joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x411492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411488
mov eax, 1
add ebx, ebx
jne 0x4114ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4114a0
jne 0x4114bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4114a0
xor ecx, ecx
sub eax, 3
jb 0x4114d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411542
mov ebp, eax
add ebx, ebx
jne 0x4114db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4114e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41150c
inc ecx
add ebx, ebx
jne 0x4114f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4114ed
jne 0x411509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4114ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41152c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41151d
jmp 0x41148e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41152c
add edi, ecx
jmp 0x41148e
pop esi
mov edi, esi
mov ecx, 0x118
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41154a
cmp byte [edi], 6
jne 0x41154a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41154f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x4115c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11dd4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11e74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41157c
mov ecx, edi
jns 0x4115ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11e78]
or eax, eax
je 0x4115c1
mov dword [ebx], eax
add ebx, 4
jmp 0x411599
call dword [esi + 0x11e7c]
popal
jmp 0x4050ab

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41e290
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
or ebp, 0xffffffff
jmp 0x41e2b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41e2b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41e2a8
mov eax, 1
add ebx, ebx
jne 0x41e2cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41e2c0
jne 0x41e2dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e2c0
xor ecx, ecx
sub eax, 3
jb 0x41e2f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e362
mov ebp, eax
add ebx, ebx
jne 0x41e2fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41e308
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41e32c
inc ecx
add ebx, ebx
jne 0x41e318
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41e30d
jne 0x41e329
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e30d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41e34c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41e33d
jmp 0x41e2ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41e34c
add edi, ecx
jmp 0x41e2ae
pop esi
mov edi, esi
mov ecx, 0x365
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e36a
cmp byte [edi], 7
jne 0x41e36a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41e36f
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41e3e7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e7f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e8f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e39c
mov ecx, edi
jns 0x41e3cb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e8f8]
or eax, eax
je 0x41e3e1
mov dword [ebx], eax
add ebx, 4
jmp 0x41e3b9
call dword [esi + 0x1e908]
mov ebp, dword [esi + 0x1e8fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41e41b
sub esp, 0xffffff80
jmp 0x40788c
Function at 0x88e2de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x88e2fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e2ec
add dl, dl
jne 0x88e306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e352
xor eax, eax
add dl, dl
jne 0x88e313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88e3ef
add dl, dl
jne 0x88e322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e32d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x88e34d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x88e2f2
mov eax, 1
add dl, dl
jne 0x88e360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88e36b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e357
sub eax, 2
jne 0x88e39a
mov ecx, 1
add dl, dl
jne 0x88e380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88e38b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e2f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88e3b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88e3bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x88e3a8
cmp eax, 0x7d00
jae 0x88e3df
cmp eax, 0x500
jb 0x88e3da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e2f2
cmp eax, 0x7f
ja 0x88e3e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e2f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88e40b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88e2f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x10057bfe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10057c0d
pop dword [ebp - 0x18]
mov eax, 0x3bf478c
sub eax, 0xf3b9cb7f
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x42830
push 0
mov eax, 0xd87dba57
sub eax, 0xc876393b
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xa1deb07c
sub ecx, 0xa1de6ae2
xor edx, edx
add edx, eax
mov ebx, 0x6a1d3b40
sub ebx, 0x5a04c940
add ebx, dword [ebp - 0x18]
mov edi, 0x3f4dc9d5
sub edi, 0xa4dc399e
mov esi, dword [ebx]
sub dword [ebp - 4], 0xe6fd793a
sub esi, edi
xor dword [ebp - 8], edi
mov dword [edx], esi
xor dword [ebp - 8], 0x6b41027f
add edx, 0x3db67480
sub edx, 0x3db6747c
add ebx, 0xa6fc7b81
add ebx, 0x59038483
loop 0x10057c6e
add eax, 0x1093b
xor ebx, ebx
add ebx, eax
add eax, 0xe2ba4ece
sub eax, 0xe2ba4ec9
mov ecx, 0x7709e778
add ecx, 0x98f61888
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10057bfe
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4

Function at 0x100723b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100723e6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10072445
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10057bfe
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10057bfe
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10057bfe
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100762d0
leave
ret 0x10
Function at 0x10072460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007248c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100724bd
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x100724bb
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10057bfe
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x100724bd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100762d0
leave
ret 8

Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret
Function at 0x531c7b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x531d00
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0050cdc0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x531cc3
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x531ce5
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x531d5b
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.005319cb
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x531d47
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x531d5b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x531c84
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100060b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1009100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10006131
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [esi]
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
push 4
push esi
call edi
xor eax, eax
nop word [eax + eax]
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10006100
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0xcc]
push 0
push dword [ebp - 0xd0]
mov dword [esi], eax
push 4
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10062f29
mov esp, ebp
pop ebp
ret 4

Function at 0x10006150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x1009100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10006197
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10006174
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret 4

Function at 0x100061b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100645fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x1009100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x10091540], 0x10
mov eax, 0x1009152c
cmovae eax, dword [0x1009152c]
cmp byte [eax], 0
je 0x100062ca
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x100062ca
cmp dword [0x100911b0], 0x10
mov eax, 0x1009119c
cmovae eax, dword [0x1009119c]
cmp byte [eax], 0
je 0x100062ca
mov esi, 0x10097158
mov edx, ecx
sub esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x10006226
mov edx, 0x10093930
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10006240
mov ecx, dword [0x10097a00]
mov edx, 0x1009152c
cmp dword [0x10091540], 0x10
push 0x10097158
cmovae edx, dword [0x1009152c]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
test eax, eax
jne 0x100062ca
mov ecx, 0x98
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x100817b8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x1000629d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x10006280
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [0x10093364]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x10093364]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100062e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006462d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1009100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10006320
sub esi, ecx
push esi
call fcn.10063787
add esp, 4
xor edx, edx
mov edi, eax
test esi, esi
js 0x1000634b
nop word [eax + eax]
xor byte [edx + edi], dl
lea ecx, [edx + edi]
inc edx
cmp edx, esi
jle 0x10006340
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10006381
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10006377
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10006377
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10063779
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10007750
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1009100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
js 0x10007787
nop
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, edi
jle 0x10007770
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10062f29
mov esp, ebp
pop ebp
ret 8

Function at 0x10007a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1009100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov ebx, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [edi], ecx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.10062f29
mov esp, ebp
pop ebp
ret 8
Function at 0x10007ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10089fd8
push 0x100630e2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1009100c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
mov edi, dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, 5
mov byte [esi], 0xe8
mov dword [esi + 1], eax
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, edi
jae 0x10007b52
mov byte [esi + eax], 0x90
inc eax
jmp 0x10007b44
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10007b6c
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10062f29
mov esp, ebp
pop ebp
ret 0xc