joyce8/EMBER2024-capa huggingface dataset:
Function at 0x93ea00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x93ea73
mov edx, dword [ecx]
test edx, edx
je 0x93ea73
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x20272625
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xc9
xor bl, byte [esp + eax]
add bl, 0x13
mov byte [esp + eax], bl
inc eax
cmp eax, 4
jne 0x93ea30
mov eax, dword [esp]
mov ebx, dword [0x67b064]
test ebx, ebx
je 0x93ead3
xor edi, edi
mov esi, dword [0x67b068]
nop
nop
nop
cmp dword [esi + edi*8], 0xaf0e0c2e
je 0x93eaaf
inc edi
cmp ebx, edi
jne 0x93ea60
mov edi, dword [ebp + 0xc]
jmp 0x93ead3
mov dword [esp], 0xf3323148
mov eax, 0x4f21078c
nop
movzx ecx, byte [esp + eax - 0x4f21078c]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x44
mov byte [esp + eax - 0x4f21078c], cl
inc eax
cmp eax, 0x4f210790
jne 0x93ea80
mov eax, dword [esp]
jmp 0x93ec1b
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0xc]
je 0x93ead3
push dword [ebp + 8]
push edx
push 8
push esi
push dword [0x67b06c]
mov esi, ecx
call fcn.00940f50
mov ecx, esi
add esp, 0x14
test edi, edi
je 0x93eb91
cmp eax, 0xc000010a
jne 0x93eb91
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
mov dword [esp], eax
mov dword [esp + 4], edx
mov ebx, dword [ecx]
mov dword [esp + 0xc], 0x20272625
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xc9
xor dl, byte [esp + eax + 0xc]
add dl, 0x13
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 4
jne 0x93eb10
xor edx, edx
cmp edi, 0xffffffff
je 0x93eb2f
mov edx, esp
mov eax, dword [esp + 0xc]
mov esi, dword [0x67b064]
test esi, esi
je 0x93eb91
mov dword [esp + 0x10], edx
mov dword [esp + 8], ebx
xor ebx, ebx
mov edx, dword [0x67b068]
nop
nop
nop
cmp dword [edx + ebx*8], 0x4c697c35
je 0x93eb6a
mov edi, ebx
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
cmp ebx, esi
jb 0x93eb50
jmp 0x93eb91
mov edx, dword [edx + ebx*8 + 4]
cmp edx, eax
je 0x93eb91
push dword [esp + 0x10]
push 0
push dword [esp + 0x10]
push 0xc
push edx
push dword [0x67b06c]
mov esi, ecx
call fcn.00940f50
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x93ec1b
mov edx, dword [ecx]
test edx, edx
je 0x93ec1b
mov dword [esp + 8], edx
mov dword [esp], 0x20272625
xor ebx, ebx
mov edx, ebx
add dl, 0xc9
xor dl, byte [esp + ebx]
add dl, 0x13
mov byte [esp + ebx], dl
inc ebx
cmp ebx, 4
jne 0x93ebb0
mov esi, dword [0x67b064]
test esi, esi
je 0x93ec15
mov edx, dword [esp]
xor ebx, ebx
mov edi, dword [0x67b068]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0x1b6183f2
je 0x93ebf0
inc ebx
cmp esi, ebx
jne 0x93ebe0
jmp 0x93ec15
mov esi, dword [edi + ebx*8 + 4]
cmp esi, edx
je 0x93ec15
push dword [esp + 8]
push 4
push esi
push dword [0x67b06c]
mov esi, ecx
mov edi, eax
call fcn.00940f50
mov eax, edi
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x942980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
movzx eax, word [eax]
mov dword [esp + 8], eax
mov dword [esp], 0xb18e7543
mov word [esp + 4], 0
mov ebp, 0xa382385d
mov esi, 0x5c7dc7a2
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ebp + 0x5c7dc7a3]
mov ebx, edx
xor ebx, ebp
or ebx, esi
mov eax, ebx
shr al, 1
and al, 1
mov ecx, ebx
not cl
mov ah, cl
and ah, 0x7d
mul ah
add al, al
sub dl, al
test bl, 2
sete al
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, ebp
add al, 0x2f
mov byte [esp + ebp + 0x5c7dc7a3], al
inc ebp
dec esi
cmp ebp, 0xa3823863
jne 0x9429b0
xor ecx, ecx
mov eax, dword [esp + 8]
cmp dword [esp], eax
setne cl
xor eax, eax
mov ebp, dword [esp + 0x3c]
jmp dword [ecx*4 + 0x678834]

Function at 0x943740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
mov eax, edx
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx]
lea ebx, [edx + 0x6e667871]
xor ebx, ecx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
add cl, 0xca
mov byte [esp + edx], cl
mov ecx, edx
xor eax, 1
add eax, edx
and edx, 1
and ecx, 6
add eax, edx
sub eax, ecx
mov edx, eax
cmp eax, 7
jb 0x943770
mov eax, dword [esp]
mov edx, dword [0x67b064]
test edx, edx
je 0x9437f8
xor ebx, ebx
mov ecx, dword [0x67b068]
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x9437d0
inc ebx
cmp edx, ebx
jne 0x9437c0
jmp 0x9437f8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x9437f8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x67b06c]
call fcn.00940f50
add esp, 0x20
test edi, edi
je 0x943802
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x94380e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40101c
Capabilities:
Allocate or change rwx memory

Disassembly:
push pe_nt_image_headers32
push 0x3000
push 0xd0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret
Function at 0x1002df80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002e144
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x1002dfaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002dfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002dfa0
mov eax, 1
add ebx, ebx
jne 0x1002dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002dfb8
jne 0x1002dfd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002dfb8
xor ecx, ecx
sub eax, 3
jb 0x1002dfe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002e05a
mov ebp, eax
add ebx, ebx
jne 0x1002dff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002e000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002e024
inc ecx
add ebx, ebx
jne 0x1002e010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002e005
jne 0x1002e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002e005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002e044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002e035
jmp 0x1002dfa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002e044
add edi, ecx
jmp 0x1002dfa6
pop esi
mov edi, esi
mov ecx, 0xc42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002e062
cmp byte [edi], 0x11
jne 0x1002e062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002e067
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x1002e0d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e44c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002e094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e4a0]
or eax, eax
je 0x1002e0d0
mov dword [ebx], eax
add ebx, 4
jmp 0x1002e0b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002e107
cmp al, 0xef
ja 0x1002e0fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002e0dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002e0e9
mov ebp, dword [esi + 0x2e4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002e13b
sub esp, 0xffffff80
jmp 0x10013194

Function at 0x40892c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x4085d8
sub edx, ebx
mov edx, 0x2a5ccfb7
call fcn.00408955
xor dword [edi], eax
and edx, ebx
inc edi
add edx, ebx
cmp edi, ecx
jne fcn.0040892c
ret
Function at 0x10029feb
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002a05a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xfffffff5
jmp 0x1002a03f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff0
jl 0x1002a058
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x1002a034
jmp 0x1002a06c
push 1
push 0x1fec
push 0x1c7b
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esp, ebp
pop ebp
ret

Function at 0x1002b168
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002b18d
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 2
jmp 0x1002b1ae
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002b1ae
push 0x3b6
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esp, ebp
pop ebp
ret
Function at 0x1002f19a
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002f2e0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push 0x14
push 0
push 0x3ab6
push 0x346e
call fcn.10022c6d
pop ecx
pop ecx
call eax
push eax
push 0x3ab6
push 0x303e
call fcn.10022c6d
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 8], 0
lea eax, [ebp - 4]
push eax
push 0x7b7e
push 1
call fcn.1002e37a
add esp, 0xc
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x50]
mov eax, dword [ebp - 8]
push dword [eax]
push 0x3ab6
push 0x40fe
call fcn.10022c6d
pop ecx
pop ecx
call eax
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x54]
mov eax, dword [ebp - 8]
push dword [eax]
push 0x3ab6
push 0x40fe
call fcn.10022c6d
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx + 0x54]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push dword [eax]
call fcn.10022cbe
add esp, 0xc
push 0x41df
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0xa89
lea eax, [ebp - 0x14]
push eax
call fcn.1002eed6
add esp, 0x18
push 0x2b46
push 1
push 0x2e18
push 0x7295
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x6be0
call fcn.1002ef4d
add esp, 0x1c
jmp 0x1002f2e8
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x1002f47e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f4a2
xor eax, eax
jmp 0x1002f5e2
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002f2ec
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f4ca
xor eax, eax
jmp 0x1002f5e2
push 0x24a9
push 1
push dword [ebp - 8]
push 0x7ae8
push 0x5972
lea eax, [ebp - 0xc]
push eax
call fcn.1002d824
add esp, 0x18
cmp dword [ebp - 0xc], 0
jne 0x1002f4f7
xor eax, eax
jmp 0x1002f5e2
lea eax, [ebp - 0x24]
push eax
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1002f347
add esp, 0x18
push dword [ebp + 8]
push 0
push 0x2ced
push dword [ebp - 8]
push dword [ebp - 4]
push 0x6c66
call fcn.1002d824
add esp, 0x18
lea eax, [ebp - 8]
push eax
push 0x1435
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002f3c3
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x1002f565
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002f41f
add esp, 0xc
push dword [ebp - 4]
call fcn.1002d6f4
pop ecx
test eax, eax
jne 0x1002f576
xor eax, eax
jmp 0x1002f5e2
push 0x4f88
push dword [ebp - 4]
push 0
call fcn.1002e37a
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f5ca
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f5a7
xor eax, eax
jmp 0x1002f5e2
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f5c0
xor eax, eax
jmp 0x1002f5e2
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f5db
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f5df
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100412c1
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100412f8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10041303
push 0x3b6
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esp, ebp
pop ebp
ret
Function at 0x10059210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.100592a0
movzx eax, al
test eax, eax
je 0x10059241
push 0x10001580
push 0x10670670
call fcn.1004aef0
add esp, 8
push 0
call fcn.10068276
mov ecx, dword [ebp - 4]
call fcn.10059570
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.100593a0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1007ac62
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008438c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006b58a
mov dword [ebp - 0x14], eax
cmp dword [0x10671708], esi
jne 0x1007ad55
push 0x800
push esi
push 0x10007dec
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007ace2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007ae35
push esi
push esi
push 0x10007dec
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007ae35
push 0x10007e04
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007ae35
push eax
call ebx
push 0x10007e10
push edi
mov dword [0x10671708], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007e20
push edi
mov dword [0x1067170c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007e34
push edi
mov dword [0x10671710], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10671718], eax
test eax, eax
je 0x1007ad52
push 0x10007e50
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10671714], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007ad7a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007ad6d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007ad8f
push 4
pop eax
jmp 0x1007ae37
cmp dword [ebp - 0x14], esi
je 0x1007ad8f
push dword [0x10671708]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007ad74
mov eax, dword [0x10671714]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007aded
cmp dword [0x10671718], edi
je 0x1007aded
push eax
call ebx
push dword [0x10671718]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007aded
test eax, eax
je 0x1007aded
call ecx
test eax, eax
je 0x1007ade2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007ade2
test byte [ebp - 8], 1
jne 0x1007aded
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007ae1d
mov eax, dword [0x1067170c]
cmp eax, edi
je 0x1007ae1a
push eax
call ebx
test eax, eax
je 0x1007ae1a
call eax
mov esi, eax
test esi, esi
je 0x1007ae1a
mov eax, dword [0x10671710]
cmp eax, edi
je 0x1007ae1a
push eax
call ebx
test eax, eax
je 0x1007ae1a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10671708]
call ebx
test eax, eax
je 0x1007ae35
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007ae37
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10067415
mov esp, ebp
pop ebp
ret
Function at 0x100129b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 8], 0xe
mov dword [ebp - 0x34], 4
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x4c], 8
mov eax, dword [ebp - 0x34]
sub eax, 4
mov dword [ebp - 0x18], eax
and dword [ebp - 0x14], 0
mov dword [ebp - 0x58], 0x50fd
mov dword [ebp - 0x40], 0xa1fb6b10
mov eax, 0x329
mul dword [ebp - 0x58]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x1f04
add dword [ebp - 0x18], 0x5a32
mov eax, dword [ebp - 0x4c]
sub eax, 8
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x1ee2
add dword [ebp - 0x14], 0x4777
add dword [ebp - 0x18], 0x310ca
mov eax, dword [ebp - 0x44]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
inc ecx
xor edx, edx
div ecx
mov dword [ebp - 0x88], eax
mov edi, eax
mov dword [ebp - 0x5c], edi
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
sub edx, 2
sub eax, edx
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x44]
mov eax, 0x18
mov ecx, dword [ebp - 0x4c]
cdq
idiv ecx
add edi, eax
cmp dword [ebp - 0x24], edi
jbe 0x10013a4
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov al, byte [edx + eax]
mov byte [ebp - 0x1d], al
movzx eax, byte [ebp - 0x1d]
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x40]
and edx, 0xff
xor eax, edx
mov byte [ebp - 0x1d], al
dec dword [ebp - 0x24]
mov edi, dword [ebp - 0x24]
mov eax, 0xc
mov ecx, dword [ebp - 0x1c]
cdq
idiv ecx
add edi, eax
mov edx, dword [ebp - 0x14]
mov cl, byte [ebp - 0x1d]
mov byte [edx + edi], cl
jmp 0x1001350
mov dword [ebp - 0x60], 0x1003afc
inc dword [ebp - 0x38]
mov dword [ebp - 0x50], 0x108e000
mov eax, dword [ebp - 8]
sub eax, 0xa
cmp eax, dword [ebp - 0x38]
jae 0x1001329
mov dword [ebp - 4], 0x11a1000
mov ebx, 0x102b0fc
mov eax, dword [ebp - 0x1c]
sub eax, 0xc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x60]
mov al, byte [edx + eax]
mov byte [ebp - 0x1d], al
inc dword [ebp - 0x28]
mov edi, dword [ebp - 0x28]
mov eax, 0xc
mov ecx, dword [ebp - 0x1c]
cdq
idiv ecx
sub edi, eax
mov edx, dword [ebp - 0x50]
mov cl, byte [ebp - 0x1d]
mov byte [edx + edi], cl
mov eax, 0x27520
cmp eax, dword [ebp - 0x28]
ja 0x10013d9
mov dword [ebp - 0x10], 0x10388fc
mov dword [ebp - 0x64], 0x103bcf8
mov dword [ebp - 0x68], 0x10000000
mov esi, dword [ebp - 0x34]
sub esi, 4
jmp 0x1001432
mov eax, dword [ebp - 4]
mov dl, byte [ebx + esi]
mov byte [eax + esi], dl
inc esi
cmp esi, 0xd2d4
jb 0x1001428
Function at 0x4060c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esi]
jl 0x4060e4
or byte [ebx - 0x40c372fa], cl
sbb dword [eax], 0x4c
push ss
shl edi, 2
mov dword [edx - 0x45], ecx
mov eax, dword [esi]
push edi
push ebx
mov dword [eax + 0x1010], ecx
mov edx, dword [esi]
mov dword [edx + 0x3d2014], ecx
mov eax, dword [esi]
mov dword [eax + 0x3d003018], ecx
invalid
push ebp
mov ebp, esp
mov ebp, ecx
or byte [ebx + 0x56], dl
push edi
in al, dx
dec eax
jle 0x406066
push eax
pop ebp
cmp ecx, edx
jne 0x4060df
pop edi
pop esi
mov eax, 0xc
pop ebx
pop ebp
ret 8
mov edx, dword [eax + 0x301c]
mov ebx, dword [ebp + 0xc]
lea ecx, [ecx + ecx*4]
mov esi, ebx
lea edi, [edx + ecx*4]
add byte [ebx + 0xc8d0c5d], cl
mov dword [ebx - 0x75c3720d], ecx
jo 0x4060f7
pop es
add ch, ah
cli
movsd dword es:[edi], dword [esi]
mov al, ah
add al, 0xb9
add dword [eax], eax
out dx, eax
cld
cmp ebp, edi
jne 0x12406169
mov edx, dword [ebx + 0xc]
mov edi, dword [edx + 4]
mov bl, byte [edi + 8]
test cl, dl
je 0x406143
mov edx, dword [eax + 0xc]
xor ecx, ecx
test edx, edx
mov dh, 0x83
lea esi, [edx + 0x743e3910]
or byte [ecx], dl
adc dword [edi + ebp], 0x37
retf 0xf472
test byte [ebx + 8], 4
je 0x40615b
mov edx, dword [eax + 0x45001010]
xor ecx, ecx
test edx, edx
inc esp
adc cl, byte [ebp - 0x63efebe2]
mov bl, 0x39
xor ecx, dword ds:[eax]
cmp dword [esi], edi
xor ecx, dword [eax]
inc ecx
add esi, 4
cmp ecx, edx
jb 0x40615b
cmp ecx, edx
jne 0x406187
cmp edx, 0xb8905f00
sbb al, 0x14
mov dword [eax + ecx*4 + 0x1014], edi
mov ebp, dword [edi + 0xf11010]
mov dword gs:[eax + 0x6cf31010], ecx
mov edx, 0x74820843
pushal
mov edx, dword [eax + 0x2014]
insd dword es:[edi], dx
leave
mov edx, 0x8d12add2
mov al, 0x18
add al, 0
add byte [ecx], bh

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ebp, dword [edx]
or byte [ebx - 0x3f7aebc0], cl
je 0x40a410
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a420
push esi
mov esi, dword [0x9b40c089]
push ds
salc
test eax, eax
jne 0x40a3fe
pop esi
pop ebp
xor ecx, dword [eax]
pop ecx
call esi
add eax, 0xafc80
cmp byte [ebp - 0x3e], bl
or byte [eax], al
xor eax, eax
pop ebp
ret 8
mov eax, 0xe0eac43b
pop ebp
ret 0x4908
ret