joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053b70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100a1dca
call fcn.1009a9e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x18]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push eax
call fcn.100022ea
and dword [ebp - 4], 0
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
call fcn.100022ea
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.100022ea
mov al, byte [edi + 0x3c]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x3c], al
mov al, byte [edi + 0x3d]
mov byte [esi + 0x3d], al
mov al, byte [edi + 0x3e]
mov byte [esi + 0x3e], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10056144
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, ecx
test esi, esi
mov ecx, edx
jbe 0x10056173
push ebx
push edi
movzx edi, byte [ecx]
movzx edx, ax
shr edx, 8
xor edx, edi
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x100c1054]
xor ax, bx
inc ecx
dec esi
jne 0x10056153
pop edi
pop ebx
pop esi
ret 4

Function at 0x10057ba6
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100a21a2
call fcn.1009a9e0
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x18]
lea edi, [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebp - 0x10], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x24]
lea edi, [ebx + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cl, byte [eax + 0x30]
add eax, 0x34
mov byte [ebx + 0x30], cl
lea ecx, [ebx + 0x34]
xor esi, esi
push eax
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [ecx], 0x100a55c4
call fcn.10050c9e
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x40]
lea eax, [esi + 0x40]
push eax
call fcn.10057c8b
add esi, 0x54
lea ecx, [ebx + 0x54]
push esi
mov byte [ebp - 4], 1
call fcn.10057cd7
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1005cf77
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100a29dc
call fcn.1009a9e0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push 3
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.100017cd
lea ecx, [esi + 0xc]
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.100017cd
mov ecx, dword [ebp - 0xc]
or dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x30], edi
mov byte [esi + 0x58], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1005dca1
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100a2a7c
call fcn.1009a9e0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10002a2a
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10002a2a
mov eax, dword [esi + 0x18]
push 5
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 8]
add esi, 0x1c
lea edi, [ebx + 0x1c]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x30]
pop edi
mov dword [ebx + 0x30], ecx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x34], ecx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x38], ecx
mov ecx, dword [eax + 0x3c]
mov dword [ebx + 0x3c], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x40], ecx
mov ecx, dword [eax + 0x44]
mov dword [ebx + 0x44], ecx
mov ecx, dword [eax + 0x48]
mov dword [ebx + 0x48], ecx
mov ecx, dword [eax + 0x4c]
mov dword [ebx + 0x4c], ecx
mov ecx, dword [eax + 0x50]
mov dword [ebx + 0x50], ecx
mov ecx, dword [eax + 0x54]
mov dword [ebx + 0x54], ecx
mov al, byte [eax + 0x58]
mov ecx, dword [ebp - 0xc]
mov byte [ebx + 0x58], al
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1006ac26
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3a5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a6b38
mov dword [esi + 4], 0x100a7844
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
mov dword [esi + 8], edi
call fcn.10004a86
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.10004a86
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.10004a86
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
call fcn.10004a86
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x4a0], edi
mov dword [esi + 0x4a4], edi
mov dword [esi + 0x4b4], edi
mov eax, 0x100000
mov dword [esi + 0x4c0], edi
mov dword [esi + 0x4c8], eax
mov dword [esi + 0x4cc], eax
mov dword [esi + 0x4d0], eax
mov dword [esi + 0x4d4], eax
mov dword [esi + 0x4d8], 0x10000
mov dword [esi], 0x100a7834
mov dword [esi + 4], 0x100a7820
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1006bdf6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3b9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a7df8
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.10004a86
mov dword [esi + 0x6fe4], edi
lea ecx, [esi + 0x6ff8]
mov dword [esi + 0x6ff4], edi
call fcn.10097270
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword [esi + 0x7020], edi
mov dword [esi + 0x6fec], edi
mov dword [esi + 0x6ff0], edi
mov dword [esi + 0x7010], eax
mov byte [esi + 0x6fe0], al
mov dword [esi], 0x100a7de0
mov dword [esi + 4], 0x100a7dd0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1007b1d7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a426b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a5210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.10004a86
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x88], bl
mov dword [esi], 0x100a83b8
mov dword [esi + 4], 0x100a83a8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1007c6a7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a42eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a5210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.10004a86
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x3038], bl
mov dword [esi], 0x100a8510
mov dword [esi + 4], 0x100a8500
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1007e1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ecx, eax
imul ecx, edx
mov edx, dword [esi + 0x14]
add edx, ecx
mov dword [esi + 0x14], edx
mov edx, dword [esi + 0x10]
sub edx, ecx
imul eax, dword [esp + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0x1007e1e8
cmp ecx, 0x8000
jae 0x1007e232
neg eax
and eax, 0x7fff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
lea ecx, [esi + 0x20]
cmp eax, edx
jb 0x1007e200
call fcn.10004b74
mov byte [esp + 8], al
jmp 0x1007e209
mov dl, byte [eax]
inc eax
mov byte [esp + 8], dl
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 8]
shl eax, 8
and ecx, 0xff
or eax, ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
shl ecx, 8
shl eax, 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], eax
jmp 0x1007e1c3
pop esi
ret 4
Function at 0x10085970
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push edi
xor edi, edi
xor eax, eax
lea edx, [ebp + 0x100]
lea esi, [edi + ecx]
xor ebx, ebx
add edx, 4
mov bl, byte [esi + eax]
mov ebx, dword [ebx*4 + 0x100c3ce0]
xor dword [edx - 4], ebx
inc eax
cmp eax, 4
jl 0x10085987
add edi, 4
cmp edi, 0x10
jl 0x1008597c
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x100861e0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x10087540
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xa8
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x10087571
lea ecx, [esp + 0x4c]
call fcn.100861e0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
push eax
mov dword [esp + 0x74], 0
call fcn.100869f0
mov ecx, dword [esp + 0xb8]
push ecx
lea ecx, [esp + 0x50]
call fcn.10086b80
pop edi
pop esi
pop ebx
add esp, 0xa8
ret 4

