joyce8/EMBER2024-capa huggingface dataset:
Function at 0x93ab1b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], edi
lea esp, [esp + 0x40]
call fcn.00941750
pushfd
mov esp, esi
push 0x585a7481
lea esp, [esp + 4]
jmp 0x93da94
test di, 0x592a
mov byte [esp + 0xc], ah
stc
add edi, eax
mov word [esp + 8], bp
mov edi, dword [edi + ecx*4]
pushfd
stc
test edi, edi
call fcn.00942992
pop eax
xor esp, edi
xchg esp, eax
jne 0x93ab31
jne 0x93ab6d
add edi, dword [ebp - 0x13fd5e20]
mov eax, dword [0x678f3822]
push edi
add byte [ebp - 0x5d], cl
sbb al, 0xee
sal esi, 0xd
dec edx
add dh, dh
xlatb
and al, 0x88
or al, 0x24
or eax, eax
push 0x8470f4a7
lea esp, [esp + 8]
jne 0x93a190
pushal
or cl, dh
mov ecx, dword [ebx]
push edx
push 0x1599d4d1
or ecx, ecx
mov byte [esp], ah
lea esp, [esp + 0x28]
jp 0x93ae74
pushfd
push edi
lea esp, [esp + 8]
je 0x93a190
bswap di
jmp 0x9432c2
pushfd
lea esp, [esp + 4]
je 0x93a190
call fcn.0093e6c6
pushfd
sbb dl, al
inc ebx
fstp qword [esi]
lahf
mov cl, 0xcd
push ss
push eax
bound edi, qword [edi]
or al, 0xb0
and dh, byte [ebp + 0x29c0c898]
int 0xe9
wait
nop
adc ah, ch
inc esi
insb byte es:[edi], dx
add byte gs:[eax + 0x60], ah
sub ebp, ecx
jmp 0xeca4c349
mov dword [esp + 0x3c], ebx
push 0xe6a23dec
jmp 0x935ed0
call fcn.0093515c
xchg byte [eax - 0x742cf24d], al
cmpsd dword [esi], dword es:[edi]
test dword [esi], ecx
test al, 0xaa
inc ebx
mov ebx, 0xb5d5920e
sbb dl, byte [edi]
je 0x9432a7
cdq
push eax
int1
sbb al, 0xb4
out 0xc6, eax
mov cl, 0x78
adc dh, byte [edi + 0x39f23ef2]
jb 0x943292
sahf
fstp xword [edi + 0x34c67b96]
scasb al, byte es:[edi]
xchg ecx, eax
movsd dword es:[edi], dword ss:[esi]
invalid

Function at 0x993910
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
test ecx, ecx
je 0x9939b2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x9939b2
shr edx, 0
and esp, 0xffffffff
clc
jl 0x993935
je 0x993940
lea esi, [esi]
jne 0x99393b
mov eax, eax
jne 0x993940
mov eax, 0xff81
add dword [eax], eax
cmp edi, 0x10000
jae 0x993971
xor eax, dword [esp]
xor eax, dword [esp]
xchg edx, eax
xchg edx, eax
js 0x993968
pushf
xor esp, 0
ror edx, 0
mov edx, edx
lea esp, [esp]
popf
jnp 0x993963
jne 0x993965
jns 0x993968
xor eax, 0xc1e85157
int1
add dword [eax], eax
push edi
push ecx
call 0x9b2b30
jmp 0x993995
std
cld
cmp edx, dword [esp + 8]
xor ecx, 0
add ebx, dword [esp]
sub ebx, dword [esp]
jnp 0x99398b
lea ecx, [ecx]
xchg esi, eax
xchg esi, eax
je 0x993988
jp 0x99398b
add eax, 0x5708458b
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.0099e8c0
add esp, 8
test eax, eax
je 0x9939bd
jns 0x99399e
je 0x9939ab
nop
jb 0x9939a3
lea esi, [esi]
js 0x9939a7
jne 0x9939ab
ljmp 0xc25d:0x5b5e5fa5
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x98e4c4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x995710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x11
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.009af150
add esp, 0xc
push eax
add eax, 0x6013
ror eax, 3
pop eax
and eax, 0xffffffff
jge 0x995743
je 0x99573a
jno 0x99573c
lea edx, [edx]
jl 0x995743
mov eax, 0x65b27f36
mov dl, 0x65
mov al, 0x66
mov cl, 0x6d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], dl
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0x42
mov byte [ebp - 0x17], al
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xc], dl
