joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445e80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x445eb3
push esi
call fcn.004541d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x445eac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x445f39
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x445f22
mov eax, dword [esi + 8]
test eax, eax
je 0x445ed7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x445f1e
cmp eax, 2
je 0x445f22
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x445eca
cmp eax, 3
je 0x445efd
cmp eax, 1
jne 0x445eca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x445eca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x445eca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00445f60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x445f48
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00445f60
add esp, 4
pop esi
ret

Function at 0x4467d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4467f1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4467f1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4467f1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x47495b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x474993
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00472a0f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004729e7
jmp 0x47499f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47604d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47608f
call fcn.0047bb02
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47608f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x476086
xor eax, eax
jmp 0x476097
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047609d
pop edi
pop esi
pop ebx
ret 4
Function at 0x47c032
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47c060
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47c07e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047bf98
jmp 0x47c07e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47c07e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047bf98
test edi, edi
mov eax, edi
jne 0x47c068
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10003dea
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
sub eax, esi
push edi
je 0x10003ea7
dec eax
jne 0x10003f2a
push 0x100012d4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x100012c0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
inc dword [0x10013f38]
mov edi, eax
cmp edi, esi
je 0x10003e5e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x10003e86
mov eax, dword [ebp + 8]
mov dword [0x10013f18], edi
mov dword [0x10013f00], eax
mov dword [0x10013f1c], esi
mov dword [0x10013f04], esi
mov dword [0x10013f0c], esi
jmp 0x10003f2a
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100012b0
push 0x100012a8
push 0x74
push 0x10001270
call fcn.10006b9b
add esp, 0x18
xor eax, eax
jmp 0x10003f2d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x10003f2a
push esi
call ebx
push eax
push 0x10001260
push 0x100012a8
push 0x7b
jmp 0x10003e72
push 0x1000124c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
dec dword [0x10013f38]
jne 0x10003f2a
push dword [0x10013f18]
mov dword [0x10013f0c], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x100012a8
mov esi, 0x10001270
test eax, eax
jne 0x10003ef9
push 0
call ebx
push eax
push 0x10001260
push edi
push 0x9b
push esi
call fcn.10006b9b
add esp, 0x18
mov eax, dword [0x10013f04]
test eax, eax
je 0x10003f2a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x10003f2a
call ebx
test eax, eax
je 0x10003f2a
push 0
push eax
push 0x1000123c
push edi
push 0xa2
push esi
call fcn.10006b9b
add esp, 0x18
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10003f39
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10013010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x10c]
push eax
push 1
xor ebx, ebx
push ebx
push 0x1000135c
push 0x80000002
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x110], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x10003fa9
push ebx
push eax
push 0x1000134c
push 0x10001334
push 0xbf
push 0x10001270
call fcn.10006b9b
add esp, 0x18
xor eax, eax
jmp 0x10004059
push esi
push edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x1000132c
push dword [ebp - 0x10c]
mov dword [ebp - 0x114], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, 0x10001334
mov esi, 0x10001270
cmp eax, ebx
jne 0x10004015
push dword [ebp - 0x118]
lea eax, [ebp - 0x108]
push eax
call fcn.1000676b
test eax, eax
jne 0x10004009
push 0x1000130c
push ebx
push ebx
push edi
push 0xd0
jmp 0x10004022
mov dword [ebp - 0x110], 1
jmp 0x1000402b
push ebx
push eax
push 0x100012f8
push edi
push 0xd4
push esi
call fcn.10006b9b
add esp, 0x18
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x10004051
push ebx
push eax
push 0x100012e8
push edi
push 0xd7
push esi
call fcn.10006b9b
add esp, 0x18
mov eax, dword [ebp - 0x110]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100072a1
leave
ret 4
Function at 0x10005705
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
push 0x10001dc8
call fcn.10006a49
add esp, 0xc
push 0x10001db4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
test ebx, ebx
je 0x1000577b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000577b
test esi, 0x1a27
je 0x10005752
or esi, 0x10018
mov dword [0x10013f08], edi
mov dword [0x10013f10], esi
call fcn.10005191
test eax, eax
je 0x1000577b
push esi
push dword [ebp + 0xc]
push dword [0x10013f08]
call dword [0x10013f28]
mov esi, eax
jmp 0x1000577e
push 0xfffffffffffffff7
pop esi
test ebx, ebx
je 0x100057b5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x100057b5
push 0x100014f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10001260
push 0x10001da4
push 0x3a2
push 0x10001270
call fcn.10006b9b
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x100068d8
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x10013010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10013f40], 0
push esi
push edi
mov esi, 0x10013f40
jne 0x1000699f
mov edi, 0x104
push edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10006928
push 0x100022bc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10006a36
push 0x100022b4
lea eax, [ebp - 0x120]
push eax
push 0x100021dc
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.100050d5
add esp, 0x14
test eax, eax
jns 0x10006954
push 0x10002290
jmp 0x1000691d
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000697b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000697b
push 0x10002260
jmp 0x1000691d
push 0x1000224c
push 0x10001524
lea eax, [ebp - 0x120]
push eax
push 0x10002244
push edi
push esi
call fcn.100050d5
add esp, 0x18
test eax, eax
js 0x1000694d
push 0x10002240
push esi
call fcn.10007a52
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100069bc
push 0x10002214
jmp 0x1000691d
lea eax, [ebp - 0x1c]
push eax
call fcn.10007970
lea eax, [ebp - 0x10]
push eax
call fcn.10007892
pop ecx
pop ecx
lea eax, [ebp - 0x10]
test ebx, ebx
je 0x100069fd
push ebx
push 0x1000220c
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x100021fc
lea eax, [ebp - 0x47c]
push 0x258
push eax
call fcn.100050d5
add esp, 0x1c
jmp 0x10006a20
push 0x1000220c
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x100021e8
lea eax, [ebp - 0x47c]
push 0x258
push eax
call fcn.100050d5
add esp, 0x18
lea eax, [ebp - 0x47c]
push esi
push eax
call fcn.100076d4
push esi
call fcn.1000765b
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100072a1
leave
ret
Function at 0x10006a94
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10013010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10014048], 0
push esi
push edi
mov esi, 0x10014048
jne 0x10006b5b
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10006ae4
push 0x100022bc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10006b88
push 0x100022b4
lea eax, [ebp - 0x108]
push eax
push 0x100021dc
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.100050d5
add esp, 0x14
test eax, eax
jns 0x10006b10
push 0x10002290
jmp 0x10006ad9
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10006b37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10006b37
push 0x10002260
jmp 0x10006ad9
push 0x100022ec
push 0x10001524
lea eax, [ebp - 0x108]
push eax
push 0x10002244
push edi
push esi
call fcn.100050d5
add esp, 0x18
test eax, eax
js 0x10006b09
push 0x10002240
push esi
call fcn.10007a52
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10006b78
push 0x10002214
jmp 0x10006ad9
push esi
push ebx
call fcn.100076d4
push esi
call fcn.1000765b
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100072a1
leave
ret

Function at 0x100072a1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10013010]
jne 0x100072ab
repz ret
jmp fcn.1000abac

Function at 0x1000e34e
Capabilities:
Enumerate pe sections

Disassembly:
or byte [esi + 0x57], dl
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1000e386
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1000e36d
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1000e37e
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1000e388
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1000e363
xor eax, eax
pop edi
pop esi
ret

Function at 0x1000e3c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.1000e30b
jg 0x1000e415
inc esp
fcom dword [esi + 0x53]
call fcn.1000e34b
pop ecx
test eax, eax
pop ecx
je 0x1000e49e
push edi
push esi
push ebx
call fcn.1000e38b
add esp, 0xc
call fcn.1000e30b
push es
loop 0x1000e467
mov esi, dword [esi + 0x78]
test esi, esi
je 0x1000e49e
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.1000e30b
inc esp
cmp dl, byte [edi]
mov eax, dword es:[esi + 0x20]
add eax, edi
mov edi, dword [esi + 0x1c]
add edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, ax
je 0x1000e4ad
and dword [ebp - 4], 0
xor ebx, ebx
mov dword [ebp - 0x10], edi
Function at 0x1000e566
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edi
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.1000e30b
or byte [ebp - 0x7499cf02], dl
inc edi
push es
cmp ax, bx
jbe 0x1000e565
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x1000e55f
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x1000e550
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], pe_nt_image_headers32
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1000e30b
stosd dword es:[edi], eax
mov edx, 0x458dbc40
test al, 0x50
call fcn.1000e31b
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1000e2d0
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1000e5f9
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1000e30b
out 0x7a, al
jl 0x1000e672
lea eax, [ebp - 0x40]
push eax
call fcn.1000e31b
push eax
push esi
push dword [ebp + 8]
call fcn.1000e2d0
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1000e30b
inc edx
invalid
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1000e31b
push eax
push esi
push dword [ebp + 8]
call fcn.1000e2d0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
invalid
Function at 0x1000e6ef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
sahf
sub eax, 0x119f45c6
invalid
invalid

Function at 0x1000ea56
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000e9e2
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000ea00
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000ea5e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000ea45
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000ea4e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000ea58
add ecx, eax
or byte [ecx], 4
invalid
invalid
or dword [eax + eax*2], eax
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000ea3a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000e9c4
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1000eaab
dec eax
je 0x1000eaa2
sub eax, 3
je 0x1000ea99
mov dword [ebp - 4], 0x40
jmp 0x1000eac8
mov dword [ebp - 4], 4
jmp 0x1000eaae
mov dword [ebp - 4], 0x20
jmp 0x1000eaae
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000eafa
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000ea7a
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1000e30b
sbb dword [edi + ebx + 0x6d], esp
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x1000eb06
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000ebe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1000e31b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000e2d0
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.1000e31b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000e2d0
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.1000e30b
ret 0x2116
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000c455
pop dword [ebp - 0x18]
mov eax, 0x1000c455
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x35cbd
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x18480d4
add ecx, 0xfe7bba74
xor edx, edx
add edx, eax
mov ebx, 0xfde7e3bc
sub ebx, 0xede65dbc
add ebx, dword [ebp - 0x18]
mov esi, 0xbb94c467
add esi, 0x53dc4925
sub dword [ebp - 0x10], edi
mov edi, dword [ebx]
xor dword [ebp - 0x14], 0x92e50a4b
sub edi, esi
add dword [ebp - 0x10], ecx
mov dword [edx], edi
xor dword [ebp - 0x14], 0x3328d7b6
add edx, 0x77ad1624
add edx, 0x8852e9e0
add ebx, 0x3118b7f9
sub ebx, 0x3118b7f5
loop 0x1000c4ac
add eax, 0xdff3
mov ebx, eax
add eax, 0x1ce1dbf1
add eax, 0xe31e2414
mov ecx, 0xc537ace3
add ecx, 0x4ac8531d
add ecx, dword [ebp - 0x18]
call ebx
leave
ret