joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009284c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ecx + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ecx + 0xc]
sub esi, dword [eax]
push edi
sub esi, 0x10
mov dword [esp + 0x10], edx
xor edi, edi
sar esi, 4
inc edi
mov dword [esp + 0xc], ecx
sub esi, ebx
jne 0x10092886
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, ebx
dec esi
call fcn.1008020b
mov ecx, dword [esp + 0xc]
mov edx, ebx
cmp eax, 3
jne 0x100928f9
call fcn.1007ff8c
mov ecx, dword [esp + 0xc]
mov edx, ebx
push 0
cmp dword [eax + 8], 0x13
jne 0x100928bb
call fcn.10080328
pop ecx
push edx
push eax
push str._lld
jmp 0x100928cb
call fcn.100802e7
push ecx
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x1c]
call fcn.100292cf
add esp, 0x10
test edi, edi
je 0x100928df
test eax, eax
jg 0x10092921
xor edi, edi
inc ebx
test esi, esi
jne 0x10092882
test edi, edi
jne 0x10092878
mov ecx, dword [esp + 0xc]
xor edx, edx
push edi
call fcn.1008ed72
pop ecx
jmp 0x1009287b
lea eax, [esp + 0x14]
push eax
call fcn.1008f07e
pop ecx
test edi, edi
je 0x100928df
push dword [esp + 0x10]
push dword [esp + 0x18]
push 1
push eax
call fcn.100ebefd
add esp, 0x10
cmp eax, dword [esp + 0x14]
jne 0x100928df
xor edi, edi
inc edi
jmp 0x100928e1
Function at 0x1009b919
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x48
push ebx
push esi
push edi
test ecx, ecx
jle 0x1009b941
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x10], eax
jmp 0x1009b949
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
test ecx, ecx
jle 0x1009b962
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x18], eax
jmp 0x1009b96a
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
test ecx, ecx
jle 0x1009b983
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x20], eax
jmp 0x1009b98b
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
test ecx, ecx
jle 0x1009b9a4
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x28], eax
jmp 0x1009b9ac
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
and dword [ebp - 8], 0
mov eax, edx
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x44], eax
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 8], esp
and esp, 0xfffffff0
push 0x33
call fcn.1009b9d7

Function at 0x1009ba54
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
push ebx
push esi
push edi
test ecx, ecx
je 0x1009bac6
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x1009ba75
test eax, eax
je 0x1009bac6
test edx, edx
je 0x1009bac6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
push 0x33
call fcn.1009ba86
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1009bacb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x17
mov dword [ebp - 8], str.LdrGetProcedureAddress
push ebx
push esi
push edi
test ecx, ecx
jne 0x1009baf4
test eax, eax
jne 0x1009baf4
xor al, al
jmp 0x1009bb52
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
push 0x33
call fcn.1009bb05
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1009bb57
Capabilities:
64-bit execution via heavens gate

Disassembly:
push 0x5b4
mov eax, 0x101a93aa
call fcn.1017513a
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
push 0x33
call fcn.1009bb75

Function at 0x1009cebc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
xor edi, edi
mov ebx, ecx
or esi, 0x100
mov ecx, esi
mov eax, esi
shr ecx, 7
add esi, esi
shr eax, 8
and ecx, 1
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx edx, word [ebx + eax*2]
mov eax, dword [ebp + 8]
shr edx, 4
xor edx, ecx
add edi, dword [eax + edx*4]
cmp esi, 0x10000
jb 0x1009cece
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1009cf03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x100
mov dword [ebp - 4], ecx
xor edi, edi
or edx, esi
add ebx, ebx
mov ecx, esi
and ecx, ebx
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add edi, dword [eax + ecx*4]
mov ecx, edx
xor ecx, ebx
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x1009cf19
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1009cfeb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
bts esi, edx
mov ebx, ecx
cmp esi, 1
je 0x1009d026
push edi
mov edi, dword [ebp + 0xc]
mov edx, esi
and esi, 1
shr edx, 1
neg esi
sar esi, 4
and esi, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, esi
mov esi, edx
add eax, dword [edi + ecx*4]
cmp esi, 1
jne 0x1009d003
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1009d02a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor esi, esi
inc edi
test ebx, ebx
je 0x1009d071
mov eax, dword [ebp + 8]
mov edx, eax
movzx ecx, word [ecx + edi*2]
and edx, 1
shr eax, 1
add edi, edi
mov dword [ebp + 8], eax
or edi, edx
mov eax, edx
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add esi, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
sub ebx, 1
jne 0x1009d03f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1009eb33
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
push 8
pop ebx
mov dword [esi + 0x3bad4], eax
lea edi, [esi + 0x8c]
mov dword [esi + 0x3bad0], eax
mov edx, eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], 0x20
mov dword [esi + 0x70], 1
mov dword [esi + 0x64], 4
mov dword [esi + 0x74], eax
mov dword [ebp - 8], ebx
mov ecx, edx
mov dword [ebp - 4], ebx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub ebx, 1
jne 0x1009eb80
mov dword [edi], ecx
inc edx
add edi, 4
push 8
pop ebx
cmp edx, 0x100
jb 0x1009eb7b
lea ecx, [ebp - 0x38]
call fcn.1009cb0f
mov edx, ecx
mov ecx, esi
call fcn.1009cc06
push 2
pop ebx
mov word [esi + 0x304a0], 0x100
mov edi, ebx
mov ecx, edi
xor edx, edx
sar ecx, 1
inc edx
dec ecx
shl edx, cl
mov dword [ebp - 4], edx
test edx, edx
je 0x1009ebec
push edx
lea eax, [esi + 0x304a0]
add eax, ebx
push edi
push eax
call fcn.100e19a0
add esp, 0xc
add ebx, dword [ebp - 4]
inc edi
cmp edi, 0x16
jl 0x1009ebc5
mov ebx, dword [ebp - 8]
push 4
mov ecx, ebx
xor edx, edx
pop edi
imul ecx, ecx
mov eax, 0x10000
add edx, edx
jmp 0x1009ec0b
shr ecx, 1
inc edx
cmp ecx, eax
jae 0x1009ec08
sub edi, 1
jne 0x1009ebfc
mov eax, ebx
mov ecx, 0xa1
shr eax, 4
sub ecx, edx
add ebx, 0x10
mov dword [esi + eax*4 + 0x30ca0], ecx
cmp ebx, 0x800
jb 0x1009ebf5
and dword [esi + 0x323ac], edi
and dword [esi + 0x3bb14], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a0eb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
lea eax, [ebp - 0x148]
push 0
push eax
call fcn.100e19a0
add esp, 0xc
mov dword [ebp - 0x14c], 0x11c
cmp dword [0x102a9420], 0
push 0x6c
pop esi
jne 0x100a0f96
mov dword [ebp - 0x30], 0x5529
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor eax, 0x6e
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x30]
inc eax
xor eax, 0x74
mov word [ebp - 0x2a], ax
mov eax, dword [ebp - 0x30]
add eax, 2
xor eax, 0x64
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x30]
add eax, 3
xor eax, esi
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 0x30]
add eax, 4
xor eax, esi
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x30]
add eax, 5
xor eax, 0x2e
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x30]
add eax, 6
xor eax, 0x64
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x30]
add eax, 7
xor eax, esi
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x30]
add eax, 8
xor eax, esi
mov word [ebp - 0x1c], ax
xor eax, eax
mov word [ebp - 0x1a], ax
mov ax, word [ebp - 0x2c]
call fcn.1001396f
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x102a9420], eax
test eax, eax
jne 0x100a0f96
mov eax, dword [0x102a9424]
jmp 0x100a1070
mov eax, dword [0x102a9424]
test eax, eax
jne 0x100a1074
mov dword [ebp - 0x18], 0x3d
mov eax, dword [ebp - 0x18]
xor eax, 0x52
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
inc al
xor eax, 0x74
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x18]
add al, 2
xor eax, esi
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x18]
add al, 3
xor eax, 0x47
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x18]
add al, 4
xor eax, 0x65
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x18]
add al, 5
xor eax, 0x74
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x18]
add al, 6
xor eax, 0x56
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x18]
add al, 7
xor eax, 0x65
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x18]
add al, 8
xor eax, 0x72
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x18]
add al, 9
xor eax, 0x73
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x18]
add al, 0xa
xor eax, 0x69
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x18]
add al, 0xb
xor eax, 0x6f
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x18]
add al, 0xc
mov byte [ebp - 7], 0
xor eax, 0x6e
xor edx, edx
mov byte [ebp - 8], al
mov al, byte [ebp - 0x14]
mov al, byte [ebp + edx - 0x14]
mov ecx, dword [ebp - 0x18]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x14], cl
inc edx
cmp edx, 0xd
jb 0x100a103f
lea eax, [ebp - 0x14]
mov byte [ebp - 7], 0
push eax
push dword [0x102a9420]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x102a9424], eax
test eax, eax
je 0x100a109b
lea ecx, [ebp - 0x14c]
push ecx
call eax
test eax, eax
jne 0x100a109b
cmp dword [ebp - 0x148], 6
ja 0x100a1097
jb 0x100a109b
cmp dword [ebp - 0x144], 1
ja 0x100a1097
jb 0x100a109b
mov al, 1
jmp 0x100a109d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100e04a9
leave
ret
Function at 0x100a1b15
Capabilities:
Encode data using xor

Disassembly:
push 0x2c
mov eax, 0x101a9583
call fcn.1017516e
mov edi, ecx
mov dword [ebp - 0x34], edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], esi
mov dword [edi], method.std::_Facet_base.virtual_4
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [edi + 0x20c]
mov dword [edi], 0x1020b2d4
xor eax, eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 7
mov word [ecx], ax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push esi
mov dword [edi + 0x224], eax
call fcn.1001eaa0
push 0x6a
pop eax
mov word [ebp - 0x1c], ax
mov ecx, ebx
push 0x79
pop eax
mov word [ebp - 0x1a], ax
push 0x72
pop eax
mov word [ebp - 0x18], ax
push 0x36
pop eax
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
mov ax, word [ebp - 0x1c]
mov ax, word [ebp + ecx*2 - 0x1c]
movzx eax, ax
add eax, 0xfffffff7
mov word [ebp + ecx*2 - 0x1c], ax
inc ecx
cmp ecx, 4
jb 0x100a1b90
push 4
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.100e8b4e
add esp, 0xc
lea esi, [edi + 4]
test eax, eax
mov eax, dword [ebp - 0x30]
jne 0x100a1bc2
add eax, 8
push eax
push 0x208
push esi
call fcn.100078b2
push 0x2e
push esi
call fcn.100e275b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100a1c3e
mov dword [ebp - 0x2c], 0xd7d0
mov eax, 0xd7fe
mov word [ebp - 0x28], ax
add eax, 0xffffffb6
mov word [ebp - 0x26], ax
mov eax, 0xd7bc
mov word [ebp - 0x24], ax
mov word [ebp - 0x22], ax
xor eax, eax
mov word [ebp - 0x20], ax
mov ax, word [ebp - 0x28]
mov ax, word [ebp + ebx*2 - 0x28]
movzx ecx, ax
movzx eax, word [ebp - 0x2c]
xor ecx, eax
mov word [ebp + ebx*2 - 0x28], cx
inc ebx
cmp ebx, 4
jb 0x100a1c0c
xor eax, eax
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.100e59d9
pop ecx
pop ecx
test eax, eax
jne 0x100a1c3e
mov word [esi], ax
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.10175118
ret 8
Function at 0x100a59eb
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x101a985c
call fcn.1017513a
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov edx, eax
mov dword [edi], eax
call fcn.100175d2
xor esi, esi
mov dword [ebp - 4], esi
lea ebx, [edi + 4]
push eax
mov ecx, ebx
call fcn.1007ded3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x100a5a2a
push dword [ebp - 0x10]
call fcn.10174e26
pop ecx
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.100175d2
mov dword [ebp - 4], 1
lea ecx, [edi + 8]
push eax
call fcn.1007ded3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x100a5a58
push dword [ebp + 0xc]
call fcn.10174e26
pop ecx
mov ch, byte [ebx]
cmp dword [edi], esi
jbe 0x100a5a70
mov edx, dword [ebp + 8]
mov cl, byte [esi + edx]
mov eax, dword [ebx]
xor cl, ch
mov byte [esi + eax], cl
inc esi
cmp esi, dword [edi]
jb 0x100a5a61
call fcn.10175103
ret 8
Function at 0x100a7b0f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x71
pop eax
push 0x6b
mov esi, ecx
xor ebx, ebx
pop ecx
push 0x78
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov word [ebp - 0x44], ax
pop eax
mov word [ebp - 0x42], cx
mov word [ebp - 0x40], ax
push 0x74
pop eax
mov word [ebp - 0x3e], ax
mov word [ebp - 0x3c], cx
push 0x72
pop ecx
push 0x39
mov word [ebp - 0x3a], cx
pop eax
mov word [ebp - 0x38], ax
push 0x38
pop eax
mov word [ebp - 0x36], ax
push 0x34
pop eax
mov word [ebp - 0x34], ax
push 0x6a
pop eax
mov word [ebp - 0x32], ax
xor eax, eax
mov word [ebp - 0x30], cx
mov word [ebp - 0x2e], cx
mov ecx, ebx
mov word [ebp - 0x2c], ax
mov ax, word [ebp - 0x44]
mov ax, word [ebp + ecx*2 - 0x44]
movzx eax, ax
add eax, 0xfffffffa
mov word [ebp + ecx*2 - 0x44], ax
inc ecx
cmp ecx, 0xc
jb 0x100a7b88
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x100a7c82
mov byte [ebp - 0x14], 0x4c
mov ecx, ebx
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xd], 0x6a
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x79
mov byte [ebp - 9], 0x68
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], bl
mov al, byte [ebp - 0x14]
mov al, byte [ebp + ecx - 0x14]
movsx eax, al
sub eax, 5
mov byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 0xd
jb 0x100a7bee
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov dword [esi], eax
xor edx, edx
mov dword [ebp - 0x28], 0x30
mov byte [ebp - 0x24], 0x62
mov byte [ebp - 0x23], 0x55
mov byte [ebp - 0x22], 0x43
mov byte [ebp - 0x21], 0x55
mov byte [ebp - 0x20], 0x44
mov byte [ebp - 0x1f], 0x67
mov byte [ebp - 0x1e], 0x42
mov byte [ebp - 0x1d], 0x59
mov byte [ebp - 0x1c], 0x44
mov byte [ebp - 0x1b], 0x55
mov byte [ebp - 0x1a], 0x67
mov byte [ebp - 0x19], 0x51
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0x58
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x15], 0
mov al, byte [ebp + edx - 0x24]
movsx ecx, byte [ebp - 0x28]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x24], al
inc edx
cmp edx, 0xf
jb 0x100a7c5d
lea eax, [ebp - 0x24]
mov byte [ebp - 0x15], 0
push eax
push edi
call ebx
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret
Function at 0x100a802b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x13c]
test edi, edi
je 0x100a80b3
cmp dword [esi + 0x138], 0
je 0x100a80b3
push ebx
mov ebx, dword [esi + 0x140]
push ebx
push ebx
push edi
call fcn.10016801
cmp eax, dword [esi + 0x144]
je 0x100a80b2
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
call ebx
mov ecx, dword [esi + 0x140]
mov edx, ecx
mov eax, dword [esi + 0x13c]
mov edi, dword [esi + 0x138]
shr edx, 2
test edx, edx
je 0x100a80a7
mov ecx, dword [edi]
cmp dword [eax], ecx
je 0x100a8090
xchg dword [eax], ecx
add eax, 4
add edi, 4
sub edx, 1
jne 0x100a8088
mov ecx, dword [esi + 0x140]
mov eax, dword [esi + 0x13c]
lea edx, [ebp - 4]
push edx
push dword [ebp - 4]
push ecx
push eax
call ebx
pop ebx
pop edi
pop esi
leave
ret

Function at 0x100a80b7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x134], 0
je 0x100a815f
push edi
mov edi, dword [esi + 0x128]
test edi, edi
je 0x100a815e
push ebx
mov ebx, 0x2000
push ebx
push ebx
push edi
call fcn.10016801
cmp eax, dword [esi + 0x148]
je 0x100a815d
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
call ebx
mov ecx, dword [esi + 0x128]
mov edx, dword [esi + 0x134]
cmp ecx, dword [esi + 0x12c]
ja 0x100a814e
mov eax, dword [edx + 6]
lea edi, [ecx + 6]
cmp dword [edi], eax
je 0x100a8120
xchg dword [edi], eax
mov eax, dword [edx + 2]
lea edi, [ecx + 2]
cmp dword [edi], eax
je 0x100a812c
xchg dword [edi], eax
mov ax, word [ecx]
cmp ax, word [edx]
je 0x100a813a
mov ax, word [edx]
mov word [ecx], ax
add ecx, 0x10
add edx, 0x10
cmp ecx, dword [esi + 0x12c]
jbe 0x100a8114
mov ecx, dword [esi + 0x128]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x2000
push ecx
call ebx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x100a859a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebx + 0x156]
test eax, eax
jne 0x100a85b9
call fcn.100a8162
jmp 0x100a86f7
push esi
push 0
mov esi, 0x1000
push esi
push eax
call fcn.10016801
cmp eax, dword [ebx + 0x15a]
je 0x100a86f6
xor edx, edx
mov eax, dword [ebx + 0x16d]
mov cl, byte [eax + edx]
xor cl, byte [ebx + 0x155]
mov eax, dword [ebx + 0x172]
mov byte [edx + eax], cl
mov eax, dword [ebx + 0x176]
mov cl, byte [edx + eax]
xor cl, byte [ebx + 0x155]
mov eax, dword [ebx + 0x17b]
mov byte [edx + eax], cl
mov eax, dword [ebx + 0x17f]
mov cl, byte [edx + eax]
xor cl, byte [ebx + 0x155]
mov eax, dword [ebx + 0x184]
mov byte [edx + eax], cl
mov eax, dword [ebx + 0x18c]
mov cl, byte [edx + eax]
mov eax, dword [ebx + 0x190]
xor cl, byte [ebx + 0x155]
mov byte [edx + eax], cl
inc edx
cmp edx, 0x80
jl 0x100a85d6
push edi
push 0
push esi
push dword [ebx + 0x156]
call fcn.10016801
mov edi, dword [ebx + 0x15e]
mov edx, dword [ebx + 0x168]
mov esi, dword [ebx + 0x163]
mov ecx, dword [ebx + 0x188]
mov dword [ebx + 0x15a], eax
mov eax, dword [ebp - 4]
mov ebx, dword [ebx + 0x172]
mov dword [ebp - 8], edi
mov edi, dword [ebp - 4]
mov dword [eax + 0x15e], ebx
mov eax, dword [eax + 0x17b]
mov dword [edi + 0x163], eax
mov eax, edi
mov eax, dword [eax + 0x184]
mov dword [edi + 0x168], eax
mov eax, edi
mov eax, dword [eax + 0x190]
mov dword [edi + 0x188], eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov dword [eax + 0x172], edi
mov edi, eax
mov dword [edi + 0x184], edx
mov edx, dword [edi + 0x194]
mov dword [edi + 0x17b], esi
mov dword [edi + 0x190], ecx
lea eax, [edx + 0xc]
xchg dword [eax], ebx
mov ecx, dword [edi + 0x163]
lea eax, [edx + 0x10]
xchg dword [eax], ecx
mov ecx, dword [edi + 0x168]
lea eax, [edx + 0x14]
xchg dword [eax], ecx
mov ecx, dword [edi + 0x188]
lea eax, [edx + 0x18]
xchg dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a8a02
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a9e28
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x1026e004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x1020b420
mov dword [esi + 4], 0x1020b43c
mov dword [esi + 8], 0x1020b428
mov dword [ebp - 4], 0xa
xor ebx, ebx
mov eax, dword [esi + 0x60]
mov dword [esi + 0x60], ebx
test eax, eax
je 0x100a8a59
push eax
call fcn.10020090
cmp dword [esi + 0xc], ebx
je 0x100a8a6b
push 0x8000
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [esi + 0x156]
test eax, eax
je 0x100a8a82
push 0x8000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [esi + 0x128]
test edx, edx
je 0x100a8a9d
mov ecx, dword [esi + 0x124]
test ecx, ecx
je 0x100a8a9d
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x20]
mov byte [ebp - 4], 9
mov eax, dword [esi + 0x138]
test eax, eax
je 0x100a8ab2
push eax
call fcn.10174e26
pop ecx
mov byte [ebp - 4], 8
mov eax, dword [esi + 0x134]
test eax, eax
je 0x100a8ac7
push eax
call fcn.10174e26
pop ecx
mov byte [ebp - 4], 7
lea eax, [esi + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 6
lea ecx, [esi + 0xe8]
call fcn.1001701c
mov byte [ebp - 4], 5
lea ecx, [esi + 0x94]
call fcn.100d3cd5
mov byte [ebp - 4], 4
lea ecx, [esi + 0x64]
call fcn.100d486f
mov byte [ebp - 4], 3
cmp dword [esi + 0x60], ebx
je 0x100a8b13
push dword [esi + 0x60]
call fcn.10020090
mov byte [ebp - 4], 2
cmp dword [esi + 0x5c], ebx
je 0x100a8b24
push dword [esi + 0x5c]
call fcn.100a92f0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.1001e8ae
mov byte [ebp - 4], bl
lea ecx, [esi + 0x18]
call fcn.1001701c
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], 0x1020b330
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
leave
ret

Function at 0x100a8b55
Capabilities:
Encode data using xor

Disassembly:
push 0
mov eax, 0x101a9e4b
call fcn.1017513a
mov esi, dword [ebp + 0x10]
lea ecx, [ebp + 0x10]
mov edx, esi
call fcn.100175d2
and dword [ebp - 4], 0
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.1007ded3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x10], 0
je 0x100a8b90
push dword [ebp + 0x10]
call fcn.10174e26
pop ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [edi]
shr esi, 2
test esi, esi
je 0x100a8bb1
mov ecx, dword [ebp + 0x14]
mov eax, dword [edx]
lea edx, [edx + 4]
xor eax, ecx
inc ecx
mov dword [edi], eax
lea edi, [edi + 4]
sub esi, 1
jne 0x100a8b9f
call fcn.10175103
ret 0x10