joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10060ea6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
test byte [ebp + 0x10], 0xf
je 0x10060eb7
push 1
pop eax
leave
ret
cmp dword [ebp + 0x10], 0
je 0x10060f9d
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov eax, dword [ebx]
push 4
mov dword [ebp - 4], eax
pop eax
add ebx, eax
sub dword [ebp + 0x10], 0x10
mov dword [ebp - 0x10], 0x14
mov esi, dword [ebx]
mov ecx, dword [eax + ebx]
add ebx, eax
mov dword [ebp - 8], ecx
add ebx, eax
mov edi, dword [ebx]
add ebx, eax
mov eax, dword [ebp + 8]
add esi, dword [eax + 8]
add edi, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp + 0xc], eax
lea eax, [esi + esi + 1]
push 5
imul eax, esi
push eax
call fcn.10060fa1
mov dword [ebp - 0xc], eax
lea eax, [edi + edi + 1]
imul eax, edi
push 5
push eax
call fcn.10060fa1
mov dword [ebp - 0x18], eax
push eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 4]
push eax
call fcn.10060fa1
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0xc]
mov dword [ebp - 4], esi
add eax, dword [ecx - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 8]
push eax
call fcn.10060fa1
mov ecx, dword [ebp + 0xc]
add dword [ebp + 0xc], 8
add esp, 0x20
mov dword [ebp - 8], edi
add eax, dword [ecx]
dec dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov esi, eax
jne 0x10060efb
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
push 4
mov edx, dword [ecx + 0xb0]
mov ecx, dword [ecx + 0xb4]
add edx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [eax], edx
pop edx
add eax, edx
mov dword [eax], esi
add eax, edx
mov dword [eax], ecx
add eax, edx
mov ecx, edi
mov dword [eax], ecx
add eax, edx
cmp dword [ebp + 0x10], 0
mov dword [ebp + 0x14], eax
jne 0x10060ec7
pop edi
pop esi
pop ebx
xor eax, eax
leave
ret

Function at 0x10061047
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
mov eax, esi
pop ecx
xor dword [eax], 0x41dfac36
add eax, 4
dec ecx
jne 0x10061055
mov ecx, dword [esi + 0x10]
mov edi, dword [ebp + 0x10]
mov eax, ecx
mov edx, edi
shr eax, 3
lea ecx, [ecx + edi*8]
and eax, 0x3f
shl edx, 3
cmp ecx, edx
mov dword [esi + 0x10], ecx
jae 0x10061081
inc dword [esi + 0x14]
push 0x40
mov ecx, edi
pop ebx
shr ecx, 0x1d
add dword [esi + 0x14], ecx
sub ebx, eax
cmp edi, ebx
jb 0x100610d4
push ebx
lea eax, [esi + eax + 0x18]
push dword [ebp + 0xc]
push eax
call fcn.10061bca
lea eax, [esi + 0x18]
push eax
push esi
call fcn.1006115a
add esp, 0x14
mov dword [ebp + 8], ebx
add ebx, 0x3f
cmp ebx, edi
jae 0x100610d0
mov eax, dword [ebp + 0xc]
lea eax, [ebx + eax - 0x3f]
push eax
push esi
call fcn.1006115a
add dword [ebp + 8], 0x40
pop ecx
pop ecx
add ebx, 0x40
jmp 0x100610b3
xor eax, eax
jmp 0x100610d8
and dword [ebp + 8], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sub edi, ecx
add ecx, edx
push edi
lea eax, [esi + eax + 0x18]
push ecx
push eax
call fcn.10061bca
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10061c1c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.10061c56
mov ax, word [esi + 2]
pop ecx
xor word [esi], ax
xor ecx, ecx
lea eax, [esi + 0x12]
mov edx, ecx
and edx, 3
mov edx, dword [esi + edx*4 + 2]
xor dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 0xa
jb 0x10061c34
mov al, byte [esi + 0x10]
xor byte [esi + 0x3a], al
mov al, byte [esi + 0x11]
xor byte [esi + 0x3b], al
pop esi
ret

Function at 0x10062644
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
push 4
pop edi
lea eax, [ebp - 4]
push edi
push 0x100a5610
push eax
call fcn.1005f8e5
mov esi, dword [ebp - 4]
push edi
lea eax, [ebp - 4]
push 0x100a55f8
push eax
call fcn.1005f8e5
mov eax, dword [ebp - 4]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push 0x100a5614
push eax
call fcn.1005f8e5
mov eax, dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0x10], eax
push 0x14
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.1005f8b6
add esp, 0x30
cmp dword [ebp + 8], 1
push 0x10
jne 0x100626cf
lea eax, [ebp - 0x24]
push 0x100a55c0
push eax
call fcn.1005f8e5
add esp, 0xc
lea eax, [ebp - 0x24]
mov ecx, edi
xor dword [eax], 0x3dd17ea6
add eax, edi
dec ecx
jne 0x100626be
mov byte [ebp - 0x14], 0x6c
jmp 0x100626f8
lea eax, [ebp - 0x24]
push 0x100a55d0
push eax
call fcn.1005f8e5
add esp, 0xc
lea eax, [ebp - 0x24]
mov ecx, edi
xor dword [eax], 0x3dd17ea6
add eax, edi
dec ecx
jne 0x100626e5
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x6c
lea eax, [ebp - 0x24]
push eax
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1006279d
mov esi, 0x100a5334
push 0x100
push esi
push eax
call fcn.1006297a
add esp, 0xc
test eax, eax
jbe 0x1006275f
call fcn.100627fb
cmp eax, 3
je 0x10062769
cmp eax, edi
je 0x10062769
cmp eax, 5
je 0x10062769
cmp dword [0x100a5434], 0xffffffff
jne 0x10062769
lea eax, [ebp - 0x28]
push eax
push ebx
push esi
push 0x10062c37
push ebx
push ebx
call fcn.10062a16
add esp, 0x18
cmp dword [0x100a5330], ebx
mov dword [0x100a5434], eax
jne 0x10062769
mov eax, 0xa816001f
jmp 0x100627f6
push 1
lea esi, [ebp - 0xa0]
pop ebx
push ebx
push dword [ebp - 8]
call dword [ebp - 0x10]
test eax, eax
mov dword [esi], eax
je 0x10062797
inc ebx
add esi, edi
cmp ebx, 0x1f
jb 0x10062772
cmp dword [ebp + 8], 1
mov eax, dword [ebp - 0x34]
jne 0x100627a4
mov dword [0x100a5594], eax
jmp 0x100627a9
push dword [ebp - 8]
call dword [ebp - 0xc]
mov eax, 0xa8160005
jmp 0x100627f6
mov dword [0x100a5598], eax
push dword [ebp - 0x90]
call fcn.10062aa3
test eax, eax
pop ecx
je 0x100627c0
mov eax, 0xa8160006
jmp 0x100627f6
push dword [ebp - 0x50]
push dword [ebp - 0x48]
call fcn.10062b70
pop ecx
test eax, eax
pop ecx
je 0x100627d8
mov eax, 0xa8160007
jmp 0x100627f6
cmp dword [ebp + 8], 1
jne 0x100627ea
mov dword [0x100a558c], 2
jmp 0x100627f4
mov dword [0x100a5590], 2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100627fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.100628d2
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.10062901
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.100628d2
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
call esi
test eax, eax
jne 0x10062899
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.100628d2
add esp, 0xc
xor eax, eax
jmp 0x100628ce
mov eax, dword [ebp - 0x98]
sub eax, ebx
je 0x100628cb
dec eax
je 0x100628ab
dec eax
je 0x100628bd
jmp 0x10062895
cmp dword [ebp - 0xa0], ebx
jne 0x100628b7
push 4
jmp 0x100628cd
jbe 0x100628bd
push 5
jmp 0x100628cd
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x100628ce
push 3
pop eax
pop esi
pop ebx
leave
ret

Function at 0x10062901
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x100a5320], 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x10062963
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100a5320], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
mov eax, dword [0x100a5320]
add esp, 0xc
leave
ret
Function at 0x1006297a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
and byte [ebp - 2], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 5], 0x6d
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 8], 0x65
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 9], 0x6c
mov byte [ebp - 3], 0x41
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 7], 0x4e
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 6], 0x61
call fcn.10062901
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
add esp, 0xc
test esi, esi
jne 0x10062a08
push 1
pop eax
jmp 0x10062a13
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x10062a16
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
and byte [ebp - 8], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 9], 0x64
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.10062901
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
add esp, 0xc
test esi, esi
jne 0x10062a8c
or eax, 0xffffffff
jmp 0x10062aa0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x10062e94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
and byte [ebp - 8], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x72
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x72
call fcn.10062901
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
add esp, 0xc
test esi, esi
jne 0x10062f09
xor eax, eax
jmp 0x10062f0b
call esi
pop esi
leave
ret

Function at 0x10062f41
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xb], 0x65
call fcn.10062901
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
add esp, 0xc
test esi, esi
jne 0x10062fb2
xor eax, eax
jmp 0x10062fc9
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x10062fcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0xf], 0x48
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6c
call fcn.10062901
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100628d2
add esp, 0xc
test esi, esi
jne 0x1006303d
xor eax, eax
jmp 0x10063042
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x100653c0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, 0xffffffff
je 0x100654c0
push edi
xor al, al
lea edi, [ebp - 0x20]
mov ecx, 0x1c
rep stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x20], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100654bf
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_HeapReAlloc]
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100654a7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100654a7
mov eax, dword [0x100acad0]
test eax, eax
jne 0x10065463
mov ecx, dword [0x100a7708]
push 0x400
push eax
push ecx
mov dword [0x100acad4], 0x100
call edi
mov dword [0x100acad0], eax
test eax, eax
je 0x100654bc
jmp 0x10065495
mov ecx, dword [0x100acad4]
cmp dword [0x100acad8], ecx
jb 0x10065495
add ecx, ecx
lea edx, [ecx*4]
push edx
push eax
mov eax, dword [0x100a7708]
push 0
push eax
mov dword [0x100acad4], ecx
call esi
test eax, eax
je 0x100654bc
mov dword [0x100acad0], eax
mov edx, dword [0x100acad8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4], ecx
inc dword [0x100acad8]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push ecx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10065420
mov esi, dword [ebp - 0x24]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10066b1b
mov esp, ebp
pop ebp
ret

Function at 0x100654e0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
call fcn.100653c0
cmp dword [0x100acad0], 0
je 0x10065544
push edi
xor edi, edi
cmp dword [0x100acad8], edi
jbe 0x10065543
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
push esi
mov eax, dword [0x100acad0]
mov ecx, dword [eax + edi*4]
push ecx
push 0
push 0x5a
call ebx
mov esi, eax
test esi, esi
je 0x10065538
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
mov edx, esi
call fcn.10065250
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [0x100acad8]
jb 0x10065504
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x10065550
Capabilities:
Resume thread

Disassembly:
cmp dword [0x100acad0], 0
je 0x100655c7
push esi
push edi
xor edi, edi
cmp dword [0x100acad8], edi
jbe 0x1006559d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
lea esp, [esp]
mov eax, dword [0x100acad0]
mov ecx, dword [eax + edi*4]
push ecx
push 0
push 0x5a
call ebx
mov esi, eax
test esi, esi
je 0x10065593
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [0x100acad8]
jb 0x10065570
pop ebx
mov edx, dword [0x100acad0]
mov eax, dword [0x100a7708]
push edx
xor esi, esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov dword [0x100acad0], esi
mov dword [0x100acad4], esi
mov dword [0x100acad8], esi
pop esi
ret

Function at 0x100655d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x100acac0]
push ebx
push esi
lea eax, [eax + eax*4]
test byte [ecx + eax*8 + 0x14], 1
lea esi, [ecx + eax*8]
push edi
mov edi, dword [esi]
mov ebx, 5
je 0x100655f8
sub edi, ebx
mov ebx, 7
lea edx, [ebp - 4]
push edx
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10065616
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
je 0x1006563d
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1006565e
mov ecx, dword [esi]
mov byte [ecx], 0xeb
mov edx, dword [esi]
mov byte [edx + 1], 0xf9
jmp 0x1006565e
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10065658
mov cx, word [esi + 0x10]
mov word [edi + 4], cx
mov dl, byte [esi + 0x12]
mov byte [edi + 6], dl
jmp 0x1006565e
mov cl, byte [esi + 0x10]
mov byte [edi + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
and eax, 1
mov ecx, eax
and ecx, 0xfffffffd
lea edx, [eax + eax]
mov eax, dword [esi + 0x14]
or ecx, edx
add ecx, ecx
and eax, 0xfffffff9
or ecx, eax
pop edi
mov dword [esi + 0x14], ecx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10065fd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100acab0]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
test eax, eax
je 0x10066010
jmp 0x10066000
cmp dword [eax + 4], 0
jne 0x100660b8
mov eax, dword [eax]
test eax, eax
jne 0x10066000
and esi, 0xfffff000
push ebx
mov ebx, esi
lea esi, [ebx - 0x1000]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, ecx
jb 0x10066050
lea ebx, [ebx]
push 0x40
push 0x3000
push 0x1000
push esi
call edi
test eax, eax
jne 0x10066085
sub esi, 0x1000
cmp esi, dword [ebp - 8]
jae 0x10066030
jmp 0x10066054
test eax, eax
jne 0x10066085
lea esi, [ebx + 0x1000]
cmp esi, dword [ebp - 4]
jae 0x100660b6
nop
push 0x40
push 0x3000
push 0x1000
push esi
call edi
test eax, eax
jne 0x10066085
add esi, 0x1000
cmp esi, dword [ebp - 4]
jb 0x10066060
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [eax + 0x20]
mov edx, ecx
mov dword [eax + 4], 0
sub edx, eax
mov esi, dword [eax + 4]
mov dword [ecx], esi
mov dword [eax + 4], ecx
add edx, 0x20
add ecx, 0x20
cmp edx, 0x1000
jbe 0x10066093
mov ecx, dword [0x100acab0]
mov dword [eax], ecx
mov dword [0x100acab0], eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10066b1b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a5c90]
jne 0x10066b25
repz ret
jmp fcn.1006bb23

Function at 0x10067acd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10067af4
call fcn.1006cd54
mov dword [eax], esi
call fcn.1006cd41
push 0x16
pop esi
mov dword [eax], esi
call fcn.1006ccef
mov eax, esi
jmp 0x10067b49
test dword [ebp + 0xc], 0xfffffff9
jne 0x10067ada
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10067b21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1006cd67
pop ecx
call fcn.1006cd41
mov eax, dword [eax]
jmp 0x10067b49
test al, 0x10
jne 0x10067b47
test al, 1
je 0x10067b47
test byte [ebp + 0xc], 2
je 0x10067b47
call fcn.1006cd54
mov dword [eax], 5
call fcn.1006cd41
mov dword [eax], 0xd
jmp 0x10067b18
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1007d7e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1006c646
and dword [ebp - 0x14], 0
cmp dword [0x100a8484], 0
mov dword [ebp - 0x18], eax
jne 0x1007d89a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1007d942
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10094dd0
push ebx
call edi
test eax, eax
je 0x1007d942
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100a8484], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100a8488], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100a848c], eax
call edi
push eax
call esi
mov dword [0x100a8494], eax
test eax, eax
je 0x1007d89a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100a8490], eax
mov eax, dword [0x100a8490]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1007d8f3
cmp dword [0x100a8494], ecx
je 0x1007d8f3
push eax
call esi
push dword [0x100a8494]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1007d8f3
test ebx, ebx
je 0x1007d8f3
call edi
test eax, eax
je 0x1007d8ea
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1007d8ea
test byte [ebp - 8], 1
jne 0x1007d8f3
or dword [ebp + 0x10], 0x200000
jmp 0x1007d926
mov eax, dword [0x100a8488]
cmp eax, dword [ebp - 0x18]
je 0x1007d926
push eax
call esi
test eax, eax
je 0x1007d926
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1007d926
mov eax, dword [0x100a848c]
cmp eax, dword [ebp - 0x18]
je 0x1007d926
push eax
call esi
test eax, eax
je 0x1007d926
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100a8484]
call esi
test eax, eax
je 0x1007d942
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1007d944
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066b1b
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219