joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12beb71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x12beddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x12beddd
mov eax, 1
test eax, eax
je 0x12beddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x12beddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x12bedd3
mov ebx, eax
and eax, 0x80000000
jne 0x12bed4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x12beddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x12beddd
mov eax, 1
test eax, eax
je 0x12beddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x12beddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x12beca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x12beddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x12beb67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x12beddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x12beca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x12bee9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x12befee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x12befee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.012beff8
test eax, eax
je 0x12befee
add ebx, 0x28
dec ecx
jne 0x12befc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x12bf09e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x12bf0c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x12bf12e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x12bf0e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x12bf12e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x12bf105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x12bf12e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x12bf123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x12bf12e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x12bf16b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x12bf172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x12bf1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x12bf1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x12bfdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.012bff04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.012bff20
push edx
push dword [ebp + 0x10]
push eax
call fcn.012bfeec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.012bff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.012bfecb
push ecx
push dword [ebp + 8]
call fcn.012bff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.012bff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.012bfecb
push ecx
push dword [ebp + 8]
call fcn.012bff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.012bff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.012bfecb
push ecx
push dword [ebp + 8]
call fcn.012bff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.012bff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.012bfecb
cmp ecx, 0x2b
jne 0x12bfe0f
leave
ret 0xc

Function at 0x12c14b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x12c1544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x623810
push 0
call dword [eax + 0x20]
test eax, eax
je 0x12c15d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x623810
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x623810
call fcn.012c13fa
push 0x623810
push dword [ebp + 0xc]
call fcn.012bf1a8
test eax, eax
jne 0x12c15b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x623810
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.012c15dd
test eax, eax
je 0x12c15d6
jmp 0x12c1574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x12c15d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x12c160b
Capabilities:
Terminate process

Disassembly:
call fcn.012c1618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x91d040
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov word [esp], bx
jmp 0x91d033
lea esp, [esp + 2]
mov dword [esp + 4], esp
call fcn.0091d01b
push dword [esp + 1]
jmp 0x91d081
lea esp, [esp + 7]
pop word [esp]
lea esp, [esp + 1]
mov word [esp], di
jmp 0x91d1ab
jne 0x91d05b
lea esp, [esp + 7]
pop word [esp]
jmp 0x91d091
lea esp, [esp + 1]
mov word [esp], di
lea esp, [esp + 2]
jmp 0x91d1af
call fcn.0091d108
fist word [edx - 0x40]
cmpsd dword [esi], dword es:[edi]
push edx
out 0x43, eax
xlatb
inc edi
and dl, cl
imul ecx, edx, 0x65
xchg esp, eax
pop es
scasb al, byte es:[edi]
push word [esp + 1]
push esp
lea esp, [esp + 2]
xchg dword [esp + 8], ecx
jmp 0x91d123
lea esp, [esp + 2]
mov dword [esp + 4], esi
pushal
push dword [esp + 0x18]
jnp 0x91d0dc
mov word [esp + 0x10], ax
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x91d0c6

Function at 0x91d153
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], dx
mov byte [esp + 1], dh
jmp 0x91d187
mov edi, dword [esp + 0x30]
btc bp, sp
je 0x91d171
dec ah
mov ch, 0xef
cmc
jmp 0x91d1f1

Function at 0x91f9fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], eax
jmp 0x91f93a
call 0x91e2cc
jmp 0x91fa23
mov dword [esp + 0x24], eax
jmp 0x91f9b1
popal
popfd
lea esp, [esp + 4]
ret
call fcn.0091f904
lea esp, [esp + 4]
popal
movzx ebx, byte [edi]
pop edi
add ebx, 0xe1dee9cb
jmp 0x91f99e
cmp ebx, 0xe1deea97
je 0x91fa02
jne 0x91e292
jmp 0x91fa66
popal
inc dword [esp + 8]
jmp 0x91fa50
call 0x91f9fb
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
fsubr dword [edx + reloc.WINMM.dll_midiStreamOut]
adc byte [eax], 0x86
loope 0x91fa18
cmpsb byte [esi], byte es:[edi]
push ds
lea ebx, reloc.WINMM.dll_midiStreamOut
pop eax
sub eax, 0xbb6a92b9
jmp 0x91f9eb
push eax
call fcn.0090b575
jmp 0x91e2c7
pop ecx
sub ecx, 0x100169c8
mov dword [ecx + reloc.WINMM.dll_midiStreamOut], eax
jmp 0x91fa6c
popfd
ret
inc dword [esp + 8]
popfd
ret
movzx ebx, byte [eax]
add ebx, 0x3f4cdea1
jmp 0x91faa5
cmp ebx, 0x3f4cdf6d
dec esp
aas
je 0x91fb09
jne 0x91e2f2
lea ebp, [esp + 0x4b]
call fcn.0091fad9
jp 0x91faa9
jnp 0x91fade
in eax, dx
pop ebx
nop
or al, 0x82
in eax, 0x14
rcr byte [ecx], cl
mov ax, word [esp]
setl ah
push esi
mov si, 0x99ec
xchg esi, eax
push ebp
jmp 0x91fab3
sbb al, 0x24
xchg bp, ax
mov byte [esp + 2], al
mov ebp, dword [esp + 4]
jmp 0x91fb22
shr bl, 1
mov ebp, 0xe8243c89
and al, 0
add byte [eax], al
mov dword [esp], edi
call fcn.0091fb38
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
xchg byte [eax - 0x3e], al
push eax
aaa
ret 0x377
mov eax, 0x1638f106
mov si, dx
mov esi, dword [esp + 8]
mov ax, 0x813d
mov al, byte [esp]
push ebp
jmp 0x91fb0c
Function at 0x91fd09
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x91fcea
mov dword [esp + 0x24], eax
jmp 0x91fdff
lea eax, [ebx*4]
mov edx, esp
mov edx, dword [esp + 9]
call fcn.0091fc17
mov dh, bl
rdtsc
lea edx, [ecx + edx]
xchg dl, al
lea edx, [esi*4]
lea eax, [edi + ebp]
jmp 0x91fc2f
mov cx, 0xe78f
setge ch
mov ecx, dword [esp]
push eax
lea esp, [esp + 8]
jmp 0x91fe52
or cl, ch
push esp
add dword [eax], eax
add byte [edi + 0x2f79002], dl
rol dword [ebx - 6], 0xd5
inc esp
test dword [edx - reloc.WINMM.dll_midiStreamOut], 0x310f2e04
mov al, dh
mov dh, dl
lea eax, [esi + ebp]
rdtsc
mov esi, dword [esp + 4]
jmp 0x91fcd2
push si
call fcn.0091fd18
cmp ebx, 0x4c07035c
je 0x91fd9b
jne 0x91e3f0
sti
push ss
mov dword [reloc.WINMM.dll_midiStreamOut], eax
xchg ebx, eax
push dword [esp + 3]
jmp 0x91fd2e
mov bh, 0xa8
js 0x91fd55
adc al, 0x10
mov byte [esi], bl
jns 0x91fcf8
cmp al, 0xbe
and eax, 0xeb2fdcb5
aam 0x47
jnp 0x91fd66
fdivr dword [ebx]
popal
pushal
setnp bl
popal
call 0x91fd5d
sub ecx, 0x10016ac3
mov dword [ecx + reloc.WINMM.dll_midiStreamOut], eax
movzx ebx, byte [eax]
add ebx, 0x4c070290
jmp 0x91fd37

Function at 0x9ffd0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0x86
setbe al
jmp 0x9ffd58
pop word [esp + 1]
setbe bh
add esp, 0x12
xchg al, cl
mov bh, byte [esp]
xchg dx, bp
jmp 0x9ffdd2
mov ebp, dword [esp]
xchg word [esp], bx
ror edi, 0x15
add esp, 0
xchg edx, esi
neg cl
jmp 0x9ffe05
cpuid
lea edx, [ebp*4]
xchg bh, al
lea edx, reloc.WINMM.dll_midiStreamOut
lea edx, [eax*4]
cpuid
jmp 0x9ffd87
mov byte [esp], dh
mov ah, al
mov esi, dword [esp]
neg bp
mov dh, 5
lea ecx, [edx*4]
jmp 0x9ffda1
lea esi, [eax + eax]
mov ebx, eax
neg ecx
mov bp, word [esp]
add esp, 0
xchg ah, al
jmp 0x9ffe2f
mov cl, dl
neg bx
xchg bh, al
lea eax, [ebp*4]
xchg ebx, edx
cmp ah, al
jmp 0x9ffde8
bswap edx
sete bh
not bx
bt ebp, ebp
mov ch, byte [esp]
not edx
jmp 0x9fffc2
mov di, word [esp]
xchg word [esp], bp
lea esp, [esp]
add esp, 1
inc esi
mov ebp, 0x17a3478c
jmp 0x9ffe19
bsf bp, bp
cld
shl di, cl
mov byte [esp + 1], cl
xchg si, bx
bt di, ax
jmp 0x9ffe61
setae cl
xchg word [esp + 3], ax
push bp
lea edx, [ebx + 0xd6]
bswap ebx
lea edi, [edi*4]
jmp 0x9ffe78
rdtsc
mov eax, dword [esp]
xchg edx, eax
sub esp, 0xd
not bx
pop dword [esp]
jmp 0x9ffeaf
lea edi, [ebp + ebp]
add esp, 0
xchg edi, edx
mov ax, 0x3060
neg dx
xchg byte [esp], dl
jmp 0x9ffef5

Function at 0xa001a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
shl bx, 0xa
mov bx, word [esp + 0xc]
mov bh, 0xfd
xchg dword [esp], edx
jmp 0xa007da
push dword [esp + 1]
cpuid
bsf ebp, ebp
mov byte [esp + 6], al
jmp 0xa00255
setnp bl
not ch
mov bh, byte [esp]
xchg word [esp + 1], ax
bsr cx, cx
xchg dword [esp], edi
jmp 0xa00213
lea edx, reloc.WINMM.dll_midiStreamOut
lea eax, [eax + 0x54]
pop cx
xchg word [esp], di
xchg bl, cl
mov dword [esp], ebx
and dl, dl
xchg word [esp], dx
bsf di, bp
jmp 0xa00229
add esp, 9
mov bx, di
xchg byte [esp + 2], ch
xchg esi, ebp
xchg bp, bx
add esp, 0
jmp 0xa005be
Function at 0xa04cfb
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
call fcn.00a04042
mov dword [esp + 0xb], ebx
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0xa04d35
mov eax, dword [eax + 0x1c]
jmp 0xa04e78
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xa04d1f
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xa0403d

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x409986
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409986
lcall 0x5de5, 0x8b10c483
jmp fcn.00781ad0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100080e8]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100080f8], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x10008108]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10003e87
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x10008108], 0
call fcn.10001a30
mov ecx, dword [0x10008104]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10003e87
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x10008104], 0
mov dword [0x100080f8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100080fc], 0
je 0x10002679
mov eax, dword [0x100080fc]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.100037c9
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10003e87
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100080fc], eax
mov dword [0x10008100], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10008104]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10008104], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10003580
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10003603
push esi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
push eax
push 0x100063e4
push str.CONOUT_
call esi
push 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push 0x100063f0
push str.CONIN_
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x20
push 0
push 0
push 0
push 0x10003500
push 0
push 0
call esi
push 0
push 0
push 0
push 0x100033f0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10003540
push 0
push 0
call esi
pop esi
mov eax, 1
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx