joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x44c4ee
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x44c5c3
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
dec edi
jne 0x44c506
pop edi
test esi, esi
je 0x44c5e2
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4f5d50]
dec esi
jne 0x44c5c7
not eax
pop esi
pop ebp
ret

Function at 0x44d6b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov ecx, esi
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [edi]
shr eax, 8
xor dl, al
movsx eax, dl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x4f5d50]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
and eax, 0xff
xor esi, dword [eax*4 + 0x4f5d50]
mov al, dl
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
ret
Function at 0x44e380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1731
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5256c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x38]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
call fcn.004567d0
mov dword [edi + 0x38], eax
lea ecx, [edi + 0x40]
mov dword [ebp - 4], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
call fcn.004488f0
mov dword [edi + 0x40], eax
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 1
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
call fcn.00456800
mov dword [edi + 0x48], eax
mov eax, edi
mov byte [ebp - 4], 2
lea ecx, [edi + 0x38]
mov dword [eax + 0x50], 0
call fcn.00456970
lea ecx, [edi + 0x40]
call fcn.00456970
mov eax, dword [edi + 0x48]
lea ecx, [edi + 0x48]
push dword [eax + 4]
call fcn.004568b0
mov eax, dword [edi + 0x48]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x48]
mov dword [eax], eax
mov eax, dword [edi + 0x48]
mov dword [eax + 8], eax
mov dword [edi + 0x4c], 0
call fcn.00459270
mov ecx, edi
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c8d10
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx], esi
cdq
pop eax
xchg ebp, eax
insd dword es:[edi], dx
retf
push edi
lodsd eax, dword [esi]
cmp al, 0x82
nop
stosb byte es:[edi], al
scasd eax, dword es:[edi]
mov al, byte [0xaba8e936]
adc edx, dword [ecx]
xor eax, 0xf136a289
dec ebp
or byte [edx + 0x30c6da10], 0x63
mov byte [0x99b45615], al
imul eax, dword [ebp + 0x33003219], 0xffffffad
loop 0x4c8cb8
jl 0x4c8cae
pop edx
mov al, byte [0x245e0b76]
sbb al, 0x90
sbb edx, edx
aad 0xc3
jae 0x4c8c99
loope 0x4c8d3d
pushfd
mov word [ecx], fs
adc al, 0xac
ficomp word [ecx - 4]
mov byte [0xbe6d78a6], al
inc eax
lodsd eax, dword [esi]
inc esp
mov cl, 0xd4
pop ss
invalid
xchg edx, eax
add ch, byte [eax]
sti
je 0x4c8caa
lcall 0xa985, 0x1f149471
inc edi
sub byte [edx + 0x664c5003], cl
mov ah, dl
dec esp
mov ah, dl
push ds
inc edi
jno 0x4c8d22
sub byte [ebp + edi*8 + 0x15], cl
inc ebp
dec ecx
add eax, 0x4a9e9094
fidivr dword [eax]
dec edx
Function at 0x4c9ddc
Capabilities:
Encode data using xor

Disassembly:
and dh, al
pop edi
sahf
stosb byte es:[edi], al
shl byte [eax + 0x55273158], 1
mov ah, 0x51
rol dword [ebp + 0x7f2b42aa], 1
leave
test dword [edx - 0x3680d4be], ebp
insb byte es:[edi], dx
cmpsb byte [esi], byte es:[edi]
xor al, 0xce
pop edi
xor al, byte [edi + 0x53b48b29]
sbb bh, byte [edi]
jp 0x4c9dc2
jecxz 0x4c9dd1
add dword [ebx], 0xfa9bc0d6
dec ebp
mov al, 0xe2
aam 0xb9
dec ecx
sub edi, dword [esi]
pop edx
cmc
push eax
fisubr word [ebp + 0x3414f2fe]
sar byte [eax + ebp + 0x5831425], cl
jno 0x4c9e5e
jno 0x4c9e5b
sub dl, ch
out dx, eax
or dword [ecx], 0xffffffed
fcmovu st(0), st(2)
inc edx
jmp 0x4c9e3f
push ds
add eax, dword [edi - 0x33]
mov eax, dword [0xcfdcd38e]
mov eax, 0xe5937437
sbb esi, dword [edi]
loopne 0x4c9dff
in eax, dx
jo 0x4c9e48
mov al, 0x70
and al, 0xf9
jo 0x4c9e84
stc
pushal
jle 0x4c9e7b
invalid
mov esi, 0xb8e7a686
add dh, cl
add al, 0x14
std
fucomi st(5)
push esp
cli
push ss
enter 0xffffffffffff94f4, 0xffffffffffffff98
outsd dx, dword [esi]
scasb al, byte es:[edi]
clc
stosd dword es:[edi], eax
std
or esi, ecx
invalid

Function at 0x4ca553
Capabilities:
Encode data using xor

Disassembly:
adc ebx, dword [edx - 0xddfe4c2]
xchg ebx, eax
push es
or al, al
out 0xe4, eax
inc eax
adc byte [edi - 0x2fe38333], cl
mov dword [edi - 0x71], edi
invalid
mov dword [0xc4bd34ef], eax
and ecx, eax
dec esi
stc
cmp edi, edx
add eax, 0x75ea50b9
stosd dword es:[edi], eax
mov dword [0xd83abac1], eax
mov ecx, 0xbf8a661f
lds edx, [eax + 0x51]
lcall 0xd3fa, 0x73aa676a
and byte [edi - 0x75], bh
test eax, 0xedfa73a
sbb eax, 0x6f4ef1b5
sbb byte [esp + ecx + 0x25], ch
xor eax, 0xefba99b8
dec edi
xor eax, 0x951e2ab2
or al, 0x14
wait
mov esi, 0x576d88c8
pop ebx
jle 0x4ca53e
movsd dword es:[edi], dword [esi]
sub ah, al
invalid

Function at 0x4cc4f7
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x4ed54a91
bound eax, qword [esi + 0x51a9d9ed]
adc eax, 0xc7ea225c
mov ch, 0x29
sbb eax, 0x2e9caf76
out dx, al
xchg dword [esi - 0x12bb65e], ebp
push 0x1f
xchg edi, eax
movsb byte es:[edi], byte [esi]
adc ebp, dword [ebx + 0x15]
cmp eax, 0xc7db030f
cmc
aad 0x41
mov edi, 0x98b75671
out dx, al
fistp word [ebx - 0x6cb1bac4]
fisttp qword [ecx - 0x7b]
mov eax, dword [0x53c5da68]
xchg edx, eax
xor eax, 0x798b1211
rcl dword [eax], 0xb1
shl byte [esi], 0x8e
xor esp, esi
jb 0x4cc505
ljmp 0xaf76:0x1d29b5c7
jb 0x4cc5c3
dec eax
cmpsd dword [esi], dword es:[edi]
sub byte [eax - 0x7b89bb38], ch
pop esi
fcmovbe st(0), st(7)
cmp al, byte [ebp - 0x14]
xor al, 0x98
in eax, 0x55
mov esi, edx
iretd
push edi
call 0x60885b1e
imul byte [eax]
aaa
sub dword [esi + 0x7f668589], esi
shr dh, 1
inc ecx
ficomp word [esi + 7]
invalid
Function at 0x406e3b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4278a4], 0
jne 0x406e79
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406e4f
mov dword [ecx*4 + 0x4278a0], eax
inc ecx
cmp ecx, 0x100
jl 0x406e4a
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ea6
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4278a0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406e87
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x22682709
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x14964216
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x523a00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xcd000]
push edi
jmp 0x523a1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x523a21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x523a10
mov eax, 1
add ebx, ebx
jne 0x523a33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x523a44
jne 0x523a63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x523a63
dec eax
add ebx, ebx
jne 0x523a50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x523a28
add ebx, ebx
jne 0x523a5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x523ab5
xor ecx, ecx
sub eax, 3
jb 0x523a7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x523aea
sar eax, 1
mov ebp, eax
jmp 0x523a86
add ebx, ebx
jne 0x523a86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x523a54
inc ecx
add ebx, ebx
jne 0x523a94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x523a54
add ebx, ebx
jne 0x523aa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x523a96
jne 0x523ab2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x523a96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x523ad4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x523ac6
jmp 0x523a16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x523ad4
add edi, ecx
jmp 0x523a16
pop esi
mov edi, esi
mov ecx, 0x3ed3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x523af2
cmp byte [edi], 0x11
jne 0x523af2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x523af7
lea edi, [esi + 0x11c000]
mov eax, dword [edi]
or eax, eax
je 0x523b6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16e81c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16e998]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x523b24
mov ecx, edi
jns 0x523b53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16e99c]
or eax, eax
je 0x523b69
mov dword [ebx], eax
add ebx, 4
jmp 0x523b41
call dword [esi + 0x16e9ac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x523ba0
cmp al, 0xef
ja 0x523b93
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x523b75
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x523b82
mov ebp, dword [esi + 0x16e9a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x523bd4
sub esp, 0xffffff80
jmp 0x427dcd
Function at 0xb0b837b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x40
push 4
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov dword [ebx], edi
push eax
push dword [ebp - 4]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop ebx
leave
ret

Function at 0xb0c224a
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
pushal
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 8]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [0xb09056c]
add esp, 8
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0xb0c2fab
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword fs:[0x2c]
push ebx
xor ebx, ebx
mov ecx, dword [eax]
mov eax, dword [0xb066fac]
cmp eax, dword [ecx + 0x98]
jg 0xb0c2fe1
jmp 0xb0c2fc6
pop esi
cmp dword [0xb066fb0], ebx
je 0xb0c2fdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0xb0c2fdd
mov bl, 1
mov al, bl
pop ebx
ret
push esi
mov esi, 0xb066fac
push esi
call fcn.0b0f5dd2
pop ecx
cmp dword [0xb066fac], 0xffffffff
jne 0xb0c2fc5
push 0xb0905b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xb1203bc
mov dword [0xb066fb0], eax
call fcn.0b0f5d41
push esi
call fcn.0b0f5d81
pop ecx
pop ecx
jmp 0xb0c2fc5

Function at 0xb0c4068
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
push 0x40
push 1
push edi
mov bl, dl
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [edi], bl
push eax
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop ebx
leave
ret

Function at 0xb0c4dcf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0xb0c4df2
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0xb0c4de0
mov eax, ecx
pop esi
pop ebp
ret
Function at 0xb0d159d
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
pushal
mov eax, dword [ebp - 8]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [0xb0a8c7c]
add esp, 8
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0xb0d1cd3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp dword [eax + 0x10], 0
je 0xb0d1d8c
cmp dword [eax + 0x14], 0xf
jbe 0xb0d1cee
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
call fcn.0b0e188e
test al, al
je 0xb0d1d8c
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.0b0d1d93
lea eax, [ebp + 0xc]
mov ecx, esi
push eax
push edi
call fcn.0b0d1e3c
push ecx
push edi
call fcn.0b0d2099
lea eax, [ebp + 8]
mov ecx, edi
push eax
push 0x40
push 0x1000
call fcn.0b0e17ae
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp + 0xc]
call fcn.0b0e17c4
mov ecx, edi
mov esi, eax
call fcn.0b0e17c4
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
mov dword [eax + 0x68], ecx
lea ecx, [ebp + 0xc]
mov dword [eax + 0x6c], edx
call fcn.0b0e17ae
movzx ecx, word [eax + 6]
imul ecx, ecx, 0x28
add ecx, 0xf8
push ecx
push eax
mov ecx, edi
call fcn.0b0e17ae
push eax
call fcn.0b0f7670
add esp, 0xc
lea ecx, [ebp + 0xc]
call fcn.0b0e1875
add eax, dword [edi]
pop edi
jmp 0xb0d1d8e
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0xb0d1d93
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x24
mov eax, 0xb11f028
call fcn.0b0f67b4
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.0b0e17dd
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
cmp esi, ebx
je 0xb0d1e10
mov edx, dword [ebp + 0xc]
mov edi, dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
mov eax, dword [eax]
add ecx, eax
mov dword [ebp - 0x10], ecx
add eax, 0xa000000
mov ecx, dword [edi + 0x14]
add ecx, dword [edx]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
jae 0xb0d1e20
cmp dword [edi + 0x10], 0
jbe 0xb0d1e09
lea eax, [ebp - 0x18]
push eax
push 0x40
push dword [edi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [edi + 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0b0f7670
mov edx, dword [ebp + 0xc]
add esp, 0xc
add esi, 4
cmp esi, ebx
jne 0xb0d1dbc
lea ecx, [ebp - 0x24]
call fcn.0b0cb0e0
call fcn.0b0f6791
ret 8
push 0xb0a8d94
lea ecx, [ebp - 0x30]
call fcn.0b0c1bd0
push 0xb0b4ee4
lea eax, [ebp - 0x30]
push eax
call fcn.0b0f754e
int3
Function at 0xb0d2099
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0b0e17c4
cmp dword [eax + 0xac], 0
je 0xb0d219e
push ebx
push edi
call fcn.0b0d23b7
mov edi, eax
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.0b0e17c4
mov ecx, dword [eax + 0xa8]
add ecx, dword [esi]
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
sub ebx, eax
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 4]
mov dword [esi], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 4
push esi
call edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 0xc]
test esi, esi
je 0xb0d2155
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push esi
call edi
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 4
push esi
call edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push dword [ebp - 8]
call edi
mov eax, dword fs:[0x2c]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
push ebx
push esi
push dword [eax + ecx*4]
call fcn.0b0f7670
push ebx
push esi
push dword [ebp - 8]
call fcn.0b0f7670
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
add esp, 0x18
push eax
push 4
push 0x18
push ebx
call edi
mov esi, dword [ebp - 0x18]
mov edi, ebx
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0xb0d2892
Capabilities:
Set current directory

Disassembly:
push 0x28
mov eax, 0xb11f1fb
call fcn.0b0f681d
push 0xb0d25e9
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
call fcn.0b0d27f9
push ebx
call fcn.0b104100
pop ecx
mov edi, eax
mov dword [ebp - 0x24], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul esi, eax
not esi
xor esi, edi
push esi
call fcn.0b1040ee
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 1
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
mov dword [esp], 0xb0a8f24
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0b1040c5
add esp, 0xc
test eax, eax
jne 0xb0d2936
cmp dword [ebp - 0x18], eax
je 0xb0d2936
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
push dword [ebp - 0x18]
call fcn.0b0fa8e0
pop ecx
call fcn.0b0d182d
test al, al
jne 0xb0d2948
mov dword [ebp - 4], 2
jmp 0xb0d2963
call fcn.0b0d276d
mov esi, eax
test esi, esi
je 0xb0d29b6
call fcn.0b0d187e
test al, al
jne 0xb0d2972
mov dword [ebp - 4], 3
cmp byte [ebp - 0x11], 0
je 0xb0d296e
call fcn.0b0d18d4
xor eax, eax
jmp 0xb0d29b0
mov byte [ebp - 0x11], bl
or dword [ebp - 4], 0xffffffff
call esi
jmp 0xb0d29b0
call fcn.0b0f6791
ret
push 0xb0a8f30
lea ecx, [ebp - 0x34]
call fcn.0b0c1bd0
push 0xb0b4ee4
lea eax, [ebp - 0x34]
push eax
call fcn.0b0f754e
int3
Function at 0xb0d5541
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0xa4020c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x114], esi
mov eax, dword fs:[0x2c]
push edi
mov ecx, dword [eax]
mov eax, dword [0xb067024]
cmp eax, dword [ecx + 0x98]
jg 0xb0d5641
cmp dword [0xa41597c], ebx
jne 0xb0d5617
lea eax, [ebp - 0x118]
push eax
push 1
push ebx
push 0xb0a914c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb0d5617
mov edi, 0x104
lea eax, [ebp - 0x110]
push edi
push ebx
push eax
call fcn.0b0f7bf0
add esp, 0xc
mov dword [ebp - 0x114], edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push 0xb0a9164
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb0d55fc
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
mov ecx, 0xa41596c
call fcn.0b0c2044
mov byte [ebp - 0x114], bl
mov edx, 0xa41596c
push dword [ebp - 0x114]
mov ecx, esi
call fcn.0b0d5efc
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0b0f5922
leave
ret
mov edi, 0xb067024
push edi
call fcn.0b0f5dd2
cmp dword [0xb067024], 0xffffffff
pop ecx
jne 0xb0d5580
push 0xb120672
call fcn.0b0f5d41
pop ecx
push edi
call fcn.0b0f5d81
pop ecx
jmp 0xb0d5580

Function at 0xb0d62fa
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
mov dword [0xa41be38], 0xea60
push esi
mov eax, 0x1f4
mov dword [0xa41be34], ebx
push edi
push ebx
mov dword [0xa41be30], eax
mov dword [0xa41be3c], ebx
mov dword [0xa41be40], eax
mov dword [0xa41be44], ebx
mov dword [0xa41be48], ebx
call fcn.0b104100
mov esi, eax
mov dword [0xa41be5c], edx
mov eax, 0x55555555
mov dword [0xa41be58], esi
xor edi, edi
mov dword [0xa41d1d8], eax
pop ecx
mov dword [0xa41d1dc], eax
inc edi
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, esi
push eax
push ecx
call fcn.0b0f6980
mov esi, eax
mov eax, 0x138
add esi, edi
mov dword [edi*8 + 0xa41be58], esi
adc edx, ebx
mov dword [edi*8 + 0xa41be5c], edx
inc edi
cmp edi, eax
jb 0xb0d6357
movaps xmm0, xmmword [0xb0ae110]
pop edi
pop esi
mov dword [0xa41be50], eax
mov eax, 0xa41be30
movaps xmmword [0xa41d1e0], xmm0
pop ebx
ret 0x10

Function at 0xb0d6558
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0xb11f633
call fcn.0b0f67b4
mov esi, dword [0xa41e208]
xor edi, edi
mov al, 1
xchg byte [esi], al
push 4
call fcn.0b0f593e
mov dword [ebp - 0x10], eax
mov dword [eax], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
push eax
push 0xb0d7622
push edi
push edi
call fcn.0b103736
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0xb0d65b7
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x5c]
call fcn.0b0cd507
cmp dword [ebp - 0x14], edi
jne 0xb0d65b2
call fcn.0b0f6791
ret
call fcn.0b10359e
push 6
mov dword [ebp - 0x14], edi
call fcn.0b0f4e7c
int3