joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c470
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x100518f0
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x1000c497
add eax, 8
inc ecx
cmp eax, 0x10051980
jb 0x1000c488
cmp dword [ecx*8 + 0x100518f0], edx
lea ebx, [ecx*8]
jne 0x1000c65b
cmp dword [0x1005166c], 1
je 0x1000c617
cmp dword [0x1005166c], 0
jne 0x1000c4ce
cmp dword [0x10051670], 1
je 0x1000c617
cmp edx, 0xfc
je 0x1000c65b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x1000c50b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x1000c54f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x1004e4e0
push ebp
call fcn.1000d290
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1004e4c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x100518f4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.1000d1f0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x100539d0], 0
je 0x1000c62d
mov eax, dword [0x100539d0]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x1000c637
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x100518f4]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x73250e94
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e060
nop
nop
nop
nop
mov eax, section._RDATA
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x447e2225
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x417e10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4c9b3c]
wait
dec esp
add byte [ebx + 0x50], dl
call dword [sym.imp.GDI32.dll_GetBkMode]
lea ecx, [esp + 8]
mov ebx, 1
push ecx
push ebx
push 0

Function at 0x417e2d
Capabilities:
Query or enumerate registry value

Disassembly:
push str.CLSID4be8a061_c73b_4f23_8114_317aae3e8698InProcServer32
push 0x80000000
add byte [eax + 0x18244489], al
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0x4caf6c], eax
scasd eax, dword es:[edi]
dec esp
add byte [ebp + 0x51], dh
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
mov dword [esp + 4], eax
push edx
lea eax, [esp + 8]
push 0x4c9c4c
pushfd
dec esp
add byte [eax + 0x6a], dl
add byte [edx], ch
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4caf6c]
test ecx, ecx
jne 0x417ec6
test eax, eax
mov eax, 0x80004005
pop ebx
invalid

Function at 0x417e45
Capabilities:
Query or enumerate registry value

Disassembly:
jo 0x417e57
dec esp
add byte [ebp - 0x50935c40], al
scasd eax, dword es:[edi]
dec esp
add byte [ebp + 0x51], dh
push esp
and al, 0xc

Function at 0x417e4d
Capabilities:
Query or enumerate registry value

Disassembly:
jo 0x417e57
dec esp
add byte [ebp - 0x50935c40], al
scasd eax, dword es:[edi]
dec esp
add byte [ebp + 0x51], dh
push esp
and al, 0xc

Function at 0x417e6d
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov dword [esp + 0x24], 0x208
add bh, bh
adc eax, sym.imp.ADVAPI32.dll_RegQueryValueExW
test eax, eax
mov dword [0x4caf6c], eax
jne 0x417e8b
cmp dword [esp + 4], ebx
je 0x417e8d
xor bl, bl
mov edx, dword [esp + 8]
push edx
invalid
invalid
invalid

Function at 0x42f18d
Capabilities:
Check for software breakpoints

Disassembly:
aas
jnp 0x42f140
sub eax, 0xe84830dd
sbb ah, ch
or al, 0xee
mov esp, 0x89643eb5

Function at 0x42f19d
Capabilities:
Check for software breakpoints

Disassembly:
scasb al, byte es:[edi]
popal
jecxz 0x42f0e1
lodsb al, byte [esi]
xor al, bl
jne 0x42f134
invalid
and al, 0xc7
ret 0x33cf
in al, 0x43
jp 0x42f131
enter 0x126e, 0x6a
xchg edx, eax
outsb dx, byte [esi]
adc ch, byte [edx - 0x6e]
js 0x42f1e8
jb 0x42f17a
mov dl, 0xf2
add eax, dword [eax + ecx*8]
add al, 0xc8
sub al, 0x39
push ecx
jecxz 0x42f1a2
test byte [edx + 3], bh
mov ch, 0x81
ret
cmp al, 0x41
aas
lcall 0xcc7c, 0x2fc9f777
invalid
leave
das
jl 0x42f1be
das
sub byte [edx - 0x2d], 0x71
inc eax
jno 0x42f21a
mov dh, 0xd9
mov ch, dh
inc ebx
popal
inc esp
shr byte [ebx + 0x340de61c], 0x23
or eax, 0x5b92334
inc esi
invalid
invalid
invalid

Function at 0x42f205
Capabilities:
Check for software breakpoints

Disassembly:
or eax, 0x5b92334
inc esi
add eax, 0xa73ca677
cmpsb byte [esi], byte es:[edi]
cmp al, 0xa7

Function at 0x42f299
Capabilities:
Check for software breakpoints

Disassembly:
adc dword [ebx], eax
mov al, 0xbf
pop ds
inc edi
jle 0x42f294
jns 0x42f2d0
mov esp, 0x733e3f30
add ah, ch
out dx, al
jns 0x42f2a3
cmp al, 0xcc
Function at 0x437edd
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x45
push es
add esi, dword [edx + 0x26677095]
push edx
push es
das
pop esi
aas
and eax, 0x247610b8
sbb dh, byte [ecx - 0x6c5a1970]
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0xd9a4dbfc]
mov ecx, 0x2e0310f3
pushal
xor al, 0x3a
in al, dx
and ebx, dword [edi + ebx*2 - 0x61c5e10c]
xor dh, byte [edi + 0x1d]
inc ebp
salc
cmpsd dword [esi], dword es:[edi]
out 0x62, eax
invalid

Function at 0x437fe1
Capabilities:
Encode data using xor

Disassembly:
sbb esi, dword [esi + 0x59]
cli
pop ecx
imul edi, esi, 0xffffffc9
xor al, 0xfd
push esi
mov bh, 0xe9
loopne 0x437fe6
test dword [eax + 0x63], esi
and esp, dword [ecx + 0x323a835f]
push es
and edi, dword [ecx - 0x78f3aed6]
push ds
out 0x54, al
shl byte [ecx], cl
daa
into
pop eax
add ebx, eax
sbb cl, bl
add cl, byte [eax - 1]
enter 0x31ad, 0x77
dec ecx
dec edx
rcr byte [esi], 1
loopne 0x43807a
invalid
sal dword [edx - 0x6cb409ab], 1
push es
or eax, 0xd26046b6
fiadd dword [eax - 0x21]
mov ch, 0x54
insb byte es:[edi], dx
mov bh, 0x47
invalid

Function at 0x4460a5
Capabilities:
Encode data using xor

Disassembly:
test dword [ecx + ebx - 0x3014d92], eax
int1
and eax, 0x82d49191
das
adc ebx, ebx
jmp 0x960f30e7
rcr dword [ecx], cl
dec edx
push ebp
xor dword [edi + ebp - 0x1e], 0xffffffbd
pop edi
push ss
add esp, dword [eax]
bound ebx, qword [esi + 0x63]
add byte [eax - 0x2e], al
cmpsb byte [esi], byte es:[edi]
jg 0x44609b
sbb al, 0x8f
lodsb al, byte [esi]
push ds
xor ebx, esp
sar byte [ebp + 0x38], 0xd7
dec esp
pop ebp
mov esp, 0xed63e7ce
xchg edi, eax
jnp 0x4460c7
jl 0x446084
add ah, bh
add byte [ebp - 0x46], dh
push edx
lahf
dec ebp

Function at 0x44ee21
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xb9
jo 0x44ee79
shl byte [eax - 0x613af6e1], 1
and al, 0xb9
mov ecx, 0xa8b9c0f0
enter 0xffffffffffffc454, 0x40
les eax, [eax - 0x79]
push ecx
or dword [eax - 0x39], esp
les eax, [eax - 0x79]
push ecx
or dword [eax - 0x39], esp
xor ebp, esi
push cs
pop ebp
ror dword [eax + 0x44fe1d93], 0xda
pop eax
sbb al, 0xcc
popal
dec ecx
cmp ebp, edx
xchg esi, eax
insd dword es:[edi], dx
sbb al, 0x31
xor dword [esi + ebx*8], ebx
aad 0xdc
movsd dword es:[edi], dword [esi]
xchg edx, eax
fmul dword [ebx]
add eax, 0x43508431
imul esp, dword [ebx], 0xfffffff1
dec esp
sbb dword [eax], 0x4b
adc dword [esi + 0x751dee02], esp
jnp 0x44ee0e
push 0x31
mov eax, dword [0x93d779d0]
fldcw word [ecx + 0x30e47a1c]
aad 0x7b
xor eax, 0x3dc0db78
int1
salc
pop ecx
je 0x44ee7a
dec ebx
mov al, byte [0x19cd59f9]
stc
pop ecx
int 0x19
nop
int 2
test dword cs:[edi], esi
add dword [ebx + 0x17], ecx
aas
adc edx, dword [0x40f02839]
mov esi, 0x6884e39b
wait
ror dl, cl
sal byte [ecx + 0x30], cl
invalid
Function at 0x45cd5d
Capabilities:
Authenticate hmac

Disassembly:
sti
shr dword [edx - 0x75], 1
mov edx, dword [ebx - 0x54]
mov dh, 0xe3
jnp 0x45cd76
mov edi, 0xc13ab7c8
cmp al, byte [ebx + edx]
or eax, eax
invalid
xchg edi, eax
wait
js 0x45cdb8
cwde
aad 0x4b
mov edi, 0x78423c86
jo 0x45cd90
xchg byte [edx + eax*2], bh
js 0x45cdeb
adc al, 0xa7
cmpsd dword [esi], dword es:[edi]
cmp edx, dword [ebx + 0x53b494d4]
mov cl, 0x6e
movsb byte es:[edi], byte [esi]
rcr byte [edx], cl
leave
imul edx, dword [ebx - 0x5c8d9b18], 0xd14b3a62
xchg ebx, eax
call 0x62e94007
cmp cl, byte [ebx - 0x2f]
invalid
pop es
wait
pop ebx
invalid
invalid
invalid
salc
sub al, 0x54

Function at 0x45cd65
Capabilities:
Authenticate hmac

Disassembly:
sti
shr dword [edx - 0x75], 1
mov edx, dword [ebx - 0x54]
mov dh, 0xe3
jnp 0x45cd76
mov edi, 0xc13ab7c8
cmp al, byte [ebx + edx]
or eax, eax
invalid
xchg edi, eax
wait
js 0x45cdb8
cwde
aad 0x4b
mov edi, 0x78423c86
jo 0x45cd90
xchg byte [edx + eax*2], bh
js 0x45cdeb
adc al, 0xa7
cmpsd dword [esi], dword es:[edi]
cmp edx, dword [ebx + 0x53b494d4]
mov cl, 0x6e
movsb byte es:[edi], byte [esi]
rcr byte [edx], cl
leave
imul edx, dword [ebx - 0x5c8d9b18], 0xd14b3a62
xchg ebx, eax
call 0x62e94007
cmp cl, byte [ebx - 0x2f]
invalid
pop es
wait
pop ebx
invalid
invalid
invalid
salc
sub al, 0x54

Function at 0x45cd75
Capabilities:
Authenticate hmac

Disassembly:
sti
shr dword [edx - 0x75], 1
mov edx, dword [ebx - 0x54]
mov dh, 0xe3
jnp 0x45cd76
mov edi, 0xc13ab7c8
cmp al, byte [ebx + edx]
or eax, eax
invalid
xchg edi, eax
wait
js 0x45cdb8
cwde
aad 0x4b
mov edi, 0x78423c86
jo 0x45cd90
xchg byte [edx + eax*2], bh
js 0x45cdeb
adc al, 0xa7
cmpsd dword [esi], dword es:[edi]
cmp edx, dword [ebx + 0x53b494d4]
mov cl, 0x6e
movsb byte es:[edi], byte [esi]
rcr byte [edx], cl
leave
imul edx, dword [ebx - 0x5c8d9b18], 0xd14b3a62
xchg ebx, eax
call 0x62e94007
cmp cl, byte [ebx - 0x2f]
invalid
pop es
wait
pop ebx
invalid
invalid
invalid
salc
sub al, 0x54

Function at 0x45cd9d
Capabilities:
Authenticate hmac

Disassembly:
xchg ebx, eax
call 0x62e94007
cmp cl, byte [ebx - 0x2f]
invalid

Function at 0x465b7d
Capabilities:
Encode data using xor

Disassembly:
cmp dl, byte [esi + edx - 0x3471f96f]
invalid
out dx, eax
jp 0x465b40
aad 0x6f
mov edi, 0x83c8e35e
sub al, 0xd2
das
xor esi, dword [0xf41ed4b]
push edx
mov eax, 0x93717f53
aaa
shl byte [ebx - 0x35], 1
invalid
Function at 0x48c2b5
Capabilities:
Encode data using xor

Disassembly:
fdivr dword [edx - 0x29]
pop ebp
push esp
push 0xffffffffffffffa3
or byte [edx + 0x53], ch
jo 0x48c27c
pop ebx
lodsd eax, dword [esi]
pop edx
inc esp
sub dword [edi + 0x72], esi
push esi
mov edi, dword [ebp - 0x6e]
xchg edx, eax
fsubr st(4), st(0)
jl fcn.0048c329
cmc
sal edx, 1
add dword [esi - 0x1a], esi
dec ecx
stc
sbb dword [edi + eax*4], 0x44
mul dword [ebp + 0x72]
jg 0x48c281
nop
add ecx, dword [edi - 0x70]
nop
cvtdq2ps xmm0, xmmword [eax]
push eax
jae 0x48c2f2
sbb eax, 0xa5bdb5ac
lodsb al, byte [esi]
mov ch, 0xbd
movsd dword es:[edi], dword [esi]
retf
sbb dword [edi], ebp
or al, 5
jge 0x48c339
jmp 0x48c2ce
add al, 0x55
in al, 0x41
mov edi, 0x5651242d
push ecx
push esi
cld
xchg ebx, eax
imul esp, dword [ecx - 0xb], 0x41
mov word [edi + edx*8], ds
sbb al, 0xd7
jae 0x48c30f
sbb bh, byte [esp + edx*8 - 0x72]
push ss
jle 0x48c308
push esi
inc esi
jbe 0x48c2d4
mov edi, 0x35aeb79e
xchg dword [0x6a3095ce], esp
mov ebx, 0x754a1775
lds ebp, [esi + eax*4]
cmp esp, dword [eax]
sbb eax, 0x41ab71e3
xchg dword [eax + 0xd], edi
ret 0x2f74

Function at 0x494f5d
Capabilities:
Encode data using xor

Disassembly:
and al, 0x33
loopne 0x494f85
aaa
mov ch, 0x19
out dx, al
xor eax, 0x15654401
mov ebp, fs
pushal
xor esi, ebx
inc ebx
adc eax, 0x66
mov eax, 0x94a3a39d
xchg esp, eax
rcl bh, 0x62
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
and cl, byte [ebx + esi*4]
xchg ebp, eax
insd dword es:[edi], dx
and eax, 0x1bf5fec3
adc eax, dword [edi + edi*4 - 0x13]
pmulhw mm3, qword [ecx + 0x5747c622]
mov dh, 0xb7
cmpsd dword [esi], dword es:[edi]
and ecx, dword [ebp - 0x7f7f536f]
sbb dword [edi], esp
pushal
xor eax, 0x55e5e84b
arpl word [edx - 0xd], bx
mov dh, dh
test byte [ebx], 0x57
mov dword [esi - 0x62ba1040], esp
jnp 0x494f28
inc esi
xor al, al
dec edx
mov bl, 0x9c
inc ebp
sal dword [ebx + 0x5f], 1
daa
mov eax, dword [0x4072b299]
div ah
invalid
shr dword [edx], 1
xchg esp, eax
or eax, dword [ebp - 0x35]
popfd
adc byte [edi + edi*2 + 0x24d89fa5], dl
invalid

Function at 0x495061
Capabilities:
Encode data using xor

Disassembly:
jg 0x494fe4
mov cl, 0xdc
loopne 0x495039
shl dword [edi + 0x2ad59d40], 1
sub byte [ecx - 0x2e], ah
cld
mov ebx, 0x51e5b753
xchg esi, eax
pop ds
invalid
Function at 0x4bbd19
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c63f0
cmp edx, dword [eax]
je 0x4bbd3b
add eax, 8
inc ecx
cmp eax, 0x4c6480
jl 0x4bbd2c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c63f0]
jne 0x4bbe69
mov eax, dword [0x4caf80]
cmp eax, 1
je 0x4bbe43
test eax, eax
jne 0x4bbd6c
cmp dword [0x4c6318], 1
je 0x4bbe43
cmp edx, 0xfc
je 0x4bbe69
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bbda3
lea eax, [ebp - 0x1a4]
push 0x4c1d08
push eax
call fcn.004bc700
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bcb90
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbde6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bcb90
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1d04
push edi
call fcn.004bea60
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1ce8
push eax
call fcn.004bc700
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc710
lea eax, [ebp - 0xa0]
push 0x4c1ce4
push eax
call fcn.004bc710
push dword [esi + 0x4c63f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc710
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1cbc
push eax
call fcn.004be9d4
add esp, 0x2c
pop edi
jmp 0x4bbe69
lea eax, [ebp + 8]
lea esi, [esi + 0x4c63f4]
push 0
push eax
push dword [esi]
call fcn.004bcb90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10003b30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb0
push esi
push edi
push 0xa0
xor esi, esi
lea eax, [esp + 0x1c]
push esi
push eax
call sub.ntdll.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esp + 0x18], eax
mov eax, 0x1000
mov word [esp + 0xb0], ax
lea eax, [esp + 0xc]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x4c], 0xc
call dword [sym.imp.KERNEL32.dll_GetNextVDMCommand]
test eax, eax
je 0x10003bc9
push dword [esp + 0xc]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10003bc9
lea eax, [esp + 8]
push eax
movzx eax, word [ebp + 0xc]
push esi
push eax
push dword [esp + 0x20]
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x10003bc2
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10009426
Capabilities:
Encode data using xor

Disassembly:
call 0x1000939f
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x100093cf
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x100093eb
xor edx, 0
jmp 0x100093f6
xor edx, edx
jmp 0x1000940d
jmp 0x10009419
xor eax, eax
push 0x8427d7c0
call 0x10009426
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x10009462
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1000943b
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x10009479
add eax, 0
jno 0x1000947e
add esi, 0
ret 0x10
Function at 0x1000a1e7
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x1000a209
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1000a3ab
cmp edi, dword [ebp + 0x10]
jb 0x1000a3ab
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10009cd3
inc edi
jmp 0x1000a292
jmp 0x1000a29f
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10009cd3
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10009cd3
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x1000a2f3
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1000a2d7
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1000a321
add dword [eax], 0x39
jle 0x1000a2fd
sub al, 0xf5
mov ch, al
call fcn.1000a336
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x1000c00e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x1000c024
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x1000c035
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.1000c076
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx
Function at 0x1000e3e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x1000e32b
add ebx, 0
push ecx
call 0x1000e340
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x100a62c2
sub ebx, dword [0x100c5b01]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x100c5af1
call fcn.10009e0a
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.10009318
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x1000e49e
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x1000e49e
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x1000e455
mov eax, 1
lock xchg dword [0x100c5afd], eax
push 0x3dd1fc71
call 0x1000e3e2
push esi
add esp, 8
cmp eax, 0
jne 0x1000e3cb
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x1000e3f1
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x1000e406
cmp ecx, edx
cmp eax, 0
je 0x1000e42b
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x1000e415
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.1000e444
dec eax
loope 0x1000e447
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x100c5afd], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x1000e47b
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x1000e490
jmp 0x1000e49b
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x1000e389
Function at 0x10015503
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x100157d9
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x100b2775
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x100a973b
push 0xffffffffffffffff
call fcn.1000c703
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x1001556d
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.10015585
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x100157cd
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x100157a1