joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ea7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov dword [0x4276d0], 0x4a54
mov dword [0x4276cc], 0xba1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, 1
mov ecx, dword [ebp - 0x30]
mov byte [ecx], 0x56
mov dword [ebp - 0x34], eax
jmp 0x414fa7
mov eax, dword [ebp - 0x38]
mov ecx, dword [0x4276cc]
add ecx, 0xffffe8e3
mov dword [0x4276cc], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.00414c52
mov eax, dword [0x4276cc]
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ebp - 0x40], eax
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 0xffffdae1
mov edx, dword [ebp - 0x3c]
add edx, 0x20a3
mov esi, dword [ebp - 0x3c]
mov dword [esi + 0xd0], 0x4550
add esi, 0xffc00000
mov dword [0x4276d0], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x50], esi
mov esi, dword [ebp - 0x3c]
mov dword [ecx + 0x20], esi
mov dword [0x4276cc], 0x8a2
cmp esi, 0
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], eax
je 0x414f9e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x54
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x4163f6]
mov dl, byte [eax + 0x4163c7]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
jne 0x414fa7
mov dword [0x4276d0], 0x293e
mov dword [0x4276cc], 0x1fef
call fcn.00415d7c
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.0041500b
cmp eax, 0
mov dword [ebp - 0x38], eax
jne 0x414ee7
xor eax, eax
add esp, 0x54
pop esi
pop ebp
ret
Function at 0x41536c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x4276d8], 0
mov byte [0x4276dc], 0
mov dword [0x4276d4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x415475
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x4276e0], 0
mov edi, dword [0x4276d8]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x4276e0], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x4276d8], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x4276dc], cl
mov dword [0x4276cc], 0x56d
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov esi, dword [0x4276cc]
add esi, 0xfffff59f
mov dword [0x4276cc], esi
mov cl, byte [0x4276dc]
mov esi, dword [0x4276d8]
mov byte [ebx + esi], cl
mov esi, dword [0x4276d4]
add esi, 1
mov dword [0x4276d4], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x4153ac
jmp 0x4154be
xor eax, eax
mov dword [0x4276cc], 0x264e
mov dword [0x4276d4], 0
mov dword [ebp - 0x20], eax
jmp 0x4153ac
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0x4276cc]
mov edx, eax
mov bl, dl
add ecx, 0xffffde07
mov dword [0x4276cc], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov eax, dword [0x4276d0]
add eax, 0xffffdd3c
mov dword [0x4276d0], eax
mov eax, dword [0x4276d4]
add eax, 1
mov dword [0x4276d4], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x415475
jmp 0x415457
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4158de
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0xc], 0
mov dword [0x4276d0], 0xe05
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, 0x1d0e
xor edx, edx
mov dword [0x4276cc], 0x1d0e
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [0x4276d0], 0x14f0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
jmp 0x415989
mov eax, 0x1f6e
mov dword [0x4276d0], 0x11a4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x24], eax
je 0x415a4b
jmp 0x4159a7
mov eax, 0x1f6e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x24], eax
je 0x415a2b
jmp 0x4159a7
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [0x4276cc], ecx
add esp, 0x34
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], esi
je 0x4159e9
jmp 0x4159b9
mov eax, dword [ebp - 0x24]
xor ecx, ecx
add eax, 0xfffff632
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
jmp 0x415976
mov eax, 0x1cdf
mov dword [0x4276cc], 0x1cdf
mov ecx, dword [ebp - 0x30]
add ecx, 1
cmp ecx, 0x104
mov edx, eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x38], ecx
jl 0x415989
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jne 0x4159a7
mov eax, 0x1f6e
mov dword [0x4276cc], 0x1f6e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x24], eax
je 0x415959
jmp 0x4159a7
mov eax, 0x1f6e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x24], eax
je 0x415932
jmp 0x4159a7
mov dword [0x4276cc], 0x17f
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff8
mov dword [ebp - 0x3c], eax
mov eax, 0x17f
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x3c]
cmp word [ecx + edx*2], 0x6c
mov dword [ebp - 0x24], eax
jne 0x4159a7
mov eax, 0x3fc
mov ecx, 1
mov edx, 0x17f
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
cmp word [esi + edi*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
je 0x415976
jmp 0x4159a7
Function at 0x415b6b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x4276d4], 0
mov dword [0x4276d8], 0
mov dword [0x4276e4], 0
mov dword [0x4276cc], 0xe82
cmp eax, 0
sete bl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
xor eax, eax
mov ecx, 0xe82
mov dl, byte [ebp - 0x1d]
test dl, 1
mov esi, eax
mov edi, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ecx
jne 0x415d24
jmp 0x415be4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, 0x100
add eax, 0xffffe35c
mov ebx, ecx
add ebx, 1
add esi, 1
mov dword [0x4276cc], eax
mov eax, esi
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x4276d4], edx
mov dword [0x4276d0], 0x5d
mov esi, dword [ebp - 0x1c]
movzx esi, byte [esi + edx]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x34]
add esi, ecx
mov eax, esi
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x4276d8], edx
mov dword [0x4276cc], 0x1863
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x4276dc], cl
mov dword [0x4276cc], 0x1748
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x4276cc], 0x73e
mov cl, byte [0x4276dc]
mov edx, dword [0x4276d8]
mov byte [edi + edx], cl
mov edx, dword [0x4276cc]
mov ecx, edx
add ecx, 0xffffeb3b
mov dword [0x4276d0], ecx
mov ecx, dword [0x4276d4]
movzx ecx, byte [edi + ecx]
mov esi, dword [0x4276d8]
movzx esi, byte [edi + esi]
add esi, ecx
and esi, 0xff
mov dword [0x4276e4], esi
mov ecx, edx
add ecx, 0xfffff1c0
mov dword [0x4276cc], ecx
mov cl, byte [edi + esi]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x38]
mov ch, byte [esi + edi]
add edx, 0xffffdb1b
mov dword [0x4276d0], edx
mov dword [0x4276cc], 0x1822
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], ch
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x40], ebx
je 0x415d24
mov eax, dword [0x4276cc]
mov ecx, dword [0x4276d4]
mov edx, dword [0x4276d8]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], eax
jmp 0x415be4
mov dword [0x4276cc], 0x17a6
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001fb0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x1003d00c]
xor eax, esp
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 4]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10002095
lea eax, [esp + 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10002095
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], 0x10
push eax
push 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 0
push dword [esp + 0x18]
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10002095
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 1
push eax
push 0x10
lea eax, [esp + 0x30]
mov dword [esp + 0x3c], 2
push eax
push 0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10002095
mov al, 1
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1000f07c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x34]
xor al, al
xor ecx, esp
call fcn.1000f07c
mov esp, ebp
pop ebp
ret
Function at 0x10002550
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0xc
push str.B8592103_AE8C_4D37_807F_F1CB76E62B7C
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push 1
push eax
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1003f2e8], eax
test eax, eax
jne 0x100025c4
mov byte [0x1003d9e0], al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f07c
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100025f7
push dword [0x1003f2e8]
mov byte [0x1003d9e0], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f07c
mov esp, ebp
pop ebp
ret 4
push 0
push esi
push 0x10002520
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x1003f2ec], eax
call fcn.100020b0
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x1003f2ec], eax
mov byte [0x1003f300], 1
setne al
xor ecx, ebp
pop esi
call fcn.1000f07c
mov esp, ebp
pop ebp
ret 4

Function at 0x10002b80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x10002bb1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10002ba0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1000deb0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1003d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000df88
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x1000df79
cmp dword [ebp - 0x20], 0x10
jb 0x1000df67
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1000df67
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1000df67
mov edx, dword [esi]
test edx, edx
jne 0x1000df35
push 0x200
push edx
push dword [0x1003f33c]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1000df81
jmp 0x1000df5b
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1000df5b
shl eax, 3
push eax
push edx
push 0
push dword [0x1003f33c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1000df81
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1000def0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000f07c
leave
ret

Function at 0x1000df96
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1000deb0
cmp dword [esi], ebx
je 0x1000dff6
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x1000dff5
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1000dfec
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.1000dd51
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x1000dfbc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000dffa
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x1000e048
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1000e038
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1000e02f
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1000e00c
mov eax, dword [esi]
pop ebx
push eax
push 0
push dword [0x1003f33c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret
Function at 0x1000e04a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
imul esi, ecx, 0x28
push edi
mov edi, edx
mov dword [ebp - 0x10], edi
add esi, dword [0x1003f4d0]
mov dword [ebp - 8], esi
mov eax, dword [esi + 0x14]
mov ebx, dword [esi]
shl eax, 0x1f
sar eax, 0x1f
test eax, eax
je 0x1000e076
sub ebx, 5
xor ecx, ecx
test eax, eax
lea eax, [ebp - 4]
setne cl
push eax
push 0x40
lea ecx, [ecx*2 + 5]
push ecx
push ebx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000e09e
push 0xa
pop eax
jmp 0x1000e11d
test edi, edi
je 0x1000e0bf
mov byte [ebx], 0xe9
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
test byte [esi + 0x14], 1
je 0x1000e0de
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1000e0de
test byte [esi + 0x14], 1
je 0x1000e0d3
lea esi, [esi + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
jmp 0x1000e0de
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov al, byte [esi + 0x10]
mov byte [ebx + 4], al
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 0x10]
and eax, 1
mov ecx, eax
add eax, eax
and ecx, 0xfffffffd
or ecx, eax
mov eax, dword [esi + 0x14]
add ecx, ecx
and eax, 0xfffffff9
or ecx, eax
xor eax, eax
mov dword [esi + 0x14], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000ea29
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x1003f4c8]
push esi
xor esi, esi
jmp 0x1000ea3b
cmp dword [edx + 4], esi
jne 0x1000ea87
mov edx, dword [edx]
test edx, edx
jne 0x1000ea34
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1000ea98
push 0x20
mov dword [edx + 4], esi
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop esi
mov eax, dword [edx + 4]
add esi, 0x20
mov dword [ecx], eax
mov dword [edx + 4], ecx
add ecx, 0x20
cmp esi, 0xfe0
jbe 0x1000ea64
mov eax, dword [0x1003f4c8]
mov dword [edx], eax
mov dword [0x1003f4c8], edx
test edx, edx
je 0x1000ea98
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
xor eax, eax
pop esi
ret

Function at 0x10021753
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100215d0
Function at 0x531210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
mov ecx, ebx
test eax, eax
je 0x531282
add ebx, 8
mov dword [ebp - 4], eax
nop
mov eax, dword [ecx]
xor dword [edi], eax
mov edx, dword [ebx - 4]
xor dword [edi + 4], edx
mov edx, dword [ebx]
xor dword [edi + 8], edx
mov edx, dword [ebx + 4]
xor dword [edi + 0xc], edx
add ecx, 0x10
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
add ebx, 0x10
call fcn.00531180
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
add esp, 4
dec dword [ebp - 4]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jne 0x531230
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x5312f5
sub ebx, ecx
add ebx, edx
test ebx, ebx
jle 0x53129f
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0054be30
add esp, 0xc
mov eax, 0x10
sub eax, ebx
lea ecx, [ebp + ebx - 0x18]
je 0x5312b8
push eax
push 0
push ecx
call fcn.0054be60
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor dword [edi], edx
mov ecx, dword [ebp - 0x14]
xor dword [edi + 4], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor dword [edi + 8], edx
xor dword [edi + 0xc], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
call fcn.00531180
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov dword [edi + 0xc], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x531300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x531402
push esi
mov esi, dword [edx]
mov dword [ebp - 0x14], esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
shr eax, 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
test eax, eax
je 0x5313c9
mov edx, ebx
sub ecx, edx
lea esi, [edx + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x18], eax
jmp 0x531350
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.00533610
mov eax, dword [edi]
xor dword [ebx], eax
mov ecx, dword [edi + 4]
xor dword [esi - 8], ecx
mov edx, dword [edi + 8]
xor dword [esi - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + esi]
xor dword [esi], ecx
movzx eax, byte [ebp - 8]
movzx edx, byte [ebp - 7]
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 5]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
inc eax
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
add esp, 0x10
add edi, 0x10
add ebx, 0x10
add esi, 0x10
dec dword [ebp + 0x18]
mov byte [ebp - 7], dl
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
jne 0x531350
mov ecx, dword [ebp + 0x10]
sub ecx, edi
add ecx, dword [ebp + 0x14]
mov esi, ecx
je 0x531401
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.00533610
add esp, 0x10
xor eax, eax
test esi, esi
je 0x531401
sub ebx, edi
mov cl, byte [ebp + eax - 0x24]
xor cl, byte [edi]
inc eax
mov byte [ebx + edi], cl
inc edi
cmp eax, esi
jb 0x5313f2
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5336b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor al, al
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x14], al
mov byte [ebp - 4], al
mov byte [ebp - 0xc], al
push 2
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 8], 0x3031
mov dword [ebp - 0x28], 0x32313032
mov word [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x36313032
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0x20], 0x38303032
mov word [ebp - 0x1c], 0
call fcn.0054c520
add esp, 0xc
test eax, eax
je 0x53371e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x64], 1
push 1
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0054c520
add esp, 0xc
test eax, eax
jne 0x53379f
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0054c520
add esp, 0xc
test eax, eax
jne 0x53379f
push 1
lea ecx, [ebp - 0x18]
push ecx
push esi
call fcn.0054c520
add esp, 0xc
test eax, eax
jne 0x533795
push 2
lea edx, [ebp - 8]
push edx
push esi
call fcn.0054c520
add esp, 0xc
test eax, eax
jne 0x533795
push 4
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.0054c520
add esp, 0xc
test eax, eax
jne 0x533795
push 4
lea ecx, [ebp - 0x30]
push ecx
push esi
call fcn.0054c520
add esp, 0xc
test eax, eax
jne 0x533795
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret