joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa616ec
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100693b0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1008e390]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x100743ec
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x10077264
call fcn.00a123cc
mov byte [esp + 0x38], 1
call fcn.00a4be2a
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.00a1247c
mov dword [esi], 0x10077288
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0xab260c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4008
call fcn.00abc58c
mov eax, dword [0x1001937c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x4000
lea eax, [ebp - 0x4004]
push 1
push eax
mov esi, ecx
call fcn.00ab4169
add esp, 0x10
test eax, eax
jle 0xab2680
push ebx
mov ebx, dword [ebp - 0x4008]
lea esp, [esp]
mov ecx, dword [esi + 4]
push ebx
lea edx, [ebp - 0x4004]
push edx
lea eax, [ebp + eax - 0x4004]
push ecx
call fcn.00ab278c
push edi
push 0x4000
lea eax, [ebp - 0x4004]
push 1
push eax
call fcn.00ab4169
add esp, 0x10
test eax, eax
jg 0xab264c
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00ab2ea1
mov esp, ebp
pop ebp
ret

Function at 0xab28ac
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0xab28b3
xor eax, eax
ret
or eax, 0xffffffff
push esi
cmp edx, 8
jb 0xab2989
mov esi, edx
shr esi, 3
push edi
lea ebx, [ebx]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001a670]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001a670]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001a670]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001a670]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001a670]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001a670]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001a670]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1001a670]
add ecx, 8
sub edx, 8
dec esi
jne 0xab28cc
pop edi
test edx, edx
je 0xab29a6
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1001a670]
inc ecx
dec edx
jne 0xab298d
not eax
pop esi
ret
Function at 0xacfb6c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003aa8b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f620]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x1003ebb4
call fcn.00af32ad
push 4
mov dword [ebp - 4], 0
call fcn.00af4ba9
mov edi, eax
add esp, 4
test edi, edi
je 0xacfbec
call fcn.00af2ec8
mov dword [edi], eax
call fcn.00af2c87
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00af2bbc
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xacfbe2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00af2be4
jmp 0xacfbee
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xad90ac
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003aa8b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f620]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x1003f594
call fcn.00af32ad
push 4
mov dword [ebp - 4], 0
call fcn.00af4ba9
mov edi, eax
add esp, 4
test edi, edi
je 0xad912c
call fcn.00af2ec8
mov dword [edi], eax
call fcn.00af2c87
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00af2bbc
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xad9122
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00af2be4
jmp 0xad912e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xadea4c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor edx, edx
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0xc], edx
jbe 0xadeba2
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [0x1004db30]
mov dword [ebp - 0xc], eax
jmp 0xadea76
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0xc]
mov cl, byte [ecx + edx]
cmp cl, 0x3d
je 0xadeab2
lea esi, [edi + 0x40]
mov eax, edi
cmp edi, esi
je 0xadea99
cmp byte [eax], cl
je 0xadea99
inc eax
cmp eax, esi
jne 0xadea90
mov ecx, 3
sub ecx, edx
sub eax, edi
lea ecx, [ecx + ecx*2]
and eax, 0x3f
add ecx, ecx
shl eax, cl
or dword [ebp - 8], eax
inc dword [ebp - 4]
inc edx
cmp edx, 4
jl 0xadea7c
dec dword [ebp - 4]
je 0xadeb89
mov edi, dword [ebp - 4]
lea edi, [ebp + edi - 9]
mov dword [ebp - 0x10], edi
nop
mov eax, dword [ebx + 4]
cmp edi, eax
jae 0xadeb2a
mov edx, dword [ebx]
cmp edx, edi
ja 0xadeb2a
mov ecx, dword [ebx + 8]
mov esi, edi
sub esi, edx
cmp eax, ecx
jne 0xadeb1a
sub eax, edx
cmp eax, 0xfffffffe
ja 0xadeba6
inc eax
sub ecx, edx
cmp eax, ecx
jbe 0xadeb1a
mov edx, ecx
shr edx, 1
or edi, 0xffffffff
sub edi, edx
cmp edi, ecx
jae 0xadeb07
xor ecx, ecx
jmp 0xadeb09
add ecx, edx
cmp ecx, eax
jae 0xadeb0f
mov ecx, eax
push ecx
mov ecx, ebx
call fcn.00adae5c
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx + 4]
test eax, eax
je 0xadeb6d
mov edx, dword [ebx]
mov cl, byte [esi + edx]
mov byte [eax], cl
jmp 0xadeb6d
mov ecx, dword [ebx + 8]
cmp eax, ecx
jne 0xadeb62
mov edx, dword [ebx]
sub eax, edx
cmp eax, 0xfffffffe
ja 0xadeba6
inc eax
sub ecx, edx
cmp eax, ecx
jbe 0xadeb62
mov edx, ecx
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, ecx
jae 0xadeb52
xor ecx, ecx
jmp 0xadeb54
add ecx, edx
cmp ecx, eax
jae 0xadeb5a
mov ecx, eax
push ecx
mov ecx, ebx
call fcn.00adae5c
mov eax, dword [ebx + 4]
test eax, eax
je 0xadeb6d
mov dl, byte [edi]
mov byte [eax], dl
mov eax, dword [ebp - 4]
inc dword [ebx + 4]
dec eax
dec edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edi
test eax, eax
jne 0xadeacc
mov edi, dword [0x1004db30]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 4
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, dword [ebp + 0xc]
jb 0xadea74
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1003f544
call fcn.00af30fd
int3
Function at 0xae538c
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bb14
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x1004f620]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [esi + 4]
push eax
mov dword [esi], 0x1003fd2c
call fcn.00ae4c2c
mov dword [esi], 0x1003fd48
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x44]
mov edx, 0xf
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
mov byte [ecx], al
mov dword [esi + 0x60], eax
lea ecx, [esi + 0x64]
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edx
mov byte [ecx], al
mov dword [esi + 0x74], eax
mov byte [esi + 0x10], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0xae710c
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bf87
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x1004f620]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 8]
push eax
mov dword [esi], 0x1003fd18
call fcn.00ae4c2c
lea eax, [esi + 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [esi], 0x1003ffbc
mov dword [esi + 4], 0x1003ffa8
call dword [0x1003e00c]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x4c], ebx
lea eax, [esi + 0x50]
mov ecx, 0xf
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ecx
mov byte [eax], bl
mov dword [esi + 0x6c], ebx
lea eax, [esi + 0x70]
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ecx
mov byte [eax], bl
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xb
call fcn.00ad6e4c
mov byte [esi + 0x3c], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xae801c
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bf87
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x1004f620]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 8]
push eax
mov dword [esi], 0x1003fd18
call fcn.00ae4c2c
lea eax, [esi + 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [esi], 0x100400a0
mov dword [esi + 4], 0x1004008c
call dword [0x1003e00c]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x4c], ebx
lea eax, [esi + 0x50]
mov ecx, 0xf
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ecx
mov byte [eax], bl
mov dword [esi + 0x6c], ebx
lea eax, [esi + 0x70]
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ecx
mov byte [eax], bl
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xb
call fcn.00ad6e4c
mov byte [esi + 0x3c], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0xae855c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c2ef
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x1004f620]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [esi + 4]
push eax
mov dword [esi], 0x1003fbfc
call fcn.00ae4c2c
mov dword [esi], 0x100400e4
xor eax, eax
mov dword [esi + 0x1c], eax
lea ecx, [esi + 0x20]
mov edx, 0xf
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edx
mov byte [ecx], al
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x40]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edx
mov byte [ecx], al
mov dword [esi + 0x50], eax
mov dword [esi + 0x60], eax
lea ecx, [esi + 0x64]
mov edx, 7
xor edi, edi
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edx
mov word [ecx], di
mov dword [esi + 0x80], eax
lea ecx, [esi + 0x84]
mov dword [esi + 0x7c], edx
xor edx, edx
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], eax
mov word [ecx], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0xb29891
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x100364fe
call fcn.00b58fe0
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x14]
mov esi, edi
mov dword [ebp - 4], ebx
call fcn.00b29956
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0
mov esi, dword [edi + 4]
add ecx, ecx
mov dword [ebp - 0x18], ebx
cmp ecx, esi
jbe 0xb298de
sub ecx, esi
push 0
call fcn.00b299c7
mov eax, dword [edi]
mov byte [eax + esi], 0
and dword [ebp - 0x14], 0
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x28], 0x33323130
mov dword [ebp - 0x24], 0x37363534
mov dword [ebp - 0x20], 0x62613938
mov dword [ebp - 0x1c], 0x66656463
je 0xb29945
mov esi, dword [ebp - 0x14]
add esi, dword [ebp + 0xc]
mov ecx, edi
movzx eax, byte [esi]
shr eax, 4
mov al, byte [ebp + eax - 0x28]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x10]
push eax
call fcn.00b29a5c
movzx eax, byte [esi]
and eax, 0xf
mov al, byte [ebp + eax - 0x28]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00b29a5c
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x10]
jne 0xb29904
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0xb309b7
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1003571f
call fcn.00b58fe0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x1004546c
call fcn.00b47297
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.00b47e04
mov ebx, eax
pop ecx
cmp ebx, edi
je 0xb309ff
call fcn.00b4710f
mov dword [ebx], eax
call fcn.00b46ece
mov ecx, eax
call fcn.00b29c36
mov eax, ebx
jmp 0xb30a01
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0xb34e74
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push edi
push 0x40
push eax
mov byte [esi + 0x68], al
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.00b4d9a4
xor eax, eax
lea edi, [esi + 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov eax, esi
pop edi
ret
Function at 0xb36aaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
lea eax, [esi + 8]
mov dl, byte [ecx + esi]
xor byte [eax], dl
inc ecx
dec eax
cmp ecx, 4
jb 0xb36ab6
pop esi
pop ebp
ret

Function at 0xb4098d
Capabilities:
Hash data using sha256

Disassembly:
push 0x70
push 0
push esi
call fcn.00b4d9a4
xor eax, eax
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
inc eax
ret
Function at 0xb94a8c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push 0x40
lea eax, [esi + 0x18]
push 0
push eax
mov byte [esi + 0x68], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.00bb029c
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp ecx, eax
je 0xb94af0
sub eax, ecx
push eax
push ecx
call fcn.00b948fc
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0xb9ff9c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002be6b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1003a37c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], 0x100336fc
call fcn.00bab064
push 4
mov dword [ebp - 4], 0
call fcn.00bac222
mov edi, eax
add esp, 4
test edi, edi
je 0xba0018
call fcn.00baaedc
mov dword [edi], eax
call fcn.00baac9b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00bab025
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xba000e
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00bab04d
jmp 0xba001a
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x518310
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb3000]
push edi
or ebp, 0xffffffff
jmp 0x518332
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x518339
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518328
mov eax, 1
add ebx, ebx
jne 0x51834b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51835c
jne 0x51837b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51837b
dec eax
add ebx, ebx
jne 0x518368
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x518340
add ebx, ebx
jne 0x518377
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5183cd
xor ecx, ecx
sub eax, 3
jb 0x518393
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x518402
sar eax, 1
mov ebp, eax
jmp 0x51839e
add ebx, ebx
jne 0x51839e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51836c
inc ecx
add ebx, ebx
jne 0x5183ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51836c
add ebx, ebx
jne 0x5183b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5183ae
jne 0x5183ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5183ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5183ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5183de
jmp 0x51832e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5183ec
add edi, ecx
jmp 0x51832e
pop esi
mov edi, esi
mov ecx, 0x2ae
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51840a
cmp byte [edi], 0xa
jne 0x51840a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51840f
lea edi, [esi + 0x116000]
mov eax, dword [edi]
or eax, eax
je 0x51847e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17c634]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17c71c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51843c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17c724]
or eax, eax
je 0x518478
mov dword [ebx], eax
add ebx, 4
jmp 0x518459
call dword [esi + 0x17c720]
mov ebp, dword [esi + 0x17c728]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5184b2
sub esp, 0xffffff80
jmp 0x402891
Function at 0x4057b0
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
mov al, byte [ebp + 0xc]
mov byte [ebp - 0xc], al
mov dword [ebp - 8], 1
jmp 0x4057d5
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 4
jge 0x40580f
mov edx, dword [ebp - 8]
movzx eax, byte [ebp + edx - 0xd]
shl eax, 1
mov ecx, dword [ebp - 8]
mov byte [ebp + ecx - 0xc], al
mov edx, dword [ebp - 8]
movzx eax, byte [ebp + edx - 0xd]
and eax, 0x80
je 0x40580d
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0xc]
xor edx, 0x1b
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0xc], dl
jmp 0x4057cc
mov dword [ebp - 8], 0
jmp 0x405821
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 4
jge 0x405848
movzx edx, byte [ebp + 8]
mov ecx, dword [ebp - 8]
sar edx, cl
and edx, 1
je 0x405846
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0xc]
movzx edx, byte [ebp - 1]
xor edx, ecx
mov byte [ebp - 1], dl
jmp 0x405818
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8