joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1000e330
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1000e330
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013b158]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1013b168], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x1013b178]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1000c661
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x1013b178], 0
call fcn.10001a30
mov ecx, dword [0x1013b174]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1000c661
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x1013b174], 0
mov dword [0x1013b168], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1013b16c], 0
je 0x10002679
mov eax, dword [0x1013b16c]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.1000c9cd
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1000c661
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1013b16c], eax
mov dword [0x1013b170], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1013b174]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1013b174], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100032d0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x100032eb
bts eax, 7
shr ecx, 1
test cl, 1
je 0x100032f6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10003301
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000330c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10003317
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10003322
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000332d
bts eax, 1
test cl, 2
je 0x10003336
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x100033d2
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x100033c3
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x100032e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003400
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x10027cb4
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.1000fad7
add esp, 0xc
test eax, eax
je 0x10003439
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.1001006e
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10003465
call fcn.1001003e
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.1000fcf7
add esp, 0x10
test eax, eax
je 0x100034bb
push esi
nop word [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10003482
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x400
push 1
push ebx
call fcn.1000fcf7
add esp, 0x10
test eax, eax
jne 0x10003480
pop esi
push ebx
call fcn.10010079
push dword [ebp + 0xc]
call fcn.1001003e
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004120
Capabilities:
Encode data using xor
Send data
Send data on socket
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x10001c]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x100010]
xor edi, edi
test eax, eax
jle 0x10004175
push 0
lea ebx, [esi + 0x80010]
push eax
add ebx, edi
push ebx
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x10004188
mov eax, dword [esi + 0x100010]
add edi, ecx
sub eax, ecx
mov dword [esi + 0x100010], eax
test eax, eax
jg 0x10004145
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
jne 0x100041c3
push dword [esi + 0x100010]
lea eax, [esi + 0x80010]
push ebx
push eax
call fcn.1000ddb0
add esp, 0xc
lea eax, [esi + 0x10001c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edi
push 0x100
push 0
push 0x1013c168
mov edi, eax
call fcn.1000e330
movaps xmm1, xmmword [0x1002c660]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor ecx, ecx
nop dword [eax + eax]
movups xmm0, xmmword [ecx + 0x10028708]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [ecx + 0x1013c168], xmm0
movups xmm0, xmmword [ecx + 0x10028718]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [ecx + 0x1013c178], xmm0
movups xmm0, xmmword [ecx + 0x10028728]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [ecx + 0x1013c188], xmm0
movups xmm0, xmmword [ecx + 0x10028738]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [ecx + 0x1013c198], xmm0
add ecx, 0x40
cmp ecx, 0x100
jb 0x100041f0
push edi
push 0x1013c168
push 0
push 0x10130ac0
call fcn.100083d0
add esp, 0x10
cmp dword [esi + 0x100034], 0
je 0x1000429b
push 0
mov dword [0x1013adfc], 0xffffffff
push dword [esi + 0x100034]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x100034]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x100034], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100042b1
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x100042c6
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
lea eax, [esi + 0x10001c]
mov byte [esi + 0x100038], 0
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100047b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0x20
push 3
push 0
push 1
push connect
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000482a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x100047f9
push eax
call fcn.1000c9bf
add esp, 4
mov dword [edi + 4], 0
push dword [edi + 8]
call fcn.1000c9c4
add esp, 4
mov dword [edi + 4], eax
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push 0
push ecx
push dword [edi + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x10004832
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x10005500
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
push 0x100
push 0
push 0x1013c168
movzx edi, byte [esi + 4]
call fcn.1000e330
movaps xmm1, xmmword [0x1002c660]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor eax, eax
nop dword [eax]
movups xmm0, xmmword [eax + str.r_jj]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c168], xmm0
movups xmm0, xmmword [eax + 0x10029b18]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c178], xmm0
movups xmm0, xmmword [eax + 0x10029b28]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c188], xmm0
movups xmm0, xmmword [eax + 0x10029b38]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c198], xmm0
add eax, 0x40
cmp eax, 0x100
jb 0x10005530
push edi
push 0x1013c168
push 0
push 0x10130ac0
call fcn.100083d0
movzx eax, byte [esi + 4]
add esp, 0x10
cmp eax, 0xa
ja case.default.0x100055ac
jmp dword [eax*4 + 0x10005634]
push 0x1388
push 0xe
jmp 0x10005614
push 0x1388
push 0xf
jmp 0x10005614
push 0x1388
push 0x10
jmp 0x10005614
push 0x1388
push 0x11
jmp 0x10005614
push 0x1388
push 0x12
jmp 0x10005614
push 0x1388
push 0x13
jmp 0x10005614
push 0x1388
push 0x14
jmp 0x10005614
push 0x1388
push 0x16
jmp 0x10005614
push 0x1388
push 0x18
jmp 0x10005614
push 0x1388
push 0x19
jmp 0x10005614
push 0x1388
push 0x15
call fcn.10008890
push eax
push ecx
mov edx, 2
mov ecx, 0x1013acb8
call fcn.1000bac0
add esp, 0xc
pop edi
pop esi
pop ecx
ret
Function at 0x10005660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1013bc50], 1
push esi
je 0x10005723
mov eax, dword [0x10130a84]
mov dword [0x1013bc88], 0
mov dword [0x1013bc84], 0
mov dword [0x1013bc80], 0
mov dword [0x1013bc7c], 0
mov dword [0x1013bc78], 0
mov dword [0x1013bc74], 0
mov dword [0x1013bc70], 0
mov dword [0x1013bc6c], 0
mov dword [0x1013bc68], 0
cmp eax, dword [0x10130a88]
je 0x100056ed
mov dword [0x10130a88], eax
mov eax, dword [0x10130a90]
cmp eax, dword [0x10130a94]
je 0x100056ff
mov dword [0x10130a94], eax
mov eax, dword [0x10130a9c]
cmp eax, dword [0x10130aa0]
je 0x10005711
mov dword [0x10130aa0], eax
mov eax, dword [0x10130aa8]
cmp eax, dword [0x10130aac]
je 0x10005723
mov dword [0x10130aac], eax
mov word [ebp - 0x140], 0x38c1
call fcn.10010094
and eax, 0x800000ff
jns 0x1000573f
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x1002af0c]
mov byte [ebp - 0x13e], al
mov eax, dword [0x1013bc50]
mov dword [ebp - 0x13c], eax
mov eax, dword [0x1013aa5c]
mov dword [ebp - 0x138], eax
mov eax, dword [0x1002af08]
push 0x100
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x108]
push 0
push eax
mov byte [ebp - 0x13d], 0
mov dword [ebp - 0x130], ecx
call fcn.1000e330
add esp, 0xc
xor esi, esi
push ecx
lea edx, [ebp - 0x108]
mov ecx, esi
call fcn.1000a2a0
add esp, 4
test al, al
jne 0x100057ac
inc esi
cmp esi, 5
jl 0x10005791
mov eax, dword [ebp - 0xfc]
xor eax, dword [ebp - 0xec]
xor eax, 0x8941d8e7
push eax
mov eax, dword [ebp - 0x100]
xor eax, dword [ebp - 0xf0]
xor eax, 0xf45bbf4c
push eax
mov eax, dword [ebp - 0x104]
xor eax, dword [ebp - 0xf4]
xor eax, 0x94fdc685
push eax
mov eax, dword [ebp - 0x108]
xor eax, dword [ebp - 0xf8]
xor eax, 0x3ad3b74a
push eax
push str._08X__08X__08X__08X
push 0x1013c140
call dword [sym.imp.USER32.dll_wsprintfA]
movups xmm0, xmmword [0x1013c140]
mov eax, dword [0x1013c160]
push 0x100
movups xmmword [ebp - 0x12c], xmm0
push 0
movups xmm0, xmmword [0x1013c150]
push 0x1013c168
mov dword [ebp - 0x10c], eax
movups xmmword [ebp - 0x11c], xmm0
call fcn.1000e330
movaps xmm1, xmmword [0x1002c660]
add esp, 0x24
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor eax, eax
nop
movups xmm0, xmmword [eax + 0x10029c08]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c168], xmm0
movups xmm0, xmmword [eax + 0x10029c18]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c178], xmm0
movups xmm0, xmmword [eax + 0x10029c28]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c188], xmm0
movups xmm0, xmmword [eax + 0x10029c38]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c198], xmm0
add eax, 0x40
cmp eax, 0x100
jb 0x10005850
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
push dword [ebp - 0x13c]
push 0x1013c168
push 0
push 0x10130ac0
call fcn.100083d0
movzx eax, byte [ebp - 0x13f]
add esp, 0x1c
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.10003d60
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000c666
mov esp, ebp
pop ebp
ret
Function at 0x10007c40
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
jne 0x10007dd6
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
push str.LdrLoadDll
push str.Ntdll.dll
mov dword [0x1013bcd0], eax
mov dword [ebp - 0x420], 0x25ff
mov word [ebp - 0x41c], 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10007d0c
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x418]
push eax
push 0x40
push 6
push 0x1013bcdc
call esi
mov eax, dword [edi]
mov dword [0x1013bcdc], eax
movzx eax, word [edi + 4]
mov word [0x1013bce0], ax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x418]
push 6
push 0x1013bcdc
call esi
lea eax, [ebp - 0x418]
push eax
push 0x40
push 6
push edi
call esi
mov eax, dword [ebp - 0x420]
mov dword [edi], eax
movzx eax, word [ebp - 0x41c]
mov word [edi + 4], ax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x418]
push 6
push edi
call esi
lea ecx, [ebp - 0x414]
call fcn.100032d0
xorps xmm0, xmm0
mov dword [ebp - 0x424], 0
push 0
movq qword [ebp - 0x42c], xmm0
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xc
lea ecx, [ebp - 0x42c]
push ecx
push esi
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
je 0x10007dbe
mov edx, dword [ebp - 0x42c]
xor eax, eax
mov ecx, dword [edx + 0x3c]
cmp ax, word [ecx + edx + 6]
jae 0x10007dbe
mov ebx, dword [ecx + edx + 0x104]
mov eax, dword [ecx + edx + 0x100]
add ebx, edx
or edx, 0xffffffff
mov dword [ebp - 0x418], eax
test eax, eax
je 0x10007da0
mov esi, eax
mov edi, ebx
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ebp + ecx*4 - 0x414]
sub esi, 1
jne 0x10007d80
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0xc], eax
not edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 8], edx
call fcn.1000adf0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000c666
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.1000c666
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100083d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x10030040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push edi
test eax, eax
js 0x100085ba
cmp eax, dword [ecx + 0x218]
jge 0x100085ba
imul edi, eax, 0x214
add edi, ecx
cmp dword [edi + 4], 0
je 0x100085ba
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x816]
cmp eax, dword [edi + 0x108]
jne 0x1000844f
movzx eax, word [ebp - 0x81a]
cmp eax, dword [edi + 0x10c]
jne 0x1000844f
movzx eax, word [ebp - 0x81c]
cmp eax, dword [edi + 0x110]
je 0x1000850e
push dword [edi + 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, word [ebp - 0x816]
lea esi, [edi + 0x114]
movzx ecx, word [ebp - 0x81a]
movzx eax, word [ebp - 0x81c]
push edx
push ecx
push eax
mov dword [edi + 0x110], eax
lea eax, [edi + 8]
push eax
push str.._s_04d__02d__02d.log
push esi
mov dword [edi + 0x108], edx
mov dword [edi + 0x10c], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0x214], eax
cmp eax, 0xffffffff
jne 0x100084d9
mov dword [edi + 4], 0
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000c666
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000850e
push dword [edi + 0x214]
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000c666
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.1000e330
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x80c]
push 0x400
push eax
call fcn.100085e0
add esp, 0x14
lea eax, [ebp - 0x40c]
push 0x400
push 0
push eax
call fcn.1000e330
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
movzx eax, word [ebp - 0x810]
push eax
movzx eax, word [ebp - 0x812]
push eax
movzx eax, word [ebp - 0x814]
push eax
lea eax, [ebp - 0x40c]
push str._02d:_02d:_02d__s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x40c]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008594
push 0
lea eax, [ebp - 0x820]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x40c]
push eax
push dword [edi + 0x214]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.1000c666
mov esp, ebp
pop ebp
ret
Function at 0x10008650
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1013bc40], 0
push esi
mov esi, dword [ebp + 8]
je 0x10008674
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x1013bc40]
cmp eax, dword [ecx]
jne case.0x100086b2.0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi*4 + 0x10130ce8]
cmp eax, 0x1388
jb 0x100086a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi*4 + 0x10130ce8], eax
mov dword [esi*4 + 0x10130cf0], 0
mov ecx, dword [0x1013bc58]
mov eax, 5
add eax, esi
cmp ecx, 5
ja case.default.0x100086b2
jmp dword [ecx*4 + 0x10008724]
inc dword [eax*4 + vtable.CMacroCheck.0]
cmp dword [eax*4 + 0x10130cdc], 0x19
jmp 0x1000870c
inc dword [eax*4 + vtable.CMacroCheck.0]
cmp dword [eax*4 + 0x10130cdc], 0x14
jmp 0x1000870c
inc dword [eax*4 + vtable.CMacroCheck.0]
cmp dword [eax*4 + 0x10130cdc], 0xf
jmp 0x1000870c
inc dword [eax*4 + vtable.CMacroCheck.0]
cmp dword [eax*4 + 0x10130cdc], 0xa
jmp 0x1000870c
inc dword [eax*4 + vtable.CMacroCheck.0]
cmp dword [eax*4 + 0x10130cdc], 5
jbe case.0x100086b2.0
xor edx, edx
push 0
lea ecx, [edx + 9]
call fcn.10005900
add esp, 4
pop esi
pop ebp
ret 4