joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48891c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48894a
mov eax, ebx
call fcn.004893d0
cmp dword [ebx + 0x40], 0
je 0x488943
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4889bb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4889ad
cmp dword [ebx + 8], 0
je 0x48896c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48897e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4889ad
cmp dword [ebx + 8], 0
je 0x48895f
cmp eax, 3
je 0x488991
dec eax
jne 0x48895f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48895f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48895f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4889d9
cmp dword [ebx + 0x14], 0xcc
je 0x4889d9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004889e4
pop ebx
ret

Function at 0x499230
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x334], 0
mov eax, dword [0x49ccf4]
mov eax, dword [eax]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, ebx
call fcn.00454d8c
push 5
push 0x499274
push 0x499274
push 0x499278
push 0x4992b4
mov eax, ebx
call fcn.0043ef18
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret

Function at 0x4992c4
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x334], 0
mov eax, dword [0x49ccf4]
mov eax, dword [eax]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, ebx
call fcn.00454d8c
push 5
push 0x499308
push 0x499308
push 0x49930c
push 0x499324
mov eax, ebx
call fcn.0043ef18
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
Function at 0x401f60
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x4035c8
call fcn.00402134
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x401f9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401f9d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401fb5
cmp eax, 0x20b
je 0x401fa2
mov dword [ebp - 0x1c], ebx
jmp 0x401fc9
cmp dword [ecx + 0x84], 0xe
jbe 0x401f9d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x401fc3
cmp dword [ecx + 0x74], 0xe
jbe 0x401f9d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x4042a0], 0xffffffff
or dword [0x4042a4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x404294]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x404290]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40429c], eax
call fcn.0040219c
cmp dword [0x4041b0], ebx
jne 0x402024
push fcn.0040219c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040218a
push 0x403240
push 0x40323c
call sub.msvcrt.dll__initterm
mov eax, dword [0x40428c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x404288]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x403238
push 0x40322c
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x4020ba
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40208e
cmp al, 0x22
jne 0x402080
cmp byte [esi], 0x22
jne 0x402097
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x4020a1
cmp al, 0x20
jbe 0x402093
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x4020c5
movzx eax, word [ebp - 0x48]
jmp 0x4020c8
cmp byte [esi], 0x20
jbe 0x402097
inc esi
mov dword [ebp - 0x34], esi
jmp 0x4020ba
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x4020e5
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x40211a
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040216d
ret
Function at 0x1001bf8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
and dword [edi], 0
push dword [ebp + 8]
and byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x1001c66
cmp word [ebx + 8], 2
jne 0x1001c4e
cmp word [ebx + 0xa], 4
jne 0x1001c4e
mov esi, dword [ebx + 0xc]
jmp 0x1001c48
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01001b95
test eax, eax
mov dword [edi], eax
je 0x1001c61
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x1001c2c
mov ecx, dword [ebx]
mov edx, dword [ebp + 0x18]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x1001c53
xor eax, eax
jmp 0x1001c8c
push 8
pop eax
jmp 0x1001c8c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x1001c8c
dec ecx
je 0x1001c87
dec ecx
je 0x1001c80
dec ecx
jmp 0x1001c8c
mov eax, 0x2afb
jmp 0x1001c8c
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x100225d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
cmp dword [0x1009b38], 0
mov dword [ebp - 0x18], 0x10011ac
mov dword [ebp - 0x14], 0x1001e2f
mov dword [ebp - 0x10], 0x10011a0
mov dword [ebp - 0xc], 0x10020a9
mov dword [ebp - 8], 0x1001190
mov dword [ebp - 4], fcn.01001df6
jne 0x10023b9
push 0x104
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10023af
xor eax, eax
mov cl, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x10022b9
push ebx
push esi
push edi
lea edi, [ebp - 0x124]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10022d6
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, 0x1001188
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x124]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x1002317
push 0x10011ac
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002313
push esi
call dword [entry0]
xor esi, esi
test esi, esi
jne 0x100236e
xor eax, eax
mov cl, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x1002319
lea edi, [ebp - 0x124]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002333
mov esi, 0x1001180
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x124]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x10023ac
push 0x10011ac
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100236a
push esi
call dword [entry0]
xor esi, esi
test esi, esi
je 0x10023ac
xor edi, edi
push dword [ebp + edi*8 - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + edi*8 - 0x14], eax
je 0x100238b
inc edi
cmp edi, 3
jl 0x1002370
jmp 0x1002394
push esi
call dword [entry0]
xor esi, esi
test esi, esi
je 0x10023ac
xor eax, eax
mov ecx, dword [ebp + eax - 0x14]
mov dword [eax + 0x1008008], ecx
add eax, 8
cmp eax, 0x18
jl 0x100239a
pop edi
pop esi
pop ebx
mov dword [0x1009b38], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x1008008]
leave
ret 4

Function at 0x1002597
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
lea ecx, [eax - 1]
mov eax, dword [ebp + 0x10]
cmp eax, ecx
mov ecx, dword [ebp + 8]
jne 0x10025b4
push dword [ecx + eax*4]
push 0x2711
jmp 0x10025df
push esi
lea esi, [ecx + eax*4]
push 0
lea eax, [ebp + 8]
push eax
push dword [esi + 4]
call fcn.010030ff
add esp, 0xc
cmp eax, dword [ebp + 0x14]
jb 0x10025d8
cmp eax, dword [ebp + 0x18]
ja 0x10025d8
pop esi
pop ebp
ret 0x14
push dword [esi]
push 0x2712
push 1
call fcn.01006d2e
add esp, 0xc
push 1
call fcn.01003383
int3
Function at 0x10033c3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x1008030]
je 0x10033e3
inc eax
cmp eax, 0x12
jb 0x10033d4
shl eax, 3
cmp edx, dword [eax + 0x1008030]
mov dword [ebp + 8], eax
jne 0x1003581
mov ecx, dword [0x1009b4c]
cmp ecx, 1
je 0x1003556
test ecx, ecx
jne 0x1003415
cmp dword [0x1008020], 1
je 0x1003556
cmp edx, 0xfc
je 0x1003581
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1003450
push 5
pop ecx
mov esi, 0x100154c
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100345f
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x1003497
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003477
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1001548
push ebx
call fcn.010050c0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100349c
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1008034]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10034b3
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01003db0
mov edx, esp
push 6
pop ecx
mov esi, 0x100152c
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10034df
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10034eb
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003504
mov eax, dword [ebp + 8]
mov esi, 0x1001528
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x1008034]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100351f
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100352b
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1001500
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.01004fbf
add esp, 0xc
jmp 0x1003581
mov ecx, dword [eax + 0x1008034]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003561
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004fbf
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1009cbc], ebx
push esi
push edi
jne 0x100503f
push 0x1001a50
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100507a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001a44
push edi
call esi
test eax, eax
mov dword [0x1009cbc], eax
je 0x100507a
push 0x1001a34
push edi
call esi
push 0x1001a20
push edi
mov dword [0x1009cc0], eax
call esi
cmp dword [0x1009b5c], 2
mov dword [0x1009cc4], eax
jne 0x100503f
push 0x1001a04
push edi
call esi
test eax, eax
mov dword [0x1009ccc], eax
je 0x100503f
push 0x10019ec
push edi
call esi
mov dword [0x1009cc8], eax
mov eax, dword [0x1009cc8]
test eax, eax
je 0x1005084
call eax
test eax, eax
je 0x100506b
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1009ccc]
test eax, eax
je 0x100506b
test byte [ebp - 8], 1
jne 0x1005084
cmp dword [0x1009b68], 4
jb 0x100507e
or byte [ebp + 0x12], 0x20
jmp 0x10050a3
xor eax, eax
jmp 0x10050b3
or byte [ebp + 0x12], 4
jmp 0x10050a3
mov eax, dword [0x1009cc0]
test eax, eax
je 0x10050a3
call eax
mov ebx, eax
test ebx, ebx
je 0x10050a3
mov eax, dword [0x1009cc4]
test eax, eax
je 0x10050a3
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1009cbc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005c73
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x100afc4]
push ebx
push esi
push edi
jae 0x1005df8
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x100afe0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x14], ebx
je 0x1005df8
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
jne 0x1005cc7
xor eax, eax
jmp 0x1005e0c
test al, 0x20
je 0x1005cd8
push 2
push edi
push edi
push ecx
call fcn.010068d6
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1005d94
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jbe 0x1005dcc
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x418]
cmp ecx, dword [ebp + 0x10]
jae 0x1005d2e
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1005d1f
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x14]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x1005d04
mov edi, eax
lea eax, [ebp - 0x418]
sub edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1005d6e
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp eax, edi
jl 0x1005d77
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x1005cf8
jmp 0x1005d79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x1005df3
cmp dword [ebp + 8], edi
je 0x1005dcc
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x1005dc1
mov dword [0x1009b54], eax
jmp 0x1005dff
push edi
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1005db6
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], edi
mov dword [ebp - 8], eax
jmp 0x1005d79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x1005d79
push dword [ebp + 8]
call fcn.010067c1
pop ecx
jmp 0x1005e09
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1005de1
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x1005cc0
mov dword [0x1009b50], 0x1c
mov dword [0x1009b54], edi
jmp 0x1005e09
sub eax, dword [ebp - 0x10]
jmp 0x1005e0c
and dword [0x1009b54], 0
mov dword [0x1009b50], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10066f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.01003db0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006785
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x1009b5c]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x1006785
cmp eax, 1
je 0x100679d
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006785
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x100675a
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x1006781
xor eax, eax
inc eax
jmp 0x10067b9
cmp esi, ebx
jae 0x1006789
xor eax, eax
jmp 0x10067b9
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1009b5c]
jmp 0x100679f
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076d78
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1009f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x10094090]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x22381432
mov dword [ebp - 0x28], 0x25322339
mov byte [ebp - 0x24], 0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x17
jb 0x100017c4
mov byte [ebp - 0x24], 0
mov cl, 0x2e
mov dword [ebp - 0x1c], 0x5c4b452e
xor eax, eax
mov dword [ebp - 0x18], 0x1d424b40
mov dword [ebp - 0x14], 0x424a001c
mov word [ebp - 0x10], 0x42
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xc
jae 0x10001803
mov cl, byte [ebp - 0x1c]
jmp 0x100017f4
lea eax, [ebp - 0x3b]
mov byte [ebp - 0xf], 0
push eax
lea eax, [ebp - 0x1b]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10015810
cmp al, 0xe9
jne 0x100018ad
movaps xmm0, xmmword [0x10093f90]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x20
nop
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10001840
cmp byte [ebp - 0x1f], 0
mov byte [ebp - 0xf], 0
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
jne 0x1000186d
xor ecx, ecx
jmp 0x1000187c
lea ecx, [ebp - 0x1f]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001873
sub ecx, edx
push ecx
lea eax, [ebp - 0x1f]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100028b0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.10019090
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x100018ad
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.10002790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100018c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076da8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1009f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov cl, 0x57
mov dword [ebp - 0x1c], 0x3a3e2357
mov dword [ebp - 0x18], 0x23321032
xor eax, eax
mov dword [ebp - 0x14], 0x323a3e03
mov byte [ebp - 0x10], 0
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xb
jae 0x10001911
mov cl, byte [ebp - 0x1c]
jmp 0x10001902
mov byte [ebp - 0x10], 0
mov cl, 0x26
mov dword [ebp - 0x34], 0x54434d26
xor eax, eax
mov dword [ebp - 0x30], 0x154a4348
mov dword [ebp - 0x2c], 0x4a420814
mov word [ebp - 0x28], 0x4a
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 0xc
jae 0x10001943
mov cl, byte [ebp - 0x34]
jmp 0x10001934
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x27], 0
push eax
lea eax, [ebp - 0x33]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10015810
cmp al, 0xe9
jne 0x100019ed
movaps xmm0, xmmword [0x100941b0]
xor ecx, ecx
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x28], 0x37
nop
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x10
jb 0x10001980
cmp byte [ebp - 0x37], 0
mov byte [ebp - 0x27], 0
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
jne 0x100019ad
xor ecx, ecx
jmp 0x100019bc
lea ecx, [ebp - 0x37]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100019b3
sub ecx, edx
push ecx
lea eax, [ebp - 0x37]
push eax
lea ecx, [ebp - 0x24]
call fcn.100028b0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.10019090
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x100019ed
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.10002790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10001db0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009f084]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10093ce0]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x10001dd0
mov byte [ebp - 0x19], 0
mov cl, 0x1d
mov dword [ebp - 0x18], 0x4f58561d
xor eax, eax
mov dword [ebp - 0x14], 0x2e515853
mov dword [ebp - 0x10], 0x7179332f
mov word [ebp - 0xc], 0x71
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001e0f
mov cl, byte [ebp - 0x18]
jmp 0x10001e00
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], 0
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.1003bc25
mov esp, ebp
pop ebp
ret

Function at 0x10001e80
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
ret

Function at 0x10001e90
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10098220
push 0x10056540
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x1009f084]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001f29
xor al, al
jmp 0x10001fb2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001f54
xor al, al
jmp 0x10001fb2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001f9f
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003bc25
mov esp, ebp
pop ebp
ret