joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020a60
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002c296
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x474
mov dword [ebp - 0x470], ecx
jmp 0x10020a96
mov eax, dword [0x100529a8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x44], 0x54
mov byte [ebp - 0x43], 0x68
mov byte [ebp - 0x42], 0x72
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x61
mov byte [ebp - 0x3f], 0x64
mov byte [ebp - 0x3e], 0x20
mov byte [ebp - 0x3d], 0x69
mov byte [ebp - 0x3c], 0x6e
mov byte [ebp - 0x3b], 0x74
mov byte [ebp - 0x3a], 0x65
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x69
mov byte [ebp - 0x36], 0x74
mov byte [ebp - 0x35], 0x79
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x66
mov byte [ebp - 0x32], 0x61
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x6c
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x64
mov byte [ebp - 0x2d], 0x21
mov byte [ebp - 0x2c], 0x20
mov byte [ebp - 0x2b], 0x45
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x25
mov byte [ebp - 0x1e], 0x64
mov byte [ebp - 0x1d], 0x20
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x79
mov byte [ebp - 0x1a], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x3a
mov byte [ebp - 0x17], 0x20
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x48], 0
jmp 0x10020b74
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 1
jae 0x10020c96
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + edx*4 - 0x10]
push eax
call fcn.10020950
add esp, 4
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x10020c91
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x48]
push edx
lea eax, [ebp - 0x44]
push eax
push 0x2000
lea ecx, [ebp - 0x44c]
push ecx
call fcn.10028d60
add esp, 0x14
mov ecx, dword [0x10051828]
call fcn.100014a0
push eax
push 0
lea edx, [ebp - 0x44c]
push edx
push 0
lea eax, [ebp - 0x44c]
push eax
mov ecx, dword [0x1005182c]
call fcn.10017950
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10020b6b
jmp 0x10020ca8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10021d30
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002c3b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
mov dword [ebp - 0x480], ecx
jmp 0x10021d66
movzx eax, byte [ebp + 8]
push eax
call fcn.10021ca0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x10022054
call fcn.10001480
movzx ecx, al
test ecx, ecx
je 0x10022054
mov byte [ebp - 0x45c], 0x47
mov byte [ebp - 0x45b], 0x61
mov byte [ebp - 0x45a], 0x6d
mov byte [ebp - 0x459], 0x65
mov byte [ebp - 0x458], 0x20
mov byte [ebp - 0x457], 0x49
mov byte [ebp - 0x456], 0x6e
mov byte [ebp - 0x455], 0x74
mov byte [ebp - 0x454], 0x65
mov byte [ebp - 0x453], 0x67
mov byte [ebp - 0x452], 0x72
mov byte [ebp - 0x451], 0x69
mov byte [ebp - 0x450], 0x74
mov byte [ebp - 0x44f], 0x79
mov byte [ebp - 0x44e], 0x20
mov byte [ebp - 0x44d], 0x66
mov byte [ebp - 0x44c], 0x61
mov byte [ebp - 0x44b], 0x69
mov byte [ebp - 0x44a], 0x6c
mov byte [ebp - 0x449], 0x65
mov byte [ebp - 0x448], 0x64
mov byte [ebp - 0x447], 0x2e
mov byte [ebp - 0x446], 0x20
mov byte [ebp - 0x445], 0x54
mov byte [ebp - 0x444], 0x72
mov byte [ebp - 0x443], 0x79
mov byte [ebp - 0x442], 0x20
mov byte [ebp - 0x441], 0x74
mov byte [ebp - 0x440], 0x6f
mov byte [ebp - 0x43f], 0x20
mov byte [ebp - 0x43e], 0x64
mov byte [ebp - 0x43d], 0x69
mov byte [ebp - 0x43c], 0x73
mov byte [ebp - 0x43b], 0x61
mov byte [ebp - 0x43a], 0x62
mov byte [ebp - 0x439], 0x6c
mov byte [ebp - 0x438], 0x65
mov byte [ebp - 0x437], 0x20
mov byte [ebp - 0x436], 0x61
mov byte [ebp - 0x435], 0x6e
mov byte [ebp - 0x434], 0x74
mov byte [ebp - 0x433], 0x69
mov byte [ebp - 0x432], 0x76
mov byte [ebp - 0x431], 0x69
mov byte [ebp - 0x430], 0x72
mov byte [ebp - 0x42f], 0x75
mov byte [ebp - 0x42e], 0x73
mov byte [ebp - 0x42d], 0x65
mov byte [ebp - 0x42c], 0x73
mov byte [ebp - 0x42b], 0x20
mov byte [ebp - 0x42a], 0x74
mov byte [ebp - 0x429], 0x68
mov byte [ebp - 0x428], 0x65
mov byte [ebp - 0x427], 0x6e
mov byte [ebp - 0x426], 0x20
mov byte [ebp - 0x425], 0x74
mov byte [ebp - 0x424], 0x72
mov byte [ebp - 0x423], 0x79
mov byte [ebp - 0x422], 0x20
mov byte [ebp - 0x421], 0x61
mov byte [ebp - 0x420], 0x67
mov byte [ebp - 0x41f], 0x61
mov byte [ebp - 0x41e], 0x69
mov byte [ebp - 0x41d], 0x6e
mov byte [ebp - 0x41c], 0
lea edx, [ebp - 0x45c]
push edx
push 0x2000
lea eax, [ebp - 0x414]
push eax
call fcn.10028d60
add esp, 0xc
call fcn.100075a0
movzx ecx, al
test ecx, ecx
je 0x10021fa7
mov ecx, dword [0x10051828]
call fcn.100014a0
push eax
push 0
lea edx, [ebp - 0x414]
push edx
push 1
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [0x1005182c]
call fcn.10017950
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10022066
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100220f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
jmp 0x1002210b
push 7
push 0
push 0x10022080
mov ecx, dword [0x10052244]
call fcn.100222a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002220f
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x37
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10051828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1005182c]
call fcn.10017950
jmp 0x10022221
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100222a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 4
call fcn.10001480
movzx eax, al
test eax, eax
je 0x1002231e
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
push 0
push 0x1fffff
lea ecx, [ebp - 8]
push ecx
mov edx, dword [0x10051824]
mov eax, dword [edx + 0x11c]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10022319
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [0x10051830]
call fcn.10021760
mov eax, dword [ebp - 8]
jmp 0x100223ee
jmp 0x100223ec
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [0x10051824]
mov eax, dword [edx + 0x114]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100223ec
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.10022700
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jae 0x100223d8
mov byte [ebp - 0x34], 0x54
mov byte [ebp - 0x33], 0x68
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x63
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x20
mov byte [ebp - 0x24], 0x71
mov byte [ebp - 0x23], 0x75
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x66
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x21
mov byte [ebp - 0x17], 0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x10051830]
call fcn.10021760
mov eax, dword [ebp - 8]
jmp 0x100223ee
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10022400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
jmp 0x1002241b
cmp dword [ebp + 8], 0
jne 0x10022426
jmp 0x100224cf
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x10051824]
mov edx, dword [ecx + 0x194]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
je 0x100224bd
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x20
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0
mov ecx, dword [0x10051828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [0x1005182c]
call fcn.10017950
jmp 0x100224cf
mov esp, ebp
pop ebp
ret 4

Function at 0x100224e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
jmp 0x100224fb
cmp dword [ebp + 8], 0
jne 0x10022506
jmp 0x100225ba
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x10051824]
mov edx, dword [ecx + 0x198]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100225a8
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
mov ecx, dword [0x10051828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [0x1005182c]
call fcn.10017950
jmp 0x100225ba
mov esp, ebp
pop ebp
ret 4
Function at 0x10023d90
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002c3d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov dword [ebp - 0x64], ecx
jmp 0x10023dc0
call fcn.100238b0
push 5
push 0
push 0x10023d30
mov ecx, dword [0x10052244]
call fcn.100222a0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10023f52
mov byte [ebp - 0x40], 0x45
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0x52
mov byte [ebp - 0x3d], 0x4f
mov byte [ebp - 0x3c], 0x52
mov byte [ebp - 0x3b], 0x21
mov byte [ebp - 0x3a], 0x20
mov byte [ebp - 0x39], 0x54
mov byte [ebp - 0x38], 0x68
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x61
mov byte [ebp - 0x34], 0x64
mov byte [ebp - 0x33], 0x20
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x69
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x66
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x2c
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x68
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x78
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
mov ecx, dword [0x10051828]
call fcn.100014a0
push eax
push 0
lea eax, [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [0x1005182c]
call fcn.10017950
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10023f64
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10025ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 4
mov dword [ebp - 8], 0
jmp 0x10025ef2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x10025f31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x16c2867b]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10025f2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10025ee9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10025f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x5f
mov dword [ebp - 8], 0
jmp 0x10025f72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x10025fb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x7161b027]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10025fac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10025f69
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10025fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc2
mov dword [ebp - 8], 0
jmp 0x10025ff2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1a
jge 0x10026031
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0xf03ad50]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1002602c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10025fe9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1a], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10026050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa7
mov dword [ebp - 8], 0
jmp 0x10026072
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jge 0x100260b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2079c0a8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100260ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10026069
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100260d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x93
mov dword [ebp - 8], 0
jmp 0x100260f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x10026131
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x53062dc]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1002612c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100260e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10026390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
call fcn.100261c0
movzx eax, al
test eax, eax
je 0x1002649c
mov byte [ebp - 0x34], 0x46
mov byte [ebp - 0x33], 0x61
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x6c
mov byte [ebp - 0x2f], 0x20
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x20
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x63
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x73
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x7a
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x21
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x3a
mov byte [ebp - 3], 0x20
mov byte [ebp - 2], 0x38
mov byte [ebp - 1], 0
mov ecx, dword [0x10051828]
call fcn.100014a0
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [0x1005182c]
call fcn.10017950
mov esp, ebp
pop ebp
ret

Function at 0x100282e2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10050b44]
jne 0x100282ec
repz ret
jmp fcn.1002893c
Function at 0x10029fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002a0d8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002a0d8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1002a0d8
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.10028d00
add esp, 0x10
cmp eax, 2
je 0x1002a019
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1002a00d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.10028d00
add esp, 0x10
cmp eax, 4
jne 0x1002a00d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1002a048
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.10028d00
add esp, 0x10
cmp eax, 2
jne 0x1002a00d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x1002a0a3
cmp eax, 0x8664
jne 0x1002a00d
push 0x108
push ebx
push edi
push esi
call fcn.10028d00
add esp, 0x10
cmp eax, 0x108
jne 0x1002a00d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.10028d00
add esp, 0x10
cmp eax, 0xf8
jne 0x1002a00d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41119f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40306b
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403011
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x4030f7
sub eax, 0x2000
add eax, dword [ebp + 0x10]
call dword [eax]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40300c
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403011
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x4030f7
sub eax, 0x2000
add eax, dword [ebp + 0x10]
call dword [eax]
pop eax
call eax
or eax, eax
jne 0x411260
push eax
jmp 0x41126e
cmp eax, 0x7f
jne 0x41126c
push 0x100
jmp 0x41126e
push 1
mov esi, dword [ebp + 8]
mov ebx, 0xa
mov ecx, dword [ebp + 0xc]
shr ecx, 2
xor edx, edx
mov eax, dword [ebp + 0xc]
shr eax, 2
sub eax, ecx
push eax
div ebx
add edx, 2
sub dword [esi], edx
xor edx, edx
pop eax
div ebx
add edx, dword [esp]
push edx
add dword [esp], 0x259d23e6
pop edx
xor dword [esi], edx
add esi, 4
loop 0x41127c
pop eax
popal
leave
ret 0x10