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], cl
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], al
shl edi, 0
xor ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0xc]
jge 0x995793
add esp, 0
je 0x9957b2
pushf
js 0x99579c
jge 0x99579e
call fcn.009957a3
Function at 0x99c410
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x98cc48
call fcn.00998f80
add esp, 0xc
mov byte [0x98cc48], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x99cca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.009af150
add esp, 0xc
and esp, 0xffffffff
lea edi, [edi]
ror edi, 5
ror edi, 0x1b
je 0x99ccd2
pushf
ror esi, 0
popf
lea edx, [edx]
jne 0x99ccd2
lcall 0x53e8, 0x45c666b0
mov al, 0x66
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x50
mov byte [ebp - 0x14], 0x71
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 0x7a
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov ebx, ebx
cmp edx, dword [esp]
xor ebx, 0x6ace
xor ebx, 0x6ace
jae 0x99cd2c
pushf
lea edi, [edi]
cmc
push esi
pop esi
je 0x99cd25
popf
jnp 0x99cd29
jb 0x99cd2c
mov edi, 0x8ae8558a
dec ebp
in eax, dx
mov dl, byte [ebp - 0x18]
mov cl, byte [ebp - 0x13]
mov al, byte [ebp - 0xe]
mov bl, byte [ebp - 0x17]
dec dl
dec cl
mov byte [ebp - 0x18], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x16]
dec dl
mov byte [ebp - 0x17], bl
mov bl, byte [ebp - 0x11]
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0xc]
dec cl
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0x15]
dec bl
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 0x14]
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 0xf]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x10], al
mov byte [ebp - 0x14], bl
mov byte [ebp - 0xf], dl
jl 0x99cd96
jo 0x99cd9e
jne 0x99cd9a
jno 0x99cd9e
mov edi, 0x4e3de888
add dword [eax], eax
call 0x9b1be0
test eax, eax
mov dword [ebp - 4], eax
jne 0x99cdb8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test edx, 0x1b8e
jg 0x99cdd1
pushf
call fcn.0099cdc7
Function at 0x9a05c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009af150
add esp, 0xc
xor esi, dword [esp + 0xc]
xor esi, dword [esp + 0xc]
js 0x9a05ed
lea edi, [edi]
jae 0x9a05e7
mov esi, esi
jns 0x9a05ed
xor eax, 0xc666b06b
inc ebp
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
or esp, 0
or edi, edi
je 0x9a062d
mov esi, esi
jne 0x9a062d
call 0x8b8a53bb
inc ebp
cmc
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xd], cl
mov byte [ebp - 8], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], dl
call fcn.009a7b60
test eax, eax
je 0x9a072b
jnp 0x9a069c
sub esp, 0
cmp ebx, dword [esp + 8]
cmp eax, dword [esp]
je 0x9a06cb
pushf
xor edi, 0x5ea6
xor edi, 0x5ea6
xchg esi, edi
xchg esi, edi
not ecx
not ecx
popf
jp 0x9a06c2
xchg edx, esi
xchg edx, esi
jo 0x9a06c8
jne 0x9a06cb
add eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00993910
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.009af150
add esp, 0xc
test esi, esi
je 0x9a072b
neg ebx
neg ebx
jge 0x9a06f1
xchg edi, edi
jns 0x9a070e
pushf
test edx, ecx
lea ebx, [ebx + 0x588b]
sub ebx, 0x588b
popf
js 0x9a0709
jmp 0x9a070b
js 0x9a070e
ljmp 0:0x2ce856
push esi
call fcn.009a0740
add esp, 4
and esp, 0xffffffff
ja 0x9a0725
xchg esp, esp
jle 0x9a0720
jbe 0x9a0725
sub eax, 0x458bc15d
or byte [eax - 1], dl
salc
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x9a98d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov dword [ebp - 0xb], eax
push 0x98e804
mov byte [ebp - 0xc], 0
mov byte [ebp - 7], al
call esi
sidt [ebp - 0xc]
mov eax, dword [ebp - 0xa]
add eax, 8
mov ebx, dword [eax]
add eax, 0x10
mov eax, dword [eax]
and eax, 0xffff
and ebx, 0xffff
sub eax, ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1e
jne 0x9a9934
xor esp, 0
test edx, eax
shl eax, 0
and esp, 0xffffffff
js 0x9a992d
xchg ecx, ecx
xchg edi, eax
xchg edi, eax
jns 0x9a992d
sub eax, 0x2bf
add bl, ch
sub edi, esi
rcl edi, 0x6b
add byte [eax], al
mov edi, 2
jmp 0x9a995d
test ecx, 0x6bd7
jge 0x9a993c
jle 0x9a993e
jno 0x9a9958
pushf
xor esp, 0
popf
jne 0x9a9949
lea ebx, [ebx + 0x2118]
lea ebx, [ebx - 0x2118]
jo 0x9a9958
sub eax, 0x4bf
add byte [eax - 0xc], ch
out 0x98, eax
add bh, bh
salc
mov edi, 4
push 0x98e7f4
call esi
test eax, 0x20d9
xor eax, 0x245f
xor eax, 0x245f
xchg edx, ecx
xchg edx, ecx
jl 0x9a9982
mov esi, esi
xchg esp, esp
js 0x9a997f
jge 0x9a9982
mov ecx, 0x5e5fc78b
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x9a9990
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x98fa9c]
push esi
push edi
push eax
push 0x98fde5
mov byte [0x98fde4], 0x45
call fcn.00997180
mov edx, dword [0x98fa9c]
mov al, 0x2d
mov byte [0x98fdea], al
mov byte [0x98fdeb], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x98fde9], cl
mov byte [0x98fdec], cl
mov esi, 0x98fded
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x97ea69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x9a99df
mov byte [esi], 0
pop edi
mov eax, 0x98fde4
pop esi
ret
Function at 0x9aa7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009af150
add esp, 0xc
add esi, dword [esp]
sub esi, dword [esp]
add edi, 0x679e
sub edi, 0x679e
jg 0x9aa7e2
pushf
lea esi, [esi + 0x1ae3]
sub esi, 0x1ae3
popf
xchg esp, esp
jle 0x9aa7e2
mov eax, 0x75b066b1
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
neg eax
neg eax
jnp 0x9aa82d
jne 0x9aa822
jns 0x9aa824
jnp 0x9aa826
xchg edx, ecx
xchg edx, ecx
jp 0x9aa82d
mov edi, 0x8afc4d8a
inc ebp
cmc
mov cl, byte [ebp - 4]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 0xa]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 6]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 7]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov cl, byte [ebp - 0xe]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x10], al
mov byte [ebp - 7], bl
mov byte [ebp - 5], dl
mov byte [ebp - 0xe], cl
xor edx, dword [esp]
xor edx, dword [esp]
jle 0x9aa8a4
xchg edx, esi
xchg edx, esi
jg 0x9aa8a4
mov ebp, 0xffd2b7e8
dec dword [ebx + 0xfc985c8]
test byte [ebx - 0x7d000000], dl
test byte [eax], 0xfd
call fcn.009a7b60
mov ecx, eax
test ecx, ecx
je 0x9aa946
xor esi, 0
std
cld
xchg edi, eax
xchg edi, eax
jg 0x9aa8c6
mov esp, esp
jge 0x9aa8c0
lea edx, [edx]
jle 0x9aa8c6
mov esi, 0xf0558db6
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00993910
mov esi, eax
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009af150
add esp, 0xc
jp 0x9aa8e4
je 0x9aa8e6
jne 0x9aa8fb
lea edx, [edx + 0x322c]
lea edx, [edx - 0x322c]
jnp 0x9aa8f6
je 0x9aa8f8
je 0x9aa8fb
sub eax, 0x4774f685
test esi, esi
je 0x9aa946
and edx, 0xffffffff
and ecx, ecx
jne 0x9aa91d
pushf
not edi
not edi
cld
xchg esp, esp
rol esp, 0
popf
lea ecx, [ecx]
jbe 0x9aa918
xchg edi, eax
xchg edi, eax
je 0x9aa91d
call 0x5eb89177
invalid
push esi
call fcn.009a0740
add esp, 4
shr edx, 0
call 0x9aa92e
add esp, 4
jg 0x9aa940
xchg ebx, ecx
xchg ebx, ecx
jge 0x9aa939
jbe 0x9aa93b
mov esp, esp
jle 0x9aa940
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x9ab160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0x10
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009af150
add esp, 0xc
ja 0x9ab17a
lea esp, [esp]
push ebx
pop ebx
jl 0x9ab1a1
pushf
call 0x9ab188
lea esp, [esp + 4]
cmp esp, 0x65e9
ror ebx, 3
rol ebx, 3
popf
mov esp, esp
lea edx, [edx]
jge 0x9ab1a1
mov esi, 0x74b066b1
mov cl, 0x66
mov al, 0x74
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xb], 0x70
mov byte [ebp - 6], 0x55
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x6a
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], cl
mov byte [ebp - 4], 0x6e
mov byte [ebp - 0xd], 0x51
mov byte [ebp - 8], al
mov byte [ebp - 3], cl
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 7], al
mov byte [ebp - 2], al
mov byte [ebp - 1], 0
rol ebx, 0x1d
ror ebx, 0x1d
xor ecx, dword [esp]
xor ecx, dword [esp]
jns 0x9ab1f7
pushf
stc
popf
jb 0x9ab1f4
js 0x9ab1f7
mov ebx, 0x8af0458a
pop ebp
cmc
mov al, byte [ebp - 0x10]
mov bl, byte [ebp - 0xb]
mov dl, byte [ebp - 6]
mov cl, byte [ebp - 0xf]
dec al
dec bl
mov byte [ebp - 0x10], al
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0xb], bl
mov bl, byte [ebp - 5]
mov byte [ebp - 6], dl
mov dl, byte [ebp - 0xe]
dec cl
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 4]
dec dl
mov byte [ebp - 5], bl
mov bl, byte [ebp - 0xd]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 8]
dec cl
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 3]
dec bl
mov byte [ebp - 4], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xd], bl
mov bl, byte [ebp - 7]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 2]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 3], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 7], bl
mov byte [ebp - 2], dl
call fcn.009a7b60
test eax, eax
jne 0x9ab280
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
add esp, 0
jbe 0x9ab291
jo 0x9ab287
jnp 0x9ab289
jno 0x9ab28b
jns 0x9ab28d
ja 0x9ab291
mov ebp, 0xf04d8dad
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00993910
mov esi, eax
xchg ebx, ebx
and esp, 0xffffffff
neg eax
neg eax
jno 0x9ab2c3
pushf
test dword [esp + 8], edi
xor ebx, 0x6040
xor ebx, 0x6040
popf
jno 0x9ab2be
xchg edx, edx
jo 0x9ab2c3
add eax, 0x558d106a
invalid
push 0x10
lea edx, [ebp - 0x10]
push 0
push edx
call fcn.009af150
add esp, 0xc
add ecx, 0
stc
jns 0x9ab2e0
jb 0x9ab2db
js 0x9ab2dd
js 0x9ab2e0
add dword [ebp + 0x330a75f6], 0x8b5b5ec0
in eax, 0x5d
test esi, esi
jne 0x9ab2ee
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
jle 0x9ab2f8
jle 0x9ab300
lea ebx, [ebx]
jg 0x9ab300
lcall 0xff54, 0x3ae8562a
inc dword [ebx - 0x2708fb3c]
push esi
call fcn.009a0740
add esp, 4
neg eax
neg eax
jge 0x9ab31f
pushf
jns 0x9ab313
ror esp, 0
jo 0x9ab318
popf
js 0x9ab31c
jl 0x9ab31f
lcall 0x144d, 0x8b18458b
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x9af2f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009af150
add esp, 0xc
nop
jae 0x9af31e
pushf
stc
xchg ecx, ecx
ror ebx, 0x1b
rol ebx, 0x1b
popf
ja 0x9af31b
jb 0x9af31e
mov eax, 0x65b073b1
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
lea esp, [esp]
jbe 0x9af363
jo 0x9af35d
lea esp, [esp]
ja 0x9af363
sub eax, 0xffff87f8
call fcn.009a7b60
test eax, eax
jne 0x9af375
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
stc
cmc
jle 0x9af379
ja 0x9af38f
pushf
cmp edx, 0x468d
popf
mov edx, edx
jbe 0x9af389
lea esp, [esp]
jbe 0x9af38f
lcall 0xe850, 0x51f04d8d
ja 0x9af3dc
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00993910
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.009af150
add esp, 0xc
test esi, esi
jne 0x9af3ba
invalid
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test dword [esp + 4], ebx
clc
add edx, 0x5727
sub edx, 0x5727
ja 0x9af3e1
pushf
call 0x9af3d4
add esp, 4
or edx, 0
popf
jno 0x9af3de
jbe 0x9af3e1
add eax, 0x1359e856
invalid
push esi
call fcn.009a0740
add esp, 4
cmc
shl edi, 0
test esp, 0x28ef
ror ecx, 0x10
ror ecx, 0x10
jae 0x9af414
pushf
call 0x9af403
lea esp, [esp + 4]
inc ebx
dec ebx
popf
xchg ecx, ecx
jg 0x9af40f
jg 0x9af411
jb 0x9af414
mov esi, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x9af850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0xf
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.009af150
add esp, 0xc
or eax, 0
and ecx, ecx
jb 0x9af86f
jo 0x9af871
jo 0x9af87e
jne 0x9af875
jo 0x9af877
jae 0x9af879
jno 0x9af87e
mov ebx, 0x73b0931a
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], al
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xa], al
mov byte [ebp - 5], cl
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], al
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x46
mov byte [ebp - 3], 0x74
call fcn.009a7b60
test eax, eax
jne 0x9af8ca
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00993910
push 0xf
lea edx, [ebp - 0x10]
push 0
push edx
mov esi, eax
call fcn.009af150
add esp, 0xc
test esi, esi
jne 0x9af8f4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
nop
je 0x9af902
pushf
ja 0x9af8fb
popf
jbe 0x9af8ff
jne 0x9af902
call 0xed3e15c
invalid
push esi
call fcn.009a0740
add esp, 4
shl esp, 0
push ebx
add ebx, 0x1f08
ror ebx, 0x1d
pop ebx
add ecx, 0x423d
sub ecx, 0x423d
jg 0x9af927
jns 0x9af930
jnp 0x9af92b
xchg ecx, eax
xchg ecx, eax
js 0x9af930
mov ebx, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001530
Capabilities:
Acquire debug privileges
Create thread
Inject thread

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
push 1
push str.SeDebugPrivilege
call fcn.10001650
mov eax, dword [esp + 0x120]
add esp, 8
push eax
push 0
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push str.SeDebugPrivilege
mov esi, eax
call fcn.10001650
add esp, 8
test esi, esi
jne 0x1000157b
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
push 4
push 0x1000
push 0x64
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
jne 0x100015a6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
mov edx, dword [0x1001ad58]
lea ecx, [esp + 0x10]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x14]
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 0xc]
push ecx
push 0
push ebx
push edx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
jne 0x1000161b
push 0x8000
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret

Function at 0x100016d0
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x400
lea eax, [esp + 0x408]
lea edx, [esp]
push eax
push ecx
push 0x400
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x400
ret