joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005df4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4a490
jmp 0x1005deed
push dx
mov dh, cl
call fcn.1005df23
test al, 0x27
mov bh, 0xd2
and dword [eax - reloc.KERNEL32.dll_VirtualAlloc], edx
pop eax
call 0xce5d033b
mov dword [ecx + ebp*8 - reloc.KERNEL32.dll_VirtualAlloc], ebx
pushfd
jmp 0x1005cffa
pushfd
jmp 0x1005cffa
mov esi, dword [esp + 0x30]
bts ecx, ebx
jnp 0x1005df44
shr al, 4
xchg ebp, ecx
neg ebx
jmp 0x1005dfa1
shr al, 4
call 0x1005df4d
int1
setg bl
mov ax, dx
sub esp, 5
lea esp, [esp + 1]
xchg dword [esp + 4], ecx
jmp 0x1005dff4
lea ebp, [esp + 4]
mov di, word [esp]
call fcn.1005dfcb
test eax, 0x3acfa83a
sti
mov dword [edi], ebx
invalid
lea ebx, [ecx*4]
sub esp, 0
mov ax, di
call fcn.1005df92

Function at 0x1005dfcb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esp + edi]
ror bh, 7
jmp 0x1005e051
sub esp, 0xb8
mov edi, esp
lea eax, [edi + 0x59]
jmp 0x1005e01c
pushal
call fcn.1005e006
jp 0x1005dfd7
jnp 0x1005dfd7

Function at 0x1005e006
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, bp
mov ecx, esi
setae dl
xchg ah, dl
lea ebx, [esp + esi]
jmp 0x1005e038
xchg ebx, eax
neg bx
mov dword [esp + 4], edx
mov dword [esp + 4], edi
xchg edx, eax
mov eax, edi
jmp 0x1005e08e
xchg ah, dl
sub esp, 0xb
jnp 0x1005e022
xchg ebx, eax
jmp 0x1005e06b
xchg edx, eax
jmp 0x1005e02f
neg bx
mov dword [esp + 4], edx
mov dword [esp + 4], edi
jmp 0x1005e055
lea ebx, [ebx*4]
mov ax, word [esp]
neg ax
jmp 0x1005e207
lea esp, [esp + 3]
rol esi, 0
bsr edx, esp
jnp 0x1005e078
jp 0x1005e0a4
xchg esi, eax
or eax, 0xa717e49d
sbb al, 0x6f
lea ebx, [ebx*4]
mov ax, word [esp]
neg ax
mov bh, byte [esp]
jmp 0x1005e0dd
jmp 0x1005e148
mov edx, dword [esp]
jmp 0x1005e20d
lea esp, [esp + 0x14]
inc esi
neg dx
jmp 0x1005e12e
add ebx, 0xa4cf97f5
push sp
mov byte [esp], dh
call fcn.1005e189
pop ebp
lodsb al, byte [esi]
mov edi, 0x8d303186
adc eax, 0xc1cb6303
lea edx, reloc.KERNEL32.dll_VirtualAlloc
rdtsc
dec ebx
lea esp, [esp + 1]
jmp 0x1005e0e5
das
inc ebp
hlt
je 0x1005e0f3
add ebx, 0xa4cf97f5
push sp
call fcn.1005e17a
clc
jp 0x1005e128
invalid
rol edx, cl
sub esp, 0x15
mov dh, al
jmp 0x1005e109
mov bh, byte [esp]
mov edx, dword [esp]
lea esp, [esp + 8]
add esi, 0x5eae9048
add bx, 0x7f5d
je 0x1005e0c7
rol edx, cl
sub esp, 0x15
mov dh, al
lea edx, reloc.KERNEL32.dll_VirtualAlloc
rdtsc
jmp 0x1005e111
Function at 0x1005e189
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1005e1b1
lea esp, [esp + 2]
rol esi, 0
lea eax, [edx*4]
mov dl, 0x3e
sub eax, edx
jmp 0x1005e34c
rdtsc
lea ebx, [edx*4]
mov ebx, 0xf627cf9d
jmp 0x1005e26c
not ax
lea edx, [ebp + 0x3b]
jmp 0x1005e24e
jmp 0x1005e236
add esi, dword [ebp]
lea edx, [ecx + ebx]
neg dx
js 0x1005e2a7
jns 0x1005e285
sbb dword [esi + 0x2a9e6304], edx
mov dword [ebx], ecx
wait
dec byte [0x18392eb8]
jnp 0x1005e2be
lea esp, [esp + 4]
sub esi, 0x6c651559
xchg dx, ax
shr ebx, 7
jns 0x1005e24c
not ax
lea edx, [ebp + 0x3b]
jmp 0x1005e24e
sub esp, 0x12
not bx
lea esp, [esp + 2]
jmp 0x1005e2d2
sub esp, 0x12
not bx
lea esp, [esp + 2]
jmp 0x1005e2d2
adc al, 0x30
mov ebx, 0xf627cf9d
jmp 0x1005e26c
jns 0x1005e1e4
rdtsc
lea ebx, [edx*4]
jmp 0x1005e303

