joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105422e
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
jne 0x1054271
mov dword [ebp - 0x10], 0x80070057
jmp 0x10542c3
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x10542a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov dword [ebp - 0x10], eax
jmp 0x10542be
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1054295
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
cmp dword [ebp - 0x10], ebx
jge 0x10542ea
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10542ea
test byte [eax + 0x3c], 2
je 0x10542ea
push dword [ebp - 0x10]
push 0x1002ff8
push 0x2a
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 0x14]
call fcn.01050e70
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01043035
leave
ret 8

Function at 0x1054306
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
xor esi, esi
and dword [ebp - 8], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x1054337
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov esi, eax
jmp 0x1054354
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1054327
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
test esi, esi
jge 0x105437d
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x105437d
test byte [eax + 0x3c], 2
je 0x105437d
push esi
push 0x1002ff8
push 0x2d
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.01050e70
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x10556c7
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x2000000
push ebx
xor esi, esi
push edi
mov dword [ebp - 0x218], esi
call fcn.01053c22
cmp eax, esi
mov dword [ebp - 0x214], eax
jl 0x10557b7
lea eax, [ebp - 0x214]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push eax
call fcn.01044c5f
test eax, eax
je 0x10557af
jmp 0x105578f
dec dword [ebp - 0x21c]
lea eax, [ebp - 0x214]
push eax
push 0x105
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
call fcn.01044c5f
test eax, eax
je 0x10557af
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call fcn.010556c7
cmp eax, esi
mov dword [ebp - 0x214], eax
jl 0x10557b7
cmp dword [ebp - 0x21c], esi
ja 0x105573e
lea ecx, [ebp - 0x218]
call fcn.01045411
push ebx
push edi
call fcn.01050601
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], esi
jge 0x10557e1
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10557e1
test byte [eax + 0x3c], 2
je 0x10557e1
push dword [ebp - 0x214]
push 0x1003038
push 0x2e
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 0x218]
call fcn.01045411
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01043035
leave
ret 8
Function at 0x1057d22
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
mov ebx, ecx
push 1
push 0x100350c
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebx + 4], esi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x1057d73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov dword [ebp - 4], eax
jmp 0x1057e36
mov eax, dword [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp - 8]
mov edi, eax
call fcn.010453e3
cmp edi, esi
jne 0x1057dd0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], esi
call edi
cmp eax, 5
jne 0x1057e02
push dword [ebp + 8]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.010453e3
cmp ebx, esi
jne 0x1057df8
mov dword [ebp - 8], esi
call edi
jmp 0x1057d65
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x1057e22
cmp eax, 0x80
je 0x1057e19
cmp eax, 0x102
jne 0x1057e29
mov dword [ebp - 4], 0x800705b4
jmp 0x1057e3b
mov edi, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], edi
jmp 0x1057dd3
cmp eax, esi
jle 0x1057d6b
and eax, 0xffff
or eax, 0x80070000
jmp 0x1057d6b
mov dword [ebp - 4], 0x8000ffff
jmp 0x1057e3b
mov dword [ebx + 4], 1
mov eax, edi
push eax
mov ecx, ebx
mov dword [ebp - 8], esi
call fcn.01045e58
cmp dword [ebp - 4], esi
jge 0x1057e62
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x1057e62
test byte [eax + 0x3c], 2
je 0x1057e62
push dword [ebp - 4]
push 0x1002ee4
push 0xb
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 8]
call fcn.010453e3
lea ecx, [ebp - 0xc]
call fcn.01050f2d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1058d3e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x100377c
lea ecx, [ebp - 8]
call fcn.0104f55c
call fcn.010f7890
push ss
add byte [eax], al
mov al, 0xb8
add byte [eax + 0x2b], 0x57
add al, 0xd0
mov esp, 0xe8704480
invalid
jo 0x1058d51
mov dl, 0xb6
xor dword [eax], eax
mov word [0xedac601d], fs
inc ecx
and byte [ecx], bl
add byte [eax - 0x6fbe1258], dl
call fcn.011f3f3c
in al, 0xd9
inc ecx
loopne 0x1058d67
fld dword [ecx + 0x10]
xor byte [ecx + 0xf], ch
xor byte [edi], dl
add byte [eax], al
adc al, ch
mov al, 0x1e
xor dword [eax], eax
xor bl, dl
and byte [eax], dl
or byte [edi - 0x70831fbf], 0x41
rcr byte [ebx], 1
add byte [eax], al
nop
call fcn.0136ac47
fadd dword [ecx]
and dword [eax + 0x50418c50], esp
dec esp
mov word [ecx - 0x10], es
lea eax, [eax]
add byte [eax - 0x18], al
stosb byte es:[edi], al
jno 0x1058dc7
add byte [ecx - 0x231f7d21], dh
outsd dx, dword [esi]
inc ecx
inc eax
inc edi
add byte [eax], al
nop
aaa
dec ecx
and dh, al
call fcn.011f8030
stc
sbb al, 0x37
jo 0x1058e3f
ljmp 0xd040:0xea68e040
mov esi, eax
test esi, esi
jl 0x1058f21
call fcn.0137441f
ficom word [ebp + 0x4fa4600e]
inc edx
invalid
call fcn.01042486
rcl byte [ecx - 0x3e028fbf], 0x20
mov al, byte [0xf0000021]
mov esp, 0xe8904191
cmc
lock sbb dword [eax], eax
and dh, byte [edi + 0x22]
invalid
Function at 0x105b85b
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01056dc9
test eax, eax
mov dword [ebp + 0xc], eax
jl 0x105b89a
mov eax, dword [ebp - 4]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.01044c5f
cmp dword [ebp + 0xc], 0
jge 0x105b8c1
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x105b8c1
test byte [eax + 0x3c], 2
je 0x105b8c1
push dword [ebp + 0xc]
push 0x1003038
push 0x1e
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.01045411
mov eax, dword [ebp + 0xc]
leave
ret 0xc

Function at 0x105c672
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.01056dc9
cmp eax, edi
mov dword [ebp + 0xc], eax
jl 0x105c6e9
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp + 8]
push ecx
push edi
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
xor esi, esi
sub ecx, edi
je 0x105c6cf
dec ecx
dec ecx
je 0x105c6cb
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.01044c5f
test eax, eax
je 0x105c6e3
jmp 0x105c6d2
xor esi, esi
jmp 0x105c6d2
xor esi, esi
inc esi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x105c6e3
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp + 0xc], edi
pop esi
jge 0x105c710
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x105c710
test byte [eax + 0x3c], 2
je 0x105c710
push dword [ebp + 0xc]
push 0x1003038
push 0x2d
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.01045411
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 0x14

Function at 0x105c720
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x105c741
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01056f5c
mov edi, eax
cmp edi, esi
jl 0x105c785
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.01044c5f
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x105c7aa
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x105c7aa
test byte [eax + 0x3c], 2
je 0x105c7aa
push edi
push 0x1003038
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 8]
call fcn.01050f44
lea ecx, [ebp - 0xc]
call fcn.01045411
lea ecx, [ebp - 4]
call fcn.01045411
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x105c84a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x105c86b
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01057008
mov edi, eax
cmp edi, esi
jl 0x105c8af
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 3
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.01044c5f
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x105c8d4
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x105c8d4
test byte [eax + 0x3c], 2
je 0x105c8d4
push edi
push 0x1003038
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 8]
call fcn.01050f44
lea ecx, [ebp - 0xc]
call fcn.01045411
lea ecx, [ebp - 4]
call fcn.01045411
mov eax, edi
pop edi
pop esi
leave
ret 0x14

Function at 0x105ca78
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x105ca99
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010563f8
mov edi, eax
cmp edi, esi
jl 0x105cadd
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.01044c5f
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x105cb02
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x105cb02
test byte [eax + 0x3c], 2
je 0x105cb02
push edi
push 0x1003038
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 8]
call fcn.01050f44
lea ecx, [ebp - 0xc]
call fcn.01045411
lea ecx, [ebp - 4]
call fcn.01045411
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x1060191
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x210], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov dword [ebp - 0x218], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call esi
test eax, eax
mov dword [ebp - 0x214], eax
jne 0x10601ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov edi, eax
jmp 0x1060250
cmp eax, edi
ja 0x1060204
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call fcn.010467e1
jmp 0x10601e8
lea ecx, [ebp - 0x210]
push ecx
push eax
push 0
call fcn.0105d2c4
mov edi, eax
test edi, edi
jl 0x1060254
push dword [ebp - 0x214]
push dword [ebp - 0x210]
push ebx
call esi
test eax, eax
je 0x10601dc
cmp eax, dword [ebp - 0x214]
je 0x106023b
mov edi, 0x8007007a
jmp 0x1060254
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x218]
and dword [ebp - 0x210], 0
mov dword [ecx], eax
test edi, edi
jge 0x1060279
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x1060279
test byte [eax + 0x3c], 2
je 0x1060279
push edi
push 0x1002ff8
push 0x13
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 0x210]
call fcn.010454cc
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01043035
leave
ret 8

Function at 0x1060c65
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x10040a4
lea ecx, [ebp - 0xc]
call fcn.0104f55c
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x1060e03
call fcn.01042486
lodsb al, byte [esi]
cmp dword [ecx - 0x70], eax
push ds
dec edi
sub byte [eax + 0x24], dh
add byte [eax], al
nop
test al, 0x39
inc ecx
xor al, ch
lcall 0x4127, 0xb8001932
xor byte [edi + 0x5baa8041], dh
sub dword [eax - 0x7fffffea], eax
mov dword [ebp + 0xc], 0x80070057
call fcn.011f3f3c
fdivr dword [esi - 0x412bdfbf]
pop es
sub al, 0x7e
xor bl, byte [ecx]
add al, bl
mov esi, 0xbed42041
inc ecx
nop
mov edi, 0xf70016c7
add dword [eax], eax
loopne 0x1060cb7
mov bl, 0x17
invalid
call fcn.0137441f
pop ds
and dword [esi], ebx
loopne 0x1060e09
loop 0x1060e50
xor bh, bh
add dword [eax], eax
sar al, 1
loop 0x1060e58
nop
cmp dword [ebp + 0x10], 0
je 0x1060c88
cmp dword [ebp + 0x14], 0
je 0x1060c88
call fcn.010f7890
pop es
add byte [eax], al
invalid
invalid
mov al, byte [0xf00000e0]
in al, 0x90
inc ecx
mov al, byte [0x1930d6e8]
add byte [esp + 0x24a85041], ch
inc ecx
sub byte [esi + 0x4ae0297d], 1
add byte [eax + 0x1a002ae8], ah
add ah, bh
enter 0xffffffffffffd040, 0xffffffffffffffb8
invalid
Function at 0x10638cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jne 0x10638ed
mov dword [ebp - 0xc], edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010563f8
mov esi, eax
cmp esi, edi
mov dword [ebp + 0xc], esi
jl 0x10639ac
mov dword [ebp + 8], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.01044c5f
test eax, eax
je 0x10639a5
cmp dword [ebp - 4], edi
jne 0x1063963
cmp dword [ebp + 8], edi
jbe 0x106399e
push dword [ebp + 8]
call fcn.0104309c
lea ecx, [ebp - 4]
mov esi, eax
call fcn.0104572b
cmp esi, edi
je 0x1063959
mov dword [ebp - 4], esi
jmp 0x106390e
mov dword [ebp - 4], edi
mov esi, 0x8007000e
jmp 0x10639a8
cmp dword [ebp - 0x10], 1
je 0x1063970
mov esi, 0x8007000d
jmp 0x10639ac
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.01060111
mov esi, eax
cmp esi, edi
jl 0x10639ac
cmp dword [ebp + 0xc], edi
je 0x1063990
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x10639a8
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x10639a8
mov esi, 0x8000ffff
jmp 0x10639ac
mov esi, dword [ebp + 0xc]
cmp esi, edi
jge 0x10639d1
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10639d1
test byte [eax + 0x3c], 2
je 0x10639d1
push esi
push 0x1003038
push 0x22
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.0104572b
lea ecx, [ebp - 0xc]
call fcn.01045411
lea ecx, [ebp - 8]
call fcn.01045411
pop edi
mov eax, esi
pop esi
leave
ret 0x14
Function at 0x106508d
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
rdtsc
sub esp, 0x2c
mov dword [0x1427a7c], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
cmp dword [0x1446984], 0
mov dword [0x1446048], eax
jne 0x10650d1
mov ecx, 0x14280c8
call fcn.01002129
test eax, eax
jl 0x1065272
mov dword [0x1446984], 1
push edi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x1000000
mov eax, dword [0x100003c]
mov ecx, dword [eax + 0x1000050]
add ecx, edx
mov eax, dword [ebp - 0x24]
lea edi, [eax - 0x80000000]
cmp ecx, edi
jb 0x1065101
lea eax, [ecx - 0x80000000]
add eax, 0xffff
and eax, 0xffff0000
mov ecx, dword [ebp - 0x20]
lea edi, [ecx - 0x80000000]
cmp edi, edx
mov dword [0x1428878], eax
pop edi
jb 0x1065123
mov ecx, 0x81000000
mov dword [0x1428a24], ecx
and word [0x1428a24], 0
mov ecx, dword [0x1428a24]
sub ecx, eax
shr ecx, 0x10
xor eax, eax
test eax, eax
mov dword [0x1428924], ecx
jl 0x1065272
mov ecx, dword [0x14469e0]
jmp 0x1065173
imul ecx, ecx, 0x18
add ecx, 0x1427c20
call fcn.01002129
test eax, eax
jl 0x1065178
mov ecx, dword [0x14469e0]
inc ecx
mov dword [0x14469e0], ecx
cmp ecx, 1
jb 0x1065154
mov dword [ebp - 4], eax
test eax, eax
jl 0x1065272
mov eax, dword [0x129bea8]
test eax, eax
je 0x1065212
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x129bea8]
mov eax, dword [0x109dc84]
imul eax, ecx
push 0x40
push eax
push section..data
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10651d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10651c5
mov eax, 0x54f
test eax, eax
jle 0x1065214
and eax, 0xffff
or eax, 0x80070000
jmp 0x1065214
xor edx, edx
mov eax, dword [0x129bea8]
test eax, eax
jbe 0x1065212
mov eax, dword [0x109dc84]
imul eax, edx
lea eax, [eax + section..data]
mov ecx, dword [0x109dc84]
test ecx, ecx
je 0x10651fd
mov byte [eax], 0
inc eax
dec ecx
jne 0x10651f6
mov eax, dword [0x129bea8]
mov dword [edx*4 + 0x1427d38], 0x3bd7
inc edx
cmp edx, eax
jb 0x10651de
xor eax, eax
test eax, eax
jl 0x1065272
mov ecx, dword [0x14466b0]
test ecx, ecx
je 0x106525b
mov eax, dword [0x14466a8]
lea edx, [eax + 0x14466d8]
add eax, dword [0x14466ac]
mov dword [0x14466c0], edx
lea edx, [eax + 0x14466d8]
mov dword [0x14466b8], 0x14466d8
mov dword [0x14466c8], edx
lea eax, [eax + ecx + 0x14466d8]
mov dword [0x14466d0], eax
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push eax
mov eax, 0xcde0333
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
jl 0x1065272
xor eax, eax
leave
ret
Function at 0x106a942
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push 0x10049d0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], edi
call fcn.0104f55c
call fcn.01042486
dec esp
sub dword [edx - 0x40], eax
cdq
salc
or dword [eax + 0x5e], eax
add byte [eax], al
and byte [eax + 0x29], cl
inc edx
and byte [ecx], bh
jge 0x106a98a
jne 0x106a9ac
call fcn.01200ea5
sbb byte [esi - 0x153affbf], cl
and al, ah
adc al, 0x8e
inc ecx
pushal
pop es
add byte [eax], al
nop
call fcn.0136ac47
or dl, byte [edi + 0x2b]
adc ah, bh
add al, 0x41
mov al, byte [0x704104f8]
and dword [eax], eax
add al, dh
mov esi, 0x80070057
jmp 0x106abb0
call fcn.0136ac47
sub byte [ebp - 0x14cf3ff2], ch
inc ecx
and byte [ebx + ebp*8], ch
inc ecx
mov al, 0x58
add byte [eax], al
inc eax
call fcn.01299031
dec esi
pop esp
pop ds
jo 0x106aa47
movsd dword es:[edi], dword [esi]
inc ecx
loopne 0x106aa47
movsd dword es:[edi], dword [esi]
inc ecx
push eax
push eax
add dword [eax], eax
invalid
xchg esp, eax
sbb byte [eax], al
in al, dx
out 0x40, eax
and al, ch
out 0x40, eax
inc eax
push ebx
aaa
sub byte [ebp], 0
sar byte [ecx], 1
jge 0x106aa81
je 0x106a978
call fcn.0137441f
pop ss
xor al, 0x44
mov al, byte [0x10417480]
pop es
add byte [eax], al
nop
jl 0x106aaea
inc ecx
pushal
cmp dword [ebp + 0x28], edi
je 0x106a978
call fcn.010f7890
adc eax, 0xa8c00000
pop ecx
inc edx
mov al, byte [0xd005f3f5]
lodsb al, byte [esi]
pop ecx
inc edx
shr al, 1
jmp 0x106ab12
mov bh, 0x63
sbb dword [eax], eax
or al, 0xd0
inc ecx
nop
push ebp
mov cl, 0xf
ror byte [eax], 0xd0
inc ecx
nop
into
add byte [eax], al
mov al, 0x8d
inc esi
add al, 0x50
lea ecx, [ebp - 4]
call fcn.0106407b
call fcn.0136ac47
popal
pop ss
pop ds
shr al, 0xa8
inc ecx
and ah, 0xa8
inc ecx
xor byte [esi], bl
add byte [eax], al
sar bh, 1
jne 0x106ab4a
mov ecx, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call int.010a6593
call fcn.011f3f3c
dec eax
mov byte [ecx - 0x70], al
inc esp
mov byte [ecx - 0x60], al
sbb ebp, dword [edi]
and dword [eax], esp
push ss
add byte [eax], al
invalid
call fcn.01299031
rol byte [edi + 0xe], 0x10
xor bh, dh
inc ecx
invalid