joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30004fff
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push esi
mov esi, eax
mov edx, 0xffff
and esi, edx
mov ecx, esi
imul ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
test eax, eax
push edi
jns 0x3000508b
mov eax, dword [ebp + 0x10]
and dword [ebp + 0xc], 0
test eax, eax
mov esi, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 4], esi
je 0x30005071
mov dword [ebp + 0x10], eax
dec dword [esi]
jne 0x30005041
inc dword [ebp + 0xc]
jmp 0x3000505f
mov ecx, dword [ebx + 4]
mov edi, dword [ebp + 8]
and ecx, edx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
and eax, edx
add dword [ebp + 8], eax
mov eax, dword [ebx + 4]
mov esi, dword [ebp - 4]
and eax, edx
add esi, eax
dec dword [ebp + 0x10]
mov dword [ebp - 4], esi
jne 0x30005038
mov esi, dword [ebx + 4]
mov eax, dword [ebp + 8]
jmp 0x3002356e
mov edi, dword [ebp + 0x10]
movzx edx, word [ebx]
mov eax, dword [ebp + 0xc]
add eax, edi
cmp eax, edx
je 0x300050b6
test edi, edi
jle 0x300050b6
sub edx, dword [ebp + 0xc]
sub edx, edi
imul edx, esi
imul esi, edi
push edx
add esi, ecx
push esi
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
sub word [ebx], di
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3000547b
Capabilities:
Packed with generic packer

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [section..cdata]
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0xa0]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x80], ecx
jne 0x300054aa
xor eax, eax
jmp loc.30023fa9
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x9c]
mov dword [eax], ecx
inc ebx
xor eax, eax
cmp edi, ebx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x7c], ecx
je 0x300054cc
cmp edi, 2
jne 0x300055d2
cmp edi, 2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x300054ff
lea eax, [ebp - 0x74]
push eax
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x30005522
call esi
cmp eax, 0x3f0
jne 0x300055b3
mov eax, ebx
cmp edi, ebx
je 0x30005507
test eax, eax
je 0x30005522
lea eax, [ebp - 0x74]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x300055b3
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push ebx
push dword [ebp - 0x74]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call ebx
call esi
cmp eax, 0x7a
jne 0x300055b3
cmp dword [ebp - 0x78], 0x100
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
jae 0x30005551
lea edi, [ebp - 0x70]
jmp 0x30005561
push dword [ebp - 0x78]
push 0
call esi
mov edi, eax
test edi, edi
mov dword [ebp - 0x7c], edi
je 0x300055b3
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x78]
push edi
push 1
push dword [ebp - 0x74]
call ebx
test eax, eax
je 0x300055b3
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push eax
push 0
mov dword [ebp - 0x78], eax
call esi
test eax, eax
mov esi, dword [ebp + 0xa0]
mov dword [esi], eax
je 0x300055b3
push dword [edi]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x300055b3
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x300055b3
mov dword [ebp - 0x80], 1
cmp dword [ebp - 0x74], 0
pop esi
je 0x300055c3
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x7c], 0
je 0x300055d2
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x80]
pop edi
pop ebx

Function at 0x300055ea
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x3002016c], 0
jne 0x30005609
push 0x3002016c
push 1
call fcn.3000547b
test eax, eax
pop ecx
pop ecx
je 0x3000562a
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [0x3002016c]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0
push 0
jmp 0x300230e0
leave
ret 4
Function at 0x30005846
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x3002017c]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x30005859
push eax
call esi
mov eax, dword [0x30020170]
test eax, eax
je 0x30005865
push eax
call esi
mov eax, dword [0x3002016c]
test eax, eax
pop esi
je 0x30005876
push eax
jmp 0x30023822
and dword [0x3002016c], 0
and dword [0x30020170], 0
and dword [0x3002017c], 0
and dword [0x30020180], 0
ret

Function at 0x30005a45
Capabilities:
Packed with generic packer

Disassembly:
push esi
xor esi, esi
push esi
push 0x3002018c
push 1
push str.D:_A__0x12FFFF___IU_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov eax, dword [0x3002018c]
cmp eax, esi
je 0x30005a86
mov dword [0x30020138], esi
mov dword [0x30020130], 0xc
mov dword [0x30020134], eax
mov dword [0x30020190], 0x30020130
inc esi
jmp fcn.30005a8b
jmp loc.30023000

Function at 0x30005af8
Capabilities:
Packed with generic packer

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jne 0x30005b14
cmp dword [0x30020178], eax
jne 0x30005b0d
call fcn.30005740
mov eax, dword [0x30020178]
jmp 0x30005b26
cmp dword [0x30020188], eax
jne 0x30005b21
jmp 0x300230a8
mov eax, dword [0x30020188]
ret 4

Function at 0x30005b51
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x30020198], 0
jne fcn.30005b5f
jmp loc.30023038

Function at 0x30006139
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x300017b0
call fcn.300064c6
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x30006174
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x30006174
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x3000618c
cmp eax, 0x20b
je 0x30006179
mov dword [ebp - 0x1c], edi
jmp 0x300061a0
cmp dword [ecx + 0x84], 0xe
jbe 0x30006174
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x3000619a
cmp dword [ecx + 0x74], 0xe
jbe 0x30006174
xor eax, eax
jmp 0x300237de
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x300201e4], 0xffffffff
or dword [0x300201e8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x300201cc]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x300201c8]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x300201e0], eax
call fcn.3000643e
call fcn.3000654b
cmp dword [0x300080c0], edi
jne 0x30006200
push 0x30006548
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
jmp 0x30023683
Function at 0x300063f9
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [section..cdata]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.300063f9
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [section..cdata]
jne 0x300062d1
ret

Function at 0x3000643e
Capabilities:
Packed with generic packer

Disassembly:
push 0xc
push 0x300017c0
call fcn.300064c6
mov dword [ebp - 0x1c], 0x30001880
cmp dword [ebp - 0x1c], 0x30001880
jae 0x3000647c
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x30006472
call eax
jmp 0x30006472
or dword [ebp - 4], 0xffffffff
add dword [ebp - 0x1c], 4
jmp 0x30006451
jmp 0x300236b6
Function at 0x40ac40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a6a8]
jne 0x40ac4a
repz ret
jmp fcn.00411bfc

Function at 0x417c4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f688
and dword [ebp - 0x14], 0
cmp dword [0x447b5c], 0
mov dword [ebp - 0x18], eax
jne 0x417cff
push 0x403814
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417da7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403808
push ebx
call edi
test eax, eax
je 0x417da7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037f8
push ebx
mov dword [0x447b5c], eax
call edi
push eax
call esi
push 0x4037e4
push ebx
mov dword [0x447b60], eax
call edi
push eax
call esi
push 0x4037c8
push ebx
mov dword [0x447b64], eax
call edi
push eax
call esi
mov dword [0x447b6c], eax
test eax, eax
je 0x417cff
push 0x4037b0
push ebx
call edi
push eax
call esi
mov dword [0x447b68], eax
mov eax, dword [0x447b68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417d58
cmp dword [0x447b6c], ecx
je 0x417d58
push eax
call esi
push dword [0x447b6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417d58
test ebx, ebx
je 0x417d58
call edi
test eax, eax
je 0x417d4f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x417d4f
test byte [ebp - 8], 1
jne 0x417d58
or dword [ebp + 0x10], 0x200000
jmp 0x417d8b
mov eax, dword [0x447b60]
cmp eax, dword [ebp - 0x18]
je 0x417d8b
push eax
call esi
test eax, eax
je 0x417d8b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417d8b
mov eax, dword [0x447b64]
cmp eax, dword [ebp - 0x18]
je 0x417d8b
push eax
call esi
test eax, eax
je 0x417d8b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x447b5c]
call esi
test eax, eax
je 0x417da7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417da9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ac40
leave
ret
Function at 0x422620
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00421960
cmp dword [0x7e88e0], 0x37
jne 0x4226cf
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404498
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4044b8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
mov ecx, dword [0x7e88e4]
mov eax, dword [0x7e4d50]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1004
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1c6c980
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x946000]
push edi
or ebp, 0xffffffff
jmp 0x1c6c9a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1c6c9a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c6c998
mov eax, 1
add ebx, ebx
jne 0x1c6c9bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1c6c9cc
jne 0x1c6c9eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c6c9eb
dec eax
add ebx, ebx
jne 0x1c6c9d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1c6c9b0
add ebx, ebx
jne 0x1c6c9e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1c6ca3d
xor ecx, ecx
sub eax, 3
jb 0x1c6ca03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1c6ca72
sar eax, 1
mov ebp, eax
jmp 0x1c6ca0e
add ebx, ebx
jne 0x1c6ca0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c6c9dc
inc ecx
add ebx, ebx
jne 0x1c6ca1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c6c9dc
add ebx, ebx
jne 0x1c6ca29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1c6ca1e
jne 0x1c6ca3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1c6ca1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1c6ca5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1c6ca4e
jmp 0x1c6c99e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1c6ca5c
add edi, ecx
jmp 0x1c6c99e
pop esi
mov edi, esi
mov ecx, 0x26beb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1c6ca7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1c6ca7f
lea edi, [esi + 0xd68000]
mov eax, dword [edi]
or eax, eax
je 0x1c6cae7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xdeba70]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xdebbb0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1c6caa5
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xdebbb4]
or eax, eax
je 0x1c6cae1
mov dword [ebx], eax
add ebx, 4
jmp 0x1c6cac2
call dword [esi + 0xdebbc4]
mov ebp, dword [esi + 0xdebbb8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1c6cb1b
sub esp, 0xffffff80
jmp 0x1614108
Function at 0xd449a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd88e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0xda2014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0xda30ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00d580c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0xda2a8c
push eax
call fcn.00d580c0
mov esi, dword [0xda30fc]
xor ebx, ebx
mov edi, dword [0xda3100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0xda6390], bl
mov eax, ebx
mov ecx, 0xda30ec
cmovae ecx, dword [0xda30ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0xda64a0], al
inc ebx
cmp ebx, 0x100
jl 0xd44a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0xda6390]
movzx eax, byte [esi + 0xda64a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0xd44a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0xda6390]
mov byte [esi + 0xda6390], al
inc esi
mov byte [edi + 0xda6390], dl
cmp esi, 0x100
jl 0xd44a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00d44690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0xd44ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xd44abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xd44b1f
push edx
push ecx
call fcn.00d5d663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0xd44b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xd44b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xd44b1f
push edx
push ecx
call fcn.00d5d663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00d76c6a
int3
Function at 0xd470a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0xda2014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x4d10169
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0xd47289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0xd47289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00d740f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x4d10285
nop
test eax, eax
je 0xd47289
push 4
push 0x1000
push 4
push 0
call 0x4d00ea7
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x4cf0006
nop
test eax, eax
je 0xd47289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0xd98df8
push dword [esp + 0x30]
call 0x4cf0372
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0xd471ac
push 0xd98dfc
push 0xd98e14
call 0x4d00b64
nop
push eax
call 0x4cf00d2
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x4cf0259
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0xd47289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x4d100b3
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0xd47243
mov dword [esp + 0xc], eax
call fcn.00d46ef0
push eax
call 0x4d00a1a
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x4d100b3
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0xd471f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x4d100b3
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x4cf0411
nop
push dword [esp + 0x24]
call 0x4d00beb
nop
push 0x8000
push 0
push esi
call 0x4d10000
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00d5cff1
mov esp, ebp
pop ebp
ret