joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51b1a3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051b019

Function at 0x5233c2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00522f15

Function at 0x526210
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00462bbf

Function at 0x5264d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x52650d
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x526506
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x526512
add edx, 0x28
cmp edx, esi
jne 0x5264f7
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x52650f

Function at 0x52c5a0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x52c5de
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x52c5d6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x52c5e0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x52c5c6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x52c6b0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x52c6e1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x52c6e1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x52c6e1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x7decb9d4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x40e020]
test eax, eax
je 0x7decba13
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x7decba13
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x7decba13
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x7decba13
cmp dword [ecx + 0x74], 0xe
jbe 0x7decba13
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x7ded6eb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x7ded6edd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x7ded6edd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x5d1965
Capabilities:
Encode data using xor

Disassembly:
das
iretd
cmpsd dword [esi], dword es:[edi]
add byte [ebp + 0x4f1e2e4b], bl
xor dword [edi], esi
push ss
adc ebx, dword [edx]
jmp 0x5d197b
fimul dword [esi]
mov edi, ds
lea ebp, [eax]
cmp ch, byte [ebp + 0x6126fc5c]
leave
ja 0x5d19fa
test eax, 0x6e0e9fe9
jg 0x5d193d
or dword [edi + 0x5d53bdd9], ebp
push ebx
pop ebp
inc ecx
out 0x4b, al
pop eax
sub dword [edi - 0x6fad4689], 0x28
enter 0xffffffffffffdcd6, 0xffffffffffffff84
loope 0x5d1a64
xor dword [eax], ecx
ja 0x5d19fc
daa
stosb byte es:[edi], al
sal dword [edx], 0xff
je 0x5d1a56
inc eax
fdiv dword [ecx - 0x75]
jbe 0x5d1995
mov dh, 0x96
cmp dh, byte [eax]
mov byte [0xb71ab1af], al
sal byte [edx - 0x2d], 1
lodsd eax, dword [esi]
mov dh, 0xef
test eax, 0xadc89dbb
test eax, 0x74130afc
push ds
lea ebp, [ebx]
sal dword [ecx - 0x4a], cl
xchg esp, eax
jmp 0x1ed54629
xor byte [ebx + 0x3a], bh
cwde
push ss
pop edx
outsd dx, dword [esi]
dec ecx
xor al, 0x12
cld
or byte [ebx + edi], bl
scasb al, byte es:[edi]
mov esi, 0x58295818
mov ecx, 0x3dc625f5
dec ebx
push ss
clc
mov bl, 0
imul ebp, dword [edx - 1], 0xdad5f82b
or ecx, dword [ecx + 5]
mov ah, 0xbe
sub byte [edx], 0xcb
lcall 0xa558, 0xd0ee85c9
lodsd eax, dword [esi]
fisubr dword [edi]
jl 0x5d1a4b
xchg edx, eax
leave
mov bl, byte [ecx + 0x49]
cwde
push edx
neg ecx
and byte [ecx + ebp*2 - 0x6d5a675d], cl
push eax
and bl, byte [ecx + 0x19165d11]
fcomp qword [edx + ebx*8]
adc dword [ebp + 0x16], ebx
sbb esp, ebx
sbb al, 0xda
lodsb al, byte [esi]
out 9, al
aam 0xe9
add edi, eax
mov dword [ebp - 0x53], esp
add byte [edx - 0x29230051], 0xb8
dec esi
sub ecx, dword [eax - 0x61]
and cl, ch
cdq
out 0x90, eax
mov dword [ebx + ebp*2], ebp
adc byte [ecx + ebx*2 + 0x6acb200c], dh
salc
invalid
and bl, cl
push 0xffffffffffffffd6
mov eax, esi
test eax, 0xf9b82854
out dx, al
cmpsd dword [esi], dword es:[edi]
push ecx
or ch, dh
or eax, 0x3f0c2546
sbb byte [edx + ebp*8 + 0x48fb66b], cl
or byte [ebx + 0x6a143a4e], ch
loop 0x5d1aac
loopne 0x5d1abf
add bh, byte [eax]
js 0x5d1a97
xor eax, 0xb9718ca4
test al, 0x7e
add ah, ch
mov esi, 0x488578b9
xchg edx, eax
sbb ch, ah
push es
cmp edi, dword [esi - 0x73]
mov ebp, dword es:[edi - 0x7b]
shufps xmm7, xmm0, 0x9a
ret 0x9f09
Function at 0x60f692
Capabilities:
Encode data using xor

Disassembly:
std
push eax
xor dword gs:[0xbdd98c4e], 0xe0d8cca9
ror ebp, cl
pop edi
adc byte [ebx + 0x4c75dc65], cl
sbb ah, ah
push esp
and ebp, ebx
invalid
stosb byte es:[edi], al
pop ds
jbe 0x60f65b
loopne 0x60f687
mov ch, 0xc4
movsb byte es:[edi], byte [esi]
mov esi, 0xd4b9d369
fcom qword [edi - 0x2ffb7e7b]
arpl dx, ax
xchg ecx, eax
fstp qword [ecx + 0xf]
mov bl, 0xd4
pop ecx
btr esp, edx
sar byte [edx - 0x5d5b3674], cl
pop esp
loopne 0x60f674
invalid
mov edx, 0xff891317
loope 0x60f61d
invalid
xchg esi, eax
adc dword [edx], 0xffffffff
adc eax, 0xd21c07f
and dword [eax + 0x20d9bce7], ebx
cwde
out 0xbc, eax
fldenv [eax]
cwde
out 0xbc, eax
fldenv [eax]
jns 0x60f6e6
pop ebp
outsd dx, dword [esi]
xchg ebx, eax
dec edi
adc dl, byte [ebp - 0x61ae92ca]
adc eax, 0x359a73ef
stosd dword es:[edi], eax
inc eax
xchg ebp, eax
sub al, 0x66
test dword [edi + 0x26], ebp
je 0x60f723
test byte [ecx], 0xf7
fcmovne st(0), st(3)
mov dword [edx - 0x6b29f711], edi
loop 0x60f642
xor dword [edi - 0x6a], edx
inc bp
les edi, [0xf1ecc3a8]
dec edi
imul ebx, esp, 0x2cfd027e
pop ecx
les esp, [ebx]
jae 0x60f73b
mov dh, 0x6b
inc edi
jl 0x60f6aa
das
mov byte [0x9974b8fe], al
mov dh, 0xac
movsd dword es:[edi], dword [esi]
pushfd
test byte [ecx], bl
sbb al, 0xe1
int1
movsb byte es:[edi], byte [esi]
cld
push ecx
rcl dword [0x69de7b09]
cmp eax, 0x8fd9c40
xor al, 0xc6
xchg edi, eax
inc edx
pop ds
push ebx
pop es
sbb eax, 0x257d3719
salc
push ss
jno 0x60f748
mov bh, al
rol byte [edi + 0x50], 0xa3
and byte [0x56a58cdd], al
jno 0x60f796
cld
jge 0x60f735
insb byte es:[edi], dx
inc ecx
lodsb al, byte [esi]
iretd
xor eax, 0xf8a78559
xchg ecx, eax
lcall 0x164a, 0x4cf7f981
push cs
loopne 0x60f71f
stc
add eax, 0x7d4b9211
cmp al, 0x61
addps xmm3, xmm4
mov esp, 0xf8257ca5
sar byte [ebp - 0x5593a304], 1
adc dword [ebx + ecx*2], ecx
inc ebx
out dx, al
dec eax
xor eax, 0xbfbe235d
and ah, bl
sbb bl, byte [edx - 0x3fd9a200]
wait
adc ecx, dword [eax - 0x22f6f657]
mov dl, ah
bound esp, qword [edx - 0x4f]
add al, 0x11
adc eax, 0x121cc1d9
inc ebx
mov edi, 0x647c41cc
sbb bh, byte [esi + 0x3a1979c]
mov al, byte [0x8df2495f]
std
mov ebx, 0x2ca0dcf0
inc ebp
sbb ch, cl
mov eax, dword [0xe3b573ac]
adc bh, bh
jmp [ecx + 0x5cf1a9f0]
Function at 0x60f80e
Capabilities:
Encode data using xor

Disassembly:
fst dword [ecx + 0x49c4c2d7]
test dword [0xe3dc65ca], esp
jl 0x60f84b
scasd eax, dword es:[edi]
sbb al, 0x7c
adc dword [edx], eax
jecxz 0x60f85f
jg 0x60f842
jo 0x60f880
and dword [edx - 0x26d10281], esp
mov ebx, 0xdc3c31cc
cmp ah, byte [eax + edx]
mov edi, 0x13dd7965
jecxz 0x60f89e
sbb al, 0x22
inc ebp
pop ecx
sub al, 0x85
push eax
push ebp
aad 0x6b
jp 0x60f8bc
test eax, 0x5c51ead3
iretd
jns 0x60f925
int 6
xchg ebp, eax
sbb byte [ecx], 0x43
mov esp, 0xfd59ff0
das
jmp 0xd6d244ae
jle 0x60f96d
ja 0x60f939
mov edi, 0x5310adbf
int3
popfd
dec edx
lcall 0xb70b, 0x4aef4e13
pop eax
pop es
jne 0x60f938
hlt
inc ebx
inc esp
imul ebp, dword [edi + 0x27], 0x22faa20b
das
cmp al, 0xfb
xchg ah, dl
push eax
popal
not byte [esp + ebp*2 + 0x6c]
lcall 0x640e, 0x6ccbc6ac
test eax, 0x76f38e2b
loopne 0x60f99d
je 0x60f9d2
xchg byte [esi + edi*2], ch
mov eax, dword [0x343b0b40]
add dword [eax - 0x2b2f6eaf], ebp
push ecx
xchg ecx, eax
rcl ah, 1
ficom dword [edx - 0x760b5364]
mov esp, 0x95707ffc
packssdw mm1, mm5
movsb byte es:[edi], byte [esi]
and al, 0x59
mov esp, 0xbc61b49
add al, 0x21
les ebp, [ecx + 0xe]
fnstenv [esi - 0x70bde22a]
xor eax, 0xbef1a0b7
and byte [ecx - 0x13cc192c], al
salc
sbb eax, 0xb7358f42
mov al, byte [0x8120bef1]
aam 0xe6
xor ebp, esp
shr dword [0x3a3463ad], 0x58
push ds
cmp bl, byte [eax + 0x1e]
jge 0x60f99b
mov byte [ebx - 0x601623e2], dh
setge ah
loop 0x60f9be
frstor dword [eax + 0x6c]
sbb byte [edi - 0x1a], bl
or al, 0x8d
pushal
mov ebx, 0x3184af94
popal
retf
Function at 0x64e45d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x659368
cmp edx, dword [eax]
je 0x64e47f
add eax, 8
inc ecx
cmp eax, 0x6593f8
jl 0x64e470
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x659368]
jne 0x64e5ad
mov eax, dword [0xa5ccc0]
cmp eax, 1
je 0x64e587
test eax, eax
jne 0x64e4b0
cmp dword [0x659294], 1
je 0x64e587
cmp edx, 0xfc
je 0x64e5ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e4e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ee40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064f2d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e52a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064f2d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65405c
push edi
call fcn.006511a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ee40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ee50
lea eax, [ebp - 0xa0]
push 0x65403c
push eax
call fcn.0064ee50
push dword [esi + 0x65936c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ee50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00651114
add esp, 0x2c
pop edi
jmp 0x64e5ad
lea eax, [ebp + 8]
lea esi, [esi + 0x65936c]
push 0
push eax
push dword [esi]
call fcn.0064f2d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10006320
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x1000633b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10006346
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10006351
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000635c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10006367
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10006372
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000637d
bts eax, 1
test cl, 2
je 0x10006386
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10006422
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10006413
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10006330
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006450
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10130018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x10122ff4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call fcn.100d9341
add esp, 0xc
test eax, eax
je 0x100064a0
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100818a7
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.100d9388
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x100064d6
call fcn.100d95cf
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100818a7
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100d97e5
add esp, 0x10
test eax, eax
je 0x1000652b
push esi
nop dword [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x100064f2
push dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
push 0x400
push 1
push ebx
call fcn.100d97e5
add esp, 0x10
test eax, eax
jne 0x100064f0
pop esi
push ebx
call fcn.100d9920
push dword [ebp - 8]
call fcn.100d95cf
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.100818a7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006560
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov dword [esi], vtable.CAntiHack.0
test eax, eax
je 0x1000658c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], 0
test byte [ebp + 8], 1
je 0x1000659d
push 0x64
push esi
call fcn.10081bcf
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10006730
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x10006670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x10006670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x10006670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x10006670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x10006670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x100067c3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006810
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x10130018]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x5045454
push eax
push 0
push 0
push 0x10123004
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [esp + 0x3a]
movzx eax, word [esp + 0x38]
shl ecx, 0x10
or ecx, eax
movzx eax, word [esp + 0x16]
xor ecx, 0xb542d8e1
push ecx
movzx ecx, word [esp + 0x1c]
shl ecx, 0x10
or ecx, eax
mov eax, dword [esp + 0x16]
xor eax, 0x5d78a569
xor ecx, 0xf45bc123
push ecx
push eax
mov eax, dword [esp + 0x10]
xor eax, 0x12b586fe
push eax
lea eax, [esi + 4]
push str._08X__08X__08X__08X
push eax
call fcn.10006950
mov ecx, dword [esp + 0x54]
add esp, 0x18
pop esi
xor ecx, esp
call fcn.100818a7
mov esp, ebp
pop ebp
ret

Function at 0x100069e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov dword [esi], vtable.CAutoClick.0
test eax, eax
je 0x10006a0c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
test byte [ebp + 8], 1
je 0x10006a1d
push 0x14
push esi
call fcn.10081bcf
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10006b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
test ebx, ebx
jle 0x10006b68
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
nop word [eax + eax]
lea esi, [ecx + eax]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
inc ecx
mov al, byte [edx + 0x101230a4]
xor al, byte [edi + esi]
mov byte [esi], al
mov eax, dword [ebp + 8]
cmp ecx, ebx
jl 0x10006b40
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10007810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10130018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x10130ebc], 0
push ebx
push esi
push edi
je 0x10007a1b
cmp dword [0x10130ec0], 0
je 0x10007a1b
cmp dword [0xe609e8], 5
jne 0x10007a1b
mov ebx, dword [ebp + 8]
mov eax, dword [0x10130ec4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, dword [ebx]
jge 0x100078a6
mov esi, dword [0x10130ee4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
movss xmm0, dword [esi]
comiss xmm0, dword [0x10125abc]
push esi
movss dword [ebp - 0x10], xmm0
jbe 0x10007887
call edi
mov dword [esi], 0xc2340000
jmp 0x1000789a
call edi
movss xmm0, dword [ebp - 0x10]
addss xmm0, dword [0x10125a10]
movss dword [esi], xmm0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x10130ec4]
cmp eax, dword [ebx]
jle 0x100078fd
mov esi, dword [0x10130ee4]
lea eax, [ebp - 0xc]
movss xmm0, dword [0x10125b2c]
push eax
push 0x40
movss xmm1, dword [esi]
comiss xmm0, xmm1
push 4
push esi
movss dword [ebp - 0x10], xmm1
jbe 0x100078de
call edi
mov dword [esi], 0xc2340000
jmp 0x100078f1
call edi
movss xmm0, dword [ebp - 0x10]
subss xmm0, dword [0x10125a10]
movss dword [esi], xmm0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x10130ec8]
cmp eax, dword [ebx + 4]
jge 0x1000798e
mov esi, dword [0x10130ee8]
movss xmm1, dword [0x10125b20]
movss xmm0, dword [esi]
comiss xmm1, xmm0
movss dword [ebp - 0x10], xmm0
jbe 0x1000798b
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
movss xmm0, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
addss xmm0, dword [0x10125998]
push eax
push dword [ebp - 0xc]
push 4
push esi
movss dword [esi], xmm0
call edi
mov esi, dword [0x10130eec]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 8
movsd xmm0, qword [esi]
subsd xmm0, qword [0x101259b8]
push esi
movsd qword [ebp - 0x14], xmm0
call edi
movsd xmm0, qword [ebp - 0x14]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x10130ec8]
cmp eax, dword [ebx + 4]
jle 0x10007a07
mov esi, dword [0x10130ee8]
movss xmm0, dword [esi]
comiss xmm0, dword [0x10125b28]
movss dword [ebp - 0x10], xmm0
jbe 0x10007a07
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
movss xmm0, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
subss xmm0, dword [0x10125998]
push eax
push dword [ebp - 0xc]
push 4
push esi
movss dword [esi], xmm0
call edi
mov esi, dword [0x10130eec]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 8
movsd xmm0, qword [esi]
addsd xmm0, qword [0x101259b8]
push esi
movsd qword [ebp - 0x14], xmm0
call edi
movsd xmm0, qword [ebp - 0x14]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [ebx]
mov dword [0x10130ec4], eax
mov eax, dword [ebx + 4]
mov dword [0x10130ec8], eax
call fcn.10007a30
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100818a7
mov esp, ebp
pop ebp
ret 4
Function at 0x10007a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10130018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10130eec]
push esi
mov esi, dword [0x10130ef0]
push edi
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x101259c8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
andps xmm0, xmmword [0x10125c50]
push esi
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
mulsd xmm0, qword [0x10125980]
push eax
push dword [ebp - 8]
push 8
addsd xmm0, qword [0x10125a08]
push esi
movsd qword [esi], xmm0
call edi
mov eax, dword [0x10130eec]
mov esi, dword [0x10130ef4]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x101259c8]
push eax
push 0x40
push 8
push esi
andps xmm0, xmmword [0x10125c50]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
mulsd xmm0, qword [0x10125980]
push eax
push dword [ebp - 8]
push 8
addsd xmm0, qword [0x10125a08]
push esi
movsd qword [esi], xmm0
call edi
mov eax, dword [0x10130eec]
mov esi, dword [0x10130ef8]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x101259c8]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10125c50]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
push dword [ebp - 8]
mulss xmm0, dword [0x101259b0]
push 4
push esi
addss xmm0, dword [0x10125ae0]
movss dword [esi], xmm0
call edi
mov eax, dword [0x10130eec]
mov esi, dword [0x10130efc]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x101259c8]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10125c50]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
push dword [ebp - 8]
mulss xmm0, dword [0x101259b0]
push 4
push esi
addss xmm0, dword [0x10125ae0]
movss dword [esi], xmm0
call edi
mov eax, dword [0x10130eec]
mov esi, dword [0x10130f00]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x101259c8]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10125c50]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
cvtpd2ps xmm0, xmm0
push eax
push dword [ebp - 8]
mulss xmm0, dword [0x101259b0]
push 4
push esi
addss xmm0, dword [0x10125adc]
movss dword [esi], xmm0
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100818a7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret