joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aa25
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.1000a69e
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1000a6d9
in al, 0xad
cmpsd dword [esi], dword es:[edi]
push edi
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1000a6e9
push eax
push esi
push dword [ebp + 8]
call fcn.1000a69e
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1000a6e9
push eax
push esi
push dword [ebp + 8]
call fcn.1000a69e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1000a6e9
push eax
push esi
push dword [ebp + 8]
call fcn.1000a69e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1000a6d9
fisub dword [ecx - 0x62771f0a]
jl 0x1000ab5e
invalid
invalid

Function at 0x1000ab8e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid

Function at 0x1000bb3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
invalid
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x1004005a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10040069
pop dword [ebp - 0x18]
mov eax, 0x8e5e3160
add eax, 0x81a5cf09
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x2cef034b
sub dword [ebp - 0x28], 0xde9cbe00
mov dword [ebp - 0x24], 0xd126e625
add dword [ebp - 0x24], 0x610c6620
mov dword [ebp - 0x20], 0x3652606c
add dword [ebp - 0x20], 0x15f9e3c2
mov dword [ebp - 0x1c], 0x86a43154
sub dword [ebp - 0x1c], 0x86a43154
lea eax, [ebp - 0x28]
push eax
mov eax, 0x82785899
add eax, 0x8d8ea873
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x1fb613d3
sub dword [ebp - 0x28], 0xab43aa7d
mov dword [ebp - 0x24], 0xb6ab9707
add dword [ebp - 0x24], 0x8ac0ca6e
mov dword [ebp - 0x20], 0xa4b810a8
add dword [ebp - 0x20], 0xbeb75bc4
mov dword [ebp - 0x1c], 0x32888cc4
add dword [ebp - 0x1c], 0xcd77733c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xaae4e1bf
add eax, 0x65221e81
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x66aa9
push 0
call eax
mov ecx, 0xcd2d8d6d
add ecx, 0x32d2b805
xor edx, edx
add edx, eax
mov ebx, 0x612eb9e1
add ebx, 0xaed9921f
add ebx, dword [ebp - 0x18]
mov esi, 0x38ded5f6
sub esi, 0x8d4d5c6f
xor dword [ebp - 8], ecx
mov edi, dword [ebx]
add dword [ebp - 0x10], 0xf70e543
add edi, esi
add dword [ebp - 0x14], ebx
mov dword [edx], edi
xor dword [ebp - 4], edi
add edx, 0xa39066a3
sub edx, 0xa390669f
add ebx, 0x4b98beb9
sub ebx, 0x4b98beb5
loop 0x1004018d
add eax, 0xbd6e058c
add eax, 0x4293030f
xor ebx, ebx
add ebx, eax
add eax, 0xbaa7845d
add eax, 0x45587ba8
mov ecx, 0x5bce4be8
add ecx, 0xb431b418
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x2580ff2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x2580ff3c
pop dword [ebp - 0x44]
mov eax, 0x8b5d15dd
add eax, 0x9a23e95f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xaa4a68f4
add dword [ebp - 0x54], 0xa407dc57
mov dword [ebp - 0x50], 0x11105a10
sub dword [ebp - 0x50], 0xdedd0dcb
mov dword [ebp - 0x4c], 0x5b95a87f
sub dword [ebp - 0x4c], 0xf496451
mov dword [ebp - 0x48], 0x858b800e
sub dword [ebp - 0x48], 0x858b800e
lea eax, [ebp - 0x54]
push eax
mov eax, 0x4e6ce09a
sub eax, 0x28eb1056
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3136940f
add dword [ebp - 0x54], 0x433bd547
mov dword [ebp - 0x50], 0xb68881c4
sub dword [ebp - 0x50], 0x751c204f
mov dword [ebp - 0x4c], 0xf7c7fb8a
sub dword [ebp - 0x4c], 0x94588f1e
mov dword [ebp - 0x48], 0x8b985e16
add dword [ebp - 0x48], 0x7467a1ea
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x44fe54ff
add eax, 0xe0837b81
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3d1c8
push 0
call eax
mov ecx, 0x8741e5e8
sub ecx, 0x87419bb0
mov edi, eax
mov ebx, 0x25829600
add ebx, dword [ebp - 0x44]
mov edx, 0x57211c02
add dword [ebp - 0x28], 0x73fcd445
mov esi, dword [ebx]
sub dword [ebp - 0x18], esi
sub esi, edx
add dword [ebp - 0x40], 0x817897fa
mov dword [edi], esi
xor dword [ebp - 0x28], edi
add edi, 0xe62cf01a
sub edi, 0xe62cf016
add ebx, 0xe337b139
sub ebx, 0xe337b135
loop 0x25810052
add eax, 0xd2e1c32c
sub eax, 0xd2e0a779
mov ebx, eax
add eax, 0xa06526ba
sub eax, 0xa06526b5
mov ecx, 0xc9feddda
sub ecx, 0xa47eddda
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10008c60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1016f070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x22c]
push 0x228
push 0
push eax
mov esi, ecx
call fcn.100f2c30
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10008cdf
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10008cbd
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100f5c64
add esp, 8
test eax, eax
je 0x10008cfb
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
jne 0x10008cb3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100da624
mov esp, ebp
pop ebp
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100da624
mov esp, ebp
pop ebp
ret 4
Function at 0x10010ee0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119fa2
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x1016f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x81c], esi
mov eax, edi
mov dword [ebp - 0x814], 0
cmp dword [edi + 0x14], 8
jb 0x10010f32
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebx, eax
test ebx, ebx
jne 0x10010f49
cmp dword [edi + 0x14], 8
mov ebx, edi
jb 0x10010f49
mov ebx, dword [edi]
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.100f2c30
mov eax, dword [edi + 0x10]
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x10010f6a
mov edi, dword [edi]
push eax
push edi
lea eax, [ebp - 0x810]
push 0x3ff
push eax
call fcn.100f5bd6
add esp, 0x10
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.MxStart.exe
push ebx
call fcn.100f5c64
add esp, 8
test eax, eax
jne 0x10011005
push 0x10145124
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001108f
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x810]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010fe2
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10004bf0
jmp 0x100110af
push str.TSBrowserLauncher.exe
push ebx
call fcn.100f5c64
add esp, 8
test eax, eax
jne 0x1001104a
push str.TSBrowser.exe
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001108f
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10004b20
jmp 0x100110af
push str.DCBrowserLauncher.exe
push ebx
call fcn.100f5c64
add esp, 8
test eax, eax
jne 0x1001108f
push str.DCBrowser.exe
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001108f
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10004b20
jmp 0x100110af
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x10143c14
mov word [esi], ax
call fcn.10004bf0
mov dword [ebp - 4], 0
mov dword [ebp - 0x814], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100da624
mov esp, ebp
pop ebp
ret
Function at 0x10014ad0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011a5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1016f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
test edi, edi
je 0x10014c62
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x80]
test eax, eax
je 0x10014c62
cmp dword [eax + edi], 0
lea ebx, [eax + edi]
je 0x10014c62
nop word [eax + eax]
mov esi, dword [ebx + 0xc]
push 0x10146124
add esi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x10146124
push esi
call fcn.101046dd
add esp, 0xc
test eax, eax
jne 0x10014c56
mov esi, dword [ebx]
add esi, edi
mov eax, dword [esi]
test eax, eax
je 0x10014c56
js 0x10014c48
mov ecx, 0x10146164
cmp ecx, 0x80000000
jae 0x10014c48
add eax, 2
mov dword [ebp - 0x18], 0
add edi, eax
mov dword [ebp - 0x14], 0
mov eax, edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014ba6
sub eax, edx
lea ecx, [ebp - 0x28]
push eax
push edi
call fcn.10011ff0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0x10146164
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100ff59e
add esp, 8
test eax, eax
jne 0x10014bf8
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x40
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10014c80
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10014c33
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10014c29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10014cde
push edx
push ecx
call fcn.100da665
add esp, 8
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x10014b65
add ebx, 0x14
cmp dword [ebx], 0
jne 0x10014b30
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100da624
mov esp, ebp
pop ebp
ret
push str.kernel23
push dword [ebp - 0x18]
push edi
call fcn.100f8635
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10014cc8
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10014cbe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10014cde
push edx
push ecx
call fcn.100da665
add esp, 8
mov dword [ebp - 0x18], 0
mov al, 1
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
jmp 0x10014c64
call fcn.100f5ab9
int3
Function at 0x100197d0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011ae72
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x1016f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x424], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x42c], str._programfiles_x86__Internet_Exploreriexplore.exe
mov dword [ebp - 0x428], str._programfiles_Internet_Exploreriexplore.exe
nop dword [eax]
nop dword [eax + eax]
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100f2c30
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x208
push eax
push dword [ebp + esi*4 - 0x42c]
call ebx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100198a5
inc esi
cmp esi, 2
jb 0x10019860
jmp 0x100198ce
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100198b0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.10004bf0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100da624
mov esp, ebp
pop ebp
ret 4
Function at 0x10028b00
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011d389
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x1016f070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x34], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0
test eax, eax
jne 0x10028b72
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], edx
mov dword [ebp - 0x38], 1
jmp 0x10028d1a
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
mov dword [ebp - 4], 1
push eax
push 1
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], ecx
push 2
push eax
call fcn.100f9460
add esp, 0x10
cmp eax, 1
jne 0x10028ccf
movzx eax, word [ebp - 0x30]
inc eax
cmp byte [ebx + 8], 0
je 0x10028c2e
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100dabf9
movzx ecx, word [ebp - 0x30]
mov edi, eax
push dword [ebp - 0x34]
xor eax, eax
mov word [edi + ecx*2], ax
movzx ecx, word [ebp - 0x30]
push ecx
push 2
push edi
call fcn.100f9460
movzx ecx, word [ebp - 0x30]
add esp, 0x14
cmp eax, ecx
jne 0x10028cc2
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10028c10
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x2c]
call fcn.10004bf0
jmp 0x10028cc2
push eax
call fcn.100dabf9
movzx ecx, word [ebp - 0x30]
mov edi, eax
push dword [ebp - 0x34]
mov byte [ecx + edi], 0
movzx ecx, word [ebp - 0x30]
push ecx
push 1
push edi
call fcn.100f9460
movzx ecx, word [ebp - 0x30]
add esp, 0x14
cmp eax, ecx
jne 0x10028cc2
mov edx, edi
lea ecx, [ebp - 0x54]
call fcn.1009aed0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push eax
call fcn.1000c390
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x40]
cmp edx, 8
jb 0x10028cae
mov ecx, dword [ebp - 0x54]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10028ca4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10028d3a
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
test edi, edi
je 0x10028ccf
push edi
call fcn.100da696
add esp, 4
movups xmm0, xmmword [ebp - 0x2c]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x2c], ax
movq xmm0, qword [ebp - 0x1c]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100da624
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100f5ab9
int3
Function at 0x100409a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
mov bh, byte [ecx + 0x100]
push ebp
mov ebp, dword [esp + 0x10]
push edi
xor edi, edi
mov dword [esp + 0xc], edx
mov dl, byte [ecx + 0x101]
test ebp, ebp
je 0x100409f9
push esi
nop
inc bh
movzx esi, bh
mov bl, byte [esi + ecx]
add dl, bl
mov byte [esp + 0x18], dl
movzx edx, dl
movzx eax, byte [edx + ecx]
mov byte [esi + ecx], al
mov byte [edx + ecx], bl
movzx eax, byte [esi + ecx]
mov edx, dword [esp + 0x10]
add al, bl
movzx eax, al
movzx eax, byte [eax + ecx]
xor byte [edi + edx], al
inc edi
mov dl, byte [esp + 0x18]
cmp edi, ebp
jb 0x100409c0
pop esi
pop edi
pop ebp
mov byte [ecx + 0x101], bh
mov byte [ecx + 0x100], bh
pop ebx
pop ecx
ret
Function at 0x10046750
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10121527
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1016f070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov byte [edi], 0
call fcn.100da635
add esp, 4
mov dword [edi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
lea esi, [edi + 8]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100481b0
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100481b0
mov dword [esi], eax
mov byte [ebp - 4], 6
xor eax, eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov byte [ebp - 4], 7
lea ecx, [edi + 0x38]
call fcn.1002c910
mov byte [ebp - 4], 8
lea eax, [edi + 0xb8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], cl
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [edi + 0x100], ecx
mov dword [edi + 0x104], 7
mov word [edi + 0xf0], ax
mov byte [ebp - 4], 0xb
mov dword [edi + 0x118], eax
mov dword [edi + 0x11c], 0xf
mov byte [edi + 0x108], al
mov byte [ebp - 4], 0xc
mov dword [edi + 0x130], eax
mov dword [edi + 0x134], 0xf
mov byte [edi + 0x120], al
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004bee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10122318
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1016f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.100fb245
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x1004c004
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x34], edx
call fcn.10047da0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x1004bf88
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1004bff4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004bfea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c020
jmp 0x1004bfea
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1004bf4b
test esi, esi
je 0x1004bf4b
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 8
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1004bf4b
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100da624
mov esp, ebp
pop ebp
ret 4
call fcn.100f5ab9
int3
Function at 0x10053810
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101231b3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1016f070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.100481b0
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10057a00
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10057970
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10057a00
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100122b0
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100578e0
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100578e0
mov dword [esi], eax
mov byte [ebp - 4], 0x14
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.100578e0
mov dword [esi], eax
mov byte [ebp - 4], 0x17
lea eax, [edi + 0x40]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x18
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], cl
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [edi + 0x88], ecx
mov dword [edi + 0x8c], 7
mov word [edi + 0x78], ax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret