joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15fb2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edi
lea eax, [ebp - 0xc]
push 0x171f4
push eax
call esi
xor edi, edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], 0x240
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
jle 0x15ff7
push si
mov si, 0xf280
pop si
jg 0x15ff7
push edi
push edi
push edi
lea eax, [ebp - 0x34]
push edi
push eax
lea eax, [ebp - 4]
push 2
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jl 0x1606f
push eax
cmp al, bl
inc ah
test si, ax
test esi, eax
pop eax
lea eax, [ebp - 0x14]
push eax
call dword [0x1036c]
lea eax, [ebp - 0x1c]
push 0x17280
push eax
call esi
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
lea eax, [ebp - 0x14]
push 8
push eax
push 3
lea eax, [ebp - 0x1c]
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x17b00
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
call fcn.000156ca
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x10]
push 0x1683c
push eax
call esi
lea eax, [ebp - 4]
push eax
push edi
push edi
lea eax, [ebp - 0x10]
push 0x8000
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, edi
jl 0x17bfc
lea eax, [ebp - 0x18]
push 0x16858
push eax
call esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
cmp esi, edi
mov dword [ebp - 8], esi
jge 0x17b72
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x17ba7
push ax
push ecx
test dx, ax
inc ah
cmp ah, dh
cmp ax, 0x217
inc ah
and al, dl
dec ch
pop ecx
pop ax
push dword [ebp + 0xc]
call fcn.00017ac0
push ebx
add bl, cl
sub bx, 0x145d
dec bx
test bl, 0x4a
pop ebx
cmp dword [0x17a30], edi
jne 0x17bab
mov eax, esi
jmp 0x17bfc
pushaw
push edi
and ch, ch
pop edi
popaw
call fcn.0001055a
test al, al
jne 0x17bc3
mov eax, 0xc0000001
jmp 0x17bfc
pushaw
push edx
test bx, 0x1458
or ax, di
add bh, ch
test bh, al
pop edx
popaw
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], 0x12a56
push ecx
push edx
push edi
test cx, cx
xor dl, 0x57
inc edi
or ch, 0x6f
pop edi
pop edx
pop ecx
push 0
push 0
push eax
call fcn.00015322
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xcd2a41
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x11
jo 0xcd2ae3
pop ax
bswap eax
jmp 0xcd2a83
rdtsc
lea esp, [esp + 3]
jmp 0xcd2a59
jmp 0xcd2a18
mov edx, esi
or bl, dh
xchg edx, eax
rdtsc
mov bh, 0x44
push dword [esp + 2]
jmp 0xcd2b2d
lea esp, [esp + 0x10]
dec ebp
lea edx, [ebx + esi]
pushfd
neg eax
jmp 0xcd2a6a
jno 0xcd2a43
mov edx, esi
or bl, dh
jmp 0xcd2aa1
rdtsc
lea esp, [esp + 3]
jmp 0xcd2a59
xchg edx, eax
rdtsc
mov bh, 0x44
call fcn.00cd2a8b
mov esi, 0xb0f18a89
xchg ebx, edx
retf
pop ax
bswap eax
jmp 0xcd2a2b
mov bx, word [esp]
xchg ebx, edx
lea eax, [eax + edx]
mov ax, word [esp]
mov bl, byte [esp]
jmp 0xcd2b6c
mov edx, 0xd7bc15e6
mov dx, cx
bt ax, bp
xchg dword [esp], edi
jmp 0xcd2aec
jmp 0xcd2b48
lea esp, [esp + 8]
add ebp, 0x340eb3c0
mov eax, dword [esp]
add dl, dh
jns 0xcd2b17
sub esp, 0xd
jmp 0xcd2b56
sub esp, 0xd
push word [esp + 1]
jmp 0xcd2b88
push word [esp + 1]
mov ebx, 0x2c136ecb
xchg dword [esp + 4], eax
pop eax
jmp 0xcd2b72
push dword [esp]
ret 4
lea esp, [esp + 3]
call 0xcd2c65
loope 0xcd2bec
call [edx - 0x7ff63e97]
push ss
jno 0xcd2b06
inc edx
mov ebp, 0x136ecbbb
sub al, 0x87
inc esp
and al, 4
mov ebx, 0x2c136ecb
xchg dword [esp + 4], eax
pop eax
call fcn.00cd2bd4
or byte [esi], 0x9c
sti
push ss
rcr dword [edi], cl
xchg cx, ax
adc byte [ebx - 0x2a08bc9a], dl
add byte [eax], al
xor eax, 0xb94a2fbf
add dword [reloc.kernel32.dll_LoadLibraryA], ebx
daa
lea ebx, [edi + ebp*2]
jbe 0xcd2c60
mov ax, bp
mov ebx, edx
xchg dword [esp], esi
bsr ebx, eax
mov ah, 0x42
jmp 0xcd2cf6
bt ax, bx
mov ebx, ecx
mov ax, 0x4136
bsf dx, bp
lea esi, reloc.kernel32.dll_LoadLibraryA
btr edx, ebp
jmp 0xcd2c2a
push 0xac5d228b
bswap ebx
rdtsc
bsf eax, eax
inc dh
xchg dword [esp], esi
jmp 0xcd2c40
mov ax, word [esp]
call 0xcd2c89
lea ebx, [eax*4]
lea ebx, reloc.kernel32.dll_LoadLibraryA
call fcn.00cd2daf
sub eax, dword [edx - 3]
int3

Function at 0xcd49a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], edx
jmp 0xcd4901
pushal
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], edx
call fcn.00cd489a
push dword [esp + 1]
jl 0xcd48f8
jge 0xcd48ba
Function at 0xd70e1e
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00df0004
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00df0004
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.00df0004
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.00df1694
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0xd70ed7
mov eax, 0
jmp 0xd71043
cmp dword [ebp + 0xc], 0
jne 0xd70f0d
mov dword [ebp - 0x18], esp
xor eax, eax
call fcn.00cbf117
cmpsb byte [esi], byte es:[edi]
nop
nop
cmp dword [ebp - 0x18], esp
je 0xd70f0a
push 0xa0
push 0x4057a4c
push 6
call fcn.00df000a
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0xd70f35
mov eax, 0xe43d4b
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0xd70f2f
push ebx
call fcn.00defff8
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
xor eax, eax
call fcn.00cbf277
inc ebx
nop
nop
cmp dword [ebp - 0x18], esp
je 0xd70f6a
push 0x104
push 0x4057a4c
push 6
call fcn.00df000a
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0xe43d0f
xor eax, eax
call fcn.00cbf3c1
nop
nop
cmp dword [ebp - 0x18], esp
je 0xd70fa0
push 0x12e
push 0x4057a4c
push 6
call fcn.00df000a
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call fcn.00cbf4b4
pop esp
nop
nop
cmp dword [ebp - 0x18], esp
je 0xd7103e
push 0x225
push 0x4057a4c
push 6
call fcn.00df000a
add esp, 0xc
jmp 0xd71043
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00defff8
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00defff8
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00defff8
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0xd7106f
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, 0xe43d4b
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
call fcn.00d710b1
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0xd710a3
push ebx
call fcn.00defff8
add esp, 4
mov eax, dword [ebp - 8]
jmp 0xd710ab
mov esp, ebp
pop ebp
ret 8
Function at 0xd73300
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0xd73338
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0xd73326
mov al, 1
jmp 0xd73397
cmp dword [ebx + 0x54], ecx
jne 0xd7332f
mov al, 2
jmp 0xd73397
cmp dword [ebx + 0x7c], ecx
jne 0xd73397
mov al, 3
jmp 0xd73397
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0xd7334d
mov al, 4
jmp 0xd73397
cmp ecx, 5
jne 0xd7336d
cmp ebx, 0
jne 0xd7335b
mov al, 5
jmp 0xd73397
cmp ebx, 1
jne 0xd73364
mov al, 6
jmp 0xd73397
cmp ebx, 2
jne 0xd7336d
mov al, 7
jmp 0xd73397
cmp ecx, 6
jne 0xd73395
cmp ebx, 0
jne 0xd7337b
mov al, 8
jmp 0xd73397
cmp ebx, 1
jne 0xd73382
mov al, 9
cmp ebx, 2
jne 0xd73389
mov al, 0xa
cmp ebx, 3
jne 0xd73390
mov al, 0xb
cmp ebx, 4
jne 0xd73397
mov al, 0xc
pop ebx
leave
ret
Function at 0xd87a0c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 4], 0
push 8
call fcn.00df0004
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.00df0004
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
add ebx, 4
push ebx
push 0x10
call fcn.00df0004
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0xe4465e
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push ebx
mov ebx, edi
mov ecx, 2
push ecx
push ebx
push 8
call fcn.00df0004
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push ebx
push 8
call fcn.00df0004
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
pop ebx
pop ecx
add ebx, 4
dec ecx
jne 0xd87a81
pop ebx
mov dword [ebp - 0x10], 0
push 8
call fcn.00df0004
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
add ebx, 4
push ebx
push 0x10
call fcn.00df0004
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0xe4465e
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push ebx
mov ebx, edi
mov ecx, 2
push ecx
push ebx
push 8
call fcn.00df0004
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push ebx
push 8
call fcn.00df0004
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
pop ebx
pop ecx
add ebx, 4
dec ecx
jne 0xd87b1b
pop ebx
mov dword [ebp - 0x18], esp
xor eax, eax
call fcn.00cbf117
mov esi, 0x65399090
call 0x584092f0
add byte [eax], al
add byte [eax - 0x74], ch
ja 0xd87b88
add al, 0x68
push es
add byte [eax], al
add al, ch
jl 0xd87b10
push es
add byte [ebx + 0x45890cc4], al
in al, 0x68
add dword [ebx], eax
add byte [eax + 0x868006a], al
add byte [edx], al
add byte [eax + 1], ch
add eax, dword [eax]
sub byte [edx], 0x68
or byte [eax], al
add byte [eax], al
push 0x80000301
push 0
push 0x20
push 3
mov ebx, 0xc8
call fcn.00df1714
add esp, 0x28
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
xor eax, eax
call fcn.00cbf277
insb byte es:[edi], dx
nop
nop
cmp dword [ebp - 0x24], esp
je 0xd87c00
push 0x6a
push 0x405778c
push 6
call fcn.00df000a
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 8]
push 0xe43d4b
push 0xe43d0f
xor eax, eax
call fcn.00cbf3c1
ljmp 0x74e8
Function at 0xdb1e5c
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0xdb1e93
mov esp, ebp
pop ebp
ret
Function at 0xdf2fd4
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0xdf2ff2
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0xdf2fe7
pop esi
ret

Function at 0xdf8904
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0xdf8925
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0xdf897f
inc edi
cmp edi, esi
jl 0xdf8919
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0xdf89b4
mov edx, dword [eax]
xor edx, esi
lea ebp, reloc.kernel32.dll_LoadLibraryA
not edx
and ebp, edx
test ebp, 0x80808080
je 0xdf896e
cmp byte [eax], bl
je 0xdf8989
cmp byte [eax + 1], bl
je 0xdf8992
cmp byte [eax + 2], bl
je 0xdf899c
cmp byte [eax + 3], bl
je 0xdf89a8
add eax, 4
cmp eax, edi
jb 0xdf8945
pop edi
pop esi
pop ebp
or eax, reloc.kernel32.dll_LoadLibraryA
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, reloc.kernel32.dll_LoadLibraryA
pop ebx
ret 4

Function at 0xe05514
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe3b06c
push 0xe1fbbc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], reloc.kernel32.dll_LoadLibraryA
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00e1fd44
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe88770
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 3
pop ecx
cdq
idiv ecx
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
lea ebx, [esi + 1]
mov dword [ebp - 8], ebx
test ebx, ebx
jle 0xe88813
mov ecx, dword [ebp + 8]
lea esi, [edi + 2]
add ecx, 2
mov edi, ecx
mov al, byte [edi - 2]
shr al, 2
movzx eax, al
push eax
call fcn.00e88726
mov byte [esi - 2], al
mov cl, byte [edi - 2]
mov al, byte [edi - 1]
and cl, 3
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
push eax
call fcn.00e88726
mov byte [esi - 1], al
mov cl, byte [edi - 1]
mov al, byte [edi]
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
push eax
call fcn.00e88726
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
movzx eax, al
push eax
call fcn.00e88726
mov byte [esi + 1], al
lea edi, [edi + 3]
lea esi, [esi + 4]
dec ebx
jne 0xe887a4
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, 1
jne 0xe88821
mov word [edi + esi*4 + 2], 0x3d3d
jmp 0xe8882b
cmp ecx, 2
jne 0xe8882d
mov byte [edi + esi*4 + 3], 0x3d
mov esi, ebx
mov eax, esi
shl eax, 2
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xef5e89
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00ef5052
pop word [esp]
jmp 0xef5e66
lea esp, [esp + 2]
mov dword [esp + 8], esi
push dx
call 0xef5e89
xor byte [edx + edi + 0x511fac5d], ah
rcl byte [ebx - 0x36]
mov dword gs:[esp + 0xc], esp
call fcn.00ef5e50
mov word [esp + 3], sp
lea esp, [esp]
lea esp, [esp + 2]
jmp 0xef5e9b
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0xef5ec4
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xef6add
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xef504d
Function at 0x1000b430
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x1003bcc8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x43d], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x438], 0
push 0x424
push 0
lea eax, [ebp - 0x434]
push eax
call fcn.1001abd0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x444]
add edx, 2
mov dword [ebp - 0x448], edx
mov eax, dword [ebp - 0x444]
mov cx, word [eax]
mov word [ebp - 0x44a], cx
add dword [ebp - 0x444], 2
cmp word [ebp - 0x44a], 0
jne 0x1000b489
mov edx, dword [ebp - 0x444]
sub edx, dword [ebp - 0x448]
sar edx, 1
mov dword [ebp - 0x450], edx
mov eax, dword [ebp - 0x450]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000b4d4
xor al, al
jmp 0x1000b584
mov ecx, dword [ebp + 8]
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000b4ef
xor al, al
jmp 0x1000b584
mov dword [ebp - 0x438], 0x428
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Module32FirstW
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
je 0x1000b574
movzx ecx, byte [ebp - 0x43d]
test ecx, ecx
jne 0x1000b574
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.1001a574
add esp, 0xc
test eax, eax
jne 0x1000b55c
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.1001bcd0
add esp, 0xc
mov byte [ebp - 0x43d], 1
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Module32NextW
mov dword [ebp - 0x43c], eax
jmp 0x1000b50f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x43d]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100184dc
mov esp, ebp
pop ebp
ret
Function at 0x1000caa6
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000ca48
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000ca66
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000cac4
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000caab
invalid
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000cab4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000cabe
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000caa0
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
invalid
xchg byte [edi - 1], cl
Function at 0x1000cb92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1000c381
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000c336
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1000c381
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000c336
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.1000c381
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000c336
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.1000c371
mov cl, ch
add eax, 0xfacca580
invalid
Function at 0x1000cea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, 0xc6
test dword [ecx - 0x62000007], esp
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
call dword [esi + eax*8 - 0x6597b]
call dword [esi + eax*8 - 0x6587b]
call dword [edi - 0x6577a3a]
invalid
call [ebx - 0x6567a3a]
invalid
invalid
clc
lea eax, [ebp - 0x664]
push eax
call fcn.1000c381
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000c336
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
invalid
call [eax - 0x5197a3a]
invalid
dec dword [edi - 0x5187a3a]
invalid
dec dword [edi - 0x5177a3a]
invalid
invalid
ljmp 0xffff
push eax
call fcn.1000c381
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000c336
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.1000c371
mov bh, 0xcb
nop
pushfd
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b