joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbdb7cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, sp
neg dx
mov dh, byte [esp]
sbb eax, 0x384a496a
dec ecx
dec edx
cmp al, ch
pop esi
add byte [eax], al
add byte [ebp - 0xbf7b82c], ah
call fcn.00bdb7cc
movsd dword es:[edi], dword [esi]
aam 0x47
or ah, dh
mov ax, word [esp]
lea eax, [ebx*4]
mov eax, edx
neg ax
rcl dl, 7
rol bl, 0
jmp 0xbdb7a5
mov dh, byte [esp]
sbb eax, 0x384a496a
jmp 0xbdb769
jae 0xbdb75b
mov ax, sp
neg dx
jmp 0xbdb78b
lea esp, [esp + 4]
inc bl
call 0xbdb7d8
jecxz 0xbdb766
adc al, 0x39
stc
or dx, 0x1069
rdtsc
xchg dword [esp], ecx
jmp 0xbdb81e
lea ecx, [ecx - 0x28]
rdtsc
rcr eax, cl
pushfd
bsr dx, bp
jmp 0xbdb808
xchg dword [esp + 0x14], ecx
mov al, dl
dec dl
sub eax, edx
mov ax, 0xf18e
jmp 0xbdb835
neg dx
sub esp, 0x13
mov dh, 1
xchg dx, ax
lea eax, [edx*4]
lea esp, [esp + 3]
jmp 0xbdb7e8
push dword [esp + 0x14]
ret 0x18

Function at 0xbdbdd7
Capabilities:
Execute anti-debugging instructions

Disassembly:
add bl, 0x3e
jno 0xbdbdef
mov ax, word [esp + 0x17]
push word [esp + 0x11]
pop ebx
mov byte [esp], bh
lea esp, [esp + 3]
jmp 0xbdbdfb
jmp 0xbdbdb5
pop ebx
mov byte [esp], bh
lea esp, [esp + 3]
jmp 0xbdbdfb
mov ax, word [esp + 0x17]
push word [esp + 0x11]
jmp 0xbdbdd9
lea esp, [esp + 0x18]
sub ebp, 0x6ff6d9bb
mov edx, dword [esp]
lea edx, [eax*4]
cmc
jmp 0xbdbf8c
rdtsc
jmp 0xbdbfff
jbe 0xbdbff9
mov bl, 0x6c
mov edx, ebx
jmp 0xbdbe7a
mov bl, 0x6c
mov edx, ebx
rdtsc
add ebp, 0x57490953
call fcn.00bdbe4a

Function at 0xbdbe21
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
pushfd
jmp 0xbdbcd7
js 0xbdbcc5
mov byte [esp + 2], dh
push word [esp + 1]
jmp 0xbdbbb5
mov byte [esp + 2], dh
push word [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x1c], ebp
pushfd
lea esp, [esp + 3]
call fcn.00bdbb40
neg dx
jmp 0xbdbd1c
lea esp, [esp + 2]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], esp
push bp
push word [esp]
jmp 0xbdbc6a

Function at 0xbe00e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0bca728
jmp 0xbe019b
mov word [esp + 1], dx
push esi
jmp 0xbe011e
pop word [esp]
lea esp, [esp + 3]
mov dword [esp + 0x34], esi
push dx
lea esp, [esp]
jmp 0xbe0153
mov dword [esp + 0x24], ecx
pushal
mov word [esp + 9], ax
mov dword [esp + 0x40], edx
call fcn.00be00fc
mov dword [esp + 0x38], ebp
pushfd
lea esp, [esp + 1]
push word [esp + 2]
jmp 0xbe018b
mov byte [esp], ah
lea esp, [esp + 2]
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0xbe0174
mov dword [esp + 0x34], esi
push dx
lea esp, [esp]
jmp 0xbe0153
pushfd
jmp 0xbdf327
jbe 0xbe0106
pop word [esp]
lea esp, [esp + 3]
jmp 0xbe0169
mov bp, word [esp]
bswap edx
xchg edi, ebx
rcr dx, 7
jmp 0xbe01d8
jmp 0xbe01f2
jg 0xbe022b
jle 0xbe022b
lea edx, [ebx + ebx]
mov cx, word [esp]
jmp 0xbe02b1
cpuid
lea ebp, [esp]
xchg ah, dh
mov bx, 0x9dfe
call fcn.00be0204
invalid
mov esi, dword [esp + 0x2c]
mov ebp, 0xf1a3d552
stc
jbe 0xbe01c2
cpuid
jmp 0xbe01f4
mov dh, ch
setge dl
sub esp, 0xc0
mov edi, esp
xchg edx, eax
and ecx, 0x99aa9be7
jmp 0xbe02e3
jbe 0xbe028d
mov dh, ch
setge dl
jmp fcn.00be0292
Function at 0xbe00fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], esp
jmp 0xbe0131

Function at 0xbe0204
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, byte [esp]
lea ecx, [edi*4]
xchg bx, cx
mov dl, 0x8a
mov ecx, esp
jmp 0xbe0285
xchg dword [esp], esi
call fcn.00be0258

Function at 0xbe800b
Capabilities:
Encode data using xor

Disassembly:
call 0xbe7f3f
mov bp, bx
lea esp, [esp + 3]
mov ebp, dword [esp]
jmp 0xbe802c

Function at 0xcb4b60
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr cx, sp
neg edx
rdtsc
pop word [esp]
mov ax, word [esp]
jmp 0xcb4bd6
not ebp
mov dh, cl
mov dh, 0xcf
jmp 0xcb4b4a
add esp, 0xd
mov dword [esp + 5], edx
ror ax, 9
bswap ebp
rdtsc
pop dx
jmp 0xcb4bb3
bswap ebp
pop di
push word [esp + 2]
bswap edx
sub esp, 0x1e
mov si, word [esp + 0x1b]
jmp 0xcb4b68
mov byte [esp + 9], ch
mov word [esp + 2], ax
mov byte [esp + 1], dh
jmp 0xcb4bea
mov di, word [esp + 9]
mov byte [esp + 2], dh
mov si, sp
xchg dword [esp + 5], edx
neg edi
pop ecx
jmp 0xcb4b9d
mov bl, 0xae
xchg edi, ebp
mov esi, ecx
xchg word [esp], di
mov byte [esp], ch
push word [esp + 1]
jmp 0xcb4b88
mov di, 0xe67d
lea edx, [ebp + 0xe0]
xchg ebx, ecx
lea esp, [esp + 9]
lea ebx, [ecx*4]
jmp 0xcb4c2b
pop word [esp]
xchg dword [esp], ecx
add esp, 2
lea ebp, [eax + esi]
jmp 0xcb4cc5
lea ebp, [ebx*4]
inc ax
lea ebp, [edi*4]
xchg word [esp + 3], dx
jmp 0xcb4c15
mov ebx, dword [esp]
mov bp, si
mov bp, word [esp]
bswap edi
rcr bp, cl
mov ch, al
jmp 0xcb4c54
push word [esp + 1]
mov al, ch
lea ecx, reloc.WINMM.dll_midiStreamOut
pop ecx
xchg byte [esp], cl
mov ax, word [esp]
jmp 0xcb4c77
Function at 0xcb4e89
Capabilities:
Execute anti-debugging instructions

Disassembly:
setae al
adc cx, 0xaf2f
mov bh, ch
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0xcb4ebb
mov dh, 0xf4
rdtsc
pop edi
mov dl, bl
xor ax, 0x3b60
mov ah, 0x63
jmp 0xcb4e59
mov edi, 0x6b9a0893
rdtsc
cpuid
jmp 0xcb4e6f
not bh
xchg esi, eax
mov bp, 0x6880
mov edi, dword [esp]
sub esp, 0x17
mov ecx, 0x5f4a193d
jmp 0xcb4fc0
pop word [esp + 1]
lea esp, [esp + 3]
add esp, 0
mov dx, word [esp]
mov ebx, dword [esp]
cmp ebx, eax
jmp 0xcb4e94
mov ax, word [esp + 4]
ror esi, cl
mov ecx, dword [esp + 0xc]
pop esi
jmp 0xcb4f15
add esp, 6
mov esi, 0x636f17ad
bswap ecx
setp cl
pop cx
mov al, 0x9d
jmp 0xcb4ed2
push word [esp + 0xd]
mov esi, dword [esp + 7]
cld
add esp, 0xe
call fcn.00cb4efb
pop edx
mov di, word [esp + 2]
push word [esp + 2]
bt esi, eax
mov di, bx
pop word [esp]
jmp 0xcb4f91
bsf di, ax
not ah
push dword [esp + 0x17]
bt eax, edx
xchg dword [esp + 0x16], ecx
not si
jmp 0xcb4ee8
mov byte [esp + 8], bl
mov word [esp + 2], cx
push word [esp + 5]
jmp 0xcb4fa8
mov ch, al
lea ecx, reloc.WINMM.dll_midiStreamOut
mov esi, 0xf8e4377a
xchg word [esp + 2], cx
pushfd
bsr ecx, esp
jmp 0xcb4f59
mov dword [esp], esp
push word [esp + 1]
xchg byte [esp + 2], ch
mov si, bp
mov dx, bp
setno bl
jmp 0xcb4f6f
bsr dx, bp
mov edi, esi
pop dword [esp]
xchg word [esp], ax
jmp 0xcb4fd9
mov si, dx
shr cx, cl
mov ecx, edx
lea eax, reloc.WINMM.dll_midiStreamOut
bswap ebp
xchg byte [esp + 0xb], ch
jmp 0xcb4f43
lea ecx, [ebp*4]
sbb dx, bx
setle bl
xchg al, cl
dec bh
push word [esp + 1]
jmp 0xcb64be

Function at 0xcb4ff5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bl, ch
not ax
xchg di, bx
jmp 0xcb5041
mov dh, ah
xchg byte [esp + 3], bl
xchg ebx, ecx
push word [esp + 2]
pop dword [esp]
jmp 0xcb502b
mov ecx, dword [esp + 3]
pop ebx
lea edx, [edx*4]
sub esp, 0xd
jmp 0xcb506d
push cx
lea edx, [edi*4]
btr edi, ecx
push dword [esp]
pop ebp
mov bx, 0xc489
jmp 0xcb4fff
xchg ebx, eax
lea esp, [esp + 0xb]
cpuid
rdtsc
or di, dx
jmp 0xcb5084
push dword [esp + 0xc]
bsr cx, bx
bsr di, si
pop word [esp + 5]
inc ah
mov dh, 8
jmp 0xcb5057
mov cx, 0xf23c
rdtsc
pop bx
lea esi, [ecx*4]
call 0xcb5099
ljmp 0x7c8a

Function at 0xcb5099
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bl, ch
not ax
xchg di, bx
jmp 0xcb5041
mov dh, ah
xchg byte [esp + 3], bl
xchg ebx, ecx
push word [esp + 2]
pop dword [esp]
jmp 0xcb502b
mov ecx, dword [esp + 3]
pop ebx
lea edx, [edx*4]
sub esp, 0xd
jmp 0xcb506d
push cx
lea edx, [edi*4]
btr edi, ecx
push dword [esp]
pop ebp
mov bx, 0xc489
jmp 0xcb4fff
xchg ebx, eax
lea esp, [esp + 0xb]
cpuid
rdtsc
or di, dx
jmp 0xcb5084
push dword [esp + 0xc]
bsr cx, bx
bsr di, si
pop word [esp + 5]
inc ah
mov dh, 8
jmp 0xcb5057
mov cx, 0xf23c
rdtsc
pop bx
lea esi, [ecx*4]
call 0xcb5099
ljmp 0x7c8a
Function at 0xcb5301
Capabilities:
Execute anti-debugging instructions

Disassembly:
setp bl
lea ecx, reloc.WINMM.dll_midiStreamOut
cmp cx, 0x408e
call fcn.00cb4ff5
setg dl
xchg edx, ecx
bt ecx, ecx
mov edx, eax
shl ecx, 0
setge bh
jmp 0xcb5018
mov dh, bl
clc
xchg ebx, eax
add esp, 0
not eax
mov ecx, 0xda95d7bd
jmp 0xcb50af
cmc
lea esp, [esp + 3]
cpuid
pop esi
mov cl, 0x58
seto dl
jmp 0xcb514a
pop dword [esp + 3]
bswap esi
xchg cx, bp
pop word [esp + 4]
push word [esp + 2]
pop bx
jmp 0xcb5275
xchg bp, dx
xchg word [esp], di
mov ch, cl
pop word [esp + 1]
cpuid
jmp 0xcb53c5
sub esp, 0x11
mov cl, 0xce
xchg word [esp + 7], cx
mov si, di
jmp 0xcb5384
mov byte [esp + 1], al
lea ebx, reloc.WINMM.dll_midiStreamOut
mov dl, byte [esp + 3]
mov edi, ebx
mov esi, eax
dec dx
jmp 0xcb532e
mov edx, eax
mov ecx, edi
mov edx, edi
bswap esi
inc edx
pushfd
jmp 0xcb5344
push word [esp + 6]
setno bl
bt eax, ecx
sub esp, 0xf
cld
jmp 0xcb53ac
mov byte [esp + 8], cl
add esp, 0x10
xchg bx, ax
cpuid
push di
xchg byte [esp], ch
jmp 0xcb536e
mov esi, 0x7345e627
mov dword [esp + 0xc], edi
bsf bp, dx
rdtsc
jmp 0xcb53d3
pop si
rdtsc
push esp
lea esp, [esp + 9]
dec al
mov eax, dword [esp + 7]
jmp 0xcb5396
pop ecx
cmc
setle cl
mov esi, dword [esp]
mov dx, si
cld
jmp 0xcb5362
xchg word [esp + 1], si
bswap eax
sub esp, 0x16
rdtsc
mov dword [esp + 0x21], ebp
push word [esp]
jmp 0xcb542a
pop esi
lea edi, [ecx + 0x83]
mov ch, bh
neg dx
jmp 0xcb543b
xchg ah, cl
lea esp, [esp + 0x18]
pop ebx
add ebx, esi
xchg dword [esp + 6], esi
bswap ebp
jmp 0xcb5414
xchg word [esp + 5], bx
pop esi
pushfd
cpuid
pop dword [esp]
mov di, word [esp + 4]
call fcn.00cb5480
ja 0xcb54b4
jbe 0xcb54ba
dec edi
jne 0xcb54cc
push edi
jb 0xcb54c4
je 0xcb54c2
add byte [ebx], bh
adc cl, byte [ebp - 0x22752b7a]
xchg ah, dl
mov bl, ch
jmp 0xcb52c8
xchg ebp, eax
add byte [eax], al
add byte [eax], al
call fcn.00cb5498
invalid
not bx
mov si, word [esp + 1]
mov esi, dword [esp + 1]
and al, 1
call fcn.00cb5501
push esp
insb byte es:[edi], dx
jae 0xcb5510
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
xchg word [esp], si
add esp, 1
xchg word [esp], ax
setae ch
mov al, 0x11
push word [esp + 1]
jmp 0xcb54be
ja 0xcb5573
jbe 0xcb5579
dec edi
jne 0xcb558b
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0xcb5581
add byte [eax + 0x850c8d], ah
add byte [eax], al
add byte [ebx - 0x5df0ff3c], al
lea ebp, reloc.WINMM.dll_midiStreamOut
pushfd
pop word [esp]
jmp 0xcb54d4
mov eax, dword [ecx + reloc.WINMM.dll_midiStreamOut]
dec edx
lea esp, [esp + 4]
and al, 4
jmp 0xcb5564
and al, 5

Function at 0xcb9ca3
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00cb903c
push dword [esp + 7]
push dword [esp + 0xb]
jmp 0xcb9cb1
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0xcb9cfd
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xcb9037
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xcb9ce2
Function at 0x10001590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1012f420]
fld qword [eax]
push esi
fsub qword [0x10016808]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [0x1012f424]
lea ecx, [esp + 0xc]
fabs
push ecx
fstp qword [esp + 0x14]
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
fmul qword [0x10016800]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push edx
fadd qword [0x100167f8]
push eax
push 8
push edi
fstp qword [edi]
call esi
mov ecx, dword [0x1012f420]
fld qword [ecx]
mov edi, dword [0x1012f428]
fsub qword [0x10016808]
lea edx, [esp + 0xc]
push edx
push 0x40
push 8
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
fmul qword [0x10016800]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
fadd qword [0x100167f8]
push ecx
push 8
push edi
fstp qword [edi]
call esi
mov edx, dword [0x1012f420]
fld qword [edx]
mov edi, dword [0x1012f42c]
fsub qword [0x10016808]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea ecx, [esp + 0xc]
fmul qword [0x10016800]
push ecx
push edx
push 4
fadd qword [0x100167f0]
push edi
fstp dword [edi]
call esi
mov eax, dword [0x1012f420]
fld qword [eax]
mov edi, dword [0x1012f430]
fsub qword [0x10016808]
lea ecx, [esp + 0xc]
fabs
fstp qword [esp + 0x10]
push ecx
push 0x40
push 4
push edi
call esi
fld qword [esp + 0x10]
mov eax, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea edx, [esp + 0xc]
fmul qword [0x10016800]
push edx
push eax
push 4
fadd qword [0x100167f0]
push edi
fstp dword [edi]
call esi
mov ecx, dword [0x1012f420]
fld qword [ecx]
mov edi, dword [0x1012f434]
fsub qword [0x10016808]
lea edx, [esp + 0xc]
push edx
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov ecx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea eax, [esp + 0xc]
fmul qword [0x10016800]
push eax
push ecx
push 4
fadd qword [0x100167e8]
push edi
fstp dword [edi]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [0x1012f438], 0
push esi
push edi
je 0x100018f7
mov edi, dword [0x1012f414]
fld dword [0x1012f43c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1012f440]
mov edi, dword [0x1012f418]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1012f444]
mov edi, dword [0x1012f41c]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld qword [0x1012f448]
mov edi, dword [0x1012f420]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x1012f450]
mov edi, dword [0x1012f424]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x1012f458]
mov edi, dword [0x1012f428]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld dword [0x1012f460]
mov edi, dword [0x1012f42c]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1012f464]
mov edi, dword [0x1012f430]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1012f468]
mov edi, dword [0x1012f434]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
push 1
push 3
call fcn.10003440
push eax
mov eax, 0x59cda0
call eax
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100019b0
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x100019c0
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x100019cc
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x100019d6
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x100019e0
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x100019ea
or eax, 8
shr ecx, 1
test cl, 1
je 0x100019f4
or eax, 4
shr ecx, 1
test cl, 1
je 0x100019fe
or eax, 2
test cl, 2
je 0x10001a06
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001ac0
test al, 1
je 0x10001acd
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001ac0
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x100019b4
pop edi
pop ebx
ret

Function at 0x10001af0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10015ecc
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10001b22
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001b50
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10001bb3
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10001b99
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001b78
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001b70
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10003dc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10003d50
test eax, eax
je 0x10003eb6
push ebx
push esi
push 0x10003f40
push 0x62974d
mov bl, 0xe8
call fcn.1000d250
push 0x10003ec0
push 0x6297a5
call fcn.1000d250
push 0x10003f00
push 0x629800
call fcn.1000d250
push 0x10003f40
push 0x629858
call fcn.1000d250
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x629752
call esi
mov bl, 0x90
lea ecx, [ebp - 4]
push ecx
mov byte [0x629752], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x629752
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x6297aa
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x6297aa], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x6297aa
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x629805
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x629805], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x629805
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62985d
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62985d], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62985d
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100040d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ecx, ecx
mov edi, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x14], edi
lea esi, [ecx + 1]
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a44e8]
mov byte [ebp - 1], al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a44e9]
movzx edx, byte [edi + 0x100a447b]
mov byte [ebp - 3], al
mov byte [ebp - 2], dl
mov eax, 0xf0f0f0f1
mul edi
mov edi, dword [ebp - 0xc]
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a44ea]
movzx edx, byte [edi + 0x100a447b]
mov byte [ebp - 5], al
mov byte [ebp - 4], dl
mov bl, byte [esi + 0x100a447b]
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100a44eb]
movzx edx, byte [ecx + 0x100a447f]
mov byte [ebp - 6], al
mov al, byte [ebp - 1]
mov byte [ebp - 7], dl
mov dl, bl
sub bl, al
xor dl, al
movzx eax, bl
movzx edi, dl
add di, word [ebp - 0x10]
mov dl, byte [ebp - 3]
xor di, ax
mov al, byte [ebp - 2]
mov bl, al
xor bl, dl
sub al, dl
movzx ebx, bl
add di, bx
movzx edx, al
mov al, byte [ebp - 4]
xor di, dx
mov dl, byte [ebp - 5]
mov bl, al
xor bl, dl
movzx ebx, bl
sub al, dl
mov dl, byte [ebp - 6]
add di, bx
movzx eax, al
xor di, ax
mov al, byte [ebp - 7]
mov bl, dl
xor bl, al
movzx ebx, bl
add di, bx
sub al, dl
add dword [ebp - 0xc], 4
movzx edx, al
xor di, dx
movzx eax, di
mov edi, dword [ebp - 0x14]
add esi, 4
add edi, 4
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp esi, 0x21
jb 0x100040f0
mov edx, dword [0xffc934]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax - 0x50]
mov byte [0x1012f1b9], cl
lea ecx, [ebp - 0x14]
push ecx
shr eax, 8
sub al, 8
push 0x40
mov byte [0x1012f1b8], al
mov eax, dword [0xffc968]
push 4
push 0xffc934
mov dword [0x1012f1c0], edx
mov dword [0x1012f1bc], eax
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xffc934], 0x10004010
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xffc934
call esi
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 4
push 0xffc968
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xffc968], 0x10004070
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xffc968
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret