joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051e30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push str.DragEnter
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esi + 0x24], eax
test eax, eax
je 0x10051e89
lea ebx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esi + 4]
call fcn.10052380
mov ecx, dword [esi + 8]
cmp ecx, dword [eax]
je 0x10051e89
mov edx, ebx
lea eax, [esi + 4]
call fcn.10052300
mov edx, dword [eax]
mov dword [esi + 0x18], edx
mov esi, dword [esi + 0x18]
test esi, esi
je 0x10051eb5
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [eax + 0xc]
push ecx
push esi
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10051f30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push str.DragLeave
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 0
mov dword [edi + 0x20], 0
je 0x10051f8d
push esi
call fcn.1005cdb0
mov esi, eax
call fcn.1005ceb0
pop esi
test eax, eax
je 0x10051f7d
mov eax, 4
call fcn.10051ec0
push eax
mov eax, dword [edi + 0x20]
push 0x1b
push 0x104
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, dword [edi + 0x18]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push edi
call edx
pop edi
pop ebp
ret 4
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x10052210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083173
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov ebx, 8
cmp dword [ebp + 0x1c], ebx
jae 0x10052253
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100522cb
shr eax, 4
not eax
and eax, 1
je 0x100522cb
lea eax, [ebp - 0x244]
push eax
call fcn.10034300
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
cmp dword [ebp + 0x1c], ebx
jae 0x10052284
lea ecx, [ebp + 8]
lea edx, [ebp - 0x244]
call fcn.10034cf0
xor eax, eax
mov cl, byte [ebp + eax - 0x228]
cmp cl, byte [eax + 0x10091754]
jne 0x100522ab
inc eax
cmp eax, 9
jl 0x10052291
mov edi, 1
lea esi, [ebp - 0x244]
call fcn.10034420
cmp dword [ebp + 0x1c], ebx
jb 0x100522c7
mov edx, dword [ebp + 8]
push edx
call fcn.10066b10
add esp, 4
mov eax, edi
jmp 0x100522de
cmp dword [ebp + 0x1c], ebx
jb 0x100522dc
mov eax, dword [ebp + 8]
push eax
call fcn.10066b10
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10052cb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100830db
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x448]
push eax
mov esi, ecx
call fcn.10034300
xor edi, edi
mov ecx, esi
lea edx, [ebp - 0x448]
mov dword [ebp - 4], edi
call fcn.10034cf0
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x42c]
cmp cl, byte [eax + 0x10091754]
jne 0x10052d1a
inc eax
cmp eax, 9
jl 0x10052d00
jmp 0x10052da5
lea edx, [ebp - 0x218]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x10052d24
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10052d40
sub eax, edx
sar eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x21a], dx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10052daa
shr eax, 4
not eax
and eax, 1
je 0x10052daa
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x448]
call fcn.10034cf0
xor eax, eax
jmp 0x10052d90
mov cl, byte [ebp + eax - 0x42c]
cmp cl, byte [eax + 0x10091754]
jne 0x10052daa
inc eax
cmp eax, 9
jl 0x10052d90
mov edi, 1
lea esi, [ebp - 0x448]
call fcn.10034420
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x10054410
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083e90
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
mov dword [ebp - 0x50], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10054468
xor eax, eax
jmp 0x100545ea
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.1005f071
mov ebx, eax
lea eax, [edi + 1]
push eax
push 0
push ebx
call fcn.1006b580
add esp, 0x10
push 0
lea edx, [ebp - 0x58]
push edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10092a5c
push ebx
call fcn.10069320
add esp, 8
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x10054571
jmp 0x100544c3
mov eax, dword [ebp - 0x4c]
mov byte [eax], 0
sub esp, 0x1c
mov esi, esp
mov eax, ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov dword [ebp - 0x54], esp
mov byte [esi], 0
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100544e4
sub eax, edi
mov edi, eax
mov eax, ebx
call fcn.10003960
lea esi, [ebp - 0x2c]
call fcn.10020fd0
add esp, 0x1c
xor esi, esi
xor eax, eax
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], esi
setne al
cmp eax, esi
sete al
test al, al
sete al
test al, al
je 0x10054527
mov edi, dword [ebp - 0x50]
lea ecx, [ebp - 0x2c]
call fcn.10009c00
mov ebx, dword [ebp - 0x4c]
add ebx, 2
push 0x10092a5c
push ebx
call fcn.10069320
add esp, 8
mov edi, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x4c], edi
jb 0x10054559
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10066b10
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
cmp edi, esi
jne 0x100544c0
sub esp, 0x1c
mov esi, esp
mov eax, ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov dword [ebp - 0x54], esp
mov byte [esi], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10054590
sub eax, edx
mov edi, eax
mov eax, ebx
call fcn.10003960
lea esi, [ebp - 0x48]
call fcn.10020fd0
add esp, 0x1c
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x38]
push 0x1008da28
xor edi, edi
mov ecx, esi
call fcn.10004240
test eax, eax
je 0x100545d3
mov edi, dword [ebp - 0x50]
mov ecx, esi
call fcn.10009c00
cmp dword [ebp - 0x34], 8
jb 0x100545e5
mov edx, dword [ebp - 0x48]
push edx
call fcn.10066b10
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret 4
Function at 0x10054990
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, dword [ebx + 4]
mov esi, dword [ebx]
cmp esi, ecx
je 0x100549c8
mov eax, ecx
sub eax, ecx
sar eax, 2
lea edi, [eax*4]
push edi
push ecx
push esi
call fcn.10066e80
add esp, 0xc
add edi, esi
mov dword [ebx + 4], edi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x28]
mov edi, dword [esi + 0x24]
cmp edi, ecx
je 0x100549f6
mov eax, ecx
sub eax, ecx
sar eax, 2
add eax, eax
add eax, eax
push eax
push ecx
push edi
mov dword [ebp - 4], eax
call fcn.10066e80
mov edx, dword [ebp - 4]
add esp, 0xc
add edx, edi
mov dword [esi + 0x28], edx
mov eax, esi
push eax
push 0x10054ab0
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [esi + 0x24]
mov ecx, ebx
call fcn.10054c10
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
pop edi
sar eax, 2
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10054a20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebx + 4]
push esi
mov esi, dword [ebx]
push edi
cmp esi, ecx
je 0x10054a4d
mov eax, ecx
sub eax, ecx
sar eax, 2
lea edi, [eax*4]
push edi
push ecx
push esi
call fcn.10066e80
add esp, 0xc
add edi, esi
mov dword [ebx + 4], edi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x28]
mov edi, dword [esi + 0x24]
cmp edi, ecx
je 0x10054a7b
mov eax, ecx
sub eax, ecx
sar eax, 2
add eax, eax
add eax, eax
push eax
push ecx
push edi
mov dword [ebp - 4], eax
call fcn.10066e80
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, edi
mov dword [esi + 0x28], eax
mov ecx, esi
push ecx
push 0x10054af0
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [esi + 0x24]
mov ecx, ebx
call fcn.10054c10
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
pop edi
sar eax, 2
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10055620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ebx, [ebp - 0x2c]
call fcn.10055530
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x10055663
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10055679
shr eax, 4
not eax
and eax, 1
jne 0x100556a7
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x10055685
lea eax, [ebp - 0x2c]
push 0
push 0x80
push 1
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100556b8
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.10055940
mov ecx, esi
call fcn.10055b20
cmp dword [ebp - 0x18], 8
jb 0x100556ca
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10066b10
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x10055940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081f28
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100a5c90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x10055973
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100559b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
push 0
push edi
call esi
push 0
push 0
push 0
push edi
mov ebx, eax
call esi
test ebx, ebx
je 0x100559f9
push ebx
call fcn.1005f071
add esp, 4
push 0
mov esi, eax
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp + 0xc], ebx
je 0x100559fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
jmp 0x1005599a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0x23535023
jne 0x100559a0
movzx eax, word [esi + 0xc]
movsx edi, ax
push edi
add esi, 0xe
call fcn.1005f071
push edi
push esi
push eax
mov dword [ebp - 0x14], eax
call fcn.10073cd0
lea eax, [esi + edi + 4]
mov esi, dword [eax]
add eax, 4
push esi
mov dword [ebp - 0x10], eax
call fcn.1005f071
mov ecx, dword [ebp - 0x10]
push esi
mov ebx, eax
push ecx
push ebx
call fcn.10073cd0
mov edx, esi
add esp, 0x20
and edx, 0x80000007
jns 0x10055a57
dec edx
or edx, 0xfffffff8
inc edx
mov eax, esi
sub eax, edx
mov dword [ebp - 0x10], 0x100940ec
push ebx
push eax
mov eax, dword [ebp - 0x14]
push ebx
push edi
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.10022490
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x10055a93
push eax
call fcn.10067956
add esp, 4
mov dword [edi + 0x10], 0
push esi
call fcn.1005f071
push esi
push ebx
push eax
mov dword [edi + 0x10], eax
call fcn.10073cd0
add esp, 0x10
mov dword [edi + 0x14], esi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10059550
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
lea eax, [ebp - 0x1ac]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1005958d
xor eax, eax
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x1ac]
mov ecx, eax
shr ecx, 8
cmp cl, 2
jne 0x100595f7
cmp al, cl
jne 0x100595f7
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push edi
mov esi, eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov edx, 2
push eax
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x18], dx
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push esi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_connect]
mov eax, esi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.10066b1b
mov esp, ebp
pop ebp
ret 4

Function at 0x10059650
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.1006b580
mov edx, dword [ebp + 8]
add esp, 0xc
push 0
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret 4
Function at 0x1005b130
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [ebp - 0x802]
push ecx
mov dword [ebp - 0x808], 0
mov word [ebp - 0x804], ax
call fcn.1006b580
add esp, 0xc
push 0x400
lea edx, [ebp - 0x804]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005b1a0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x804]
call fcn.10003a30
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x1005c720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 6]
movzx ebx, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
movzx edi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xc]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
xor esi, 0x677d9197
xor edx, 0x56aa3350
xor ecx, 0xa3b1bac6
xor edi, 0xb27022dc
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], esi
mov esi, dword [ebp - 0x98]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x88], edi
xor edx, edx
jmp 0x1005c800
mov eax, dword [edx + 0x1008db40]
xor eax, dword [ebp + edx - 0x90]
add edx, 4
xor eax, dword [ebp + edx - 0x8c]
xor eax, dword [ebp + edx - 0x90]
mov ecx, eax
shr ecx, 0x18
movzx ecx, cl
movzx ecx, byte [ecx + 0x1008da30]
mov ebx, eax
shr ebx, 0x10
mov byte [ebp - 0x98], cl
mov byte [ebp - 0x9b], bl
movzx ecx, byte [ebp - 0x9b]
mov cl, byte [ecx + 0x1008da30]
mov ebx, eax
movzx eax, al
mov al, byte [eax + 0x1008da30]
mov byte [ebp - 0x95], al
movzx eax, byte [ebp - 0x98]
movzx ecx, cl
shl eax, 8
or eax, ecx
shr ebx, 8
movzx edi, bl
movzx ecx, byte [edi + 0x1008da30]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x95]
shl eax, 8
or eax, ecx
mov ecx, eax
rol ecx, 0xd
mov edi, eax
ror edi, 9
xor ecx, edi
xor ecx, dword [ebp + edx - 0x98]
xor ecx, eax
mov dword [ebp + edx - 0x88], ecx
mov dword [edx + esi - 4], ecx
cmp edx, 0x80
jb 0x1005c800
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066b1b
mov esp, ebp
pop ebp
ret

Function at 0x1005db50
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push str.Kernel32.DLL
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1005dbd4
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10094038
push edi
call ebx
push str.Process32First
push edi
mov dword [esi + 8], eax
call ebx
push str.Process32Next
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32First
push edi
mov dword [esi + 0x10], eax
call ebx
push str.Module32Next
push edi
mov dword [esi + 0x14], eax
call ebx
push edi
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esi + 8], 0
je 0x1005dbcf
cmp dword [esi + 0xc], 0
je 0x1005dbcf
cmp dword [esi + 0x10], 0
je 0x1005dbcf
cmp dword [esi + 0x14], 0
je 0x1005dbcf
cmp dword [esi + 0x18], 0
je 0x1005dbcf
pop edi
mov eax, 1
pop ebx
ret
pop edi
xor eax, eax
pop ebx
ret
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x1005ef40
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push 0
push 0
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x1005ef74
push esi
push 0x10098110
mov esi, 0x100aa2d0
call fcn.10005750
add esp, 4
pop esi
xor eax, eax
pop ebp
ret 0xc
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 0x10]
jne 0x1005ef6e
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0xc]
jne 0x1005ef6e
mov eax, dword [eax]
cmp eax, dword [ebp + 8]
jne 0x1005ef6e
mov eax, 1
pop ebp
ret 0xc

Function at 0x1005face
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push edi
push 0x12c
lea eax, [ebp - 0x130]
push 0x100a561c
push eax
call fcn.1005f8e5
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0xc
mov esi, 0xe73d110a
xor eax, esi
xor edi, esi
push 0x4b
lea ecx, [ebp - 0x130]
pop edx
xor dword [ecx], esi
add ecx, 4
dec edx
jne 0x1005fb0f
lea ecx, [ebp - 0x130]
xor eax, esi
push ecx
call eax
test eax, eax
mov dword [ebp - 4], eax
je 0x1005fb53
xor edi, esi
push ebx
mov ebx, edi
mov esi, 0x100a55e4
lea edi, [ebp - 0x11c]
push edi
push dword [ebp - 4]
call ebx
mov dword [esi], eax
add esi, 4
add edi, 0x14
cmp esi, 0x100a561c
jl 0x1005fb39
push 1
pop eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x1006036a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x1c]
cmp ecx, 1
jle 0x10060445
add eax, 0x32
push esi
dec ecx
movzx edx, byte [eax + 1]
movzx esi, byte [eax - 1]
mov edx, dword [edx*4 + 0x100a4ea8]
xor edx, dword [esi*4 + 0x100a46a8]
movzx esi, byte [eax]
add eax, 0x10
xor edx, dword [esi*4 + 0x100a4aa8]
movzx esi, byte [eax - 0x12]
xor edx, dword [esi*4 + 0x100a42a8]
mov dword [eax - 0x12], edx
movzx edx, byte [eax - 0xb]
movzx esi, byte [eax - 0xc]
mov edx, dword [edx*4 + 0x100a4ea8]
xor edx, dword [esi*4 + 0x100a4aa8]
movzx esi, byte [eax - 0xd]
xor edx, dword [esi*4 + 0x100a46a8]
movzx esi, byte [eax - 0xe]
xor edx, dword [esi*4 + 0x100a42a8]
mov dword [eax - 0xe], edx
movzx edx, byte [eax - 7]
movzx esi, byte [eax - 8]
mov edx, dword [edx*4 + 0x100a4ea8]
xor edx, dword [esi*4 + 0x100a4aa8]
movzx esi, byte [eax - 9]
xor edx, dword [esi*4 + 0x100a46a8]
movzx esi, byte [eax - 0xa]
xor edx, dword [esi*4 + 0x100a42a8]
mov dword [eax - 0xa], edx
movzx edx, byte [eax - 3]
movzx esi, byte [eax - 4]
mov edx, dword [edx*4 + 0x100a4ea8]
xor edx, dword [esi*4 + 0x100a4aa8]
movzx esi, byte [eax - 5]
xor edx, dword [esi*4 + 0x100a46a8]
movzx esi, byte [eax - 6]
xor edx, dword [esi*4 + 0x100a42a8]
dec ecx
mov dword [eax - 6], edx
jne 0x1006037f
pop esi
ret
Function at 0x10060b74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 4
lea eax, [ebp - 4]
push 0x100a55f0
push eax
call fcn.1005f8e5
mov esi, dword [ebp - 4]
push 4
lea eax, [ebp - 4]
push 0x100a55ec
push eax
call fcn.1005f8e5
mov edi, dword [ebp - 4]
add esp, 0x18
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x475f4352
push eax
push 0
push 0
mov dword [ebp - 0x10], 0x646e6172
mov dword [ebp - 0xc], 0x6e65704f
mov dword [ebp - 8], 0x676f44
call esi
mov esi, eax
test esi, esi
je 0x10060bd8
push 0xffffffffffffffff
push esi
call edi
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x10060bdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100a559c]
push esi
mov esi, dword [ebp + 8]
and eax, 3
sub eax, 0
je 0x10060c66
dec eax
je 0x10060c43
dec eax
je 0x10060c20
dec eax
jne 0x10060c87
mov eax, dword [0x100a55ac]
mov dword [ebp + 8], eax
lea eax, [esi + 2]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10060cc7
add dword [0x100a55ac], 0x3f2
pop ecx
pop ecx
jmp 0x10060c87
mov eax, dword [0x100a55a8]
mov dword [ebp + 8], eax
lea eax, [esi + 2]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10060cc7
add dword [0x100a55a8], 0x3f2
pop ecx
pop ecx
jmp 0x10060c87
mov eax, dword [0x100a55a4]
mov dword [ebp + 8], eax
lea eax, [esi + 2]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10060cc7
add dword [0x100a55a4], 0x3f2
pop ecx
pop ecx
jmp 0x10060c87
mov eax, dword [0x100a55a0]
mov dword [ebp + 8], eax
lea eax, [esi + 2]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10060cc7
add dword [0x100a55a0], 0x3f2
pop ecx
pop ecx
mov ax, word [esi + 2]
add dword [0x100a559c], 0x3eb
xor word [esi], ax
xor ecx, ecx
lea eax, [esi + 0x12]
mov edx, ecx
and edx, 3
mov edx, dword [esi + edx*4 + 2]
xor dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 0xa
jb 0x10060c9d
mov al, byte [esi + 0x10]
push esi
xor byte [esi + 0x3a], al
mov al, byte [esi + 0x11]
xor byte [esi + 0x3b], al
call fcn.10060d5b
pop ecx
pop esi
pop ebp
ret