joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013e00
Capabilities:
Encode data using xor

Disassembly:
lds edi, [ebp + 0x49]
or byte [esi + 0x74c5d0d5], bh
push 0xffffffffffffffb6
xor ebx, dword [ecx]
invalid
adc dword [eax], eax
ret
test bl, dh
out 0xbc, eax
jne 0x10013d2c
and al, 0xec
sti
lcall 0xa4e5, 0xc6287ba6
cdq
jbe 0x10013d7d
insd dword es:[edi], dx
xchg esp, eax
sbb eax, 0x1e0baa7b
xchg edi, eax
lodsb al, byte [esi]
inc byte [eax + 0x1719eb4a]
in eax, 0x95
push esp
test dword [edx + 0x74e06ab5], ebp
mov eax, dword [0x9c3a48a8]
jmp 0x10013dd0
popal
jno 0x10013d82
lcall 0x1729, 0xf700cc16
push ss
int3
pop ss
add dh, byte [esi + 0x34]
salc
loop 0x10013dc9
ret 0x357e
cli
push 0x58
fnsave dword [ebp - 0x7a]
mov eax, ebp
add eax, 0x7861bacb
sub al, 0x4d
xlatb
mov eax, 0xf0303977
ja 0x10013e3b
xor al, dh
pushfd
jno 0x10013dc0
push 0x332e27fd
inc ebp
cmp dword [ecx + 0x11], edi
mov esi, 0x9035cd58
add dword [ebx + edx*8 - 0x57], ebp
ja 0x10013def
lcall 0x80b9, 0x7e54e257
mov ah, 0x93
je 0x10013dc4
fsubr dword [eax - 0x12128acd]
frstor dword [esi - 0x2f937760]
wait
mov byte [0xe853b74f], al
cmp dl, byte [edi + 0x79b07c18]
inc ebx
int 0xe3
outsd dx, dword [esi]
mov ecx, 0xf07f5d52
bound ebp, qword [ebp + 0x11]
mov esp, 0x9051b539
movsd dword es:[edi], dword [esi]
pop es
lodsd eax, dword [esi]
sbb cl, 0xfa
mov esp, 0xa047ab1b
insb byte es:[edi], dx
mov bl, 0x4a
and dh, byte [edi - 0x6309a258]
xchg esi, eax
mov ecx, 0xd42090d0
salc
push cs
sub bl, byte [ebx + 0x37]
pop ebx
aaa
int 0x7e
jbe 0x10013e43
xor dword [esi - 0x3c56ec71], edx
adc al, 0xd4
xor edi, dword [edx + 0x29274922]
inc edx
scasd eax, dword es:[edi]
dec ebp
int 0x49
jmp 0x10013e6e

Function at 0x1009cf80
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov ecx, 0x10512d8f
psrld mm1, qword [ecx - 0x4fba8d73]
push ecx
adc byte [edi], cl
ror byte [ecx - 0x4fba8d73], cl
or byte [eax + 0x6081d21b], bh
xchg byte [ebx + 0x34], cl
xor dword [ebx], 0xffffffd1
shr byte [ecx - 0x5f], cl
cmovns esi, dword [eax + ecx]
dec eax
nop
rol ch, cl
sub al, 0xb8
sar dword [eax - 0x55], 0xbc
xchg esi, eax
rcl ch, cl
sub al, 0xe4
sbb ah, bl
mov dh, 0x7b
in al, dx
sar byte [esi - 0x7d], cl
pop eax
sar dword [edx - 0x6d], 0x35
dec edi
shl byte [ebp + 0x708cf248], cl
cmpsd dword [esi], dword es:[edi]
aam 0x1a
shr byte [ecx + 0x29], cl
arpl word [ebp - 0x6f88f735], di
sal byte [ecx - 9], cl
mov ch, 0x9a
inc esi
mov word [eax - 0x39f52db5], gs
pop edi
pop edi
sbb cl, dh
mov bh, 0xb
xchg edx, eax
add al, 0xc8
sub eax, 0x4dc31006
push es
xor eax, 0x4ca557d2
push cs
adc bl, ch
mov eax, 0x6e0752d3
popfd
and esp, 0x6e
adc byte [eax - 0x5ec0032e], bh
jl 0x1009cf84
sar dword [eax - 0x59], 0xd2
nop
nop
lds ebp, [eax + eax*4]
or esi, dword [edx + ecx - 0x2e]
hlt
Function at 0x100b6d90
Capabilities:
Encode data using xor

Disassembly:
push ss
push ss
sbb dh, ch
xor byte [ecx + 0x711615a8], dl
sar byte [esi + 0x60], cl
push 0xdc933a9b
mov edx, 0xa00881d2
dec edx
out 0x31, eax
ror dword ds:[esi], cl
adc byte [ebp], ch
add dword [esi], esi
inc eax
xchg ecx, eax
test al, 0xd2
dec ebp
rol dword [ebp + 0x6b3c6eec], 1
jb 0x100b6d92
inc esp
or dword [eax], 0x2b
adc byte ds:[edi - 0x7a402d30], bl
sbb dh, byte [eax - 0x3bb053f]
sar byte [edi], cl
cdq
or byte [eax - 0x4794cbb6], ah
fidivr dword [ebx - 0x7d]
or byte [esi + 0x3c6ef410], dh
or dl, dl
mov ecx, 0xa42cc590
sar dword [eax - 0x59], 0x52
mov ah, 0x92
ret

Function at 0x100b8940
Capabilities:
Encode data using xor

Disassembly:
dec ebp
or al, ch
dec eax
sal byte [eax - 0x37], cl
jl 0x100b8990
nop
int 0x2c
nop
xchg edx, eax
adc eax, 0x46e645bf
fimul dword [esi + 0x6cd2c408]
xchg byte [edi - 0x2a], ah
xor esi, dword [esi]
sbb dword [edx + edx*8 - 0x51], edi
pop edx
invalid
dec ecx
dec ecx
in eax, 0x42
inc edx
inc edx
sbb eax, 0x61d2ca0a
mov byte [0x207a802b], al
pop ecx
pop es
sub eax, dword [eax + 0x759207a]
shl byte [ebx], cl
les esi, [ebx + eax*4]
mov eax, 0xd218c790
mov dword [0xa4cbb98d], eax
in al, 0x94
mov eax, 0x2445d3d2
or ah, dh
aas
xchg ebp, eax
pop eax
rol dword [0xe1b5f011], cl
add byte [ebx + edx + 4], bh
jp 0x100b8985
aad 0xc
std
add cl, byte [eax + 0x190f9b14]
mov edx, 0xfdad6f78
add bl, byte [eax + ebp + 0x19]
pop ss
test eax, 0x44b709d2
enter 0xffffffffffffe2f2, 0xfffffffffffffff7
pop edi
sal byte [ebp + 0x70a8cdbf], cl
pop edx
js 0x100b8988
rcl byte [ebx + 0x79ccfbf], cl
sal bh, cl
mov ch, 0xd2
push cs
inc eax
mov word [eax + 0x1055df44], gs
ror byte [ebx + 0x6f], cl
inc ecx
mov ah, 0x1b
ficom word [esi - 3]
bnd js 0x100b89f7
fdivr dword [edx + 0x17]
aad 0x18
dec ebp
invalid
Function at 0x100e2170
Capabilities:
Encode data using xor