Function at 0x1005ed95
Capabilities:
Execute anti-debugging instructions

Disassembly:
setb ah
pushal
inc ax
xchg dword [esp + 0x20], ebx
not eax
mov ah, byte [esp]
jmp 0x1005edf2
mov ax, word [esp]
jmp 0x1005ed7f
neg ax
mov ah, 0xc5
lea ebx, [ebx + 0x12]
mov eax, 0xc30f301d
call fcn.1005edcd

Function at 0x1005ee3d
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x16
jnp 0x1005eea6
btc ebx, ebp
add esp, 0x10
lea esp, [esp + 2]
jmp 0x1005ee78
add esp, 0x10
lea esp, [esp + 2]
cmp ebp, edx
jmp 0x1005ee5b
btc ebx, ebp
jmp 0x1005ee71

Function at 0x1005ef76
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1005efae
rep movsb byte es:[edi], byte [esi]
jmp 0x1005efb8
lea esp, [esp + 4]
popal
mov ecx, edx
cld
jmp 0x1005ef98
pop ecx
pop edi
pop esi
jmp 0x1005eff9
popfd
jmp 0x1005efbd
Function at 0x1005f7fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebp, 4
mov edx, esi
lea edx, reloc.KERNEL32.dll_VirtualAlloc
not dl
rdtsc
jmp 0x1005f90b
not dx
lea eax, reloc.KERNEL32.dll_VirtualAlloc
jmp 0x1005f7e7
mov eax, dword [esp + 0x14]
bsr edx, ebx
mov al, bl
jmp 0x1005f86b
jnp 0x1005f85e
mov eax, dword [esp]
pushal
jmp 0x1005f821
add bl, cl
xchg dl, dh
mov ah, byte [esp]
call fcn.1005f883
dec edx
invalid
mov eax, dword [esp]
pushal
mov eax, dword [esp + 0x14]
bsr edx, ebx
mov al, bl
jmp 0x1005f83f
movzx ebx, byte [esi - 1]
mov dx, cx
mov al, byte [esp]
rdtsc
btc dx, dx
jmp 0x1005f837
jmp 0x1005f8cc

Function at 0x1005f883
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp]
mov ah, 0xe2
mov eax, dword [esp]
mov al, byte [esp]
jmp 0x1005f8ad
mov dl, bl
neg eax
jmp 0x1005f8a3
mov eax, dword [esp]
mov al, byte [esp]
jmp 0x1005f8ad
jae 0x1005f86d
mov ax, word [esp]
mov ah, 0xe2
jmp 0x1005f889
neg dl
xchg al, ah
shr eax, 0x16
jno 0x1005f8e1
jo 0x1005f8e8
mov cl, 0x25
mov ch, 0xdc
das
popfd
rcl dword [esi - 0x3c], 0xa3
pop esi
in eax, dx
push ecx
retf
dec eax
jmp 0x1005f93c
dec eax
mov ah, dl
mov eax, 0xc8b9b561
neg al
bsf ax, bx
bsf eax, ebx
jmp 0x1005f90d
adc eax, 0x6b0c9e0b
cmpsb byte [esi], byte es:[edi]
push ss
ja 0x1005f8f3
arpl word [esi], ax
cmc
xor byte [edi - 0xc], ch
push 0xd
cld
inc ebx
popal
inc dl
bswap eax
dec al
jge 0x1005f9b7
jl 0x1005f979
mov edx, 0x22d7b022
xchg ecx, eax
jecxz 0x1005f93d
bsf ax, bx
jmp 0x1005f90d
mov ah, dl
mov eax, 0xc8b9b561
neg al
jmp 0x1005f923
loop 0x1005f8f7
popal
mov ch, 0xb9
enter 0xffffffffffffd8f6, 0xffffffffffffffeb
fdivr st(6), st(0)
shl byte [esi - 0x75], cl
invalid
not dl
mov ax, di
lea eax, reloc.KERNEL32.dll_VirtualAlloc
xchg ah, al
neg ax
jmp 0x1005f99d
mov eax, dword [esp]
push edx
jmp 0x1005f9c7
cmc
jmp 0x1005f987
neg ah
rcl eax, 0
lea eax, [edi*4]
jmp 0x1005f95d
ror dl, 0
mov eax, 0xcd068f95
mov eax, dword [esp]
clc
jmp 0x1005f9d4
jnp 0x1005f963
cmc
jmp 0x1005f987
neg ah
rcl eax, 0
lea eax, [edi*4]
mov eax, dword [esp]
push edx
mov ax, 0x83e
lea esp, [esp + 4]
jmp 0x1005f947
jns 0x1005f9ea
sub esp, 0x16
mov eax, 0x793417cb
jmp 0x1005f9fc
sub esp, 0x16
mov eax, 0x793417cb
push dword [esp + 4]
jmp 0x1005fa48
push dword [esp + 4]
lea esp, [esp + 2]
jmp 0x1005fa4c
lea esp, [esp + 2]
lea esp, [esp + 0x18]
add dl, 0x38
bsf ax, sp
jmp 0x1005fb86

Function at 0x1005fcfb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
jmp 0x1005fd26
push word [esp]
lea esp, [esp + 2]
mov dword [esp + 4], edx
jmp 0x1005fceb
jl 0x1005fcd8
mov byte [esp + 5], bh
mov dword [esp], ebx
jmp 0x1005fd00

Function at 0x1005ff50
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
mov ax, si
sub esp, 0x18
jg 0x1005feec
jle 0x1005feec
jmp 0x1005ff02
Function at 0x100682a3
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov byte [esp], ch
mov dword [esp], ebp
xchg bp, si
pushfd
not esi
push edx
jmp 0x100682c2
mov byte [esp], ch
mov edi, dword [esp + 1]
jmp 0x10068289
lea esi, [ebx*4]
lea esi, [esi*4]
jmp 0x100683d2
push dword [esp + 3]
mov ebp, dword [esp + 2]
mov ebp, dword [esp + 0xc]
mov edi, 0x791da4c7
mov edi, dword [esp + 0x10]
mov si, ax
jmp 0x100682ac
mov esi, dword [esp + 0x17]
lea esp, [esp + 0x1c]
pushal
mov eax, ebx
lea esi, reloc.KERNEL32.dll_VirtualAlloc
popal
call fcn.100682f2

Function at 0x1006900d
Capabilities:
Encode data using base64

Disassembly:
jmp 0x10069008
jmp 0x1004b1fa
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0x100801a7
jmp 0x100801be
lea esp, [esp + 4]
jmp 0x1004b232
call 0x10068fea
push ebp
setae al
jmp 0x1008018c
shl eax, 0x10
push dx
clc
lea esp, [esp + 2]
cmp dword [ebp + 0xc], 2
call fcn.10080143
lea esp, [esp + 4]
jb 0x1004b415
lea edx, [ecx*4]
jmp 0x1008020a
lea eax, reloc.KERNEL32.dll_VirtualAlloc
mov ebp, esp
movzx eax, byte [ecx]
jmp 0x10080159
push edi
mov byte [esp + 2], cl
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x100801e5
push ebx
lea ecx, [eax*4]
mov ecx, dword [esp]
jmp 0x100801cf
cmp dword [ebp + 0xc], 3
push ecx
lea esp, [esp + 4]
jne 0x1004b3d2
je 0x1008019a
push esi
cmc
lea ecx, reloc.KERNEL32.dll_VirtualAlloc
jmp 0x100801ee
lea esp, [esp + 4]
jmp 0x1004b3d2
push edi
mov ecx, eax
mov dx, 0x83f8
sub esp, 0x11
jmp 0x10080249
movzx edx, byte [ecx + 1]
shl edx, 8
or eax, edx
jmp 0x1004b415
mov esi, eax
mov edx, ebp
neg dx
bswap edx
jmp 0x10080259
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x10080218
lea esp, [esp + 1]
lea esp, [esp + 0x10]
push 0x3f
mov dx, bp
pushfd
jmp 0x1008022e
shr ecx, 0x12
neg edx
lea esp, [esp + 4]
pop edx
jmp 0x10080269
shr esi, 0xc
clc
jmp 0x1008047b
and ecx, edx
and esi, edx
call fcn.100802cb
Function at 0x1007e321
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push edi
jmp 0x1007e528
mov ch, 0x70
jmp 0x1007e41c
call 0x1007e1e1
lea esp, [esp + 4]
dec dword [ebp - 4]
call 0x1007d8b9
popfd
push word [esp]
lea esp, [esp + 2]
jmp 0x1007e1ea
mov word [esp + 1], bp
jmp 0x1007e204
lea eax, reloc.KERNEL32.dll_VirtualAlloc
jmp 0x1007d8a7
lea esp, [esp + 4]
test ecx, ecx
jmp 0x1007e23d
lea esp, [esp + 4]
mov dword [ebx], ecx
pop ecx
pop ebx
mov ax, 0x2001
setge ah
jmp 0x1007e19d
jne 0x1007e314
je 0x1004af1b
pushfd
lea esp, [esp + 4]
mov byte [eax], 0
call fcn.1007e1df
mov edx, dword [esp]
jmp 0x1007e35a
mov eax, esi
call 0x1007e37e
jmp 0x1007e3cb
mov edx, eax
xchg ah, al
mov ax, 0xd0ff
xchg al, ah
bswap eax
jmp 0x1007e344
pop ecx
mov dword [ebp - 8], eax
stc
jmp 0x1007e3b2
test edx, edx
jmp 0x1007e3d6
and al, 2
pop ecx
mov ecx, 0xea234eaf
jmp 0x1007e38d
jbe 0x1004b055
ja 0x1007e4ab
retf
mov dword [ebp - 4], edx
jmp 0x1004b09a
sub ebx, eax
xchg cl, al
lea eax, [edx*4]
mov eax, dword [esp]
jmp 0x1007e3f6
push dword [ebp + 0xc]
rdtsc
lea ecx, [esi*4]
jmp 0x1007e477
lea esi, reloc.KERNEL32.dll_VirtualAlloc
mov eax, edi
mov ecx, 0x48c29241
mov ch, bh
lea ecx, [ebx*4]
jmp 0x1007e40c
mov ecx, dword [edx]
pop edx
mov ah, byte [esp]
mov ax, 0xdfc8
not al
jmp 0x1007e482
cpuid
rdtsc
mov dword [esp + 0x14], edi
call fcn.1007e4fa
movsb byte es:[edi], byte [esi]
and dh, byte [eax - 0x1c62dd29]
sbb dh, byte [ebp + 0x64]
push edx
mov edx, ebp
add edx, 0xfffffff8
jmp 0x1007e452
push dword [ebx + edi]
lea eax, [edi*4]
setnp al
pushal
mov eax, 0x3c04e353
jmp 0x1007e460
lea edi, reloc.KERNEL32.dll_VirtualAlloc
and cl, cl
neg esi
rcr esi, 0x18
jmp 0x1007e439
mov edx, dword [ebp - 0xc]
mov ecx, dword [esp]
jmp 0x1007e54e
mov eax, dword [ebp + 8]
lea esp, [esp + 8]
lea ecx, reloc.KERNEL32.dll_VirtualAlloc
jmp 0x1007e668
lea eax, reloc.KERNEL32.dll_VirtualAlloc
call 0x1007e5c0
lcall 0x38be, 0xaff980a
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0xccfd4208
pop edi
cmpsb byte [esi], byte es:[edi]
shl dword [eax - 1], 1
je 0x1007e5c0
pushal
push dword [esp + 0xe]
push cs
lea esp, [esp + 0x24]
mov dword [ebp - 4], 0x208
jmp 0x1007e57b
mov byte [esp], bh
lea esp, [esp + 4]
pop ebx
jmp 0x1004b080
call fcn.10067d81
pop edi
pop esi
jmp 0x1007e598

Function at 0x1007e3ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea esp, [esp + 0x28]
popal
call 0x1007e374
mov dword [esp + 0x20], esi
pushal
jmp 0x1007e3a7

Function at 0x10100010
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
pushal
jmp 0x10100071
sub esp, 0x1e
inc al
setp al
bswap ecx
mov bp, 0xa6da
mov bh, 0x49
jmp 0x10100055
dec cx
xchg word [esp + 0xf], bp
mov eax, dword [esp + 0xe]
rdtsc
rdtsc
mov dword [esp + 0x18], eax
jmp 0x1010003f
setbe bl
shl bp, 1
cmc
not dl
rcl eax, cl
bsr edi, esi
jmp 0x1010001b
Function at 0x101008b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bp
mov edx, esp
xchg bl, cl
push si
rdtsc
lea edi, [esp + esi]
jmp 0x10100847
lea edi, [edx*4]
cld
mov edi, edx
mov ebx, 0xa4bd2c87
lea esp, [esp + 8]
mov byte [esp + 5], bl
jmp 0x101007f0
mov edx, dword [esp + 0x18]
btc eax, eax
mov bp, 0x1fed
bsf bx, si
mov word [esp + 0x10], di
pop dword [esp + 0xa]
jmp 0x10100806
push word [esp + 3]
dec edi
add esp, 9
mov edx, esi
sub esp, 5
xchg ebp, edx
jmp 0x10100884
cpuid
mov eax, esp
xchg ah, dl
pop word [esp + 0x14]
xchg cx, dx
cld
jmp 0x1010082d
mov byte [esp + 1], bl
bsf ebp, ebp
lea eax, reloc.KERNEL32.dll_VirtualAlloc
cpuid
cmc
jmp 0x101008c8
mov ax, bx
mov ebp, 0x5f4ad691
mov ecx, esi
add ecx, 0xf2dd3d4f
pop word [esp + 6]
pop dword [esp]
jmp 0x1010086e
jmp 0x1010085d
add esp, 0x13
or ebx, 0xa9f61641
mov byte [esp], dh
lea edx, [eax + edx]
jmp 0x10100b68
lea esp, [esp + 2]
xchg dl, ah
bsr cx, dx
sub esp, 0x11
lea ebp, [edx*4]
xchg dword [esp + 0xc], eax
jmp 0x101008b2
xchg esi, edx
mov si, 0x1790
mov si, bx
sub esp, 6
push sp
jmp 0x1010094d
xchg edi, esi
xor ebp, ebp
mov cl, byte [esp + 2]
xchg ebp, eax
std
lea edx, [edx*4]
jmp 0x101008fe
xchg word [esp + 1], cx
xchg word [esp], ax
lea esp, [esp]
pop si
bsr edi, ebp
mov dh, 0x67
jmp 0x10100914
lea ecx, [ecx + ecx]
push dword [esp + 8]
sub esp, 0x19
cpuid
xchg word [esp + 0xd], di
lea ebp, reloc.KERNEL32.dll_VirtualAlloc
jmp 0x101009a4
pushfd
mov byte [esp + 1], dl
xchg byte [esp + 1], bl
bsf si, bx
setle ch
cpuid
jmp 0x10100938
bswap esi
mov ecx, dword [esp + 0x27]
add esp, 0x1c
rdtsc
mov byte [esp + 2], dh
mov byte [esp + 9], bh
call fcn.101009bc
inc eax
rol dword [ebx + 0x26], cl
aad 0x30
invalid
mov esi, dword [esp + 0xa]
cpuid
mov bx, word [esp + 0x19]
bt ebp, esp
mov bx, word [esp + 0x24]
ror ebx, 0x1c
jmp 0x1010097e
mov dl, byte [esp]
bswap edi
mov ebp, 0x3440607e
rcr edi, 7
lea ecx, [ecx + edi]
mov cl, 0x9e
jmp 0x1010096a
lea esp, [esp]
xchg byte [esp], ch
lea edx, reloc.KERNEL32.dll_VirtualAlloc
not cx
seto ch
lea eax, [eax*4]
jmp 0x101009e3

Function at 0x10103bd8
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.10102ac1
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x10103bb2
lea esp, [esp + 0x18]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x10103b77
push eax
jmp 0x10102abc
mov byte [esp], ah
push word [esp + 2]
push word [esp + 2]
mov dword [esp + 0x18], edi
jmp 0x10103ba3
Function at 0x10070a80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10174202
call fcn.1006b4e9
mov dword [ebp - 8], 0
xor eax, eax
mov ecx, dword [ebp + 0x18]
add ecx, dword [ebp + 0x10]
setb al
neg eax
or eax, ecx
push eax
call fcn.100683e3
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10070ad5
or eax, 0xffffffff
jmp 0x10070b65
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.1006b228
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp + 0x18]
push edx
call fcn.1006b228
add esp, 0xc
mov esi, esp
push 0
mov eax, dword [ebp + 0x18]
add eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp esi, esp
call fcn.1006a512
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x10070b56
mov esi, esp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, esp
call fcn.1006a512
push eax
push str.send
push str.Socket_error:__s___d_n
push 2
call fcn.10069d01
add esp, 4
push eax
call fcn.1006a4fe
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
call fcn.1006a23d
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1006a512
mov esp, ebp
pop ebp
ret
Function at 0x1010cda0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10068988
mov eax, dword [0x1017002c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10171a20]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x1010cf78
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x1010cec7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x1010cec7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x1010cea5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x1010ce29
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1010cf31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x1010cf98
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x1010cf73
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1010cf98
jmp 0x1010ce02
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069676
mov esp, ebp
pop ebp
ret
Function at 0x1010d030
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10068988
mov eax, dword [0x1017002c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10171a20]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x1010d21b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x1010d166
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x1010d166
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x1010d142
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x1010d0b9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1010d1d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1010d23b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x1010d216
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x1010d23b
jmp 0x1010d092
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069676
mov esp, ebp
pop ebp
ret
Function at 0x100366e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e348
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004e2d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004e28c]
cmp eax, 0xffffffff
jne 0x10036716
xor ebx, ebx
jmp 0x1003671f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003675f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003679e
test esi, esi
jne 0x100367a2
push 0x10035270
push 0x1004fad8
call fcn.10008030
mov eax, dword [0x1004e28c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003675f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003678c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003678c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100367e4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x100367cd
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x100367a2
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036730
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10036809
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x10036809
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10008030
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100367f0
jmp 0x10036730
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219