, eax
xor dword [ecx], esi
add eax, 1
sub esp, 4
mov dword [esp], eax
pop ebx
and ebx, ebx
inc ecx
dec ebx
cmp ecx, edi
jne fcn.00710c57
mov ebx, eax
sub eax, 0xf40bda18
add ebx, 0xa8378100
ret
Function at 0x4bb3b0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
lea ebp, [esp + 4]
push 6
push ebp
push ecx
call sym.adb.exe_CBS_get_asn1
add esp, 0xc
xor edi, edi
test eax, eax
je 0x4bb4f2
mov dword [esp], esi
push ebp
call sym.adb.exe_CBS_len
add esp, 4
movzx ebx, byte [0x57a7e1]
cmp eax, ebx
jne 0x4bb41e
mov esi, eax
push ebp
call sym.adb.exe_CBS_data
add esp, 4
mov ecx, 0x57a7d4
test bl, bl
je 0x4bb4e6
push esi
push 0x57a7d8
push eax
call sub.msvcrt.dll_memcmp
mov ecx, 0x57a7d4
add esp, 0xc
test eax, eax
je 0x4bb4e6
push ebp
call sym.adb.exe_CBS_len
add esp, 4
movzx ebx, byte [0x57a5c1]
cmp eax, ebx
jne 0x4bb466
mov esi, eax
push ebp
call sym.adb.exe_CBS_data
add esp, 4
mov ecx, 0x57a5b4
test bl, bl
je 0x4bb4e6
push esi
push 0x57a5b8
push eax
call sub.msvcrt.dll_memcmp
mov ecx, 0x57a5b4
add esp, 0xc
test eax, eax
je 0x4bb4e6
push ebp
call sym.adb.exe_CBS_len
add esp, 4
movzx ebx, byte [0x57a4ed]
cmp eax, ebx
jne 0x4bb4a6
mov esi, eax
push ebp
call sym.adb.exe_CBS_data
add esp, 4
mov ecx, 0x57a4e0
test bl, bl
je 0x4bb4e6
push esi
push 0x57a4e4
push eax
call sub.msvcrt.dll_memcmp
mov ecx, 0x57a4e0
add esp, 0xc
test eax, eax
je 0x4bb4e6
push ebp
call sym.adb.exe_CBS_len
add esp, 4
movzx ebx, byte [0x57a699]
cmp eax, ebx
jne 0x4bb4f2
mov esi, eax
push ebp
call sym.adb.exe_CBS_data
add esp, 4
mov ecx, 0x57a68c
test bl, bl
je 0x4bb4e6
push esi
push 0x57a690
push eax
call sub.msvcrt.dll_memcmp
mov ecx, 0x57a68c
add esp, 0xc
test eax, eax
jne 0x4bb4f2
mov eax, dword [ecx]
mov edx, dword [esp]
mov edi, 1
mov dword [edx], eax
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4be780
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
test edi, edi
je 0x4be7d6
xor ebp, ebp
nop word [eax + eax]
inc ecx
movzx ecx, cl
mov esi, dword [eax + ecx*4 + 8]
add edx, esi
movzx edx, dl
mov ebx, dword [eax + edx*4 + 8]
mov dword [eax + ecx*4 + 8], ebx
add ebx, esi
mov dword [eax + edx*4 + 8], esi
movzx esi, bl
mov ebx, dword [esp + 0x1c]
movzx ebx, byte [ebx + ebp]
xor bl, byte [eax + esi*4 + 8]
mov esi, dword [esp + 0x20]
mov byte [esi + ebp], bl
inc ebp
cmp edi, ebp
jne 0x4be7a0
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c69b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
jl 0x4c6978
inc ebp
iretd
jo 0x4c697c
inc ebp
rcl byte [ebx]
call fcn.004c6680
int3
jl 0x4c6978
inc ebp
iretd
Function at 0x4c6a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda

Function at 0x4c6a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004c6690
push eax
push esi
push dword [ebp + 8]
call fcn.004c6645
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6

Function at 0x4c6a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004c6690
push eax
push esi
push dword [ebp + 8]
call fcn.004c6645
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6

Function at 0x4c6a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
inc ebp
mov eax, dword [0xa245c62e]
xor eax, 0x24a345c6

Function at 0x4c6a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov eax, dword [0xa245c62e]
xor eax, 0x24a345c6
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004c6690
push eax
push esi
push dword [ebp + 8]
call fcn.004c6645
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004c6690
push eax
push esi
push dword [ebp + 8]
call fcn.004c6645
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004c6680
cmp eax, 0x882feecb
popfd
jl 0x4c6b05
invalid
invalid

Function at 0x4c7210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax - 0x5235b]
inc dword [eax]
and byte [ebp - 0x523], 0
invalid
Function at 0x4c7ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x4c7ad6
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x4c7a80
call fcn.004c6680
adc ecx, esi
inc ebx
inc ecx
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004c6680
sub byte [edi + 0x31], 0xc4
lea eax, [ebp - 0x72c]
push eax
call fcn.004c6690
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004c6645
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.004c6680
jae 0x4c7b92
invalid
popfd
lea eax, [ebp - 0x718]
push eax
push 0x40
inc eax
Function at 0x4c8540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp + eax - 0x230]
push eax
call fcn.004c65f1
add esp, 0xc
jmp 0x4c85f8

Function at 0x4cce40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov ebx, dword [esp + 0xb4]
mov esi, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
push ebx
call sym.adb.exe_EVP_MD_size
add esp, 4
lea ebp, [esp + 0x58]
mov dword [esp + 8], eax
push ebp
call sym.adb.exe_HMAC_CTX_init
add esp, 4
push 0
push ebx
push edi
push esi
push ebp
call sym.adb.exe_HMAC_Init_ex
add esp, 0x14
xor ebx, ebx
test eax, eax
je 0x4cd07a
mov ecx, dword [esp + 0xb8]
test ecx, ecx
je 0x4cd067
mov ebx, dword [esp + 0xbc]
mov edx, 1
mov esi, dword [esp + 8]
mov eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
cmp esi, ecx
cmova esi, ecx
shr eax, 0x18
mov byte [esp + 4], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 5], al
mov byte [esp + 6], dh
mov byte [esp + 7], dl
push 0
push 0
push 0
push 0
push ebp
call sym.adb.exe_HMAC_Init_ex
add esp, 0x14
test eax, eax
mov edi, ebp
je 0x4cd076
push dword [esp + 0xac]
push dword [esp + 0xac]
push edi
call sym.adb.exe_HMAC_Update
add esp, 0xc
test eax, eax
je 0x4cd076
push 4
lea eax, [esp + 8]
push eax
push edi
call sym.adb.exe_HMAC_Update
add esp, 0xc
test eax, eax
je 0x4cd076
push 0
lea eax, [esp + 0x1c]
push eax
push edi
call sym.adb.exe_HMAC_Final
add esp, 0xc
test eax, eax
je 0x4cd076
test esi, esi
je 0x4ccf54
push esi
lea eax, [esp + 0x1c]
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [esp + 0xb0], 2
jb 0x4cd050
lea ecx, [esp + esi + 0x18]
lea eax, [ebx + esi]
lea edx, [esp + 0x18]
mov ebp, esi
cmp ebx, ecx
setb cl
cmp edx, eax
setb al
and ebp, 0xffffffe0
and al, cl
mov byte [esp + 3], al
mov eax, 1
nop word [eax + eax]
mov dword [esp + 0x14], eax
push 0
push 0
push 0
push 0
lea edi, [esp + 0x68]
push edi
call sym.adb.exe_HMAC_Init_ex
add esp, 0x14
test eax, eax
je 0x4cd076
push dword [esp + 8]
lea eax, [esp + 0x1c]
push eax
push edi
call sym.adb.exe_HMAC_Update
add esp, 0xc
test eax, eax
je 0x4cd076
push 0
lea eax, [esp + 0x1c]
push eax
push edi
call sym.adb.exe_HMAC_Final
add esp, 0xc
test eax, eax
je 0x4cd076
test esi, esi
je 0x4cd03d
cmp esi, 0x20
setb cl
xor eax, eax
or cl, byte [esp + 3]
jne 0x4cd030
xor eax, eax
nop word [eax + eax]
movups xmm0, xmmword [esp + eax + 0x18]
movups xmm2, xmmword [ebx + eax]
movups xmm1, xmmword [esp + eax + 0x28]
movups xmm3, xmmword [ebx + eax + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [ebx + eax], xmm2
movups xmmword [ebx + eax + 0x10], xmm3
add eax, 0x20
cmp ebp, eax
jne 0x4cd000
cmp esi, ebp
mov eax, ebp
je 0x4cd03d
nop
movzx ecx, byte [esp + eax + 0x18]
xor byte [ebx + eax], cl
inc eax
cmp eax, esi
jb 0x4cd030
mov eax, dword [esp + 0x14]
inc eax
cmp eax, dword [esp + 0xb0]
jb 0x4ccf90
nop
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add ebx, esi
lea ebp, [esp + 0x58]
inc edx
sub ecx, esi
jne 0x4cceac
xor ebx, ebx
cmp dword [esp + 0xb0], 0
setne bl
jmp 0x4cd07a
mov ebp, edi
xor ebx, ebx
push ebp
call sym.adb.exe_HMAC_CTX_cleanup
add esp, 4
mov eax, ebx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7ffe53b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
pushf
popf
inc esi
dec esi
xor eax, ecx
xor eax, ecx
push es
pop ds
push bx
inc esp
inc esp
add al, 0
add al, 4
sub al, 4
push eax
pop eax
add al, 4
sub al, 4
inc esi
dec esi
pushf
popf
add al, 0
push bx
inc esp
inc esp
push eax
pop eax
not eax
not eax
and al, 0xff
pushf
popf
add al, 0
pushf
popf
and al, 0xff
xor eax, ecx
xor eax, ecx
add al, 0
not eax
not eax
add al, 0
add al, 4
sub al, 4
push eax
pop eax
not eax
not eax
add al, 0
not eax
not eax
push eax
pop eax
not eax
not eax
push eax
pop eax
pushf
popf
push es
pop ds
xor eax, ecx
xor eax, ecx
inc esi
dec esi
push bx
inc esp
inc esp
push es
pop ds
not eax
not eax
inc esi
dec esi
xor eax, ecx
xor eax, ecx
push eax
pop eax
lea esp, [esp]
call 0x7ffe543c
pop edx
add al, 0
xor eax, ecx
xor eax, ecx
xor dx, dx
clc
and al, 0xff
add edx, 0xd5e0
push es
pop ds
not eax
not eax
push eax
pop eax
xor ecx, ecx
xor eax, ecx
xor eax, ecx
nop
mov cl, 0x1e
push es
pop ds
xor byte [ecx + edx], 0xd3
loop 0x7ffe5462
add al, 0
nop
push dword fs:[0x24]
pop dword [edx + 0xa]
inc esi
dec esi
pushf
popf
cld
mov cl, 0xff
push bx
inc esp
inc esp
push edx
loop 0x7ffe5482
push es
pop ds
xor eax, ecx
xor eax, ecx
cld
push es
pop ds
mov dword [edx + 0x11], 0xffffacbb
add al, 0
push eax
pop eax
mov ecx, dword [eax + 0x2c]
add al, 0
clc
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
add al, 0
push bx
inc esp
inc esp
add eax, 0
mov dword [eax + 0x2c], esp
xor eax, ecx
xor eax, ecx
push eax
pop eax
push es
pop ds
push 0
stc
push 0
push 0
not eax
not eax
push eax
pop eax
clc
and al, 0xff
push 0
add al, 4
sub al, 4
add al, 0
push eax
pop eax
push 0x30
cld
push 0x20
push eax
pop eax
push 0
stc
push 0
add edx, 0xffff7f35
cld
push edx
inc esi
dec esi
add al, 0
push edx
and bh, 0xff
push 0
not eax
not eax
call dword [edx + 0x820e]
push es
pop ds
add al, 0
stc
add esp, 0x3f8
push bx
inc esp
inc esp
xor eax, eax
stc
inc eax
ret 0xc
Function at 0x10001d20
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1006e05c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x114], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x10001d74
xor al, al
jmp 0x10001df5
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x10001da1
xor al, al
jmp 0x10001df5
lea ecx, [ebp - 0x108]
push ecx
push str.Scanning_Module:__s_n
call fcn.100017c0
add esp, 8
push 0xc
mov edx, dword [ebp - 0x10c]
add edx, 4
push edx
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x10c]
call fcn.10001e10
mov ecx, dword [ebp - 0x10c]
mov dword [ecx + 8], eax
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10032619
mov esp, ebp
pop ebp
ret

Function at 0x10001e10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x10001e5b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0x4550
jne 0x10001e5b
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
jne 0x10001e5b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x50]
jmp 0x10001e5d
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10009f90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006e05c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x10009fba
jl 0x10009fb1
cmp dword [ebp + 0xc], 0
ja 0x10009fba
xor eax, eax
xor edx, edx
jmp 0x1000a0f1
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x10009fdc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.100041a0
jmp 0x1000a0f1
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.10005040
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x1000a04b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10006be0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.100051a0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10005c80
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.10005120
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x1000a0e2
mov ecx, dword [ebp - 0x10]
call fcn.1000aeb0
mov dword [ebp - 0x24], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x1000a0bb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1003ad20
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x1000a0b9
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1000a0f1
jmp 0x1000a067
cmp dword [ebp - 8], 0
jbe 0x1000a0e2
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1003ad20
add esp, 0x10
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10032619
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10015ef0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1006e05c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.100342f0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x108], ecx
cmp dword [ebp - 0x108], 0
je 0x10015fa3
cmp dword [ebp - 0x108], 1
je 0x10015f36
jmp 0x10015fae
cmp dword [ebp + 0x10], 0
je 0x10015f59
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
add eax, 8
push eax
call fcn.100035f0
add esp, 4
jmp 0x10015f7e
push 0x100
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push eax
call fcn.100035f0
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [0x10070908], ecx
push 0
push 0
push 0
push 0x10015e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1007090c], eax
jmp 0x10015fae
call fcn.10015fc0
mov dword [ebp - 0x110], eax
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10032619
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10029cd0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a467
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1006e05c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x14]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], eax
mov dword [edi], vtable.AnyAngleAlgorithm.0
call fcn.10019a30
lea ecx, [edi + 0x20]
mov dword [ebp - 4], 0
call fcn.10019a30
lea ecx, [edi + 0x30]
call fcn.10019a30
lea ecx, [edi + 0x3c]
call fcn.10019a30
lea ecx, [edi + 0x48]
mov dword [ecx], 0
push 0x10066e0e
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.100020c0
lea ecx, [edi + 0x54]
mov dword [ecx], 0
push 0x10066e0e
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.100020c0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov edx, dword [ebp + 0xc]
add eax, 2
add edx, 2
mov byte [ebp - 4], 5
mov dword [edi + 4], eax
mov eax, edx
mov dword [edi + 8], edx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10032dad
mov dword [edi + 0xc], eax
add esp, 4
mov eax, dword [edi + 8]
xor esi, esi
test eax, eax
je 0x10029de8
push dword [edi + 4]
call fcn.10032dad
mov ecx, eax
add esp, 4
mov eax, dword [edi + 0xc]
mov dword [eax + esi*4], ecx
xor ecx, ecx
cmp dword [edi + 4], ecx
jbe 0x10029de0
nop
mov eax, dword [edi + 0xc]
mov eax, dword [eax + esi*4]
mov byte [ecx + eax], 0
inc ecx
cmp ecx, dword [edi + 4]
jb 0x10029dd0
mov eax, dword [edi + 8]
inc esi
cmp esi, eax
jb 0x10029db5
xor edx, edx
mov dword [ebp - 0x1c], edx
add eax, 0xfffffffe
je 0x10029e85
mov eax, dword [edi + 4]
xor esi, esi
sub eax, 2
je 0x10029e73
xor ebx, ebx
mov eax, dword [ebp - 0x20]
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
push dword [eax]
call fcn.10005ad0
add esp, 4
lea ecx, [ebp - 0x18]
push dword [ebp - 0x20]
push eax
call fcn.100219e0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
add edx, ebx
add edx, dword [ebp - 0x1c]
mov ecx, edx
and edx, 0x1f
shr ecx, 5
mov dword [ebp - 0x14], edx
lea eax, [eax + ecx*4]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x18]
push eax
call fcn.10024090
mov ecx, eax
call fcn.100244b0
mov edx, dword [ebp - 0x1c]
test al, al
je 0x10029e65
mov eax, dword [edi + 0xc]
mov eax, dword [eax + edx*4 + 4]
mov byte [eax + esi + 1], 1
mov eax, dword [edi + 4]
inc esi
add ebx, dword [ebp + 0xc]
sub eax, 2
cmp esi, eax
jb 0x10029e02
mov ecx, dword [edi + 8]
inc edx
sub ecx, 2
mov dword [ebp - 0x1c], edx
cmp edx, ecx
jb 0x10029df6
mov ecx, edi
call fcn.10029fb0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10032619
mov esp, ebp
pop ebp
ret 0xc