joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005d00
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1140
call fcn.1004c370
mov eax, dword [0x1008b274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1120], 0x11c
mov dword [ebp - 0x111c], 0
mov dword [ebp - 0x1118], 0
mov dword [ebp - 0x1114], 0
mov dword [ebp - 0x1110], 0
push 0x100
push 0
lea eax, [ebp - 0x110c]
push eax
call fcn.1004e010
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x100c], cx
xor edx, edx
mov word [ebp - 0x100a], dx
xor eax, eax
mov dword [ebp - 0x1008], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], edx
mov ecx, 6
movzx edx, cx
mov dword [ebp - 0x111c], edx
xor eax, eax
movzx ecx, ax
mov dword [ebp - 0x1118], ecx
xor edx, edx
mov word [ebp - 0x100c], dx
mov eax, dword [ebp - 0x113c]
push eax
mov ecx, dword [ebp - 0x1140]
push ecx
push 0x23
lea edx, [ebp - 0x1120]
push edx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x10005dfa
mov dword [ebp - 0x1130], 1
jmp 0x10005e04
mov dword [ebp - 0x1130], 0
movzx eax, byte [ebp - 0x1130]
test eax, eax
je 0x10005e1c
cmp dword [0x1008c544], 0
jne 0x10005ef3
lea ecx, [ebp - 0x1134]
push ecx
push 0x1000
lea edx, [ebp - 0x1004]
push edx
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x10005e3d
call fcn.10022100
mov dword [ebp - 0x1124], 0
jmp 0x10005e58
mov eax, dword [ebp - 0x1124]
add eax, 1
mov dword [ebp - 0x1124], eax
mov ecx, dword [ebp - 0x1134]
shr ecx, 2
cmp dword [ebp - 0x1124], ecx
jae 0x10005ef1
mov edx, dword [ebp - 0x1124]
cmp dword [ebp + edx*4 - 0x1004], 0
je 0x10005eec
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x1124]
cmp dword [ebp + ecx*4 - 0x1004], eax
je 0x10005eec
mov edx, dword [ebp - 0x1124]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
jne 0x10005ebe
jmp 0x10005e49
mov ecx, dword [ebp - 0x112c]
push ecx
mov edx, dword [ebp - 0x1124]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
call fcn.10004600
add esp, 8
lea ecx, [ebp - 0x112c]
push ecx
mov ecx, 0x1008c574
call fcn.10003760
jmp 0x10005e49
jmp 0x10005f5c
mov dword [ebp - 0x1128], 0
lea edx, [ebp - 0x1128]
push edx
push 0
push 0
push 0x2000000
mov eax, dword [ebp - 0x1128]
push eax
call dword [0x1008c544]
test eax, eax
jne 0x10005f5c
mov ecx, dword [ebp - 0x1128]
push ecx
call fcn.10005ab0
add esp, 4
mov dword [ebp - 0x1138], eax
mov edx, dword [ebp - 0x1128]
push edx
mov eax, dword [ebp - 0x1138]
push eax
call fcn.10004600
add esp, 8
lea ecx, [ebp - 0x1128]
push ecx
mov ecx, 0x1008c574
call fcn.10003760
jmp 0x10005efd
call fcn.10004430
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret
Function at 0x10006290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1008b274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x40], 0xc20
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x401fffff
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x55
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0x4e
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x5f
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x52
mov byte [ebp - 8], 0
push 0
push 3
mov ecx, dword [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0x40]
push edx
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
push 0x20000004
push 6
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret

Function at 0x10008c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 6
mov dword [ebp - 4], 0
jmp 0x10008c52
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10008c91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x64316fc3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10008c8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10008c49
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000adc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1008b274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x1000ade7
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1000adee
mov al, 1
jmp 0x1000aee0
mov dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0xffffffff
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x50]
jne 0x1000ae21
mov dword [ebp - 0x3c], 1
jmp 0x1000ae28
mov dword [ebp - 0x3c], 0
mov dl, byte [ebp - 0x3c]
mov byte [ebp - 0x2d], dl
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x1000ae3d
xor al, al
jmp 0x1000aee0
mov dword [ebp - 0x58], 0x20
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x40], edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1000ae84
cmp dword [ebp - 0x34], 1
je 0x1000ae8b
cmp dword [ebp - 0x34], 3
je 0x1000aeda
jmp 0x1000aede
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x1000aeba
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.10054da8
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1000aeba
xor al, al
jmp 0x1000aee0
mov edx, dword [ebp - 0x2c]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x1000aece
mov dword [ebp - 0x44], 1
jmp 0x1000aed5
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
jmp 0x1000aee0
mov al, 1
jmp 0x1000aee0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret
Function at 0x100105e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x10010757
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x10010618
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.10010780
jmp 0x1001076b
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
cmp dword [edx], 0
je 0x1001063c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x10010643
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0x10], 0
jl 0x100106fd
jg 0x10010663
cmp dword [ebp + 0xc], 0
jbe 0x100106fd
cmp dword [ebp - 0x14], 0
jl 0x100106fd
jg 0x10010679
cmp dword [ebp - 0x18], 0
jbe 0x100106fd
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jg 0x10010697
jl 0x1001068b
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x18]
jae 0x10010697
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1004d510
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [edx], eax
cmp dword [ebp + 0x10], 0
jl 0x10010747
jg 0x1001070b
cmp dword [ebp + 0xc], 0
jbe 0x10010747
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x10010747
mov ecx, dword [ebp - 4]
call fcn.1000d360
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.1005473b
add esp, 0x10
xor edx, edx
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, dword [ebp + 0x10]
sbb eax, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp + 0x10]
jmp 0x1001076b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.10010780
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100108f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x10010a5f
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x10010928
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.10010a80
jmp 0x10010a73
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
cmp dword [edx], 0
je 0x1001094c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x10010953
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0x10], 0
jl 0x10010a0d
jg 0x10010973
cmp dword [ebp + 0xc], 0
jbe 0x10010a0d
cmp dword [ebp - 0x14], 0
jl 0x10010a0d
jg 0x10010989
cmp dword [ebp - 0x18], 0
jbe 0x10010a0d
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jg 0x100109a7
jl 0x1001099b
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x18]
jae 0x100109a7
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.1004d510
add esp, 0xc
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [edx], eax
cmp dword [ebp + 0x10], 0
jl 0x10010a4f
jg 0x10010a1b
cmp dword [ebp + 0xc], 0
jbe 0x10010a4f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x10010a4f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.10054da8
add esp, 0x10
xor edx, edx
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov eax, dword [ebp + 0x10]
sbb eax, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp + 0x10]
jmp 0x10010a73
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.10010a80
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xc1
mov dword [ebp - 4], 0
jmp 0x10010e72
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x10010eb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x390d063a]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10010eac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010e69
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10010ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd7
mov dword [ebp - 4], 0
jmp 0x10010ef2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x10010f31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x26700b95]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10010f2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010ee9
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10010f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008b274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x10011034
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.10021e00
add esp, 4
call fcn.10022100
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret
Function at 0x10011250
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1008b274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x10011268
pop esi
inc edx
pushf
push 0xa

Function at 0x10011277
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x10011275
jmp 0x10011270
call fcn.10011277
jae 0x10011270
add esp, 4
jmp 0x1001127c
dec dword [esp]
jno 0x10011281
jns 0x1001126c
jp 0x10011285
add esp, 4
popf
jmp 0x1001128c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100112a5
jne 0x100112a5
inc edx
jl 0x100112aa
jmp 0x100112ac
je 0x100112a7
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100112c6
jne 0x100112c5
call 0x9305034d
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x100112d4
add eax, 0x1750374
jne 0x100112d4
call 0x35e5589e
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x1001133f
jg 0x100112ce
pushf
push 0xa
jae 0x1001134c
jmp 0x10011347
call 0x1001134e
jae 0x10011347
add esp, 4
jmp 0x10011353
dec dword [esp]
jno 0x10011358
jns 0x10011343
jp 0x1001135c
add esp, 4
popf
jmp 0x10011363
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001137c
jne 0x1001137c
invalid
jl 0x10011381
jmp 0x10011383
je 0x1001137e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001139d
jne 0x1001139c
call 0x93050424
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100113ab
jne 0x100113ab
call 0x9b5c720e
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c355
mov esp, ebp
pop ebp
ret
Function at 0x10014b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xf1
mov dword [ebp - 4], 0
jmp 0x10014b72
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 7
jge 0x10014bb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x644ef23b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10014bac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10014b69
mov eax, 1
imul ecx, eax, 7
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x32
mov dword [ebp - 4], 0
jmp 0x1001d262
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x1001d2a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x5b197e9b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d29c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d259
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x42
mov dword [ebp - 4], 0
jmp 0x1001d2e2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jge 0x1001d321
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x41d9b550]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d31c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d2d9
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa6
mov dword [ebp - 4], 0
jmp 0x1001d362
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x1001d3a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x676b3cb6]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d39c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d359
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d980
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1001dcf0
add esp, 8
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov byte [edx], 0xe8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 1], ecx
mov dword [ebp - 4], 5
jmp 0x1001d9d5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x1001d9e8
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x90
jmp 0x1001d9cc
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret