joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004815b
mov eax, dword fs:[0]
push eax
sub esp, 0xdc8
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x79
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x2e
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0
lea eax, [ebp + 0xc]
mov dword [ebp - 0xd1c], eax
mov ecx, dword [ebp - 0xd1c]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xcf4]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
mov dword [ebp - 0xd1c], 0
push 0
call fcn.1000dd00
add esp, 4
mov dword [ebp - 0xd24], eax
mov dword [ebp - 0xd20], edx
lea ecx, [ebp - 0xd24]
push ecx
call fcn.1000dc60
add esp, 4
mov ecx, 9
mov esi, eax
lea edi, [ebp - 0xd18]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x40], 0x25
mov byte [ebp - 0x3f], 0x30
mov byte [ebp - 0x3e], 0x32
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], 0x3a
mov byte [ebp - 0x3b], 0x25
mov byte [ebp - 0x3a], 0x30
mov byte [ebp - 0x39], 0x32
mov byte [ebp - 0x38], 0x64
mov byte [ebp - 0x37], 0x3a
mov byte [ebp - 0x36], 0x25
mov byte [ebp - 0x35], 0x30
mov byte [ebp - 0x34], 0x32
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x20
mov byte [ebp - 0x31], 0x2d
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x25
mov byte [ebp - 0x2e], 0x30
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3a
mov byte [ebp - 0x2a], 0x25
mov byte [ebp - 0x29], 0x30
mov byte [ebp - 0x28], 0x32
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x3a
mov byte [ebp - 0x25], 0x25
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x20
mov byte [ebp - 0x22], 0x3a
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0
mov edx, dword [ebp - 0xd04]
add edx, 0x76c
push edx
mov eax, dword [ebp - 0xd08]
add eax, 1
push eax
mov ecx, dword [ebp - 0xd0c]
push ecx
mov edx, dword [ebp - 0xd18]
push edx
mov eax, dword [ebp - 0xd14]
push eax
mov ecx, dword [ebp - 0xd10]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x524]
push eax
call fcn.1000dc80
add esp, 0x20
push 1
push 0x40
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0xdd4]
call fcn.10006f40
mov dword [ebp - 4], 0
push 0x100066c0
push 0xa
lea edx, [ebp - 0xcf4]
push edx
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0xdd4]
push ecx
call fcn.10005b20
add esp, 8
push eax
call fcn.10005b20
add esp, 8
push eax
call fcn.10005840
add esp, 8
mov ecx, eax
call fcn.10008480
lea ecx, [ebp - 0xdd4]
call fcn.1000b0a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd4]
call fcn.10008820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10008fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x10008fc7
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10008fce
mov al, 1
jmp 0x100090a2
call fcn.10005510
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10005510
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.1000bdc0
add esp, 8
movzx eax, al
test eax, eax
je 0x1000900a
xor al, al
jmp 0x100090a2
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.1000d550
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10009046
cmp dword [ebp - 0x30], 1
je 0x1000904d
cmp dword [ebp - 0x30], 3
je 0x1000909c
jmp 0x100090a0
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x1000907c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.10030cac
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x1000907c
xor al, al
jmp 0x100090a2
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10009090
mov dword [ebp - 0x38], 1
jmp 0x10009097
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x100090a2
mov al, 1
jmp 0x100090a2
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x1000c670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.10005510
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.1000bdc0
add esp, 8
movzx edx, al
test edx, edx
je 0x1000c6b5
lea eax, [ebp + 8]
push eax
call fcn.1000c520
add esp, 4
jmp 0x1000c836
mov ecx, dword [ebp - 0x2c]
call fcn.1000ca00
test eax, eax
je 0x1000c6f7
mov ecx, dword [ebp - 0x2c]
call fcn.1000ca00
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000bda0
cmp esi, eax
jae 0x1000c6f7
lea ecx, [ebp + 8]
push ecx
call fcn.1000d180
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.1000a940
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x1000c836
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x1000c70a
call fcn.10005510
jmp 0x1000c836
mov ecx, dword [ebp - 0x2c]
call fcn.1000aa30
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x1000c759
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.1000d180
add esp, 4
movzx ecx, al
push ecx
call fcn.10005e70
add esp, 8
movzx edx, al
test edx, edx
je 0x1000c749
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x1000c751
call fcn.10005510
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x1000c836
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.1000d180
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.1000c630
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1000c831
cmp dword [ebp - 0x34], 1
jle 0x1000c7b4
cmp dword [ebp - 0x34], 3
je 0x1000c801
jmp 0x1000c831
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x1000c7e6
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.10030cac
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1000c7e6
call fcn.10005510
jmp 0x1000c836
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x1000c7fa
mov eax, dword [ebp + 8]
jmp 0x1000c836
call fcn.10005510
jmp 0x1000c836
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.10005e70
add esp, 8
movzx eax, al
test eax, eax
je 0x1000c824
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x1000c82c
call fcn.10005510
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x1000c836
call fcn.10005510
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d6f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x1000d816
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x1000d728
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000d830
jmp 0x1000d82a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.10009c40
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x1000d7bc
jg 0x1000d750
cmp dword [ebp + 0xc], 0
jbe 0x1000d7bc
cmp dword [ebp - 8], 0
jl 0x1000d7bc
jg 0x1000d75e
cmp dword [ebp - 0xc], 0
jbe 0x1000d7bc
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x1000d77c
jl 0x1000d770
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x1000d77c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.1000c1b0
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.10005370
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000c0a0
cmp dword [ebp + 0x10], 0
jl 0x1000d806
jg 0x1000d7ca
cmp dword [ebp + 0xc], 0
jbe 0x1000d806
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x1000d806
mov ecx, dword [ebp - 4]
call fcn.1000aa30
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1003063f
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x1000d82a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.1000d830
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x1000da6e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x1000d988
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000da90
jmp 0x1000da82
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.1000a910
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x1000da1c
jg 0x1000d9b0
cmp dword [ebp + 0xc], 0
jbe 0x1000da1c
cmp dword [ebp - 8], 0
jl 0x1000da1c
jg 0x1000d9be
cmp dword [ebp - 0xc], 0
jbe 0x1000da1c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x1000d9dc
jl 0x1000d9d0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x1000d9dc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.1000ca00
push eax
call fcn.10005370
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000c9c0
cmp dword [ebp + 0x10], 0
jl 0x1000da5e
jg 0x1000da2a
cmp dword [ebp + 0xc], 0
jbe 0x1000da5e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x1000da5e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10030cac
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x1000da82
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.1000da90
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000dd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x42
mov dword [ebp - 4], 0
jmp 0x1000dd42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xf
jge 0x1000dd81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x72a9db26]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000dd7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000dd39
mov eax, 1
imul ecx, eax, 0xf
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000dda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x5b
mov dword [ebp - 4], 0
jmp 0x1000ddc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jge 0x1000de01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x5b17cf41]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000ddfc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000ddb9
mov eax, 1
imul ecx, eax, 0x18
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000de20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x73
mov dword [ebp - 4], 0
jmp 0x1000de42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 7
jge 0x1000de81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x6125ddaa]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000de7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000de39
mov eax, 1
imul ecx, eax, 7
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000dea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xc1
mov dword [ebp - 4], 0
jmp 0x1000dec2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x1000df01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x390d063a]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000defc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000deb9
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000df20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd7
mov dword [ebp - 4], 0
jmp 0x1000df42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x1000df81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x26700b95]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000df7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000df39
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000e1a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x1000e1b8
pop esi
inc edx
pushf
push 0xa
Function at 0x1000e1c7
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x1000e1c5
jmp 0x1000e1c0
call fcn.1000e1c7
jae 0x1000e1c0
add esp, 4
jmp 0x1000e1cc
dec dword [esp]
jno 0x1000e1d1
jns 0x1000e1bc
jp 0x1000e1d5
add esp, 4
popf
jmp 0x1000e1dc
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e1f5
jne 0x1000e1f5
inc edx
jl 0x1000e1fa
jmp 0x1000e1fc
je 0x1000e1f7
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e216
jne 0x1000e215
call 0x9304d29d
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e224
add eax, 0x1750374
jne 0x1000e224
call 0x35e527ee
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x1000e28f
jg 0x1000e21e
pushf
push 0xa
jae 0x1000e29c
jmp 0x1000e297
call 0x1000e29e
jae 0x1000e297
add esp, 4
jmp 0x1000e2a3
dec dword [esp]
jno 0x1000e2a8
jns 0x1000e293
jp 0x1000e2ac
add esp, 4
popf
jmp 0x1000e2b3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e2cc
jne 0x1000e2cc
invalid
jl 0x1000e2d1
jmp 0x1000e2d3
je 0x1000e2ce
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e2ed
jne 0x1000e2ec
call 0x9304d374
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e2fb
jne 0x1000e2fb
call 0x9b5c415e
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret

Function at 0x1000e348
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x1000e346
jmp 0x1000e341
call fcn.1000e348
jae 0x1000e341
add esp, 4
jmp 0x1000e34d
dec dword [esp]
jno 0x1000e352
jns 0x1000e33d
jp 0x1000e356
add esp, 4
popf
jmp 0x1000e35d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e376
jne 0x1000e376
call 0x1fc116ca
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000e624
Capabilities:
Create thread

Disassembly:
jae 0x1000e536
jmp 0x1000e531
call fcn.1000e538
jae 0x1000e531
add esp, 4
jmp 0x1000e53d
dec dword [esp]
jno 0x1000e542
jns 0x1000e52d
jp 0x1000e546
add esp, 4
popf
jmp 0x1000e54d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e566
jne 0x1000e566
call 0x1fc118ba
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.1000e1a0
clc
jae 0x1000e581
retf
pushf
push 0xa
jae 0x1000e58e
jmp 0x1000e589
call 0x1000e590
jae 0x1000e589
add esp, 4
jmp 0x1000e595
dec dword [esp]
jno 0x1000e59a
jns 0x1000e585
jp 0x1000e59e
add esp, 4
popf
jmp 0x1000e5a5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e5be
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x358
jne 0x1000e5be
jns 0x1000e63b
jl 0x1000e5c3
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x1000e5c5
je 0x1000e5c0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e5df
jne 0x1000e5de
call 0x9304d666
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e5ed
jne 0x1000e5ed
call 0xffe04d9
push dword [ebx]
rol byte [ebp + 0x750374c0], 0
call 0x1000e310
xor eax, eax
test eax, eax
je 0x1000e5fb
jne 0x1000e5fa
call 0x9304d682
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
lcall 0x7002, 0x73f8fb74
lcall 0x669a, 0x1750374
pushfd
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1000e609
jmp 0x1000e60b
je 0x1000e606
clc
jae 0x1000e610
jo 0x1000e5aa
je 0x1000e615
jne 0x1000e615
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x1000e622
jmp 0x1000e61d
call 0x1000e624
jae 0x1000e61d
add esp, 4
jmp 0x1000e629
dec dword [esp]
jno 0x1000e62e
jns 0x1000e619
jp 0x1000e632
add esp, 4
popf
jmp 0x1000e639
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e652
jne 0x1000e652
call 0x1fc119a6
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000e3a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000e450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000e000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000e809
Capabilities:
Create thread

Disassembly:
jae 0x1000e807
jmp 0x1000e802
call fcn.1000e809
jae 0x1000e802
add esp, 4
jmp 0x1000e80e
dec dword [esp]
jno 0x1000e813
jns 0x1000e7fe
jp 0x1000e817
add esp, 4
popf
jmp 0x1000e81e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e837
jne 0x1000e837
call 0x1fc11b8b
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000e6b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e86b
call fcn.10013200
clc
jae 0x1000e870
add dword [ecx], esp
pushf
push 0xa
jae 0x1000e87d
jmp 0x1000e878
call 0x1000e87f
jae 0x1000e878
add esp, 4
jmp 0x1000e884
dec dword [esp]
jno 0x1000e889
jns 0x1000e874
jp 0x1000e88d
add esp, 4
popf
jmp 0x1000e894
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e8ad
jne 0x1000e8ad
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1000e8b2
jmp 0x1000e8b4
je 0x1000e8af
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e8ce
jne 0x1000e8cd
call 0x9304d955
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e8dc
jne 0x1000e8dc
call 0x6ffd2e6b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret