joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101edc0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push edi
mov edi, 0xf0000000
push edi
push 0x18
push 0x1002680
lea ebx, [ecx + 4]
push 0
push ebx
mov dword [ebp - 4], ecx
call esi
test eax, eax
jne 0x101ee16
push edi
push 0x18
push 0x10025f8
push eax
push ebx
call esi
test eax, eax
jne 0x101ee16
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov ebx, dword [ebx]
mov esi, eax
test ebx, ebx
je 0x101ee12
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x101ee25
mov eax, dword [ebp - 4]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x101ee2f
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
je 0x101ee56
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
jmp 0x101ee5f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
ret 8

Function at 0x101eebb
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push 0
test eax, eax
je 0x101eeee
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
push eax
push 0
push 0x20006
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyTransactedW]
jmp 0x101eefc
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegDeleteKeyExW]
pop esi
pop ebp
ret 0xc
Function at 0x4271b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x81e328]
xor edx, edx
cmp eax, edx
jne 0x4271d6
xor eax, eax
mov byte [eax + 0x81e228], al
inc eax
cmp eax, 0x100
jl 0x4271be
mov dword [0x81e328], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x81e228
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x427267
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42723a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x427208
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4272e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x427333
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42731a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43bb60
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4804b8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x43bb99
inc eax
mov dword [esi + 0x10], eax
jmp 0x43bcac
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x43bbad
mov eax, 0xffffffc7
jmp 0x43bcae
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x43bbbe
cmp dword [esi + 8], eax
jne 0x43bbad
cmp dword [esi + 8], eax
jne 0x43bbd7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x43bbd7
mov eax, 0xffffffc7
jmp 0x43bcae
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x43bbeb
push eax
mov ecx, ebx
call fcn.0043b390
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.0040aa00
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x43bc1c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.0040aa20
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0043ab00
test eax, eax
mov dword [esp + 0x38], eax
je 0x43bc4f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7ec080
call fcn.0040ac00
mov eax, dword [esp + 0x38]
jmp 0x43bcae
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0043b9c0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x43bc93
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0043b9e0
mov esi, eax
test esi, esi
jne 0x43bcc3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0043b9c0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x43bc65
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7ec080
call fcn.0040ac00
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x7ec080
call fcn.0040ac00
mov eax, esi
jmp 0x43bcae
Function at 0x887d7b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x408427
call fcn.0091003d
pop ecx
add eax, 0x9f8f9163
jo 0x887dbf
mov edx, 0xbe16efef
lea ebx, [ecx + 0x6c6f8d90]
lea ebp, [edi + 0x6c]
dec esi
sub eax, 0xf4752b3c
push ebx
sub ebp, dword [eax]
jle 0x887dcd
sub cl, byte [esp + ebx*4]
retf 0x7cce
std
jg 0x887d95
sub byte [eax + 0x2f60ebed], bl
cld
movsb byte es:[edi], byte [esi]
dec esi
add ebp, ebp
mov ebx, 0x93dd5769
bound esp, qword [0x23f43660]
mov al, 0xd5
das
pop esp
jecxz 0x887e3e
aaa
leave
mov ebp, 0xf081b0f5
mov ecx, dword [ebp + 0x21]
add dh, byte [edx]
cwde
outsd dx, dword [esi]
inc ebx
and al, 0x6d
das
retf
or al, 0x81
jno 0x887e9a
cdq
xchg ecx, eax
in al, 0xcb
adc al, 0x68
invalid
mov bl, 0xfc
push ds
in eax, dx
ret 0x7518
dec ebx
sbb bl, ch
outsd dx, dword [esi]
pop eax
daa
insb byte es:[edi], dx
imul ebp, esi, 0xa270c2d2
cli
and bl, ch
mov eax, 0x30e0f71e
call [edi + 0x4c]
cmc
jo 0x887e79
mov dl, 0x12
scasd eax, dword es:[edi]
das
xchg esi, eax
pop edi
sub ebx, dword es:[ebx + 0x65]
and byte ds:[0x5ee0359], ch
invalid

Function at 0x8963cb
Capabilities:
Encode data using xor

Disassembly:
push 0xdb4c17f2
lea ecx, [ecx + 0x387c0c38]
jmp 0x8c1fc6

Function at 0x8bb636
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.0090e079
mov dword [esp + 0x2c], esi
lea esi, [ebp + 0x1695d789]
movsx si, dl
mov dword [esp + 0x28], eax
xchg esi, eax
xchg si, ax
mov eax, 0x472a50
jmp 0x8afb3a

Function at 0x8d0541
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
mov edi, eax
xadd ah, dl
movzx dx, dl
das
mov dword [edi], ecx
rdtsc
shld cx, di, cl
bsr edx, ecx
mov edx, dword [esi + 8]
bsf cx, sp
pushal
and ch, dh
add esp, 0x24
mov ah, 0x77
cwde
mov dword [edi + 8], edx
lahf
mov eax, dword [esi + 4]
lea esi, [0x51bc1c2d]
xchg cx, si
lea ecx, [ebp - 0xc]
pushfd
mov dword [esp], ecx
movzx si, cl
jmp 0x9f7fc3
call fcn.009b2609
pushal
lea esp, [esp + 0x30]
jbe 0xa39b5a
mov dword [ebp - 0xc], esi
jmp 0x9b88fa
push 0x6173c3e2
lea esp, [esp + 4]
call fcn.008568bd
bts cx, bp
adc di, di
add dh, dl
add cx, 0xaa2e
mov ecx, dword [esi]
jmp 0x89ca94
mov dword [ebp - 0xc], esi
pushfd
pushfd
lea esp, [esp + 0x30]
call fcn.008568bd
bswap edx
neg edi
mov ecx, dword [esi]
lea edi, [edx - 0x7afba832]
sub di, di
test cl, 0xfe
bts dx, sp
mov edi, eax
cdq
lea edx, [esi - 0x419eff39]
mov dword [edi], ecx
rdtsc
mov edx, dword [esi + 8]
clc
ror ax, 0xc
xadd ax, cx
shrd cx, dx, cl
add esp, 4
pushfd
xchg cx, ax
cwde
setbe ch
mov dword [edi + 8], edx
movsx cx, al
lea eax, [edx + 0x23674041]
mov eax, dword [esi + 4]
not si
lea ecx, [ebp - 0xc]
movzx si, cl
mov dword [esp], ecx
mov si, si
push 0xa9146faa
pop esi
lea esi, [ebx + 0x20]
pushal
push dword [esp + 4]
mov byte [esp], dh
mov dword [ebp - 8], edi
jmp 0x8c09e6
call fcn.00968cb0
push 0x2012d19f
pushal
pushfd
jmp 0x9e6320

Function at 0x8d430f
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0x4cb04c86
mov esi, 0x47ad0e
mov byte [esp + 4], al
mov esi, dword [esi + 0x4ceb52]
push dword [esp]
lea esi, [esi - 0x7efeec1a]
pushfd
call fcn.009469d1
Function at 0x924b69
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0x43
mov byte [esp + 4], bh
lea ebx, [ebx + 0x5380fb32]
jmp 0x975cc8
call fcn.008507d0
xor eax, 0x130d964b
stosd dword es:[edi], eax
in eax, dx
push dword [0x130d964b]
xor ah, byte [eax + edx*8]
outsb dx, byte [esi]
scasb al, byte es:[edi]
jo 0x975d16
invalid
int3
jnp 0x975cca
pop edi
mov eax, dword [0x3223dfe2]
imul ebp, eax, 0x507ed5f1
add edx, dword [esp - 0x4c2f2333]
imul edi, dword [bp + si - 0x4a], 0xffffffb5
xchg ebx, eax
je 0x975db2
js 0x975cdc
mov al, 0x8e
mov al, 0xc7
xchg esp, eax
xchg esi, eax
xchg ebx, eax
and eax, dword [eax + 0x1ef4cf1d]
arpl word [esp + 0x59], cx
xor bh, byte [edi + 0x67304960]
mov al, byte [0x1984fa92]
sub bh, bh
sbb al, 0xae
faddp st(4)
outsd dx, dword [esi]
mov esi, dword [ebp + eax - 0x1638e185]
enter 0x6077, 1
imul esp, dword [esi], 0xfffffff9
rcr byte [ecx], cl
mov edx, 0x5066b9b7
aam 0xa
add ah, byte [ebp - 0x3d5832d9]
mov dh, 0xbb
mov esp, 0x762064c6
jle 0x975dee
scasb al, byte es:[edi]
jo 0x975dc7
or eax, 0x73fbf4e4
mov al, byte [0xa081715c]
inc esp
pop ebx
cmp dword [ebp - 0x50771343], 0x51
and eax, 0xdbf10016
scasb al, byte es:[edi]
xor eax, 0x917edfaf
cli
test byte [ebp + ecx*4 + 0x6ecad89c], ah
mov esi, dword [ebp + ebp + 0x73f61487]
out 0xf5, al
sub al, 0xc6
fisubr dword [esi + 0x3d]
mov al, 0xb3
push ebx
mov dh, byte [edi]
shr ebp, 0x11
imul ebx, dword [esi + 0x7b7538af], 0xffffffe9
mov al, byte [0xe23edb9d]
sub ecx, ebp
ljmp 0x5083
invalid
fstp xword [esi]
loop 0x975df6
int 0xea
retf
cmp eax, 0x9ec50e01
sbb dword [edx], esp
push es
scasd eax, dword es:[edi]
imul esp, dword [eax], 0xca938499
dec ecx
sal dl, 1
add ecx, dword [ebp - 0x2b341fda]
mov byte [ebx + ecx*4], bl
xchg edx, eax
aam 0xca
mov cl, 0xf1
push ss
inc ecx
mov byte [edx + 0x2fddfe35], ah
or bh, dl
lea esi, [edi]
jbe 0x975e37
wait
mov bh, 0xb6
js 0x975e2c
aam 0xe3
pushfd
push ss
invalid
jl 0x975e5e
push ss
cmp dh, byte [ecx + 0x4a]
xor edx, dword [ebx - 0x5d]
jle 0x975e61
or dword [edx], ecx
sub al, 0xc9
jmp 0x975ea7
dec ecx
sbb al, 0x66
test byte [edi], dl
mov al, byte [0x7c5f901d]
bound eax, qword [eax + 0x3f4f2894]
sub bh, ch
invalid
lahf
rol ecx, 1
inc ecx
bound esi, qword [ecx - 0xc]
mov esp, 0x607e9c9b
test byte [ebx + 0x7e], cl
repne outsd dx, dword [esi]
xor dl, byte [ebp - 0x6c0b64ee]
rcl dword [edi], cl
into
lodsd eax, dword [esi]
rcl byte [ebx + 0x16], 0xb2
adc bh, bl
ret 0x5c54

Function at 0x987e66
Capabilities:
Packed with generic packer

Disassembly:
mov edi, 0x45f7b5
not esi
pushal
push dword [esp]
call fcn.0084aec5
Function at 0x987e76
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebx, dword [ebx + 0x49389a]
jmp 0x95041b
lea ebx, [ebx + 0x62ecf0d3]
jmp 0xa35a80
pushfd
call fcn.00a43492
pushfd
mov byte [esp], 0x18
push ebx
pushal
mov dword [esp + 0x2c], ebx
lea esp, [esp + 0x28]
jle 0xa0dd7c
mov ebx, 0x47f5a8
push 0x577d303b
push esp
jmp 0x9004e7
lea ecx, [esp + ebx*4 - 0xb009d18]
dec dword [ecx - 0x72a80383]
mov dword [ebp - 4], edi
push edi
lea esp, [esp + 0x10]
dec edi
jnp 0xa0dd23
add al, 0x24
mov ebx, dword [edi + eax*8 - 0x6afbdbbc]
add al, 0x95
fbld tbyte [0x648d6020]
and al, 0x24
jmp fcn.004037ee
mov bx, dx
mov ebx, 0x47f5a8
test al, 0xf5
inc edi
add al, ch
jo 0xa0dddc
call fcn.00a032f9
sbb ebx, dword [eax - 0x24]
dec eax
out dx, eax
mov bh, 0x70
mov byte [ebx + 0x3041999d], ch
sub al, 0x4b
invalid
inc ecx
xor byte [ebx + ecx*2], ch
out dx, eax
push es
jbe 0xa0dd80
jg 0xa0dd25
or eax, 0xce4c2819
pop esp
or byte [eax], bl
fbstp tbyte [edi - 0x399be5d4]
push ebp
jae 0xa0dd95
cmpsb byte [esi], byte es:[edi]
jb 0xa0dd5a
mov bh, 0x71
cmp esp, dword [ecx - 0x77c302cb]
jecxz 0xa0ddb2
pop ss
jno 0xa0ddfe
mov byte [ecx + 0x48], dl
xor eax, 0x96d2b1f9
jge 0xa0de0e
xchg byte [ecx + 0x79306732], ch
mov ecx, 0xee2314c3
jle 0xa0dd64
lcall 0x2f2d, 0xbdc12a2a
enter 0x2dfd, 0xffffffffffffff88
xor byte [edi + 0xe71a8fd], 0xcc
int1
jp 0xa0dd84
mov ebp, 0xfdc82f2d
sub eax, 0xfdb78288
test al, 0x71
push cs
int3
mov eax, 0x41f0d703
iretd
js 0xa0de3f
adc byte [edi], al
jecxz 0xa0de6a
pop ss
fstp qword [ebx + eax*8 - 7]
out 0xb, eax
sal byte [ebx + 0x25060f46], cl
call 0x7c25999c
add eax, 0x277f1b4e
mov bl, 0x46
clts
and eax, 0x84bb84e8
jnp 0xa0de1e
dec esi
sbb edi, dword [edi + 0x27]
mov dword [esi], ecx
push cs
sub ebx, esi
invalid
sbb byte [ebp - 0x44f9687a], 0x2a
cld
out dx, al
jns 0xa0de77
retf 0x6b08
ret 0xb605
or byte [edx], 0xf
shr byte [ebx + 0x3c], cl
invalid
xchg dword [esp + 0x28], ebx
pushfd
push dword [esp]
pushfd
push dword [esp]
push dword [esp + 0x38]
ret 0x3c

Function at 0x991628
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0x24], ebp
jmp 0xa218dc

Function at 0x9925de
Capabilities:
Packed with generic packer

Disassembly:
call fcn.0097b074
sub al, 0x79
mov cl, 0x73
aaa
mov al, 0x70
push eax
fcom dword [0xf5a04009]
movsd dword es:[edi], dword [esi]
xchg esp, eax
nop
xchg edi, eax
dec edi
sub al, 0xe8
invalid

Function at 0x9969f6
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx - 0x6da5881c]
call fcn.0090b0d3
mov ecx, 0x4462ed
pushal
pushfd
mov ecx, dword [ecx + 0x5ff979]
pushfd
jmp 0x94a762

Function at 0x9aab60
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ebp - 1], 1
not al
call fcn.008d5bb2
mov byte [esp + 8], cl
mov byte [esp + 0xc], cl
lea esp, [esp + 0x58]
jb 0x8bc2ae
rdtsc
rdtsc
mov cx, ax
dec dword [esi + 0x28]
movzx bx, dl
jmp 0x925416
Function at 0x9deb6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx edx, bl
nop
ja 0x8d050c
movsx dx, cl
movsx edx, al
pop edx
js 0xa4197b
pushal
xchg dword [esp + 0x20], edx
mov byte [esp + 8], cl
pushal
xchg dword [esp + 0x3c], edx
pushfd
push ecx
mov dx, word [esp]
mov edx, 0x45d44a
call fcn.009b6b52
call fcn.0097f0a2
mov byte [esp], 0x98
mov esi, dword [esi + 0x4fae8d]
mov word [esp], 0x8cb5
lea esp, [esp + 0x58]
jp 0xa5bdf2
push esi
pushfd
lea esi, [esi + 0x18cba59b]
pushfd
call fcn.009be1b4
push edi
lea esi, [esi + 0x18cba59b]
call fcn.00949874

Function at 0x9fec55
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edi*4 + 0x7de388a9]
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 0x3a99f86a]
mov dx, si
movzx ecx, word [edi + ebx*8 + 4]
not dh
pushfd
lea esp, [esp + 4]
jge 0x996bc9
movsx dx, dl
mov edx, dword [ebp + 0x10]
pushfd
pushal
mov word [esp + 8], cx
jmp 0xa103cc
push ecx
lea edx, [0x6e1fba69]
mov edx, dword [ebp + 0x10]
call fcn.009b89e8
xchg dword [esp + 0x14], edx
mov dword [esp], 0xe8122c1b
call fcn.008967a3
lea esp, [esp + 4]
jns 0x84d865
stc
and eax, 0x7fffffff
movzx edx, dl
inc dl
shrd bx, bp, 7
add eax, dword [esi + 0x2c]
lea edx, [edx*2 - 0x2bbe0dba]
mov dx, sp
xchg bh, dl
not dl
mov ebx, eax
jmp 0xa30613
mov dh, 0x3b
lea edx, [eax + 2]
push ecx
lea esp, [esp + 4]
jmp 0x8f604a

Function at 0xa0dd73
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov dword [esp + 0x30], ebp
call fcn.0087b662

Function at 0xa838fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pop dword [esp + 0x34]
bsf edi, edx
not al
cmp edx, 0x10b3f086
adc bl, 0x9b
xchg dword [esp + 0x30], esi
mov word [esp + 0x14], 0x6b4e
xor esi, 0x4b1cb8e6
pop esi
test ah, 0x57
mov dword [esp + 0x28], ebp
ror si, 6
cmc
btc si, ax
push dword [0xa83a0e]
pop dword [esp + 0x24]
sal si, cl
ror bp, cl
adc bp, si
mov dword [esp + 0x20], 0
ror bp, 5
bsr di, sp
cmp cl, 4
rol si, cl
mov esi, dword [esp + 0x50]
jmp 0xa83eef
pop ebp
sub esi, 0x6f7b6857
sub bp, 0x25c1
adc cl, bh
jmp 0xa84ffc
neg esi
shr bp, cl
sub esi, 0xf39abf16
jmp 0xa85338
ror ebp, 0x13
push 0x40d5d411
lea ebp, [esp + 0x20]
dec bl
not ch
dec ch
sub esp, 0xa0
add edi, ebx
mov edi, esp
pushfd
sub al, 0xea
xadd bh, al
mov ebx, esi
bsr cx, cx
sal al, cl
rol al, 1
movzx cx, cl
add esi, dword [ebp]
add esp, 4
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1001295
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push 0x2710
push 2
call fcn.01001f58
pop ecx
pop ecx
push 2
call dword [sym.imp.msvcrt.dll_exit]
int3
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call fcn.01002011
push 0x1003060
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x10012d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2711
call fcn.01001fce
cmp dword [ebp + 8], 2
jl 0x1001342
mov ebx, dword [esi + 4]
inc dword [0x100300c]
and dword [0x1003204], 0
mov edi, 0x1001158
jmp 0x1001325
sub eax, 0x3f
je 0x1001342
sub eax, 0x2d
je 0x1001319
dec eax
dec eax
jne 0x1001325
push 0
call dword [sym.imp.msvcrt.dll__close]
push 0
push 0x1001154
call dword [sym.imp.msvcrt.dll__open]
add esp, 0xc
jmp 0x1001325
mov eax, dword [0x1003208]
test eax, eax
mov dword [ebp - 4], eax
je 0x1001342
push edi
push esi
push dword [ebp + 8]
call fcn.01002019
cmp eax, 0xffffffff
jne 0x10012f1
mov eax, dword [0x100300c]
cmp dword [ebp + 8], eax
jle 0x1001342
test ebx, ebx
jne 0x1001347
jmp 0x1001279
lea eax, [esi + eax*4]
push eax
push 0
push 1
push 0x100114c
push dword [ebp - 4]
push ebx
push dword [esi]
call fcn.01001c52
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x100136b
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001160
call fcn.01001520
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10013a6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10013a6
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10013be
cmp eax, 0x20b
je 0x10013ab
mov dword [ebp - 0x1c], edi
jmp 0x10013d2
cmp dword [ecx + 0x84], 0xe
jbe 0x10013a6
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x10013cc
cmp dword [ecx + 0x74], 0xe
jbe 0x10013a6
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10031f0], 0xffffffff
or dword [0x10031f4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100302c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1003028]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10031f8], eax
call fcn.01001518
cmp dword [section..data], edi
jne 0x100142d
push fcn.01001518
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001501
push 0x1001128
push 0x1001124
call sub.msvcrt.dll__initterm
mov eax, dword [0x1003024]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1003020]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1001120
push 0x1001118
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001295
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x10014a4
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10014d9
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100155b
ret
Function at 0x1001589
Capabilities:
Manipulate console buffer
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
inc ebx
cmp dword [0x1003034], 0
push esi
push edi
mov byte [0x100303c], bl
je 0x1001673
and dword [ebp - 4], 0
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 8], eax
mov eax, dword [0x1003030]
test eax, eax
je 0x10015c9
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x3e8
push dword [0x1003034]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1001659
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
cmp eax, 3
je 0x100164b
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
mov word [ebp - 0x20], bx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x12], 0xd
mov word [ebp - 0x18], bx
mov word [ebp - 0x16], 0xd
call esi
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call esi
push 0x3e8
push dword [0x1003034]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10015e7
jmp 0x1001659
push 0
push dword [0x1003034]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x1003034]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [0x1003030]
test eax, eax
je 0x1001673
push eax
call esi
mov eax, dword [0x1003038]
test eax, eax
je 0x1001683
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1003004]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
je 0x1001696
push eax
call esi
mov eax, dword [0x1003008]
cmp eax, 0xffffffff
je 0x10016a3
push eax
call esi
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_exit]
int3