Disassembly:
add byte [edi - 0x7c], bh
adc dl, bh
fcom qword [edx]
scasb al, byte es:[edi]
adc byte [esp + eax*4 + 0x12], ch
sbb eax, 0xcc1213f1
pop esp
xchg ebx, eax
sbb al, cl
inc esp
add byte [edx + edx + 0x20cab84], al
ficom word [eax]
pop ss
test byte [edx], dl
sbb byte [ecx - 0x394d54fd], dh
sbb dh, byte [eax + 0x745c22]
test byte [edx], dl
and bh, cl
cmp al, 2
push cs
add byte [eax - 0x7c], ch
adc bh, byte [ecx + 0x4f6d03b1]
bound esi, qword [edx - 0x5b20a3a6]
add byte [edx + edx - 0x4fd93e5], al
add byte ds:[edi], dl
leave
jp 0x100e2174
lodsb al, byte [esi]
mov cl, 3
mov byte [edx], al
bound esp, qword [esi]
xchg ebx, eax
ror byte [ebx - 0x2c], 1
add byte [ecx + 2], bl
and al, 0x9c
add al, bh
outsb dx, byte [esi]
add byte [eax + 0x59], al
add al, byte [esi]
mov cl, 3
jl 0x100e2121
or ch, byte [eax + 0x1004c573]
pop ecx
add ch, byte [edi + 0x9e02cc]
fsub dword [ecx + ebx*2]
add ah, dl
loope 0x100e21a7
xchg esp, eax
retf
or edi, dword [esi + 0x103430e9]
pop ecx
add cl, byte [ecx]
cld
add cl, dh
add byte [edx - 0x61fd2b29], cl
mov eax, dword [0x9f05f13]
xchg ecx, eax
pushal
nop
adc ah, dl
adc ah, dl
add ah, cl
sub al, 0x12
inc byte [eax]
enter 0x2d4, 0xffffffffffffffd0
das
mov eax, dword [0x9352a013]
sbb al, cl
outsb dx, byte [esi]
xchg esp, eax
adc byte [ebp + 0x55], bh
adc dword [esi], ebp
pop esp
adc ch, byte [esi]
adc byte [eax - 0x4a2fedcc], al
mov eax, dword [0xb241d513]
pop edx
pop esp
wait
mov esp, eax
adc byte [edx + edx], dh
pop ss
mov word [edx], ss
pop esi
adc byte [edi + 0x34], ch
adc dh, byte [ecx]
push ebx
mov eax, dword [0x58e99813]
and al, 0xeb
mov al, 0xf4
adc byte [edi + 0x34], bh
adc ch, byte [edx + 0x108e12bc]
xor dword [edx + edx], esi
mov edx, 0x6c120361
add esp, dword [esi]
xchg ebx, eax
rcr byte [ebx], 1
and al, 0
xor al, 0x12
test byte [edx], dh
in al, dx
adc bh, byte [esi + 0x1234e410]
adc al, 0x61
add eax, dword [edx - 0x2e]
jle 0x100e21c3
test al, 0x73
jne 0x100e2253
mov al, 0x5a
mov edx, 0x15f28f8d
add dword [esi + 0x10ee021c], ebp
test eax, 0xbe12f4d7
popal
add esp, esp
add byte [esi], ah
xchg ebx, eax
rcl byte [edx - 0x4fe76b0d]
jl 0x100e224b
mov al, 0xf3
jl 0x100e224b
adc dh, byte [ecx + edi*8]
dec esp
add bl, byte [esi]
add ah, bl
hlt
Function at 0x100e24e0
Capabilities:
Encode data using xor

Disassembly:
adc al, byte [ecx + edx + 0x13]
loop 0x100e2501
xchg ecx, eax
test al, 0x52
jae 0x100e24fc
sbb al, 0xb0
pop edx
lea ebp, [edi]
stc
adc al, byte [ebp + ebx*2 + 0x6e029c]
sar ecx, cl
adc ah, byte [edi + 0x11]
adc ebp, esp
shr bh, cl
pop eax
and al, 0xeb
pop esp
setno byte [eax]
out 0x19, al
mov byte [0xccd312f9], al
add bl, byte [esi - 0x38177900]
fiadd dword [ecx]
adc dword [ebx], edx
mov eax, dword [0x490401b9]
and dl, dl
in al, dx
xchg edi, eax
test al, 0xb
cmp byte [eax + esi*8], ch
pop eax
test byte [esp + edi*8], ah
add dl, bl
add bl, al
mov ecx, 0x13115202
inc edi
rcl cl, cl
sbb dh, byte [eax - 0x57681bde]
or esp, dword [esi + 0x38]
cmp byte [eax - 0x47], ch
add cl, byte [ebx + 0x2c]
adc bh, dh
add byte [esi], dh
mov ecx, 0x41d8d002
adc ebx, dword [ebx]
call 0x786eb5ff
jb 0x100e2556
or dword [ecx + 0x5e726860], edx
and al, 0x93
add dword [edi + 0x5c6c02b9], eax
adc al, bh
adc byte cs:[eax + 0x14e02b9], dh
add ebx, dword [esi - 0x572d6e9c]
jae 0x100e254e
mov ecx, 0x125c6c02
invalid
sbb al, 0xb0
pop edx
lea ebx, [ebx + 0x7f]
mov ecx, 0x128c5702
pop esi
adc bh, ch
mov ecx, 0x3017102
rcr byte [eax], cl
int1
pop eax
and al, 0xeb
push eax
mov es, word fs:[edx]
sbb byte [ecx], bl
pop esi
mov ch, 0x11
jb 0x100e24f2
adc cl, byte [esi - 0x6b7727f0]
adc ch, cl
in al, dx
adc al, byte [ecx + 0x6b]
scasd eax, dword es:[edi]
pop edx
sar byte [ebp - 0x6cb50b62], cl
sbb byte [eax - 0x11], cl
ror ah, cl
jge 0x100e2598
int3
nop
int 0x2c
test al, 0xc9
sal al, cl
xchg esp, ebx
xchg edx, eax
mov word [eax], cs
mov al, byte [0xd834524a]
cmp ebx, edi
invalid
shr byte [ebx + ebx*8], 1
add ch, byte [ecx]
jg 0x100e255b
shr byte [edx + 0x10e9d20b], cl
mov esp, 0x343a245a
dec edx
rcl byte [ebx + 0x100e6718], cl
xchg ebx, eax
mov ecx, 0x8817e1b
dec esp
add ah, byte [0x12940800]
dec eax
sbb byte [ebx], al
sal al, cl
shr byte [edx - 0x43fb16f5], cl
pop edx
mov edx, 0x94703a24
adc bl, byte [eax]
jl 0x100e25d5
pop eax
add byte [ebp - 0x29], ah
xlatb
xchg esp, eax
adc cl, byte [eax + ebx]
add esp, dword [eax - 0x2f6cd9e8]
push edx
sbb ebx, dword [ebp + 0x30f3b018]
rol dword [ecx + eax - 0x7c], 1
mov ebp, 0x88129c
cmp ecx, dword [esi + 0x3188702]
xor al, 0xd2
pop eax
and al, 0xeb
push 0xc6189102
sbb dword [edx], ecx
mov es, word [edx]
xor ecx, dword [ebx + edx]
lcall 0x8e54, 0x38c60ba8
add ch, byte [eax + 0x66320318]
xchg ecx, eax
shr byte [eax - 0x4fec8a8d], cl
pop edx
invalid

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0xf77b6c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0xf77b72
ret

Function at 0xf87264
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x437015
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00f55440
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43702c
call fcn.00f5509c
mov eax, ebx
call fcn.00f759d0
mov edi, eax
dec edi
test edi, edi
jl 0xf8731c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00f759a4
mov edx, dword [0x466454]
call fcn.00f5416c
test al, al
je 0xf87318
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00f759a4
lea edx, [ebp - 0x14]
call fcn.00fc277c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00f55440
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00f55110
inc esi
dec edi
jne 0xf872ca
mov al, byte [0x437030]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43703c
mov eax, dword [ebp - 0xc]
call fcn.00f5e7b0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00f54e28
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00fc277c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00fc277c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x437048
call fcn.00f5a820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43701c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00f54db4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00f54db4
lea eax, [ebp - 0x14]
call fcn.00f54d90
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00f54db4
ret
Function at 0xff4a64
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0xff4a92
mov eax, ebx
call fcn.00ff5518
cmp dword [ebx + 0x40], 0
je 0xff4a8b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0xff4b03
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0xff4af5
cmp dword [ebx + 8], 0
je 0xff4ab4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0xff4ac6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0xff4af5
cmp dword [ebx + 8], 0
je 0xff4aa7
cmp eax, 3
je 0xff4ad9
dec eax
jne 0xff4aa7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0xff4aa7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0xff4aa7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0xff4b21
cmp dword [ebx + 0x14], 0xcc
je 0xff4b21
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00ff4b2c
pop ebx
ret

Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x58145187
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x279a585e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100ce440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100ce44f
pop dword [ebp - 0x1c]
mov eax, 0xa1799f63
add eax, 0x6e9344ec
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xa30baf3e
add dword [ebp - 0x2c], 0xab46960d
mov dword [ebp - 0x28], 0x11704966
add dword [ebp - 0x28], 0x20c302df
mov dword [ebp - 0x24], 0xa321cb63
sub dword [ebp - 0x24], 0x56d58735
mov dword [ebp - 0x20], 0x35ec4a10
add dword [ebp - 0x20], 0xca13b5f0
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x3beb3222
sub dword [ebp - 0x2c], 0xc778c8cc
mov dword [ebp - 0x28], 0x2ad3ba80
add dword [ebp - 0x28], 0x1698a6f5
mov dword [ebp - 0x24], 0xfa31cf81
add dword [ebp - 0x24], 0x693d9ceb
mov dword [ebp - 0x20], 0xaa36714c
sub dword [ebp - 0x20], 0xaa36714c
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x9119ebd1
sub eax, 0x81033ad1
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35caf
push 0
call eax
mov ecx, 0x3d78
xor ebx, ebx
add ebx, eax
mov edx, 0x8ac1cfed
sub edx, 0x7aa233ed
add edx, dword [ebp - 0x1c]
mov edi, 0xdf185a1e
sub edi, 0x7dcc01f5
xor dword [ebp - 8], 0x4edfd991
mov esi, dword [edx]
sub dword [ebp - 0x10], 0x2acf63d1
sub esi, edi
add dword [ebp - 4], 0x97e04e30
mov dword [ebx], esi
add dword [ebp - 0x18], esi
add ebx, 4
add edx, 0x65e0929c
add edx, 0x9a1f6d68
loop 0x100ce568
add eax, 0x5f536a70
add eax, 0xa0ad7e43
xor ebx, ebx
add ebx, eax
add eax, 0x8e6b7bc0
sub eax, 0x8e6b7bbb
mov ecx, 0xb132732d
add ecx, 0x5ecd8cd3
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10001057
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x104
mov eax, dword [0x10010074]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
mov word [ebp + 0x68], 0x18
mov word [ebp + 0x6a], 0x21
mov word [ebp + 0x6c], 0x70
mov word [ebp + 0x6e], 0xd
mov word [ebp + 0x70], 0xbb
mov word [ebp + 0x72], 0xab
mov dword [ebp - 0x54], 0xb3
mov ebx, 0x9c46
mov esi, str.OpenDodgem
lea edi, [ebp + 0x5c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x68]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x5c]
movsw word es:[edi], word [esi]
push eax
lea eax, [ebp - 0x54]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
dec ebx
jne 0x1000109f
push 0x40
push 0x1000
push 0x5b90
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
mov dword [ebp - 0x58], 0x9c46
mov esi, str.OpenDodgem
lea edi, [ebp + 0x5c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x68]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x5c]
movsw word es:[edi], word [esi]
push eax
lea eax, [ebp - 0x54]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
dec dword [ebp - 0x58]
jne 0x10001107
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x78
push 0x40
call edi
movsx ecx, byte [0x10010002]
mov dword [ebp - 0x58], eax
mov eax, dword [0x10010068]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, dword [0x10010004]
cmp ecx, edx
jg 0x10001186
mov word [0x1001005e], 0x61
movsx ecx, word [section..data]
xor eax, 0x27
cmp eax, ecx
jle 0x1000119d
mov word [0x10010070], 0x56
push 5
mov esi, 0x1000dce8
push esi
push 0x16e4
push 0x10008158
push ebx
call section..text
push 5
push esi
mov esi, dword [ebp - 0x58]
push 0x1e
push 0x1000dd00
push esi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], 0x28af
call section..text
add esp, 0x28
push 0x64
push 0x40
mov dword [ebp - 0x6c], esi
call edi
mov esi, eax
push 0x1000dd80
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.sc.exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x6c]
push eax
add ebx, 0x5b0f
mov dword [ebp - 0x60], esi
call ebx
movsx ax, byte [0x10010002]
cmp word [section..data], ax
pop ecx
pop edi
pop esi
pop ebx
jg 0x10001225
mov word [0x1001005c], 0x3e
mov ecx, dword [ebp + 0x74]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.10001445
add ebp, 0x78
leave
ret
Function at 0x10001445
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10010074]
jne 0x1000144f
repz ret
jmp fcn.10001744

Function at 0x100058cb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10001b93
xor ebx, ebx
cmp dword [0x100116b8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x100059a0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1000590b
xor eax, eax
jmp 0x10005a64
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10005904
push eax
call fcn.10001b30
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100116b8], eax
call esi
push eax
call fcn.10001b30
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100116bc], eax
call esi
push eax
call fcn.10001b30
mov dword [0x100116c0], eax
lea eax, [ebp - 8]
push eax
call fcn.100018f1
test eax, eax
pop ecx
pop ecx
je 0x1000596e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000323c
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x100059a0
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10001b30
cmp eax, ebx
pop ecx
mov dword [0x100116c8], eax
je 0x100059a0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10001b30
pop ecx
mov dword [0x100116c4], eax
mov eax, dword [0x100116c4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x10005a19
cmp dword [0x100116c8], esi
je 0x10005a19
push eax
call fcn.10001b9c
pop ecx
call eax
cmp eax, ebx
je 0x100059e6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x100116c8]
call fcn.10001b9c
pop ecx
call eax
test eax, eax
je 0x100059e6
test byte [ebp - 0x18], 1
jne 0x10005a19
lea eax, [ebp - 0xc]
push eax
call fcn.10001928
test eax, eax
pop ecx
je 0x10005a01
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000323c
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x10005a10
or dword [ebp + 0x10], 0x200000
jmp 0x10005a4a
or dword [ebp + 0x10], 0x40000
jmp 0x10005a4a
mov eax, dword [0x100116bc]
cmp eax, esi
je 0x10005a4a
push eax
call fcn.10001b9c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10005a4a
mov eax, dword [0x100116c0]
cmp eax, esi
je 0x10005a4a
push dword [ebp - 4]
push eax
call fcn.10001b9c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x100116b8]
call fcn.10001b9c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret