joyce8/EMBER2024-capa huggingface dataset:
Function at 0x166f708
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x16c]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.0166f538
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x198], bl
je 0x166f785
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x174]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
push ecx
call fcn.016b79e8
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x166f7c2
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x170
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x166f797
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.0166f898
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x198], bl
je 0x166f881
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x194]
inc edi
cmp edi, ecx
jne 0x166f80d
xor edi, edi
cmp dword [eax + 0x1ac], ebx
je 0x166f85d
lea ebx, [eax + 0x138]
mov ecx, ebx
call fcn.0166b40d
mov ebp, dword [ebx + 0x28]
mov ecx, 0xf
sub ecx, ebp
xor ebx, ebx
shr ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1ac]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x174]
sub ecx, edi
shl ecx, 9
lea eax, [edx + ecx + 0x8cf0]
push eax
call fcn.016b7a58
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x167bcd2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1006cb07
call fcn.016b7fd0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x10072a64
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x10072a5c
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
push 3
mov byte [ebp - 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.0165803c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x167e3bc
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x1006d188
call fcn.016b7fd0
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x100717e0
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x10072a7c
push 4
mov ebx, 0x10071594
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.0165f291
mov dword [esi + 0x3c], 0x10072bd8
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.0165f291
mov dword [edi], 0x10072be0
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0167a7ae
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0167d3b0
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0167a7ae
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0167d3b0
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0167a7ae
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0167d3b0
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0167a7ae
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0167d3b0
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0167d3b0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x168beed
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1006e3e7
call fcn.016b7fd0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 4
mov dword [esi], 0x10072a6c
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 1
mov dword [esi + 0x20], 0x10072d40
lea ecx, [esi + 0x38]
mov byte [esi + 0x34], bl
push 3
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01659c05
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], ebx
mov byte [esi + 0x50], bl
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x169b1f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1006f9e3
call fcn.016b7fd0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.01657fd6
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.01657fd6
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.01657fd6
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.01657fd6
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.01657fd6
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.01657fd6
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.01657fd6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x169de54
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1006ffbe
call fcn.016b7fd0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov al, byte [edi]
lea ecx, [esi + 0xc]
mov byte [esi], al
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0xc]
push eax
call fcn.01657fd6
and dword [ebp - 4], 0
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call fcn.0169decb
and dword [esi + 0x30], 0
and dword [esi + 0x34], 0
lea ecx, [esi + 0x2c]
lea eax, [edi + 0x2c]
push eax
mov byte [ebp - 4], 1
mov dword [ecx], 0x10071944
call fcn.0167c383
mov al, byte [edi + 0x38]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x38], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x16a35e8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x16a362f
mov ecx, ebx
call fcn.016a3da8
mov eax, dword [esp + 0x50]
push esi
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.016a45b8
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
call fcn.016a4658
jmp 0x16a364b
test esi, esi
jbe 0x16a364b
mov ecx, esi
mov esi, dword [esp + 0x50]
mov edx, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x36
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x16a364d
mov ecx, ebx
call fcn.016a3da8
lea eax, [esp + 0xc]
push 0x40
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.016a45b8
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x6a
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x16a367c
lea esi, [ebx + 0x68]
mov ecx, esi
call fcn.016a3da8
lea ecx, [esp + 0xc]
push 0x40
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.016a45b8
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x16a3718
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xbc
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xd0]
cmp edi, 0x40
jbe 0x16a37a0
lea ecx, [esp + 0x60]
call fcn.016a3da8
mov eax, dword [esp + 0xcc]
push edi
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x88], 0
call fcn.016a45b8
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x64]
call fcn.016a4658
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dh, byte [esp + eax + 0xc]
mov cl, byte [esp + eax + 0xe]
mov dl, byte [esp + eax + 0xd]
add eax, 4
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + eax + 0xb]
shl edx, 8
or edx, ecx
cmp eax, 0x14
mov dword [esp + eax + 0x1c], edx
jb 0x16a3772
jmp 0x16a37d9
xor eax, eax
test edi, edi
jbe 0x16a37d9
push ebp
mov ebp, dword [esp + 0xd0]
mov edx, eax
mov ecx, 3
shr edx, 2
lea esi, [esp + edx*4 + 0x24]
mov edx, eax
and edx, 3
sub ecx, edx
xor edx, edx
mov dl, byte [eax + ebp]
shl ecx, 3
shl edx, cl
mov ecx, dword [esi]
or ecx, edx
inc eax
cmp eax, edi
mov dword [esi], ecx
jb 0x16a37ae
pop ebp
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x16a37e2
mov ecx, ebx
call fcn.016a3da8
lea eax, [esp + 0x20]
push 0x10
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.016a4768
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x16a3818
lea esi, [ebx + 0x68]
mov ecx, esi
call fcn.016a3da8
lea ecx, [esp + 0x20]
push 0x10
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.016a4768
pop edi
pop esi
pop ebx
add esp, 0xbc
ret 8

Function at 0x16a38a8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push 5
mov ebp, ecx
push eax
call fcn.016a4548
lea edx, [esp + 0x50]
push 5
lea ecx, [ebp + 0x68]
push edx
call fcn.016a4548
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
mov ecx, 5
mov esi, ebx
lea edi, [esp + 0x10]
test eax, eax
rep movsd dword es:[edi], dword [esi]
jbe 0x16a3932
mov esi, eax
lea eax, [esp + 0x50]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call fcn.016a3dd8
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0x54]
push edx
push eax
lea ecx, [ebp + 0x68]
call fcn.016a3dd8
lea ecx, [esp + 0x10]
mov eax, ebx
sub ecx, ebx
mov edx, 5
mov edi, dword [ecx + eax]
xor dword [eax], edi
add eax, 4
dec edx
jne 0x16a3924
dec esi
jne 0x16a38f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 8

Function at 0x16a3da8
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x16a4c82
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [ecx + 0xc]
push esi
push edi
mov eax, edx
movzx edi, byte [esp + 0xc]
mov esi, 0xff
and eax, esi
xor eax, edi
shr edx, 8
mov eax, dword [eax*4 + 0x1008ad00]
xor eax, edx
mov edx, dword [ecx + 0x14]
mov dword [ecx + 0xc], eax
and eax, esi
add eax, dword [ecx + 0x10]
mov edi, edx
and edi, esi
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 0x10], eax
shr eax, 0x18
xor eax, edi
pop edi
shr edx, 8
mov eax, dword [eax*4 + 0x1008ad00]
pop esi
xor eax, edx
mov dword [ecx + 0x14], eax
ret 4

Function at 0x16a4ed2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
movzx eax, byte [ebp + 0xc]
push esi
push 0x40
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.016b84d8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
add esp, 0xc
xor esi, esi
sub ecx, eax
lea eax, [ebp + esi - 0x40]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc esi
cmp esi, 0x14
jb 0x16a4ef9
lea ecx, [ebp - 0xa8]
call fcn.016a3da8
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x40]
push 0x40
push eax
lea ecx, [ebp - 0xa8]
call fcn.016a45b8
push dword [ebp + 0x10]
lea ecx, [ebp - 0xa8]
call fcn.016a4658
pop esi
leave
ret 0xc

Function at 0x16a5458
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test edx, edx
jbe 0x16a54a3
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
xor ecx, ecx
mov cl, byte [esi]
and ebx, 0xff
xor ebx, ecx
mov ecx, 8
call fcn.016b81a8
mov ecx, dword [ebx*8 + 0x1008cd00]
xor ecx, eax
mov ebx, dword [ebx*8 + 0x1008cd04]
mov eax, ecx
xor ebx, edx
inc esi
dec edi
mov edx, ebx
jne 0x16a546b
pop edi
pop ebx
pop esi
ret 8
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop esi
ret 8

Function at 0x16aa658
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
push esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x20], edi
call fcn.016aa6a8
xor edx, edx
add esi, 0x70
mov eax, edx
mov ecx, 8
mov edi, eax
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec ecx
jne 0x16aa67b
mov dword [esi], eax
inc edx
add esi, 4
cmp edx, 0x100
jb 0x16aa674
pop edi
pop esi
ret 4

Function at 0x16b02f8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, 1
shl edx, cl
mov ecx, dword [esp + 0xc]
xor eax, eax
or ecx, edx
cmp ecx, 1
je 0x16b0344
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x10]
mov edx, ecx
and ecx, 1
shr edx, 1
xor ebx, ebx
mov bx, word [edi + edx*2]
neg ecx
sar ecx, 4
shr ebx, 4
and ecx, 0x7f
xor ebx, ecx
mov ecx, dword [esi + ebx*4]
add eax, ecx
mov ecx, edx
cmp ecx, 1
jne 0x16b031b
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x16b0398
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov edx, 1
test edi, edi
je 0x16b03e2
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
mov ecx, esi
xor ebx, ebx
and ecx, 1
mov bx, word [ebp + edx*2]
mov ebp, ecx
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
add edx, edx
xor ebx, ebp
mov ebp, dword [esp + 0x20]
shr esi, 1
add eax, dword [ebp + ebx*4]
or edx, ecx
dec edi
jne 0x16b03af
pop esi
pop ebp
pop ebx
pop edi
ret 0x10

Function at 0x16b1188
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, 0x100
or esi, edi
mov eax, esi
mov ecx, edi
shr eax, 7
and eax, 1
mov edx, esi
shl ebx, 1
push eax
and ecx, ebx
mov eax, edi
shr edx, 8
add eax, ecx
add edx, eax
lea ecx, [ebp + edx*2]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.016b10d8
shl esi, 1
mov eax, esi
xor eax, ebx
not eax
and edi, eax
cmp esi, 0x10000
jb 0x16b119f
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x16b26f8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
push edi
or ch, 1
mov edi, ecx
xor ebx, ebx
shr edi, 8
mov bx, word [esi + edi*2]
mov edi, ecx
shr edi, 7
and edi, 1
neg edi
sar edi, 4
shr ebx, 4
and edi, 0x7f
xor ebx, edi
shl ecx, 1
mov edi, dword [edx + ebx*4]
add eax, edi
cmp ecx, 0x10000
jb 0x16b270c
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x16b2748
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edx, 0x100
or ch, 1
shl esi, 1
mov edi, edx
mov ebx, ecx
and edi, esi
mov ebp, edx
shr ebx, 8
add ebp, edi
xor edi, edi
add ebx, ebp
mov ebp, dword [esp + 0x14]
mov di, word [ebp + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [esp + 0x20]
shl ecx, 1
mov ebp, dword [ebx + edi*4]
mov edi, ecx
xor edi, esi
add eax, ebp
not edi
and edx, edi
cmp ecx, 0x10000
jb 0x16b275e
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x16b7028
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 0x50]
mov ecx, eax
imul ecx, dword [esp + 0xc]
add edx, ecx
mov dword [esi + 0x50], edx
mov edx, dword [esi + 0x4c]
sub edx, ecx
imul eax, dword [esp + 0x10]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0x16b7074
cmp ecx, 0x8000
jae 0x16b709e
neg eax
and eax, 0x7fff
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x54]
push eax
call dword [eax]
mov ecx, dword [esi + 0x4c]
and eax, 0xff
shl ecx, 8
or eax, ecx
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x50]
shl ecx, 8
shl eax, 8
mov dword [esi + 0x48], ecx
mov dword [esi + 0x50], eax
jmp 0x16b704f
pop esi
ret 0xc

Function at 0x16b74e8
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x20], ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x24], ecx
ret 4

Function at 0x16b79f8
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.016b81c7
mov ecx, dword [esp + 0x1c]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.016b7968
ret 0xc
Function at 0x19c120c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [0x100ec008]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
mov esi, dword [ebp + 8]
push edi
test edx, edx
jne 0x19c122f
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push edx
mov edx, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.019c091c
mov ecx, dword [esp + 8]
mov eax, 0x78
shr ecx, 3
mov edi, 0x38
and ecx, 0x3f
sub eax, ecx
sub edi, ecx
cmp ecx, 0x38
lea ecx, [esp + 9]
cmovae edi, eax
xor edx, edx
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [esp + edx + 0x64], al
movzx eax, byte [ecx - 4]
mov byte [esp + edx + 0x65], al
movzx eax, byte [ecx - 3]
mov byte [esp + edx + 0x66], al
movzx eax, byte [ecx - 2]
mov byte [esp + edx + 0x67], al
add edx, 4
cmp edx, 8
jb 0x19c128f
push edi
mov edx, 0x100ec8b0
lea ecx, [esp + 0xc]
call fcn.019c091c
push 8
lea edx, [esp + 0x68]
lea ecx, [esp + 0xc]
call fcn.019c091c
lea edx, [esi + 1]
mov esi, 4
lea eax, [esp + 0x11]
nop dword [eax + eax]
movzx ecx, byte [eax - 1]
lea eax, [eax + 4]
mov byte [edx - 1], cl
lea edx, [edx + 4]
movzx ecx, byte [eax - 4]
mov byte [edx - 4], cl
movzx ecx, byte [eax - 3]
mov byte [edx - 3], cl
movzx ecx, byte [eax - 2]
mov byte [edx - 2], cl
sub esi, 1
jne 0x19c12ec
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
call fcn.01a10ff4
mov esp, ebp
pop ebp
ret 4
Function at 0x4011c9
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x427004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
push eax
push 0x40020010
xor esi, esi
push esi
push esi
push ecx
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x40124e
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x401204
sub ecx, edx
sar ecx, 1
push edi
lea edi, [ecx*2 + 2]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x401242
mov eax, dword [ebp - 8]
xor esi, esi
push edi
inc esi
mov eax, dword [eax]
add eax, 4
push eax
push ecx
call fcn.00405120
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop edi
jmp 0x40125b
push eax
push 0x4226a8
call fcn.004012e8
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040358d
leave
ret
Function at 0x401d5f
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
sub esp, 0x94
mov eax, dword [0x427004]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
push esi
push edi
push 0x10
pop eax
mov edi, ecx
mov dword [esp + 0x14], eax
xor ebp, ebp
mov dword [esp + 0x18], eax
lea eax, [esp + 0x88]
mov dword [esp + 0x1c], eax
mov ebx, dword [edi + 4]
cmp dword [0x42850c], ebp
je 0x401e9e
cmp dword [0x428508], ebp
je 0x401e9e
cmp dword [edi], 0x14
jb 0x401e97
test ebx, ebx
je 0x401e97
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.cryptdll.dll_MD5Init]
push dword [0x428508]
mov esi, dword [sym.imp.cryptdll.dll_MD5Update]
lea eax, [esp + 0x34]
push dword [0x42850c]
push eax
call esi
push 0x10
push ebx
lea eax, [esp + 0x38]
push eax
call esi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [edi]
sub eax, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
lea eax, [ebx + 0x10]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction033]
test eax, eax
js 0x401e90
mov esi, dword [edi]
lea eax, [ebx + 0x14]
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], eax
push ecx
sub esi, 0x14
mov edx, eax
push esi
call fcn.00401106
add esp, 0xc
test eax, eax
je 0x401e89
mov eax, dword [esp + 0x2c]
cmp eax, dword [ebx + 0x10]
jne 0x401e76
mov ebx, dword [edi + 4]
push esi
call fcn.004015a1
mov dword [edi + 4], eax
test eax, eax
je 0x401ea9
push esi
push dword [esp + 0x14]
push eax
call fcn.00405120
add esp, 0xc
mov dword [edi], esi
inc ebp
test ebx, ebx
je 0x401ea9
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401ea9
push dword [ebx + 0x10]
push eax
push str.ERROR_alibaba_rpc_drsr_ProcessGetNCChangesReply_decrypt___Checksums_dont_match__C:0x_08x___R:0x_08x__n
call fcn.004012e8
add esp, 0xc
jmp 0x401ea9
push str.ERROR_alibaba_rpc_drsr_ProcessGetNCChangesReply_decrypt___Unable_to_calculate_CRC32_n
jmp 0x401ea3
push str.ERROR_alibaba_rpc_drsr_ProcessGetNCChangesReply_decrypt___RtlDecryptData2_n
jmp 0x401ea3
push str.ERROR_alibaba_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_valid_data_n
jmp 0x401ea3
push str.ERROR_alibaba_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_Session_Key_n
call fcn.004012e8
pop ecx
mov ecx, dword [esp + 0x9c]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040358d
add esp, 0x94
ret