Function at 0x10087f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebp
xor ebp, ebp
and eax, 7
mov dword [esp + 8], ecx
cmp edx, 5
jae 0x10087fb1
xor eax, eax
pop ebp
add esp, 0xc
ret 0xc
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [ecx + edx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x18], edx
nop
mov ecx, dword [esp + 0x14]
lea edi, [ecx + ebp]
cmp edi, edx
jae 0x10087fef
jmp 0x10087fe0
mov bl, byte [edi]
and bl, 0xfe
cmp bl, 0xe8
je 0x10087fef
inc edi
cmp edi, edx
jb 0x10087fe0
mov ebp, edi
sub ebp, ecx
mov ecx, ebp
sub ecx, dword [esp + 0x10]
cmp edi, edx
jae 0x10088104
cmp ecx, 3
jbe 0x10088023
xor eax, eax
mov cl, byte [edi + 4]
mov dword [esp + 0x10], ebp
test cl, cl
je 0x1008805d
cmp cl, 0xff
je 0x1008805d
and eax, 3
add eax, eax
or eax, 1
inc ebp
jmp 0x10087fd0
dec ecx
shl eax, cl
and eax, 7
je 0x10088008
movzx ecx, byte [eax + 0x100a8884]
mov ebx, edi
sub ebx, ecx
cmp byte [eax + 0x100a887c], 0
mov cl, byte [ebx + 4]
je 0x1008804b
test cl, cl
je 0x1008804b
cmp cl, 0xff
jne 0x10088008
and eax, 3
add eax, eax
mov dword [esp + 0x10], ebp
or eax, 1
inc ebp
jmp 0x10087fd0
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
jmp 0x10088080
cmp dword [esp + 0x28], 0
je 0x1008808e
lea ebx, [edx + ebp]
add ebx, esi
jmp 0x10088094
sub edx, ebp
sub edx, esi
mov ebx, edx
test eax, eax
je 0x100880d6
movzx esi, byte [eax + 0x100a8884]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
mov cl, dl
test cl, cl
je 0x100880bb
cmp cl, 0xff
jne 0x100880d2
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x10088080
mov esi, dword [esp + 0x20]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, ebx
shr edx, 0x10
mov ecx, ebx
shr ecx, 8
mov byte [edi + 3], dl
mov edx, dword [esp + 0x18]
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add ebp, 5
jmp 0x10087fd0
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x1008811d
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [edx], eax
mov eax, ebp
pop ebp
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x18]
dec ecx
shl eax, cl
and eax, 7
mov dword [edx], eax
mov eax, ebp
pop ebp
add esp, 0xc
ret 0xc
Function at 0x10089490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
lea esi, [ecx + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x100894b7
pop esi
ret

Function at 0x1008f1b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x1008f1c0
pop edi
pop ebx
ret

Function at 0x1008f1f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x1008f200
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1008f4a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x1008f611
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x1008f52a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x1008f500
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x1008f4e4
cmp edx, 0x10
jae 0x1008f5ab
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x1008f550
cmp edx, dword [esp + 0x1c]
jae 0x1008f611
or eax, 8
xor edi, edi
cmp eax, 1
je 0x1008f591
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x1008f564
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x1008f550
cmp edx, dword [esp + 0x1c]
jae 0x1008f611
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
jmp 0x1008f5c0
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x1008f5f6
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x1008f5d0
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0x1008f5c0
pop edi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x100970e0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x10097108
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10097117
mov eax, 1
ret 4

Function at 0x100975f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test edx, edx
je 0x1009762b
push esi
push edi
mov edi, dword [esp + 0x10]
mov edi, edi
movzx esi, byte [ecx]
xor esi, eax
shrd eax, edi, 8
and esi, 0xff
xor eax, dword [esi*8 + 0x100c5d00]
shr edi, 8
xor edi, dword [esi*8 + 0x100c5d04]
inc ecx
dec edx
jne 0x10097600
mov edx, edi
pop edi
pop esi
ret 8
mov edx, dword [esp + 8]
ret 8
Function at 0x405540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3b5c8d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x3b77014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x3b78070
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041bfc0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x3b77a88
push eax
call fcn.0041bfc0
mov esi, dword [0x3b78080]
xor ebx, ebx
mov edi, dword [0x3b78084]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x3b7b280], bl
mov eax, ebx
mov ecx, 0x3b78070
cmovae ecx, dword [0x3b78070]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x3b7b390], al
inc ebx
cmp ebx, 0x100
jl 0x4055c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x3b7b280]
movzx eax, byte [esi + 0x3b7b390]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x405614
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x3b7b280]
mov byte [esi + 0x3b7b280], al
inc esi
mov byte [edi + 0x3b7b280], dl
cmp esi, 0x100
jl 0x4055f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00405190
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405669
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40565f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056bf
push edx
push ecx
call fcn.00421568
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4056ab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4056a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056bf
push edx
push ecx
call fcn.00421568
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043ab6a
int3
Function at 0x4056d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov ecx, dword [eax]
mov eax, 0xaaaaaaab
add ecx, 2
mov dword [ebp - 0xc], ebx
mul ecx
push esi
push edi
shr edx, 1
mov ecx, ebx
shl edx, 2
push 0x3d
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebx], 0
call fcn.0041be80
cmp dword [ebx + 0x14], 0x10
mov edi, ebx
jb 0x405723
mov edi, dword [ebx]
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], 3
xor esi, esi
mov ecx, dword [ecx]
mov eax, ecx
div dword [ebp - 4]
sub ecx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
je 0x4057ce
mov eax, dword [ebp - 8]
dec ecx
add eax, 2
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 1
inc eax
mov ebx, eax
movsx ecx, byte [edx - 2]
lea edx, [edx + 3]
movsx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movsx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
sar eax, 0x12
movzx eax, byte [eax + 0x3b6ccd0]
mov byte [edi + esi], al
mov eax, ecx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x3b6ccd0]
mov byte [edi + esi + 1], al
mov eax, ecx
sar eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + 0x3b6ccd0]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + 0x3b6ccd0]
mov byte [edi + esi + 3], al
add esi, 4
sub ebx, 1
jne 0x405761
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x405845
mov eax, dword [ebp - 8]
movsx eax, byte [ecx + eax]
sub edx, 1
je 0x4057f8
mov ebx, dword [ebp - 8]
shl eax, 8
movsx ecx, byte [ecx + ebx + 1]
mov ebx, dword [ebp - 0x10]
or ecx, eax
mov eax, ecx
sar eax, 0xa
and eax, 0x3f
jmp 0x4057fd
mov ecx, eax
sar eax, 2
mov al, byte [eax + 0x3b6ccd0]
mov byte [edi + esi], al
mov eax, ecx
test edx, edx
je 0x405814
sar eax, 4
and eax, 0x3f
jmp 0x40581a
and eax, 3
shl eax, 4
mov al, byte [eax + 0x3b6ccd0]
mov byte [edi + esi + 1], al
test edx, edx
je 0x40583f
and ecx, 0xf
mov al, byte [ecx*4 + 0x3b6ccd0]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ac0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x3b77014]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], 0x67452301
push 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.0041baf0
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push 0x10
push eax
push esi
call fcn.00438150
lea eax, [esp + 0x1c]
add esp, 0xc
lea ebx, [esi + 0x10]
cmp edi, eax
je 0x405b8b
mov eax, dword [edi]
test eax, eax
je 0x405b6d
mov ecx, dword [edi + 8]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x405b63
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405bce
mov eax, edx
push ecx
push eax
call fcn.00421568
add esp, 8
mov eax, dword [esp + 0x18]
mov dword [edi], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00420ef1
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x405bbc
mov ecx, dword [esp + 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x405bb2
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405bce
push ecx
push esi
call fcn.00421568
add esp, 8
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00420ef1
mov esp, ebp
pop ebp
ret
call fcn.0043ab6a
int3