joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102effd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1040a560
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
mov eax, dword [0x104c5878]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x30], 0x756e6547
xor ecx, ecx
mov dword [ebp - 0x2c], 0x6c65746e
push ebx
cpuid
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0x49656e69
mov esi, ebx
mov dword [ebp - 0x3c], 0x68747541
movups xmmword [0x104cca90], xmm0
mov dword [ebp - 0x38], 0x444d4163
lea edi, [ebp - 0x24]
mov dword [ebp - 0x34], 0x69746e65
movups xmmword [ebp - 0x24], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x48], edi
test edi, edi
je 0x102f017a
mov dword [ebp - 0x44], 0
xor eax, eax
mov ecx, dword [ebp + eax - 0x20]
xor ecx, dword [ebp + eax - 0x30]
add eax, 4
or ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
cmp eax, 0xc
jne 0x102f0075
cmp dword [ebp - 0x44], 0
mov dword [ebp - 0x44], 0
sete byte [ebp - 0x3d]
xor ecx, ecx
nop dword [eax]
mov eax, dword [ebp + ecx - 0x20]
xor eax, dword [ebp + ecx - 0x3c]
add ecx, 4
or eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
cmp ecx, 0xc
jne 0x102f00a0
cmp dword [ebp - 0x44], 0
mov eax, 1
push ebx
sete byte [ebp - 0x3e]
xor ecx, ecx
cpuid
mov esi, ebx
pop ebx
lea edi, [ebp - 0x24]
mov dword [edi], eax
mov eax, edi
mov edi, dword [ebp - 0x48]
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
xor eax, eax
or eax, dword [ebp - 0x18]
cmp byte [ebp - 0x3d], 0
mov ecx, dword [ebp - 0x1c]
mov dword [0x104cca90], eax
mov dword [0x104cca94], ecx
je 0x102f0108
mov eax, dword [ebp - 0x20]
shr eax, 8
movzx eax, al
shl eax, 3
mov dword [0x104c6480], eax
cmp edi, 7
jb 0x102f0142
mov eax, 7
lea edi, [ebp - 0x24]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x24], xmm0
pop ebx
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
or eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [0x104cca98], eax
mov dword [0x104cca9c], ecx
cmp byte [ebp - 0x3e], 0
je 0x102f016c
mov eax, reloc.WS2_32.dll_getpeername
lea edi, [ebp - 0x24]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
movzx eax, byte [ebp - 0x1c]
mov dword [0x104c6480], eax
mov byte [0x104ccaa0], 1
mov byte [0x104ccaa1], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.103b6385
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x103071a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x104c5878]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm6, xmmword [0x104cce50]
movaps xmm2, xmm0
movaps xmm0, xmmword [0x1047c630]
movaps xmm4, xmm6
mov ecx, dword [ebx + 8]
mov eax, 1
movaps xmm3, xmmword [0x104cce40]
lea edx, [ecx + 0x10]
movaps xmm1, xmmword [0x1047c690]
movaps xmmword [ebp - 0x30], xmm0
movaps xmm0, xmmword [0x1047c5e0]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmm6
pandn xmm0, xmm2
movaps xmmword [ebp - 0x50], xmm1
movaps xmm1, xmmword [0x1047c660]
psrld xmm0, 4
movaps xmmword [ebp - 0x40], xmm1
movaps xmm1, xmmword [0x104cce30]
pshufb xmm3, xmm0
push esi
mov esi, dword [ebx + 0xc]
movaps xmm5, xmmword [0x1047c840]
movups xmm0, xmmword [ecx]
pxor xmm3, xmm0
movaps xmm0, xmm6
pand xmm0, xmm2
movaps xmm2, xmmword [0x104cce70]
pshufb xmm1, xmm0
movups xmm0, xmmword [edx]
pxor xmm3, xmm1
movaps xmmword [ebp - 0x60], xmm0
pandn xmm4, xmm3
psrld xmm4, 4
movaps xmm0, xmm6
pand xmm0, xmm3
movaps xmm3, xmmword [0x104cce20]
movaps xmm1, xmm4
movaps xmm6, xmm3
pxor xmm1, xmm0
movaps xmm7, xmm3
pshufb xmm2, xmm0
movaps xmm0, xmm3
pshufb xmm0, xmm4
pxor xmm0, xmm2
pshufb xmm6, xmm0
movaps xmm0, xmm3
pxor xmm6, xmm1
pshufb xmm0, xmm1
pxor xmm0, xmm2
pshufb xmm7, xmm0
pxor xmm7, xmm4
cmp esi, eax
je 0x1030739b
movaps xmm5, xmmword [ebp - 0x60]
movaps xmm4, xmmword [0x104cce80]
lea edx, [edx + 0x10]
movaps xmm0, xmmword [0x104cce60]
mov ecx, eax
movaps xmm2, xmmword [0x1047c7a0]
and ecx, 3
pshufb xmm0, xmm7
shl ecx, 4
inc eax
pshufb xmm4, xmm6
movups xmm1, xmmword [ecx + 0x104cd250]
pxor xmm4, xmm5
pxor xmm4, xmm0
movaps xmm0, xmm4
pshufb xmm4, xmmword [ebp + ecx - 0x50]
pshufb xmm0, xmm1
pshufb xmm2, xmm6
movups xmm5, xmmword [edx]
pxor xmm2, xmm0
movaps xmm0, xmmword [0x1047c8a0]
pshufb xmm0, xmm7
pxor xmm2, xmm0
movaps xmm0, xmmword [0x104cce50]
pxor xmm4, xmm2
movaps xmm3, xmm0
pshufb xmm2, xmm1
pxor xmm4, xmm2
movaps xmm2, xmmword [0x104cce70]
pand xmm0, xmm4
pandn xmm3, xmm4
movaps xmm4, xmmword [0x104cce20]
psrld xmm3, 4
movaps xmm6, xmm4
movaps xmm7, xmm4
movaps xmm1, xmm3
pxor xmm1, xmm0
pshufb xmm2, xmm0
movaps xmm0, xmm4
pshufb xmm0, xmm3
pxor xmm0, xmm2
pshufb xmm6, xmm0
movaps xmm0, xmm4
pxor xmm6, xmm1
pshufb xmm0, xmm1
pxor xmm0, xmm2
pshufb xmm7, xmm0
pxor xmm7, xmm3
cmp eax, esi
jne 0x103072b5
movaps xmmword [ebp - 0x60], xmm5
movaps xmm5, xmmword [0x1047c840]
movaps xmm0, xmmword [0x1047c6e0]
and eax, 3
mov ecx, dword [ebp - 4]
pshufb xmm5, xmm7
shl eax, 4
xor ecx, ebp
add eax, 0x104cd210
pshufb xmm0, xmm6
pop esi
pxor xmm5, xmmword [ebp - 0x60]
pxor xmm0, xmm5
pshufb xmm0, xmmword [eax]
call fcn.103b6385
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x103073e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
movaps xmm5, xmmword [0x104cce50]
movaps xmm2, xmm0
mov eax, dword [ebx + 8]
movaps xmm0, xmm5
movaps xmm3, xmmword [0x1047c6d0]
pand xmm0, xmm2
movaps xmm1, xmmword [0x1047c6c0]
movaps xmm4, xmm5
pshufb xmm3, xmm0
lea ecx, [eax + 0x10]
movups xmm0, xmmword [eax]
mov eax, dword [ebx + 0xc]
movaps xmm7, xmmword [0x104cce20]
pxor xmm3, xmm0
movaps xmm0, xmm5
pandn xmm0, xmm2
movaps xmm2, xmmword [0x104cce70]
psrld xmm0, 4
movaps xmm6, xmm7
pshufb xmm1, xmm0
movaps xmm0, xmm5
movaps xmm5, xmm7
pxor xmm3, xmm1
pand xmm0, xmm3
pandn xmm4, xmm3
psrld xmm4, 4
pshufb xmm2, xmm0
movaps xmm1, xmm4
pxor xmm1, xmm0
movaps xmm0, xmm7
pshufb xmm0, xmm4
pxor xmm0, xmm2
pshufb xmm5, xmm0
movaps xmm0, xmm7
pxor xmm5, xmm1
pshufb xmm0, xmm1
pxor xmm0, xmm2
pshufb xmm6, xmm0
pxor xmm6, xmm4
cmp eax, 1
je 0x103075b4
movaps xmm4, xmmword [0x104cd280]
lea edx, [eax - 1]
nop
movaps xmm2, xmmword [0x1047c8f0]
movups xmm1, xmmword [ecx]
add ecx, 0x10
movaps xmm0, xmmword [0x1047c7e0]
pshufb xmm0, xmm6
pshufb xmm2, xmm5
pxor xmm2, xmm1
movaps xmm1, xmmword [0x1047c720]
pxor xmm2, xmm0
movaps xmm0, xmmword [0x1047c930]
pshufb xmm0, xmm5
pshufb xmm2, xmm4
pshufb xmm1, xmm6
pxor xmm1, xmm0
movaps xmm0, xmmword [0x1047c7b0]
pxor xmm2, xmm1
pshufb xmm0, xmm5
pshufb xmm2, xmm4
pxor xmm2, xmm0
movaps xmm0, xmmword [0x1047c920]
pshufb xmm0, xmm6
pxor xmm2, xmm0
movaps xmm0, xmmword [0x1047c700]
pshufb xmm0, xmm5
movaps xmm5, xmm7
pshufb xmm2, xmm4
pxor xmm2, xmm0
movaps xmm0, xmmword [0x1047c860]
pshufb xmm0, xmm6
movaps xmm6, xmm7
pxor xmm2, xmm0
movaps xmm0, xmm4
palignr xmm0, xmm4, 0xc
movaps xmm4, xmm0
movaps xmm0, xmmword [0x104cce50]
movaps xmm3, xmm0
pand xmm0, xmm2
pandn xmm3, xmm2
movaps xmm2, xmmword [0x104cce70]
psrld xmm3, 4
pshufb xmm2, xmm0
movaps xmm1, xmm3
pxor xmm1, xmm0
movaps xmm0, xmm7
pshufb xmm0, xmm3
pxor xmm0, xmm2
pshufb xmm5, xmm0
movaps xmm0, xmm7
pxor xmm5, xmm1
pshufb xmm0, xmm1
pxor xmm0, xmm2
pshufb xmm6, xmm0
pxor xmm6, xmm3
sub edx, 1
jne 0x103074b0
movaps xmm0, xmmword [0x1047c8b0]
neg eax
movups xmm1, xmmword [ecx]
and eax, 3
pshufb xmm0, xmm5
shl eax, 4
add eax, 0x104cd210
pxor xmm0, xmm1
movaps xmm1, xmmword [0x1047c8c0]
pshufb xmm1, xmm6
pxor xmm0, xmm1
pshufb xmm0, xmmword [eax]
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x103167b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
test esi, esi
je 0x1031685e
cmp esi, 0x40
jb 0x10316845
push ebx
lea eax, [esi - 1]
lea ebx, [esi - 1]
add eax, edx
add ebx, ecx
cmp ecx, eax
ja 0x103167e0
cmp ebx, edx
jae 0x10316844
mov ebx, esi
mov eax, ecx
mov esi, edx
and ebx, 0xffffffc0
sub esi, ecx
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [edx + edi + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [edx + edi + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [edx + edi + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ebx
jne 0x103167f4
mov ecx, dword [ebp - 8]
pop ebx
cmp edi, esi
je 0x1031685e
sub edx, ecx
lea eax, [edi + ecx]
sub esi, edi
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub esi, 1
jne 0x10316850
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10316870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0x18], edx
xor ecx, ecx
test esi, esi
je 0x10316974
push ebx
mov ebx, dword [ebp + 8]
cmp esi, 0x40
jb 0x10316954
lea eax, [esi - 1]
add eax, ebx
cmp edi, eax
ja 0x103168ad
lea eax, [esi - 1]
add eax, edi
cmp eax, ebx
jae 0x10316954
lea eax, [esi - 1]
add eax, edx
cmp edi, eax
ja 0x103168c3
lea eax, [esi - 1]
add eax, edi
cmp eax, edx
jae 0x10316954
mov eax, esi
mov esi, edx
sub esi, ebx
and eax, 0xffffffc0
mov dword [ebp - 4], esi
mov esi, edi
sub esi, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 8], esi
mov ebx, edx
lea esi, [edx + 0x30]
mov edx, dword [ebp - 8]
sub ebx, edi
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x10], esi
lea esi, [edi + 0x10]
movups xmm1, xmmword [ebx + eax]
mov ebx, dword [ebp - 0xc]
lea eax, [eax + 0x40]
movups xmm0, xmmword [eax - 0x40]
lea esi, [esi + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x30]
movups xmmword [edx + eax - 0x40], xmm1
movups xmm1, xmmword [ebx + esi - 0x40]
mov ebx, dword [ebp - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
movups xmmword [esi - 0x40], xmm1
movups xmm1, xmmword [ebx + ecx - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
movups xmmword [esi - 0x30], xmm1
movups xmm1, xmmword [ebx + ecx]
mov ebx, dword [ebp - 4]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [esi - 0x20], xmm1
cmp ecx, dword [ebp - 0x14]
jne 0x103168f1
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp + 8]
cmp ecx, esi
je 0x10316973
sub edx, ebx
lea eax, [ecx + ebx]
sub edi, ebx
sub esi, ecx
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + edi - 1], cl
sub esi, 1
jne 0x10316961
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10316e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov byte [ebp - 1], 0
push edi
mov edi, ecx
test esi, esi
je 0x10316e5f
sub edi, edx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, byte [edi + edx - 1]
xor ecx, eax
mov al, byte [ebp - 1]
or eax, ecx
mov byte [ebp - 1], al
sub esi, 1
jne 0x10316e45
cmp byte [ebp - 1], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x103236b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10411ab5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x104c5878]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.Botan::ASN1_Object.0
mov dword [ebp - 4], 0
lea edi, [eax + 4]
mov dword [eax], vtable.Botan::OCSP::SingleResponse.0
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.Botan::ASN1_Object.0
mov byte [ebp - 4], 1
lea ecx, [edi + 4]
mov ebx, dword [ebp + 8]
mov dword [edi], vtable.Botan::OCSP::CertID.0
lea eax, [ebx + 8]
push eax
call fcn.102f3fe0
mov byte [ebp - 4], 2
lea eax, [ebx + 0x28]
push eax
lea ecx, [edi + 0x24]
call fcn.1030c330
mov byte [ebp - 4], 3
lea eax, [ebx + 0x34]
push eax
lea ecx, [edi + 0x30]
call fcn.1030c330
mov byte [ebp - 4], 4
add edi, 0x3c
mov dword [ebp + 8], edi
lea esi, [ebx + 0x40]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 5
mov ecx, edi
push esi
mov dword [edi + 0xc], 1
call fcn.1030beb0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x50]
lea ecx, [edx + 0x54]
mov dword [ebp + 8], ecx
mov dword [edx + 0x50], eax
mov dword [ecx], vtable.Botan::ASN1_Object.0
mov byte [ebp - 4], 8
mov dword [ecx], vtable.Botan::X509_Time.0
mov eax, dword [ebx + 0x58]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 0x5c]
mov dword [ecx + 8], eax
mov eax, dword [ebx + 0x60]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x64]
mov dword [ecx + 0x10], eax
mov eax, dword [ebx + 0x68]
mov dword [ecx + 0x14], eax
mov eax, dword [ebx + 0x6c]
mov dword [ecx + 0x18], eax
mov eax, dword [ebx + 0x70]
mov dword [ecx + 0x1c], eax
mov byte [ebp - 4], 9
lea ecx, [edx + 0x74]
mov dword [ebp + 8], ecx
mov dword [ecx], vtable.Botan::ASN1_Object.0
mov byte [ebp - 4], 0xa
mov dword [ecx], vtable.Botan::X509_Time.0
mov eax, dword [ebx + 0x78]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 0x7c]
mov dword [ecx + 8], eax
mov eax, dword [ebx + 0x80]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x84]
mov dword [ecx + 0x10], eax
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0x14], eax
mov eax, dword [ebx + 0x8c]
mov dword [ecx + 0x18], eax
mov eax, dword [ebx + 0x90]
mov dword [ecx + 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1032a840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x104129f3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x104c5878]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.1032ca90
mov edi, eax
mov dword [ebp - 0x14], edi
mov word [edi + 0xc], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x10]
mov dword [ebp - 0x18], ecx
mov esi, dword [ebp + 8]
push esi
call fcn.1027e810
mov byte [ebp - 4], 1
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x20], xmm0
movq xmm0, qword [esi + 0x20]
movq qword [edi + 0x30], xmm0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0xf
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10331980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
test ecx, ecx
je 0x10331af6
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x10331af6
cmp dword [ecx + 0x20], 0
je 0x10331af6
cmp dword [ecx + 0x24], 0
je 0x10331af6
mov dword [ecx + 0x14], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 2
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test edx, edx
jns 0x103319dd
neg edx
mov dword [esi + 0x18], edx
test edx, edx
mov eax, 0x71
push edi
mov edi, 0x2a
cmovne eax, edi
mov dword [esi + 4], eax
xor eax, eax
cmp edx, 2
setne al
mov dword [ecx + 0x30], eax
lea eax, [esi + 0x94]
mov dword [esi + 0xb18], eax
mov ecx, esi
lea eax, [esi + 0x988]
mov dword [esi + 0x28], 0
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0xb20], 0x104c64c4
mov dword [esi + 0xb2c], 0x104c649c
mov dword [esi + 0xb38], 0x104c64b0
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
mov dword [esi + 0x16b4], 8
call fcn.1032e650
mov ecx, dword [esi + 0x2c]
push dword [esi + 0x4c]
push dword [esi + 0x44]
lea eax, [ecx + ecx]
neg ecx
push ecx
mov dword [esi + 0x3c], eax
call fcn.102510c0
mov eax, dword [esi + 0x84]
pop edi
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x1046db5a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x1046db58]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x1046db5c]
mov dword [esi + 0x90], eax
movzx eax, word [ecx*4 + 0x1046db5e]
mov dword [esi + 0x7c], eax
xor eax, eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x10332630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov ebx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x6c]
add eax, esi
sub edx, ebx
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x103326d8
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.103ce0b0
mov ebx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea edx, [eax + ebx*2]
nop
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub ebx, 1
jne 0x10332680
mov eax, dword [edi + 0x40]
mov ebx, esi
lea edx, [eax + esi*2]
nop dword [eax + eax]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub ebx, 1
jne 0x103326b0
mov edx, dword [ebp - 8]
add edx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x1033272e
push edx
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x38]
add edx, dword [edi + 0x6c]
call fcn.10332420
add dword [edi + 0x74], eax
add esp, 4
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x1033271a
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x1033272e
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x10332641
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x103338f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x20
jbe 0x10333916
mov dword [ebp + 8], ecx
test edx, edx
je 0x10333956
lea eax, [ebp + 8]
push eax
push esi
push edx
call fcn.100d5060
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret
mov edi, ecx
movzx ecx, cx
shr edi, 0x10
cmp esi, 1
jne 0x10333952
movzx eax, byte [edx]
add eax, ecx
cmp eax, 0xfff1
lea edx, [eax - 0xfff1]
cmovb edx, eax
lea eax, [edx + edi]
cmp eax, 0xfff1
lea ecx, [eax - 0xfff1]
pop edi
cmovb ecx, eax
shl ecx, 0x10
or ecx, edx
mov eax, ecx
pop esi
pop ebp
ret
test edx, edx
jne 0x1033395f
pop edi
mov eax, 1
pop esi
pop ebp
ret
cmp esi, 0x10
jae 0x103339a2
test esi, esi
je 0x10333977
movzx eax, byte [edx]
lea edx, [edx + 1]
add ecx, eax
add edi, ecx
sub esi, 1
jne 0x10333968
cmp ecx, 0xfff1
lea esi, [ecx - 0xfff1]
mov eax, 0x80078071
cmovb esi, ecx
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
shl eax, 0x10
pop edi
or eax, esi
pop esi
pop ebp
ret
test esi, esi
je 0x10333a76
push ebx
mov ebx, esi
shr ebx, 4
movzx eax, byte [edx]
sub esi, 0x10
add ecx, eax
movzx eax, byte [edx + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 7]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 8]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 9]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 0xa]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 0xb]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 0xc]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 0xd]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 0xe]
add edi, ecx
add ecx, eax
movzx eax, byte [edx + 0xf]
add edi, ecx
add edx, 0x10
add ecx, eax
add edi, ecx
sub ebx, 1
jne 0x103339b0
pop ebx
test esi, esi
je 0x10333a52
movzx eax, byte [edx]
lea edx, [edx + 1]
add ecx, eax
add edi, ecx
sub esi, 1
jne 0x10333a43
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
shl edi, 0x10
or edi, ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x10338650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x10338671
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x10338671
mov eax, dword [eax + 0x44]
test eax, eax
je 0x10338671
push dword [ebp + 0xc]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]