joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10091bb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c366d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100e2040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 1
xor edx, edx
mov edi, 0xf
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov esi, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], eax
cmp esi, eax
je 0x10091cbc
nop
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x10091c33
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x10091c21
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.1002f8c0
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x10091c4d
cmp edi, 0xf
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x10091c5a
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.1003f740
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edi, 0x811c9dc5
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
test edx, edx
je 0x10091c94
mov esi, dword [ebp - 0x34]
nop dword [eax]
movzx ecx, byte [eax + esi]
inc eax
xor ecx, edi
imul edi, ecx, 0x1000193
cmp eax, edx
jb 0x10091c80
mov esi, dword [ebp - 0x30]
cmp edi, dword [ebp + 8]
jne 0x10091ca4
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10091cb7
dec eax
mov dword [ebp - 0x2c], eax
add esi, 0x1c
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x38]
je 0x10091cbc
mov edi, dword [ebp - 0x14]
jmp 0x10091c10
mov esi, dword [esi + 0x18]
jmp 0x10091cbe
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x10091cf6
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x10091cec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10091cec
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100bfaf1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100bf676
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10093770
Capabilities:
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100e2040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x214]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x105
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x220], 0
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
jne 0x100938d1
push 0x105
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x105
lea eax, [ebp - 0x214]
push eax
push 0x100d50e8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x100938bd
mov edx, dword [ebp - 0x220]
push esi
mov esi, dword [0x1012139c]
mov ecx, esi
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10093844
nop dword [eax]
cmp dword [eax + 0x10], edx
jae 0x1009383a
mov eax, dword [eax + 8]
jmp 0x1009383e
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10093830
cmp byte [ecx + 0xd], 0
jne 0x1009384f
cmp edx, dword [ecx + 0x10]
jae 0x10093851
mov ecx, esi
cmp ecx, esi
je 0x10093893
mov eax, dword [ecx + 0x14]
pop esi
push 0
push 0
push 0
push 0x1003b320
push 0
push 0
mov dword [0x1011f574], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100938d1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bf676
mov esp, ebp
pop ebp
ret 0xc
mov ecx, edx
call fcn.10093620
push 0
push str.nice_try_lil_bro
mov esi, eax
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.100bfb96
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0
push str.Error
push str.Failed_to_get_volume_information
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100bf676
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100a9d50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push esi
push edi
mov edi, 4
lea esi, [ebx + 4]
jmp dword [edi*4 + 0x100aaf98]
Function at 0x100bc360
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.100bcb70
mov esi, dword [eax + 4]
test esi, esi
je 0x100bc415
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100bc3dc
cmp eax, esi
jne 0x100bc3d4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100bc3e4
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100bc3e4
cmp eax, esi
jne 0x100bc3e4
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.1002f720
push 0x5c
push esi
call fcn.100bfaf1
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100bd130
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100bd161
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1002fa00
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100bd26c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x100bd1f1
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100bd262
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x100bd22b
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100bd223
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x100bd25f
cmp edi, edx
je 0x100bd23c
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x100bd275
cmp edi, edx
jne 0x100bd230
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x100bd1a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100bd25f
Function at 0x4749f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa682
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4cf084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x474a31
mov eax, dword [edi]
jmp 0x474a33
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x474a52
push esi
push edi
push ebx
call fcn.004741c0
add esp, 0xc
jmp 0x474b4e
test eax, 0x400
je 0x474b0d
cmp dword [edi + 0x14], 8
jb 0x474a67
mov eax, dword [edi]
jmp 0x474a69
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.00473010
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00430950
cmp esi, 0xffffffff
jne 0x474ac2
push dword [ebp - 0x34]
push edi
push ebx
call fcn.004741c0
add esp, 0xc
jmp 0x474b4e
push edi
call fcn.00473d30
add esp, 4
test al, al
jne 0x474af5
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.00473e10
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x474b4e
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x474b1f
mov dword [esi], 0
call fcn.00472b40
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x474b36
mov dword [ebp - 0x30], 2
call fcn.00473e10
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret
Function at 0x49774f
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
pop ecx
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0049730b
push eax
push esi
push dword [ebp + 8]
call fcn.004972c0
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004972fb
add al, 0x46
aam 0xb8
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004972fb
jno 0x497804
cwde
cld
lea eax, [ebp - 0x84]
push eax
call fcn.0049730b
push eax
push esi
push dword [ebp + 8]
call fcn.004972c0
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x497af4
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.0049726c
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x49786b
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.0049726c
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x497838
call fcn.004972fb
adc eax, 0x8ba5c872
jle 0x4978b3
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x497aea
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x4978a0
cmp dword [eax + 0xc], ebx
je 0x497943
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.004972fb
inc ecx
mov dword [0x5d39f128], eax
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
inc dword [ecx - 0x5d]
sub cl, dh
cmp dword [ebp + 0xc], ebx
jne 0x4978cf
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x497aea
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x4978e3
mov dword [ebp + 0x10], edi
jmp 0x4978e8
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.004972fb
invalid
call fcn.004972fb
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x497be3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x4fffff9], edx
add byte [eax], al
add byte [eax - 0x3c35b], al
inc dword [eax]
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0049730b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004972c0
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
invalid
test dword [edx], ebx
cld
invalid
Function at 0x49c9be
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049c32c

Function at 0x49c9c9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049c567
Function at 0x10002592
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100269c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x100025d2
push 0x1001f8f8
push 4
push eax
call fcn.1000f663
push eax
call fcn.10001000
add esp, 0x10
jmp 0x100025e4
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10002652
push edi
call fcn.1000d947
mov edi, dword [eax]
call fcn.1000d947
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.1000f6e4
add esp, 0x18
mov ebx, eax
call fcn.1000d947
cmp dword [eax], 0
je 0x10002632
call fcn.1000d947
push dword [eax]
call fcn.10001643
pop ecx
jmp 0x10002639
call fcn.1000d947
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x10002652
cmp ebx, esi
jae 0x10002652
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x10002654
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000cbd1
leave
ret
Function at 0x1000cbd1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100269c0]
jne 0x1000cbdb
repz ret
jmp fcn.100116a5

Function at 0x1001115d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10026c98]
je 0x10011178
inc edi
cmp edi, 0x17
jb 0x10011169
cmp edi, 0x17
jae 0x100112f8
push ebp
push 3
call fcn.10018157
cmp eax, 1
pop ecx
je 0x100112c4
push 3
call fcn.10018157
test eax, eax
pop ecx
jne 0x100111ac
cmp dword [0x10029c30], 1
je 0x100112c4
cmp ebx, 0xfc
je 0x100112f7
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10029df8
push ebp
call fcn.1000f663
add esp, 0xc
test eax, eax
je 0x100111e2
push esi
push esi
push esi
push esi
push esi
call fcn.1001103d
add esp, 0x14
push 0x104
mov esi, 0x10029e11
push esi
push 0
mov byte [0x10029f15], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10011226
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000f663
add esp, 0xc
test eax, eax
je 0x10011226
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1001103d
add esp, 0x14
push esi
call fcn.1000d600
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001126b
push esi
call fcn.1000d600
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1002a10c
push 0x10020ee4
sub ecx, eax
push ecx
push eax
call fcn.1000fca9
add esp, 0x14
test eax, eax
je 0x1001126b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1001103d
add esp, 0x14
jmp 0x1001126d
xor esi, esi
push 0x10020ee0
push ebx
push ebp
call fcn.1000f78a
add esp, 0xc
test eax, eax
je 0x1001128d
push esi
push esi
push esi
push esi
push esi
call fcn.1001103d
add esp, 0x14
push dword [edi*8 + 0x10026c9c]
push ebx
push ebp
call fcn.1000f78a
add esp, 0xc
test eax, eax
je 0x100112af
push esi
push esi
push esi
push esi
push esi
call fcn.1001103d
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10017f9a
add esp, 0xc
jmp 0x100112f7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100112f7
cmp ebp, 0xffffffff
je 0x100112f7
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10026c9c]
push dword [esi]
call fcn.1000d600
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10017f9a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10011883
xor ebx, ebx
cmp dword [0x1002a6b4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10018070
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10018150
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10021918
push edi
call esi
cmp eax, ebx
je 0x10018150
push eax
call fcn.10011815
mov dword [esp], 0x10021908
push edi
mov dword [0x1002a6b4], eax
call esi
push eax
call fcn.10011815
mov dword [esp], 0x100218f4
push edi
mov dword [0x1002a6b8], eax
call esi
push eax
call fcn.10011815
mov dword [0x1002a6bc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000f133
test eax, eax
pop ecx
pop ecx
je 0x1001803e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1001103d
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10018070
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10011815
cmp eax, ebx
pop ecx
mov dword [0x1002a6c4], eax
je 0x10018070
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10011815
pop ecx
mov dword [0x1002a6c0], eax
mov eax, dword [0x1002a6c0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x100180f5
cmp dword [0x1002a6c4], ecx
je 0x100180f5
push eax
call fcn.1001188c
push dword [0x1002a6c4]
mov esi, eax
call fcn.1001188c
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x100180f5
cmp edi, ebx
je 0x100180f5
call esi
cmp eax, ebx
je 0x100180c2
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100180c2
test byte [ebp - 0x18], 1
jne 0x100180f5
lea eax, [ebp - 0x10]
push eax
call fcn.1000f16a
test eax, eax
pop ecx
je 0x100180dd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1001103d
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x100180ec
or dword [ebp + 0x10], 0x200000
jmp 0x10018130
or dword [ebp + 0x10], 0x40000
jmp 0x10018130
mov eax, dword [0x1002a6b8]
cmp eax, dword [ebp - 8]
je 0x10018130
push eax
call fcn.1001188c
cmp eax, ebx
pop ecx
je 0x10018130
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10018130
mov eax, dword [0x1002a6bc]
cmp eax, dword [ebp - 8]
je 0x10018130
push eax
call fcn.1001188c
cmp eax, ebx
pop ecx
je 0x10018130
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002a6b4]
call fcn.1001188c
cmp eax, ebx
pop ecx
je 0x10018150
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10018152
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411179
Capabilities:
Encode data using xor

Disassembly:
cdq
inc edi
test eax, 0x940ccf60
clc
jg 0x4111ef
invalid
pushfd
mov eax, dword [0xbbf96f4a]
mov bh, byte fs:[esi + 0x53]
dec esp
test dword [edx], eax
lea ebx, [edx + 0x2d8d72c4]
lahf
mov bh, 0xb
or edi, dword [eax + 0x5c]
js 0x411263
jns 0x411280
xchg ebx, eax
push ecx
add ah, bl
imul edi, dword [ebp - 0x53], 0x7c
pop edx
popfd
inc ebp
xor dl, byte [edi]
mov dl, 0xba
loop 0x411204
sbb bl, byte [0xbeb562df]
fucom st(4)
sahf
xchg byte [edx + ecx*2], dl
in eax, 0xaf
and eax, 0x44988bf6
fdiv st(3), st(0)
pop esi
cld
rol byte [ecx + 0x1a], cl
push 0x30
xlatb
xchg esp, eax
pop es
or byte [ebx + 0x47], dl
js 0x411205
pop edi
mov eax, dword [0x9d92df1b]
int1
rcr byte [edi - 0x5fcb904a], 0x58
fist word [edx - 0x603f0e63]
mov dh, 0x6f
xor al, 0xa0
pop eax
inc esi
jle 0x411244
imul eax, dword [ebx - 0x1f], 0xffffffef
popal
wait
nop
les ebp, [eax - 0x2d2832b2]
push ebx
dec eax
jbe 0x4112c5
das
dec edi
rep stosd dword es:[edi], eax
push ebp
in al, 0xea
aad 0x75
pop esi
jne 0x411296
retf
xchg esp, eax
jbe 0x4112e5
or ebp, dword gs:[ebx]
movsd dword es:[edi], dword [esi]
int 0xa5
and eax, 0x512c17c
invalid
fcmovnbe st(0), st(1)
push ebx
dec edi
or byte [ebx + 0x3de4226f], ch
xchg ebp, eax
jb 0x41126d
out dx, al
ret
fbld tbyte [ebx + 0x62b032c7]
xor edx, esp
stc
out 0xba, eax
cli
pop ds
cld
inc edi
lodsb al, byte [esi]
and dword [eax - 0x57bab299], ecx
stosd dword es:[edi], eax
salc
rol byte [ebx + 0x1a0e7482], 1
jl 0x411327
mov ecx, 0xdf31a23a
add al, 0xc9
push ecx
adc dl, byte [ebp + 0xe820b42]
push ebx
and eax, 0x569c25c8
mov dl, 0xd8
inc eax
and edx, dword [ebx - 0x2b]
pop eax
out 0x93, eax
stosd dword es:[edi], eax
cli
inc esp
fisubr word [edi + 0xc]
pop ebp
pushal
fsub qword [ebp - 0x32804a79]
retf
ret 0x8730