joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10067be0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x10067bf7
xor ebx, ebx
jmp 0x10067c0f
cmp byte [ebp], 0
je 0x10067c06
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x10067c00
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x10067cce
jmp 0x10067c34
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x10067c3c
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10067c5c
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edx, dword [edx + eax]
call fcn.1003cab0
test eax, eax
jne 0x10067cbb
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
shl esi, 4
mov ecx, dword [esi + edx + 0xc]
add ecx, 4
cmp dword [ecx + 0xc], 0
je 0x10067ca5
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x10067c9f
lea ecx, [ecx]
movzx esi, byte [edx]
movzx esi, byte [esi + 0x100af600]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x10067c80
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x10067ca7
xor edx, edx
push ebp
call fcn.1003d9a0
add esp, 4
test eax, eax
je 0x10067cd8
mov edi, dword [eax + 8]
test edi, edi
jne 0x10067cce
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x10067c30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x10067cbb

Function at 0x10067d70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x10067d86
xor ebx, ebx
jmp 0x10067d9f
cmp byte [edi], 0
je 0x10067d96
jmp 0x10067d90
inc eax
cmp byte [eax], 0
jne 0x10067d90
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 4]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x10067e5c
mov ecx, dword [ecx + 8]
push esi
mov dword [esp + 0x14], ecx
jmp 0x10067dc4
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x10067dcc
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x10067dec
mov edx, dword [eax]
call fcn.1003cab0
test eax, eax
jne 0x10067e3b
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x14]
je 0x10067e25
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x10067e1f
nop
movzx edi, byte [edx]
movzx edi, byte [edi + 0x100af600]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x10067e00
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x10067e27
xor edx, edx
push edi
call fcn.1003d9a0
add esp, 4
test eax, eax
je 0x10067e58
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x10067e4e
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x10067dc0
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x10067e3b
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1006c5c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x1006c5e0
mov al, byte [ebp + 0x100afe50]
mov byte [esp + 0x10], al
test edi, edi
je 0x1006c665
cmp byte [edi], 0
mov eax, edi
je 0x1006c5fb
inc eax
cmp byte [eax], 0
jne 0x1006c5f5
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x190
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x1006c64d
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x1006c643
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x100af600]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x1006c620
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x1006c64f
xor edx, edx
push edi
call fcn.1003d9a0
add esp, 4
test eax, eax
je 0x1006c661
mov eax, dword [eax + 8]
jmp 0x1006c66c
xor eax, eax
jmp 0x1006c66c
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x1006c67c
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x1006c69d
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x1006c5e0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x10092d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1426
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x100cc020]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x42c], 0x78
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
mov edx, dword [eax]
call edx
mov dword [ebp - method.SpeedBit::Utils::StackBufferEx_1024_.virtual_0], vtable.SpeedBit::Utils::StackBufferEx_1024_.0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x430]
push eax
mov byte [ebp - 4], 2
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 1
call ebx
cmp eax, esi
jne 0x10092dfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100bd9e0
lea ecx, [ebp - 0x438]
push ecx
mov dword [ebp - 0x438], eax
call sub.MSVCR90.dll__CxxThrowException
mov edx, dword [ebp - 0x428]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edx + 0xc]
lea ecx, [ebp - 0x428]
call eax
mov edx, dword [ebp - 0x428]
mov eax, dword [edx + 0x18]
lea ecx, [ebp - 0x428]
call eax
cmp eax, esi
je 0x10092e44
push 0x100bd9e0
lea ecx, [ebp - 0x434]
push ecx
mov dword [ebp - 0x434], 8
call sub.MSVCR90.dll__CxxThrowException
mov edx, dword [ebp - 0x428]
mov eax, dword [edx + 8]
lea ecx, [ebp - 0x428]
call eax
mov edx, dword [ebp - 0x428]
mov esi, eax
mov eax, dword [edx + 0x1c]
lea ecx, [ebp - 0x428]
call eax
push esi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x10092e8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100bd9e0
lea ecx, [ebp - 0x43c]
push ecx
mov dword [ebp - 0x43c], eax
call sub.MSVCR90.dll__CxxThrowException
mov edx, dword [ebp - 0x428]
mov eax, dword [edx + 8]
lea ecx, [ebp - 0x428]
call eax
mov edx, dword [edi]
push esi
push eax
mov eax, dword [edx + 8]
mov ecx, edi
call eax
xor edi, edi
lea ecx, [ebp - 0x428]
lea esi, [edi + 1]
call fcn.10027f90
jmp 0x10092ee7
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1009ecb4
mov esp, ebp
pop ebp
ret
Function at 0x10092f10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a332f
mov eax, dword fs:[0]
push eax
sub esp, 0x460
mov eax, dword [0x100cc020]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x458], 0x78
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 2
call fcn.10093880
add esp, 4
cmp eax, ebx
jne 0x10092f9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100bd9e0
lea ecx, [ebp - 0x464]
push ecx
mov dword [ebp - 0x464], eax
call sub.MSVCR90.dll__CxxThrowException
mov dword [ebp - method.SpeedBit::Utils::StackBufferEx_1040_.virtual_0], vtable.SpeedBit::Utils::StackBufferEx_1040_.0
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
push 0x208
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 3
call dword [0x100ba290]
mov edx, dword [ebp - 0x454]
mov eax, dword [edx + 8]
lea ecx, [ebp - 0x454]
call eax
cmp dword [ebp - 0x1c], 8
mov ecx, dword [ebp - 0x30]
jae 0x10092fdc
lea ecx, [ebp - 0x30]
mov edx, dword [ebp + 8]
push eax
push edx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, ebx
jne 0x1009300a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x460], eax
push 0x100bd9e0
lea eax, [ebp - 0x460]
push eax
call sub.MSVCR90.dll__CxxThrowException
mov edx, dword [ebp - 0x454]
mov eax, dword [edx + 8]
lea ecx, [ebp - 0x454]
call eax
mov edx, dword [esi]
push eax
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x458], ebx
mov esi, 1
call fcn.10093480
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x1009306e
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1009ecb4
mov esp, ebp
pop ebp
ret
Function at 0x10095300
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x100a13ab
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x100cc020]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push esi
push edi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
mov ebx, ecx
push 0x80
xor edi, edi
mov ecx, eax
push edi
push ecx
mov dword [ebx], 0x2710
mov dword [esp + 0x20], vtable.SpeedBit::Utils::StackBufferEx_128_.0
mov dword [esp + 0xac], 0x80
mov dword [esp + 0xa8], eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esp + 0xb0], edi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1c]
lea ecx, [esp + 0x14]
call eax
mov edx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [edx + 8]
lea ecx, [esp + 0x14]
call eax
push esi
push eax
push str.SB_VAR_F3B44D29_36CA_4481_9EA7_B31ADA3C649E
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x100953d0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1c]
lea ecx, [esp + 0x14]
call eax
cmp esi, eax
jae 0x100953d0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 8]
lea ecx, [esp + 0x14]
call eax
mov esi, eax
call fcn.10095240
mov edi, eax
mov eax, dword [esp + 0x9c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], vtable.SpeedBit::Utils::StackBufferEx_128_.0
cmp eax, ecx
je 0x100953f2
test eax, eax
je 0x100953f2
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1009ecb4
add esp, 0xa4
ret

Function at 0x10097330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a4898
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push 0
push str.NTDLL.DLL
push esi
call fcn.100970a0
mov dword [esp + 0x14], 0
call fcn.10097150
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10097384
push str.NtQueryKey
push eax
call edi
jmp 0x10097386
xor eax, eax
mov dword [esi + 0x24], eax
call fcn.10097150
test eax, eax
je 0x1009739c
push str.NtQueryInformationFile
push eax
call edi
jmp 0x1009739e
xor eax, eax
mov dword [esi + 0x28], eax
call fcn.10097150
test eax, eax
je 0x100973b4
push str.NtQueryInformationProcess
push eax
call edi
jmp 0x100973b6
xor eax, eax
mov dword [esi + 0x2c], eax
call fcn.10097150
test eax, eax
je 0x100973cc
push str.RtlNtStatusToDosError
push eax
call edi
jmp 0x100973ce
xor eax, eax
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x100974b0
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov edx, dword [esp + 8]
test eax, eax
je 0x100974ce
lea ecx, [edx + eax*2 - 2]
lea ecx, [ecx]
cmp word [ecx], 0x3d
jne 0x100974ce
dec eax
sub ecx, 2
test eax, eax
jne 0x100974c0
push ebx
push ebp
mov ecx, eax
push esi
shr ecx, 2
and eax, 3
xor esi, esi
xor ebp, ebp
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x1009757f
lea eax, [edx + 2]
lea ebp, [ecx*4]
jmp 0x10097500
movzx edx, word [eax]
movzx edx, byte [edx*2 + 0x100af3f8]
movzx ebx, word [eax - 2]
movzx ebx, byte [ebx*2 + 0x100af3f8]
shr dl, 4
and dl, 3
add bl, bl
add bl, bl
or dl, bl
mov byte [edi + esi], dl
movzx edx, word [eax + 2]
movzx edx, byte [edx*2 + 0x100af3f8]
movzx ebx, word [eax]
movzx ebx, byte [ebx*2 + 0x100af3f8]
shr dl, 2
and dl, 0xf
shl bl, 4
or dl, bl
mov byte [edi + esi + 1], dl
movzx edx, word [eax + 4]
movzx ebx, word [eax + 2]
movzx edx, byte [edx*2 + 0x100af3f8]
movzx ebx, byte [ebx*2 + 0x100af3f8]
and dl, 0x3f
shl bl, 6
or dl, bl
mov byte [edi + esi + 2], dl
add esi, 3
add eax, 8
sub ecx, 1
jne 0x10097500
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
sub eax, 2
je 0x100975f4
sub eax, 1
jne 0x10097619
movzx ecx, word [edx + ebp*2 + 2]
movzx ecx, byte [ecx*2 + 0x100af3f8]
movzx ebx, word [edx + ebp*2]
mov bl, byte [ebx*2 + 0x100af3f8]
lea eax, [edx + ebp*2 + 2]
shr cl, 4
and cl, 3
add bl, bl
add bl, bl
or cl, bl
mov byte [esi + edi], cl
movzx edx, word [edx + ebp*2 + 4]
movzx ecx, byte [edx*2 + 0x100af3f8]
movzx edx, word [eax]
mov al, byte [edx*2 + 0x100af3f8]
shr cl, 2
and cl, 0xf
shl al, 4
or cl, al
push 0
mov byte [esi + edi + 1], cl
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
movzx ecx, word [edx + ebp*2 + 2]
mov al, byte [ecx*2 + 0x100af3f8]
movzx ecx, word [edx + ebp*2]
mov dl, byte [ecx*2 + 0x100af3f8]
shr al, 4
add dl, dl
and al, 3
add dl, dl
or al, dl
mov byte [esi + edi], al
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x10098260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3098
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push esi
push edi
mov eax, dword [0x100cc020]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
push 1
push 2
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_int_]
mov dword [esp + 0xbc], 0
call dword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____cdecl_std::locale::classic_void_]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + 4]
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + ecx + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_class_std::locale___thiscall_std::basic_ios_char__struct_std::char_traits_char__::imbue_class_std::locale_const__]
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::locale::destructor_void_]
mov edx, dword [esp + 0xcc]
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::str_void_]
mov byte [esp + 0xbc], 1
cmp dword [eax + 0x18], 0x10
jb 0x100982ff
mov eax, dword [eax + 4]
jmp 0x10098302
add eax, 4
mov ecx, dword [esp + 0xc8]
push ecx
mov ecx, dword [esp + 0xc8]
mov edi, eax
call fcn.10098020
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0xbc], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xbc], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::vbase_dtor_void_]
mov eax, esi
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xb4
ret 0xc
Function at 0x10098c20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor edx, edx
push esi
push edi
mov byte [ebp + 0x100], dl
mov byte [ebp + 0x101], dl
xor eax, eax
jmp 0x10098c40
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jne 0x10098c40
xor esi, esi
mov ecx, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
movzx edi, dl
movzx edx, byte [edi + eax]
movzx eax, byte [ecx]
add edx, esi
add eax, edx
and eax, 0x800000ff
jns 0x10098c73
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
lea eax, [esi + ebp]
cmp ecx, eax
je 0x10098c85
mov bl, byte [eax]
mov dl, byte [ecx]
mov byte [ecx], bl
mov byte [eax], dl
xor edx, edx
lea eax, [edi + 1]
div dword [esp + 0x1c]
inc ecx
sub dword [esp + 0x14], 1
jne 0x10098c53
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 0xc

Function at 0x10098ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov al, byte [ecx + 0x100]
mov dl, byte [ecx + 0x101]
sub esp, 8
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
je 0x10098d6f
push ebx
push ebp
push esi
movzx ebp, al
movzx esi, dl
jmp 0x10098cd4
mov esi, dword [esp + 0x14]
lea edx, [ebp + 1]
and edx, 0x800000ff
jns 0x10098ce7
dec edx
or edx, 0xffffff00
inc edx
movzx ebp, dl
movzx ebx, byte [ecx + ebp]
lea eax, [ecx + ebp]
add ebx, esi
and ebx, 0x800000ff
jns 0x10098d03
dec ebx
or ebx, 0xffffff00
inc ebx
movzx esi, bl
mov dword [esp + 0x14], esi
add esi, ecx
mov byte [esp + 0x13], bl
cmp eax, esi
je 0x10098d2b
movzx ebx, byte [eax]
mov byte [esp + 0x12], bl
movzx ebx, byte [esi]
mov byte [eax], bl
movzx ebx, byte [esp + 0x12]
mov byte [esi], bl
mov bl, byte [esp + 0x13]
movzx eax, byte [eax]
movzx esi, byte [esi]
add eax, esi
and eax, 0x800000ff
jns 0x10098d41
dec eax
or eax, 0xffffff00
inc eax
mov esi, dword [esp + 0x1c]
movzx eax, al
mov al, byte [eax + ecx]
xor byte [edi + esi], al
inc edi
cmp edi, dword [esp + 0x20]
jne 0x10098cd0
pop esi
pop ebp
mov byte [ecx + 0x101], bl
pop ebx
mov byte [ecx + 0x100], dl
pop edi
add esp, 8
ret 8
mov byte [ecx + 0x100], al
mov byte [ecx + 0x101], dl
pop edi
add esp, 8
ret 8
Function at 0x10098e90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100bdba0
push 0x1009f441
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100cc020]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], ecx
xor esi, esi
cmp eax, esi
jne 0x10098edd
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x10098ef4
push 0xc1
jmp 0x10098fd1
mov edx, dword [ecx + 0x3c]
add edx, ecx
mov dword [ebp - 0x20], edx
cmp dword [edx], 0x4550
je 0x10098f0e
push 0xbf
jmp 0x10098fd1
movzx ecx, word [edx + 0x14]
cmp cx, si
je 0x10098fcc
movzx ecx, cx
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x1c], esi
movzx edx, word [edx + 6]
cmp esi, edx
jae 0x10098fcc
lea ecx, [esi + esi*4]
lea edi, [eax + ecx*8]
mov edx, str..detour
mov ecx, edi
mov edi, edi
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x10098f60
test bl, bl
je 0x10098f5c
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x10098f60
add ecx, 2
add edx, 2
test bl, bl
jne 0x10098f40
xor ecx, ecx
jmp 0x10098f65
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x10098fba
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10098fcc
cmp dword [edi + 0x10], 0
je 0x10098fcc
mov edx, dword [ebp + 8]
lea esi, [ecx + edx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x10098fcc
cmp dword [esi + 4], 0x727444
jne 0x10098fcc
cmp dword [esi + 8], 0
jne 0x10098f95
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc esi
mov edx, dword [ebp - 0x20]
jmp 0x10098f22
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100991a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
cmp dword [esi], 0x678
jne 0x100992a8
cmp dword [esp + 0x10], 0x678
jb 0x100992a8
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
push ebx
or eax, 0xffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push ecx
push edx
xor ebx, ebx
call edi
test eax, eax
je 0x1009929e
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
push 0x40
push ecx
push edx
call edi
test eax, eax
je 0x1009928a
mov eax, dword [esi + 4]
mov edx, dword [esi + 0x10]
push eax
lea ecx, [esi + 0x1c]
push ecx
push edx
call sub.MSVCR90.dll_memcpy
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x14]
push eax
lea ecx, [esi + 0x5c]
push ecx
push edx
call sub.MSVCR90.dll_memcpy
mov eax, dword [esi + 0x18]
add esp, 0x18
test eax, eax
je 0x10099271
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push edx
push eax
call edi
test eax, eax
je 0x10099276
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x18]
push eax
lea ecx, [esi + 0x664]
push ecx
push edx
call sub.MSVCR90.dll_memcpy
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0xc]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call edi
mov ebx, 1
mov edx, dword [esp + 8]
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x14]
push edx
push eax
push ecx
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call edi
pop edi
mov eax, ebx
pop ebx
add esp, 0xc
ret 4
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0xc
ret 4

Function at 0x100992c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100bdb80
push 0x1009f441
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100cc020]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], dx
jne 0x10099362
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10099362
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x10099362
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x10099362
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret