joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4334c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0x5b
mov eax, dword [ebp - 4]
mov byte [eax + 0x44e3ac], 0
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jne 0x4334d1
mov dword [ebp - 8], 0x17
mov eax, 0x4468a4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp dword [edx + eax*4], 4
jb 0x433567
xor eax, eax
mov al, byte [0x446904]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub dword [ecx + edx*4], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x43353c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor dword [ecx + edx*4], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x43351f
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
and dword [edx + eax*4], 3
xor eax, eax
mov dword [ebp - 4], eax
mov al, byte [ebp - 4]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x4468a4]
mov byte [edx + 0x44e3ac], al
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x5b
jne 0x43354b
mov esp, ebp
pop ebp
ret

Function at 0x434ca0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 8]
call fcn.0041b4e0
test al, al
je 0x434d17
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0041b794
test eax, eax
jne 0x434cf8
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jne 0x434cec
cmp eax, dword [ebp - 0x20]
seta al
jmp 0x434cef
setg al
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x434d17
mov al, byte [ebp - 0xd]
and al, byte [ebp + 8]
je 0x434d17
mov eax, dword [ebp - 8]
call fcn.00405290
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4
Function at 0x437e8c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x437e94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x438061
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0042f93c
mov eax, dword [eax + 0x14]
cmp eax, 0x1d
jge 0x437ed7
sub eax, 0xffffffff
je 0x437f3c
sub eax, 3
je 0x437eff
sub eax, 0x16
je 0x437fd2
jmp 0x438029
add eax, 0xffffffe3
sub eax, 2
jb 0x437fd2
sub eax, 7
je 0x437f80
sub eax, 0x11
je 0x437fd2
sub eax, 0x1d
je 0x437f3c
jmp 0x438029
mov eax, dword [ebp - 4]
call fcn.0042f93c
cmp dword [eax], 0
ja 0x437f1e
mov eax, dword [ebp - 4]
call fcn.0042f93c
cmp dword [eax + 4], 0
jbe 0x438039
mov eax, dword [ebp - 4]
call fcn.0042f93c
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
call fcn.0042f93c
xor edx, edx
mov dword [eax + 4], edx
jmp 0x438039
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, 0x438078
call fcn.00405118
lea eax, [ebp - 0x14]
mov ecx, 0x438098
mov edx, dword [ebp - 0xc]
call fcn.00405118
mov ecx, dword [ebp - 0x14]
mov edx, 0x65
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0042faf8
jmp 0x438039
lea eax, [ebp - 0xc]
mov edx, 0x4380b0
call fcn.00404e7c
lea eax, [ebp - 0x18]
mov ecx, 0x4380e8
mov edx, dword [ebp - 0xc]
call fcn.00405118
mov ecx, dword [ebp - 0x18]
mov edx, 0x65
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0042faf8
cmp dword [ebp - 0x10], 0
je 0x438039
mov ecx, dword [ebp - 0x10]
mov edx, 0x65
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
jmp 0x438039
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
call fcn.00411a68
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4380fc
call fcn.0040b93c
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040b1c8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.00404e7c
mov eax, dword [ebp - 0xc]
call fcn.00405290
push eax
mov eax, dword [ebp - 8]
call fcn.00405290
push eax
call sub.kernel32.dll_MoveFileA
jmp 0x438039
mov ecx, 0x438110
mov edx, 0x65
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438068
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404e08
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404e08
ret
Function at 0x4010b0
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x8be4dc], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov dword [ebp - 8], eax
jne 0x4010db
push str.hokuxeyidofap_lafegohawuzusatuxakoterasiva_purumogihali
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov ecx, dword [0x49fcb8]
mov ebx, dword [0x49fcbc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], ecx
call fcn.004010a0
mov edx, dword [0x49fcc0]
mov eax, dword [0x49fcc4]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov edi, 0x20
jmp 0x401120
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x8be4dc]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401186
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 0x34]
push edx
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], cx
mov eax, dword [ebp - 0x1c]
push eax
push ecx
push str.dojizilujidufarekezurutiric
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov eax, dword [ebp - 4]
mov ecx, dword [0x8be4dc]
add eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x4011a0
mov dword [0x8be4d8], 0xedeb2e40
jmp 0x4011c2
cmp ecx, 0x3eb
jne 0x4011c2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x8bde8c], 0
mov ecx, dword [ebp - 0x18]
add ecx, esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xc]
mov edx, esi
shr edx, cl
mov dword [0x8be4d4], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov edx, dword [ebp - 8]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
mov ecx, dword [ebp - 4]
add eax, ebx
xor eax, dword [ebp - 0x14]
xor ecx, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ecx
sub esi, ecx
call fcn.00401090
sub edi, 1
jne 0x401120
cmp dword [0x8be4dc], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], esi
jne 0x401279
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [ebp - 8]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405fbc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49fa40]
jne 0x405fc6
repz ret
jmp fcn.004073d8

Function at 0x4061fe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402cda
and dword [ebp - 4], 0
cmp dword [0x4a0910], 0
mov ebx, eax
jne 0x4062af
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406360
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406360
push eax
call fcn.00402c68
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a0910], eax
call esi
push eax
call fcn.00402c68
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a0914], eax
call esi
push eax
call fcn.00402c68
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a0918], eax
call esi
push eax
call fcn.00402c68
pop ecx
mov dword [0x4a0920], eax
test eax, eax
je 0x4062af
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402c68
pop ecx
mov dword [0x4a091c], eax
mov eax, dword [0x4a091c]
cmp eax, ebx
je 0x406307
cmp dword [0x4a0920], ebx
je 0x406307
push eax
call fcn.00402ce3
push dword [0x4a0920]
mov esi, eax
call fcn.00402ce3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406307
test edi, edi
je 0x406307
call esi
test eax, eax
je 0x4062fe
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4062fe
test byte [ebp - 0xc], 1
jne 0x406307
or dword [ebp + 0x10], 0x200000
jmp 0x406340
mov eax, dword [0x4a0914]
cmp eax, ebx
je 0x406340
push eax
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406340
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406340
mov eax, dword [0x4a0918]
cmp eax, ebx
je 0x406340
push eax
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406340
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a0910]
call fcn.00402ce3
pop ecx
test eax, eax
je 0x406360
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406362
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xdb4316
Capabilities:
Encode data using xor

Disassembly:
xor bl, al
lea eax, [esp + eax + 0x1c]
call fcn.00faa321
xchg dword [ebp - 0x74ffe21e], edi
in al, dx
mov edx, 0xe4ac3931
mov ecx, 0x40
lea edx, [esi - 0x80]
call fcn.00df6e01
shr byte [esp + 0x1a], 0xe2
jns 0xc596c9
inc eax
jne 0xdb4329
jnp 0xdb4389
sbb dword [edi + 6], ebp
push cs
insb byte es:[edi], dx
jl 0xdb4343
inc eax
adc dword [ecx], ebx
inc edi
pop edi
adc eax, 0x78121a43
pop edi
insb byte es:[edi], dx
aad 0x3e
jp 0xdb42fc
fucomp st(4)
mov dh, bl
jp 0xdb43a2
pop esi
dec ecx
jp 0xdb4331
retf
and dword [ecx], esi
push cs
inc edi
dec edi
or eax, 0x64357b1d
insb byte es:[edi], dx
sub ah, byte [edx]
xor eax, 0x222a6c64
cmp byte [esi], cl
pop ebx
imul ecx, dword [0x540d4305], 0x5c
and dh, byte [ebx + eax*4 + 0x17b16df7]
dec eax
mov eax, dword [0x6c02b1b6]
insb byte es:[edi], dx
jge 0xdb435d
adc ebp, 0x290a7a3e
cmp bh, byte [esi - 0x7227c3]
outsb dx, byte [esi]
cmp byte [edx], ch
shl dword [ebp - 0x1cfe9a0e], 0xbd
arpl word [edx + ebx*8], sp
aad 0x3e
fidivr dword [eax]
loopne 0xdb43ec
fild word [eax]
daa
or al, 0x4a
jle 0xdb4354
mov cl, 0x8a
aad 0xab
mov dl, ch
stosd dword es:[edi], eax
in eax, 0x3e
pop edx
and ah, byte [edx + 0x14]
cmp al, 0xd9
adc ecx, esp
ret 0xa8b8
xor cl, dh
xlatb
mov dh, 0xa2
inc ebp
jle 0xdb4417
mov byte [0x19277e45], al
fdivr st(6)
adc dword [eax], 0x2b
ja 0xdb445a
sbb eax, ebx
inc byte [ebx + 0x62772b10]
sub eax, 0x197ddf31
sbb eax, 0xd1fd8ca3
xor edx, dword [esi + 0x4c]
sti
call 0x7d37624f
inc esi
add al, 0xe4
salc
jmp 0xdb43e8
std
retf
pop es
add esp, dword [eax + 0x3e]
js 0xdb44d8
pop ds
or al, 0x3f
invalid
xchg edi, eax
fsub qword [esi - 9]
fimul dword [edi]
retf 0xc0d0

Function at 0xdf86a8
Capabilities:
Encode data using xor

Disassembly:
js 0xdff634
pop edi
stc
invalid
add ebp, 2
xor dx, bx
not dx
mov dword [esp], 0x59d7f3f
neg dx
add dx, 0x9fbf
xor dx, 0x83bb
xor bx, dx
sub esi, 2
jmp 0xf1a35d
mov word [esi], dx
lea esp, [esp + 4]
jmp fcn.00f9e037

Function at 0xe18276
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0xdb3677
sub esp, 0x114
test bh, 0x11
jmp 0xfaffb4
test esi, esi
jmp 0xdb365e
push ebp
xor edx, 0x35879d2e
mov ebp, esp
and dx, bp
cmova edx, ebx
mov edx, dword [ebp + 8]
jmp 0xde703d
je 0xdb3677
mov esi, dword [ebp + 0xc]
cmc
clc
jmp 0xe0c2cc
push esi
clc
cmc
test edx, edx
jmp 0xf180bb

Function at 0xe1d4ad
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
je 0xe1d505
mov ecx, 0xfb35e0ac
inc ecx
xor ecx, ecx
adc cl, byte [edi + ecx]
xor ecx, edx
push 0x952cd322
and ecx, 0xff
rol byte [esp + 1], 0x84
mov ecx, dword [ecx*4 + 0xdf9dc0]
sub byte [esp + 1], 0x9d
shr edx, 8
xor edx, ecx
inc byte [esp + 2]
seto byte [esp + 2]
inc edi
rol byte [esp + 3], 0x43
xor edx, 0x8b96511f
dec eax
lea esp, [esp + 4]
jne 0xe1d4b7
not edx
push 0x680bd234
mov dword [ebp], edx
lea esp, [esp + 4]
jmp fcn.00dbd688

Function at 0xf3cafc
Capabilities:
Encode data using xor

Disassembly:
add esi, 1
xor dl, bl
call fcn.00df7741
sbb dword [esp + eax*8], esp
adc al, 0xb3
invalid
Function at 0x402d00
Capabilities:
Check mutex on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov dword [0x41a424], esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.IGK_6000_Device
call edi
movups xmm0, xmmword [0x41608c]
push 0x41a468
push 1
movups xmmword [0x41a468], xmm0
push 0
movups xmm0, xmmword [0x41609c]
movups xmmword [0x41a478], xmm0
movups xmm0, xmmword [0x416074]
movups xmmword [0x41a486], xmm0
movq xmm0, qword [0x416084]
movq qword [0x41a496], xmm0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x402d8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402ece
movups xmm1, xmmword [0x41609c]
push str.4695579F_999A_41d4_9FAF_EFFCE93EBE19
movups xmm0, xmmword [0x416074]
movups xmm2, xmmword [0x41608c]
movups xmmword [0x41a878], xmm1
movups xmmword [0x41a886], xmm0
movq xmm0, qword [0x416084]
movq qword [0x41a896], xmm0
movups xmm0, xmmword [0x41605c]
movups xmmword [0x41a678], xmm1
movups xmmword [0x41a686], xmm0
movq xmm0, qword [0x41606c]
movups xmmword [0x41a868], xmm2
movups xmmword [0x41a668], xmm2
movq qword [0x41a696], xmm0
call edi
mov ecx, esi
mov dword [0x41aa6c], eax
call fcn.00402ef0
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x41a868
push 0x41a668
push 0
mov dword [0x41aa68], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x402ece
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push 0
push eax
call esi
test eax, eax
je 0x402eb3
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x402ea2
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x402e82
pop ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040439d
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040439d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10002390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10062064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov cl, byte [esi]
mov byte [ebp - 0x19], cl
test eax, eax
je 0x100023e8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov cl, byte [ebp - 0x19]
cmp cl, 0xe8
jb 0x100024e5
cmp cl, 0xe9
jbe 0x1000246d
cmp cl, 0xff
jne 0x100024e5
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.100083f0
add esp, 4
cmp al, 0x15
je 0x1000241c
cmp al, 0x25
jne 0x100024e5
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x14], 4
push 4
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10002456
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov ecx, dword [esi]
mov eax, edi
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f0be
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
inc esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
lea eax, [esi + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov ecx, dword [esi]
mov dword [ebp - 0x20], ecx
test eax, eax
je 0x100024cb
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov ecx, dword [ebp - 0x20]
lea eax, [esi + 4]
add eax, ecx
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f0be
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f0be
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
mov dword [edi], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1002f0be
mov esp, ebp
pop ebp
ret
Function at 0x10002740
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10062064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10063be0]
push esi
mov esi, ecx
test al, 1
jne 0x1000279c
xorps xmm0, xmm0
mov dword [0x10063bc8], 0
or eax, 1
movq qword [0x10063bc0], xmm0
mov dword [0x10063be0], eax
mov dword [0x10063bc0], 0x10059058
mov dword [0x10063bc8], 0
mov dword [0x10063bc4], 0
call fcn.10002500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 2
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, 0x90909090
setne byte [ebp - 0xc]
mov word [esi], ax
cmp byte [ebp - 0xc], 0
je 0x100027e0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002f0be
mov esp, ebp
pop ebp
ret

Function at 0x100027f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10062064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10063be0]
push ebx
mov ebx, edx
push esi
mov esi, ecx
push edi
test al, 1
jne 0x10002850
xorps xmm0, xmm0
mov dword [0x10063bc8], 0
or eax, 1
movq qword [0x10063bc0], xmm0
mov dword [0x10063be0], eax
mov dword [0x10063bc0], 0x10059058
mov dword [0x10063bc8], 0
mov dword [0x10063bc4], 0
call fcn.10002500
push ecx
mov eax, esp
lea ecx, [ebp - 0x30]
mov dword [eax], esi
call fcn.10002390
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
push eax
push 0x40
push 1
push esi
call edi
test eax, eax
setne byte [ebp - 0x10]
mov byte [esi], 0xe8
cmp byte [ebp - 0x10], 0
je 0x1000289d
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call edi
inc esi
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x2c], esi
lea eax, [esi + 4]
sub ebx, eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
test eax, eax
setne byte [ebp - 0x20]
mov dword [esi], ebx
cmp byte [ebp - 0x20], 0
je 0x100028d9
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x2c]
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1002f0be
mov esp, ebp
pop ebp
ret
Function at 0x100028f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10062064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10063be0]
push ebx
mov ebx, edx
push esi
mov esi, ecx
push edi
test al, 1
jne 0x10002950
xorps xmm0, xmm0
mov dword [0x10063bc8], 0
or eax, 1
movq qword [0x10063bc0], xmm0
mov dword [0x10063be0], eax
mov dword [0x10063bc0], 0x10059058
mov dword [0x10063bc8], 0
mov dword [0x10063bc4], 0
call fcn.10002500
push ecx
mov eax, esp
lea ecx, [ebp - 0x30]
mov dword [eax], esi
call fcn.10002390
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
push eax
push 0x40
push 1
push esi
call edi
test eax, eax
setne byte [ebp - 0x10]
mov byte [esi], 0xe9
cmp byte [ebp - 0x10], 0
je 0x1000299d
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call edi
inc esi
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x2c], esi
lea eax, [esi + 4]
sub ebx, eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
test eax, eax
setne byte [ebp - 0x20]
mov dword [esi], ebx
cmp byte [ebp - 0x20], 0
je 0x100029d9
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x2c]
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1002f0be
mov esp, ebp
pop ebp
ret

Function at 0x100029f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10062064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10063be0]
push ebx
mov bl, dl
push esi
mov esi, ecx
test al, 1
jne 0x10002a4f
xorps xmm0, xmm0
mov dword [0x10063bc8], 0
or eax, 1
movq qword [0x10063bc0], xmm0
mov dword [0x10063be0], eax
mov dword [0x10063bc0], 0x10059058
mov dword [0x10063bc8], 0
mov dword [0x10063bc4], 0
call fcn.10002500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], bl
cmp byte [ebp - 0xc], 0
je 0x10002a8d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f0be
mov esp, ebp
pop ebp
ret

Function at 0x10002d50
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
xor eax, eax
movzx ecx, word [edx]
test cx, cx
je 0x10002d80
push esi
mov esi, ecx
nop
movzx ecx, si
lea edx, [edx + 2]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x10002d60
pop esi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret