joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461610
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4cf8e4]
xor edx, edx
cmp eax, edx
jne 0x461636
xor eax, eax
mov byte [eax + 0x4cf7e4], al
inc eax
cmp eax, 0x100
jl 0x46161e
mov dword [0x4cf8e4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4cf7e4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4616c7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x46169a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x461668
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4616d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x461723
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x46170a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4680a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49485e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004689c0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x49deac
call fcn.004869a4
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x468133
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004869a4
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x46812c
push 0
mov ecx, eax
call fcn.0045f240
mov dword [esi + 0xc], eax
jmp 0x468135
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x468135
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x489007
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48903f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004870be
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00487096
jmp 0x48904b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48a6fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48a740
call fcn.004901b1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48a740
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48a737
xor eax, eax
jmp 0x48a748
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048a74e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4906e1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49070f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49072d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00490647
jmp 0x49072d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49072d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00490647
test edi, edi
mov eax, edi
jne 0x490717
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40b5d1
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x5c], eax
ret
Function at 0x40cb30
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40eb40
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x34
push edi
test ecx, ecx
je 0x410176
mov edi, dword [ecx + 0x1c]
mov dword [esp + 0x14], edi
test edi, edi
je 0x410176
cmp dword [ecx + 0xc], 0
je 0x410176
cmp dword [ecx], 0
jne 0x40eb78
cmp dword [ecx + 4], 0
jne 0x410176
cmp dword [edi], 0xb
jne 0x40eb83
mov dword [edi], 0xc
mov eax, dword [ecx + 0xc]
mov edx, dword [edi + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ecx]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
xor eax, eax
push ebp
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], eax
mov eax, dword [edi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x38], ebp
push esi
mov esi, dword [edi + 0x3c]
cmp eax, 0x1e
ja 0x40f4f5
lea ebx, [edi + 0x54]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x14]
jmp 0x40ebd0
jmp dword [eax*4 + 0x410180]
pop esi
pop ebp
pop ebx
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x23e16d8c
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..text
mov ebx, 0x42cd70
nop
mov ecx, 0x1ace3ec8
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call fcn.004011c0
add esp, 8
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40105b
mov edx, dword [esp + 0x18]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x4020a0
Capabilities:
Delete file
Get file size

Disassembly:
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.C:ZVAntiHook.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x4020ed
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0x186a0
jbe 0x4020e9
push esi
call edi
push str.C:ZVAntiHook.log
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call edi
pop edi
pop esi
ret

Function at 0x403f65
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4085a8
cmp edx, dword [eax]
je 0x403f87
add eax, 8
inc ecx
cmp eax, 0x408638
jl 0x403f78
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4085a8]
jne 0x4040b5
mov eax, dword [0x408f10]
cmp eax, 1
je 0x40408f
test eax, eax
jne 0x403fb8
cmp dword [0x4084e4], 1
je 0x40408f
cmp edx, 0xfc
je 0x4040b5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403fef
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405ae0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402800
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404032
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402800
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4074cc
push edi
call fcn.00405c60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405ae0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405af0
lea eax, [ebp - 0xa0]
push 0x4074ac
push eax
call fcn.00405af0
push dword [esi + 0x4085ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405af0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405bd0
add esp, 0x2c
pop edi
jmp 0x4040b5
lea eax, [ebp + 8]
lea esi, [esi + 0x4085ac]
push 0
push eax
push dword [esi]
call fcn.00402800
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40134d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0x4d
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x2e
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 0xd], 0x45
mov byte [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x40140b
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x80000000
call dword [0x422014]
test eax, eax
jne 0x40140b
mov dword [ebp - 0x24], 1
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x24]
push edx
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [0x422018]
test eax, eax
jne 0x4013fe
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416270
add esp, 4
cmp eax, 8
jbe 0x4013fe
mov dword [ebp - 0x28], 1
jmp 0x401405
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40a063
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0x10325476
push 0x40
push 0
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
mov ecx, dword [ebp - 4]
call fcn.0040b282
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x5c], 0x80
mov esp, ebp
pop ebp
ret
Function at 0x41015d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0x40
jae 0x410170
xor eax, eax
jmp 0x41023c
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x5a4d
je 0x41018d
xor eax, eax
jmp 0x41023c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
add ecx, 0xf8
cmp dword [ebp + 0xc], ecx
jae 0x4101a5
xor eax, eax
jmp 0x41023c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx], 0x4550
je 0x4101c0
xor eax, eax
jmp 0x41023c
mov edx, dword [ebp - 0x10]
xor eax, eax
mov ax, word [edx + 0x16]
and eax, 2
test eax, eax
jne 0x4101d4
xor eax, eax
jmp 0x41023c
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dx, word [ecx + 0x14]
cmp edx, 0xe0
je 0x4101e9
xor eax, eax
jmp 0x41023c
mov eax, dword [ebp - 0x10]
add eax, 0xf8
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x410206
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
xor eax, eax
mov ax, word [edx + 6]
cmp dword [ebp - 0xc], eax
jae 0x410239
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x28
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ecx + 0x14]
mov eax, dword [ebp - 4]
add ecx, dword [eax + edx + 0x10]
cmp ecx, dword [ebp + 0xc]
jbe 0x410237
xor eax, eax
jmp 0x41023c
jmp 0x4101fd
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1000102b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ecx]
mov eax, dword [ebx]
mov ebx, edi
mov dword [ebp - 4], ecx
mov dword [ebp + 8], 0x10
push esi
xor eax, dword [ebx]
push eax
push edi
mov esi, eax
call fcn.10001159
xor eax, dword [ebp - 4]
lea ebx, [ebx + 4]
sub dword [ebp + 8], 1
mov edx, esi
pop ecx
pop ecx
mov dword [ebp - 4], edx
jne 0x1000104b
mov ecx, dword [edi + 0x40]
mov ebx, dword [ebp + 0xc]
xor ecx, eax
mov eax, dword [edi + 0x44]
xor eax, edx
pop esi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
pop edi
pop ebx
mov dword [eax], ecx
leave
ret

Function at 0x10001082
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x400
push esi
push edi
mov esi, 0x10002060
mov dword [ebp - 8], 0x12
lea edi, [ebx + 0x48]
mov eax, 0x10002018
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov ecx, ebx
push 4
sub eax, ebx
mov edx, esi
pop edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
mov ebx, esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 0xc]
movzx eax, byte [edx + esi]
shl ebx, 8
or ebx, eax
lea eax, [edx + 1]
xor edx, edx
cmp eax, dword [ebp + 0x10]
cmovl edx, eax
sub edi, 1
jne 0x100010c2
mov eax, dword [ebp - 0x10]
push 4
pop edi
push 0
mov eax, dword [eax + ecx]
xor eax, ebx
mov dword [ecx], eax
add ecx, edi
sub dword [ebp - 8], 1
pop esi
jne 0x100010ba
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
call fcn.1000102b
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x100010fc
lea esi, [ebx + 0x4c]
mov edi, 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
call fcn.1000102b
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esi, 8
sub edi, 1
jne 0x1000112a
sub dword [ebp - 0xc], 1
jne 0x10001125
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100011b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x109c
call fcn.10001000
push ebx
push esi
push edi
xor esi, esi
push 8
mov edi, esi
pop ebx
call sub.msvcrt.dll_rand
mov byte [ebp + edi - 0x20], al
inc edi
cmp edi, ebx
jb 0x100011d0
push 4
pop esi
push esi
lea eax, [ebp - 0x18]
push str.APUX
push eax
call sub.msvcrt.dll_memcpy
push esi
lea eax, [ebp - 0x14]
push str.apuC
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x18
call sub.msvcrt.dll_rand
movzx eax, al
push eax
call sub.msvcrt.dll_rand
movzx eax, al
push eax
lea eax, [ebp - 0x10]
push str._02x_02x
push eax
call sub.msvcrt.dll_sprintf
push esi
lea eax, [ebp - 0xc]
push 0x100030e4
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x1c
lea edi, [ebp - 0x18]
push edi
call fcn.10001315
add edi, 4
pop ecx
sub esi, 1
jne 0x10001237
push 0x48
lea eax, [ebp - 0x109c]
push 0x10003060
push eax
call fcn.10001082
add esp, 0xc
mov dword [ebp - 4], 2
lea edi, [ebp - 0x14]
mov eax, dword [edi - 0xc]
lea ecx, [edi - 4]
xor dword [ecx], eax
mov eax, dword [edi - 8]
xor dword [edi], eax
lea eax, [ebp - 0x109c]
push edi
push ecx
push eax
call fcn.1000102b
add esp, 0xc
add edi, ebx
sub dword [ebp - 4], 1
jne 0x10001266
mov edi, esi
lea esi, [ebp - 0x54]
movzx eax, byte [ebp + edi*4 - 0x20]
push eax
movzx eax, byte [ebp + edi*4 - 0x1f]
push eax
movzx eax, byte [ebp + edi*4 - 0x1e]
push eax
movzx eax, byte [ebp + edi*4 - 0x1d]
push eax
push str._02x_02x_02x_02x
push esi
call sub.msvcrt.dll_sprintf
add esp, 0x18
add esi, ebx
inc edi
cmp edi, 6
jb 0x10001291
xor esi, esi
mov dword [ebp - 8], 0x100030a8
mov eax, esi
mov edi, esi
mov dword [ebp - 4], eax
test edi, edi
je 0x100012db
mov ecx, dword [ebp + 8]
mov byte [esi + ecx], 0x2d
inc esi
lea ecx, [ebp - 0x54]
add eax, ecx
push ebx
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 8]
add esp, 0xc
mov eax, dword [ebp - 4]
add eax, dword [ecx]
add esi, dword [ecx]
inc edi
mov dword [ebp - 4], eax
lea ecx, [edi*4 + 0x100030a8]
mov ebx, dword [ecx]
mov dword [ebp - 8], ecx
test ebx, ebx
jne 0x100012cf
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x5877cd
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
bsr ebp, edx
shl dl, cl
test dl, bl
mov ebp, esp
sar edx, cl
mov edx, dword [ebp + 8]
test eax, ecx
cmp bh, 0xae
lea esp, [esp - 0x114]
cmp sp, cx
jmp 0x82d61c
je 0x6043bb
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x6043a1
ret
je 0x6043bb
mov eax, 0x5a4d
test esp, 0xea017b9b
cmp word [edx], ax
je 0x80238f
sub eax, eax
pop esi
mov esp, ebp
xchg bp, bp
jmp 0x7f7c6d
push ebx
clc
push edi
mov dword [ebp - 0x10], eax
cmc
mov dword [ebp - 8], 0xffffffff
cmp di, sp
clc
cmp esi, 0xffff
jmp 0x591806
jne 0x6043bb
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
test ebp, 0x6caebe31
cmp edx, 0x87ac1bab
test ecx, ecx
je 0x6043bb
mov eax, dword [eax + 0x7c]
test si, 0x2287
jmp 0x61f1e7
pop ebp
jmp 0x5eaf3f
mov eax, dword [edx + 0x3c]
test bp, dx
lea eax, [eax + edx]
test dh, 0x8e
cmp dword [eax], 0x4550
jmp 0x7e97cb
push esi
test edx, edx
jmp 0x5b84a9

Function at 0x597cc9
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
xor dl, bl
sub di, di
rol dl, 1
xor dl, 0x1b
mov dword [esp + edi - 0x62120000], edi
neg dl
bswap edi
sar di, 0x85
ror di, 7
sbb dl, 0x8f
not dl
add dl, 0x19
call fcn.007d22db
xlatb
cmp byte [edx], bl
sti
push ecx
xchg esp, eax
in al, dx
mov cs, word [eax + 5]
in al, 0xad
add byte [eax + 0x75], 0x89
fdiv qword [eax]
out dx, eax
test dh, bl
aas
leave
or al, 0x6c
add esp, dword [edx - 0x46]
pop eax
mov edx, 0xc752807a
dec edx
pop esi
and ebx, ebp
call 0xaf78b680
and dl, byte [ebx + 0x6c7e0df4]
jle 0x597d8c
and esp, dword [edx]
in eax, 0x43
aad 0xb4
clc
xor eax, 0xc8b75be5
sbb byte [ecx - 0x47], dh
das
leave
mov eax, 0x7be92d56
invalid
iretd

Function at 0x5a550d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x604384
dec ebx
mov dword [esp], 0x2c357829
lea esp, [esp + 4]
jne 0x608b9a
mov eax, dword [ebp]
call eax
call fcn.0060df27
mov eax, dword [ebp + ebx*4]
call fcn.00627e2a
push 0xf53e7c0f
and word [esp + 0x11], 0x8cb8
xor al, bl
jmp 0x634daa
dec al
not al
mov dword [esp + 4], 0xb0ae2c2d
dec al
xor al, 0xa9
not al
xor bl, al
lea eax, [esp + eax + 0x14]
mov dword [eax], ecx
call fcn.00843412

Function at 0x5adcac
Capabilities:
Encode data using xor

Disassembly:
xor al, bl
mov dword [esp], 0x700816a3
xor al, 0x27
inc al
xor al, 0xb5
dec al
xor bl, al
shl dword [esp], 0xa1
lea eax, [esp + eax + 4]
jns fcn.005881cc
jge 0x779111
mov ecx, 0x151f3803
movsx edx, cx
mov di, word [ecx + esi - 0x151f3803]
xor dx, cx
shr cl, 0xa5
or dx, word [esi + ecx*4 - 0x547cdffe]
xor cl, byte [esi + ecx*4 - 0x547cdffc]
call fcn.005b3e67
mov dword [eax], ecx
lea esp, [esp + 4]
js fcn.005b12cf
add byte [eax], al
add byte [eax + 0x65], cl
popal
jo 0x779166
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
jmp 0x8dfc3dc
salc
pop eax
or eax, 0x6c8fc95
leave
push ebp
xor ebp, ebx
mov esi, 0xa5fd39a
sbb bl, ch
cmp al, 0xf6
popfd
or cl, byte [edx + 0x5fa10179]
sbb dword [edx - 0x2a], 0xb0ee2320
push ebp
and dword [eax - 0xe], esp
invalid
Function at 0x5b24aa
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + esi - 0x19d52d6], edx
lea eax, [esi + esi*8 + 0x16866919]
mov dword [esp + esi*4 - 0x6754b68], eax
mov dword [esp + esi*2 - 0x33aa5b4], edi
and eax, eax
not ax
push edx
ror eax, 0x6d
mov eax, 0
lea esi, [esp + esi*2 - 0x33aa5c0]
mov edx, 0x5d3732b4
push ecx
mov dword [esp + edx - 0x5d3732a8], eax
movzx ecx, dl
shr dl, 0xc5
push ebp
shr cx, 0xa8
inc dl
ror edx, 0x19
push ebx
mov ebp, dword [esp + ecx*8 + 0x28]
sal edx, 0x71
xadd cx, dx
sal ecx, 0xed
not ebp
jp 0x627fb9
adc dh, byte gs:[ebx + eax*8 - 0x7c734b2d]
inc edi
sub esi, dword [ebp + ecx*8 - 0x2b635125]
sub esp, dword [eax]
outsd dx, dword [esi]
invalid
movzx ebx, dl
lea edx, [ecx + ecx*8 + 0x3628221c]
xor ebp, 0x46a1f2b6
call fcn.007ee0f7
mov word [esi], di
jmp fcn.0059cbb5

Function at 0x5b5077
Capabilities:
Authenticate hmac

Disassembly:
inc bp
mov edi, dword [edi + esi - 0x3985358d]
jge 0x82a02e
call fcn.00830cf9
dec eax
mov dword [esp], 0xad1d3e2d
dec eax
add esi, 2
inc cx
not esp
inc cx
not edi