joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7e9c40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23a000]
mov dword [edi + 0x2cd47c], 0xa7e4cf3
push edi
jmp 0x7e9c6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7e9c71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7e9c60
mov eax, 1
add ebx, ebx
jne 0x7e9c83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7e9c94
jne 0x7e9cb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7e9cb3
dec eax
add ebx, ebx
jne 0x7e9ca0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7e9c78
add ebx, ebx
jne 0x7e9caf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7e9d05
xor ecx, ecx
sub eax, 3
jb 0x7e9ccb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7e9d3a
sar eax, 1
mov ebp, eax
jmp 0x7e9cd6
add ebx, ebx
jne 0x7e9cd6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7e9ca4
inc ecx
add ebx, ebx
jne 0x7e9ce4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7e9ca4
add ebx, ebx
jne 0x7e9cf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7e9ce6
jne 0x7e9d02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7e9ce6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7e9d24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7e9d16
jmp 0x7e9c66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7e9d24
add edi, ecx
jmp 0x7e9c66
pop esi
mov edi, esi
mov ecx, 0xef86
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7e9d42
cmp byte [edi], 0x26
jne 0x7e9d42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7e9d47
lea edi, [esi + 0x3d8000]
mov eax, dword [edi]
or eax, eax
je 0x7e9dbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x441e28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x441ffc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7e9d74
mov ecx, edi
jns 0x7e9da3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x442004]
or eax, eax
je 0x7e9db9
mov dword [ebx], eax
add ebx, 4
jmp 0x7e9d91
call dword [esi + 0x442000]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7e9df0
cmp al, 0xef
ja 0x7e9de3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7e9dc5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7e9dd2
mov ebp, dword [esi + 0x442008]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7e9e24
sub esp, 0xffffff80
jmp 0x5c9f5a
Function at 0x10001700
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, 0x80
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
test cl, 1
cmovne eax, edx
shr ecx, 1
test cl, 1
je 0x10001726
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10001731
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000173c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10001747
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10001752
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000175d
bts eax, 1
test cl, 2
je 0x10001766
bts eax, 0
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
and edx, 0x80000000
neg edx
lea eax, [ecx + ecx]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov ebx, ecx
and ebx, 0x80000000
neg ebx
lea eax, [ecx + ecx]
sbb ebx, ebx
and ebx, 0x4c11db7
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [edi + eax*4], ebx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
nop
test bl, 1
je 0x1000183f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10001830
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
mov edx, 0x80
cmp ecx, 0xff
jle 0x10001713
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001870
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x100571c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x1004fd2c
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], ecx
push eax
or ebx, 0xffffffff
mov dword [ebp - 0x408], 0
call fcn.1002db54
add esp, 0xc
test eax, eax
je 0x100018c7
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax]
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.1002dea9
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov dword [ebp - 0x410], edi
mov edx, edi
test edi, edi
je 0x10001922
mov edi, dword [ebp - 0x40c]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [edi + ecx*4]
sub edx, 1
jne 0x10001906
mov edi, dword [ebp - 0x410]
cmp edi, 0x400
je 0x100018d0
push dword [ebp - 0x408]
call fcn.1002dc58
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 4
Function at 0x10001950
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x1004fd34
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.1002db9b
add esp, 0xc
test eax, eax
je 0x10001989
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.1002df59
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x100019b5
call fcn.1002dc58
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.1002dea9
add esp, 0x10
test eax, eax
je 0x10001a0f
push esi
nop word [eax + eax]
mov esi, ebx
test eax, eax
je 0x100019f7
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x100019d6
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call fcn.1002dea9
add esp, 0x10
test eax, eax
jne 0x100019d0
pop esi
push ebx
call fcn.1002dcd8
push dword [ebp + 0xc]
call fcn.1002dc58
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001a30
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x1004fd2c
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.1002db54
add esp, 0xc
test eax, eax
je 0x10001a69
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.1002df59
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10001a95
call fcn.1002dc58
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.1002dea9
add esp, 0x10
test eax, eax
je 0x10001aef
push esi
nop word [eax + eax]
mov esi, ebx
test eax, eax
je 0x10001ad7
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10001ab6
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call fcn.1002dea9
add esp, 0x10
test eax, eax
jne 0x10001ab0
pop esi
push ebx
call fcn.1002dcd8
push dword [ebp + 0xc]
call fcn.1002dc58
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001b90
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x100571c4]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10001bd3
xor al, al
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1009d874], eax
cmp eax, 0xffffffff
je 0x10001bbd
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x1009d878], eax
test eax, eax
je 0x10001bbd
mov ecx, dword [esp + 0x194]
mov al, 1
xor ecx, esp
mov dword [0x1019d884], 0x10002750
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 4
Function at 0x10001c20
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x100571c4]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x1009d874], 0xffffffff
push esi
mov esi, dword [ebp + 8]
jne 0x10001c6f
mov ecx, 0x10057b50
call fcn.1001c970
push eax
push 0
push 0x1019dc18
call fcn.100153a0
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov eax, 2
mov word [esp + 8], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [esp + 0xa], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x10001cb9
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10001cb9
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [esp + 0x10]
push eax
call fcn.1002a970
add esp, 0xc
push 0x10
lea eax, [esp + 8]
push eax
push dword [0x1009d874]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x10001d1b
call esi
cmp eax, 0x2733
je 0x10001d1b
call esi
push eax
mov ecx, 0x10058650
call fcn.1001c970
push eax
push 0
push 0x1019dc18
call fcn.100153a0
add esp, 0x10
mov ecx, 0x1009d870
call fcn.10001e10
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 8
push 0x23
push dword [0x1009d878]
push dword [0x1009d874]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10001da1
call esi
push eax
mov ecx, 0x10058250
call fcn.1001c970
push eax
push 0
push 0x1019dc18
call fcn.100153a0
mov eax, dword [0x1009d874]
add esp, 0x10
cmp eax, 0xffffffff
je 0x10001d6c
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x1009d874], 0xffffffff
mov eax, dword [0x1009d878]
test eax, eax
je 0x10001d86
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [0x1009d878], 0
mov byte [0x1019d8a8], 0
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 8
push 0x80000
push 0
push 0x1009d87c
call fcn.1002aef0
add esp, 0xc
mov dword [0x1011d87c], 0
push 0x80000
push 0
push 0x1011d880
call fcn.1002aef0
add esp, 4
mov dword [0x1019d880], 0
push 0x1009d870
push 0x10002390
call fcn.1001dda0
mov ecx, dword [esp + 0x14]
mov al, 1
pop esi
xor ecx, esp
mov byte [0x1019d8a8], 1
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 8
Function at 0x100020b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8000c
call fcn.10028f40
mov eax, dword [0x100571c4]
xor eax, esp
mov dword [esp + 0x80008], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1019d88c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1009d874]
cmp ebx, 0xffffffff
je 0x10002185
cmp byte [0x1019d8a8], 0
je 0x10002185
push 0x80000
lea eax, [esp + 0x14]
push 0
push eax
call fcn.1002aef0
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x1c]
add esp, 0xc
push esi
push edi
push eax
call fcn.1002a970
add esp, 0xc
cmp byte [esp + 0x10], 0xc1
jne 0x10002135
push dword [esp + 0x12]
lea edx, [esi - 3]
lea ecx, [esp + 0x17]
jmp 0x10002140
push dword [esp + 0x13]
lea edx, [esi - 4]
lea ecx, [esp + 0x18]
call fcn.1001c6d0
mov eax, dword [0x1019d880]
add esp, 4
test eax, eax
jle 0x100021e8
lea ecx, [eax + esi]
cmp ecx, 0x80000
jle 0x100021a9
push ecx
mov ecx, 0x10058750
call fcn.1001c970
push eax
push 0
push 0x1019dc18
call fcn.100153a0
add esp, 0x10
mov ecx, 0x1009d870
call fcn.10001e10
push 0x1019d88c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 8
push esi
lea ecx, [esp + 0x14]
push ecx
lea eax, [eax + 0x1011d880]
push eax
call fcn.1002a970
add esp, 0xc
add dword [0x1019d880], esi
push 0x1019d88c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 8
xor edi, edi
test esi, esi
jle 0x100021c4
nop
push 0
push esi
lea eax, [esp + 0x18]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10002216
sub esi, eax
add edi, eax
test esi, esi
jle 0x100021c4
mov ebx, dword [0x1009d874]
jmp 0x100021f0
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x10002281
mov ecx, dword [0x1019d880]
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10002240
push eax
mov ecx, 0x10057f50
jmp 0x10002166
lea eax, [esp + 0x10]
add eax, edi
push esi
push eax
lea eax, [ecx + 0x1011d880]
push eax
call fcn.1002a970
add dword [0x1019d880], esi
add esp, 0xc
push 0x1019d88c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x80014]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret 8
call ebx
push eax
mov ecx, 0x10058150
jmp 0x10002166
Function at 0x10002290
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10001c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 0x100010], edi
jle 0x100022e2
lea eax, [esi + 0x80010]
push 0
push dword [esi + 0x100010]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100022ef
sub dword [esi + 0x100010], eax
add edi, eax
cmp dword [esi + 0x100010], 0
lea eax, [esi + 0x80010]
jg 0x100022b2
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10002327
push dword [esi + 0x100010]
lea eax, [esi + 0x80010]
add eax, edi
push eax
lea eax, [esi + 0x80010]
push eax
call fcn.10029cf0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, 0x10058550
call fcn.1001c970
push eax
push 0
push 0x1019dc18
call fcn.100153a0
mov eax, dword [esi + 4]
add esp, 0x10
cmp eax, 0xffffffff
je 0x1000235e
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x10002373
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
push ebx
mov byte [esi + 0x100038], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x100033e0
Capabilities:
Check if file exists
Set registry value

Disassembly:
movzx eax, byte [ecx + 4]
cmp eax, 5
ja case.default.0x100033ed
jmp dword [eax*4 + 0x10003498]
jmp fcn.1001dfb0
cmp dword [0x1019d8cc], 0
jne case.default.0x100033ed
sub esp, 8
mov dword [0x1019d8cc], 1
push 0
push 0x1001e1d0
call fcn.1001dda0
ret
cmp dword [0x1019d8cc], 0
jne case.default.0x100033ed
sub esp, 8
mov dword [0x1019d8cc], 2
push 0
push 0x1001e1d0
call fcn.1001dda0
ret
cmp dword [0x1019d8cc], 0
jne case.default.0x100033ed
sub esp, 8
mov dword [0x1019d8cc], 3
push 0
push 0x1001e1d0
call fcn.1001dda0
ret
cmp dword [0x1019d8cc], 0
jne case.default.0x100033ed
sub esp, 8
mov dword [0x1019d8cc], 4
push 0
push 0x1001e1d0
call fcn.1001dda0
ret
cmp byte [ecx + 0x10], 0
setne byte [0x1019dbbc]
ret
Function at 0x10003d80
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10045618
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100571c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, 0x75
xor eax, eax
nop
mov cl, byte [eax + 0x1004fe98]
xor cl, dl
mov byte [ebp + eax - 0x34], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x21
jb 0x10003db0
mov byte [ebp - 0x13], 0
push 0x1388
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
push ecx
mov edx, 2
mov ecx, 0x1019e0a8
call fcn.1001c800
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]

Function at 0x10003e20
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100571c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x49
xor eax, eax
nop word [eax + eax]
mov cl, byte [eax + str.:__8__8_q]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x10
jb 0x10003e40
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]

Function at 0x10004b90
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10004c53
push ebx
mov bl, byte [0x1019fb65]
mov bh, byte [0x1019fb66]
cmp edx, 0x20
jb 0x10004c33
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10004bc3
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm3, xmmword [0x10051850]
mov edi, edx
sub edi, ecx
movaps xmm2, xmm3
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
paddb xmm2, xmm1
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm4, xmm0, 0
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm4
paddb xmm0, xmm3
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm4
paddb xmm0, xmm3
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10004c00
pop edi
cmp eax, edx
jge 0x10004c52
add bl, 0xf
nop word [eax + eax]
mov cl, byte [eax + esi]
xor cl, bl
sub cl, bh
add cl, 0xf
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10004c40
pop ebx
pop esi
ret
Function at 0x10004c60
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10004d16
push ebx
mov bh, byte [0x1019fb66]
mov bl, byte [0x1019fb65]
cmp edx, 0x20
jb 0x10004cfc
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10004c93
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x10051850]
mov edi, edx
sub edi, ecx
movsx ecx, bh
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bl
pshufd xmm2, xmm0, 0
psubb xmm2, xmm1
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
paddb xmm1, xmm0
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10004cd1
pop edi
cmp eax, edx
jge 0x10004d15
add bl, 0xf
mov cl, byte [eax + esi]
sub cl, 0xf
add cl, bh
xor cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10004d03
pop ebx
pop esi
ret

Function at 0x10006570
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100571c4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
xorps xmm0, xmm0
push 0x400000
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0xff6aff6a
mov dword [ebp - 0xc], 0xffffffff
mov word [ebp - 8], 0xffff
mov byte [ebp - 6], 0xe8
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000664e
push ebx
push esi
push edi
mov edi, 0x40000b
xor eax, eax
mov cl, byte [ebp + eax - 0x10]
cmp cl, 0xff
je 0x100065e6
cmp byte [edi + eax - 0xb], cl
jne 0x10006644
inc eax
cmp eax, 0xb
jl 0x100065d7
mov al, byte [edi - 0xa]
test al, al
je 0x100065f7
cmp al, 1
jne 0x10006644
mov al, byte [edi - 8]
test al, al
je 0x10006602
cmp al, 1
jne 0x10006644
mov eax, dword [edi]
lea ebx, [edi - 1]
add eax, 5
add eax, ebx
cmp eax, 0x404d70
jne 0x10006644
lea eax, [ebp - 0x18]
push eax
push 0x40
push 5
lea esi, [edi - 1]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10006520
mov byte [esi], 0xe8
sub eax, ebx
sub eax, 5
mov dword [edi], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
sub dword [ebp - 0x14], 1
jne 0x100065d5
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027e1f
mov esp, ebp
pop ebp
ret
Function at 0x10006660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100571c4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
je 0x1000672b
push esi
push 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
xorps xmm0, xmm0
push edi
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
xor esi, esi
mov dword [ebp - 0x10], 0xff6aff6a
mov dword [ebp - 0xc], 0xffffffff
mov word [ebp - 8], 0xffff
mov byte [ebp - 6], 0xff
cmp dword [ebp - 0x1c], esi
jbe 0x1000672a
push ebx
nop
xor eax, eax
mov dl, byte [ebp + eax - 0x10]
cmp dl, 0xff
je 0x100066d3
lea ecx, [eax + edi]
cmp byte [ecx + esi], dl
jne 0x10006723
inc eax
cmp eax, 0xb
jl 0x100066c2
mov al, byte [edi + esi + 1]
test al, al
je 0x100066e5
cmp al, 1
jne 0x10006723
mov al, byte [edi + esi + 3]
test al, al
je 0x100066f1
cmp al, 1
jne 0x10006723
lea ebx, [edi + 5]
add ebx, esi
cmp dword [ebx], 0x404d70
jne 0x10006723
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
mov dword [ebx], 0x10006520
push eax
push dword [ebp - 0x14]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x100066c0
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10027e1f
mov esp, ebp
pop ebp
ret