joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102535f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x10287590]
mov dword [0x10287594], 0
mov dword [0x10287598], 0
mov dword [0x102875a4], 0
mov dword [0x1028758c], 0xa9f
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
je 0x10253780
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
mov dword [0x1028758c], 0x1b0a
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10287594], edx
mov ecx, dword [ebp - 0x24]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x10287598], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1028759c], cl
mov dword [0x1028758c], 0x1ba7
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1028759c]
mov edx, dword [0x10287598]
mov byte [edi + edx], cl
mov dword [0x1028758c], 0x25da
mov edx, dword [0x10287594]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10287598]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x102875a4], ebx
mov dword [0x1028758c], 0x4df
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov byte [0x102875a9], ch
mov byte [0x102875aa], cl
xor ch, cl
mov byte [0x102875a8], ch
mov dword [0x10287590], 0xd0
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], ch
mov edx, dword [0x10287590]
mov esi, edx
add esi, 0xffffe557
mov dword [0x1028758c], esi
add ebx, 1
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], edx
je 0x10253780
mov eax, dword [0x10287594]
mov ecx, dword [0x10287598]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], edx
jmp 0x10253660
mov eax, dword [ebp - 0x2c]
add eax, 0xffffe56e
mov dword [0x1028758c], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10253795
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, dword [0x10287590]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
add eax, 0x1601
mov dword [0x10287590], eax
call fcn.10001092
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x30], ecx
je 0x102537ef
jmp 0x1025394c
mov eax, dword [esp + 0x2c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
jmp 0x1025388d
lea eax, [esp + 0x38]
lea ecx, [esp + 0x48]
mov edx, ecx
add ecx, 0x18
mov dword [0x1028758c], 0x3bb
mov dword [esp], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
call fcn.10252d6b
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x84], 0x13ee00
mov ecx, dword [0x10287578]
mov dword [esp + 0x50], ecx
mov ecx, dword [0x1028757c]
mov dword [esp + 0x9c], ecx
mov ecx, dword [0x10287580]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
lea eax, [0x102526b6]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov dword [ecx], edx
mov esi, dword [0x10287584]
mov dword [esp + 0x6c], esi
mov esi, dword [0x10287588]
mov dword [esp + 0x48], esi
mov dword [0x10287590], 0xc9d
mov dword [0x1028758c], 0xc7
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp word [eax], 0x5a4d
mov dword [esp + 0x2c], eax
jne 0x102537d0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x10]
cmp dword [eax], 0x4550
jne 0x102537d0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x78], eax
mov dword [0x10287590], 0x83d
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x80], edx
mov dword [0x1028758c], 0x5f1
call fcn.10252170
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x10253944
lea eax, [esp + 0x48]
mov dword [0x10287590], 0x17ac
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1025315d
mov ecx, esp
lea edx, [esp + 0x48]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x1028758c]
add ecx, 0x122d
mov dword [0x1028758c], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x404fdf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x404fee
pop dword [ebp - 0x14]
mov eax, 0xa0032f1c
add eax, 0x603d20d2
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xa64fedbf
sub dword [ebp - 0x24], 0x57fda874
mov dword [ebp - 0x20], 0xb9019f2d
sub dword [ebp - 0x20], 0x86ce52e8
mov dword [ebp - 0x1c], 0x273b4fb2
sub dword [ebp - 0x1c], 0xdaef0b84
mov dword [ebp - 0x18], 0x82a1ae24
sub dword [ebp - 0x18], 0x82a1ae24
lea eax, [ebp - 0x24]
push eax
mov eax, 0x8e4e9ebf
sub eax, 0x8e0dfeb3
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x4ef56ca0
sub dword [ebp - 0x24], 0xda83034a
mov dword [ebp - 0x20], 0x37057586
sub dword [ebp - 0x20], 0xf5991411
mov dword [ebp - 0x1c], 0x4c8cd067
sub dword [ebp - 0x1c], 0xe91d63fb
mov dword [ebp - 0x18], 0xdd259aff
sub dword [ebp - 0x18], 0xdd259aff
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x9066c588
sub eax, 0x90262574
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x37297
push 0
call eax
mov ecx, 0xff2ddee1
add ecx, 0xd26294
xor esi, esi
add esi, eax
mov edx, 0x43be00
add edx, dword [ebp - 0x14]
mov edi, 0x84fa3643
sub edi, 0x6e568e08
sub dword [ebp - 0xc], 0xa8cb9a59
mov ebx, dword [edx]
xor dword [ebp - 8], edi
add ebx, edi
add dword [ebp - 0xc], ebx
mov dword [esi], ebx
xor dword [ebp - 8], esi
add esi, 4
add edx, 4
loop 0x40510c
add eax, 0x4d2ae073
add eax, 0xb2d61834
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x407ce0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x407cfa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407d01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407cf0
mov eax, 1
add ebx, ebx
jne 0x407d13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407d24
jne 0x407d34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407d34
dec eax
add ebx, ebx
jne 0x407d30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x407d08
xor ecx, ecx
sub eax, 3
jb 0x407d4c
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407dbe
sar eax, 1
mov ebp, eax
jmp 0x407d57
add ebx, ebx
jne 0x407d57
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407d64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407d88
inc ecx
add ebx, ebx
jne 0x407d74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407d69
jne 0x407d85
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407d69
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407da8
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407d99
jmp 0x407cf6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407da8
add edi, ecx
jmp 0x407cf6
pop esi
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407e07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x75d0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7664]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407dc5
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x766c]
or eax, eax
je 0x407e01
mov dword [ebx], eax
add ebx, 4
jmp 0x407de2
call dword [esi + 0x7668]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x407e38
cmp al, 0xef
ja 0x407e2b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x407e0d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x407e1a
mov ebp, dword [esi + 0x7670]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x407e6c
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x284d2851
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x48530343
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10008178
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov ebx, dword [0x1001d985]
add ebx, 4
mov dword [ebp - 8], ebx
push dword [ebp - 8]
call fcn.1000418b
xor ecx, ecx
push eax
lea eax, [ebp - 4]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x100081e6
mov ebx, dword [0x1001d985]
mov ebx, dword [ebx + 4]
mov ecx, dword [ebx]
inc ecx
shl ecx, 2
add ebx, ecx
push ebx
mov eax, dword [ebp - 4]
dec eax
pop ebx
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
pop eax
pop ebx
pop ecx
jmp 0x100081a5
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100081f1
mov esp, ebp
pop ebp
ret
Function at 0x1000da1f
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x1c
push 1
mov ebx, 0x1bc
call fcn.100165a0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000da78
push ebx
call fcn.10015402
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x1c
mov eax, dword [ebp - 8]
test eax, eax
je 0x1000da8b
add eax, 8
push eax
push dword [ebp + 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
nop
nop
push dword [ebp - 4]
xor eax, eax
call dword [0x1001da19]
nop
nop
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx]
inc ecx
shl ecx, 2
add ebx, ecx
mov eax, 0x14
add ebx, eax
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp byte [ebx], 1
mov eax, 0
setne al
jmp 0x1000dad1
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000dae2
push ebx
call fcn.10015402
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1000e1a3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x1000e1ea
cmp ebx, 0x20
je 0x1000e1ea
cmp ebx, 0xffffffe0
je 0x1000e1ea
jne 0x1000e1f3
add eax, 1
cmp esi, eax
je 0x1000e200
jne 0x1000e1cf
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x1000e204
jne 0x1000e1cb
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4
Function at 0x1000e218
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x1000e2d9
test ecx, ecx
je 0x1000e2d9
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x1000e2d9
test ebx, ebx
je 0x1000e2d9
mov ebx, eax
add ebx, edx
je 0x1000e2d9
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x1000e2d9
cmp dword [edx + eax + 0x14], 0
je 0x1000e2d9
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x1000e2d9
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x1000e2c9
test dl, dl
je 0x1000e2c5
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x1000e2c9
add edi, 2
add esi, 2
test dl, dl
jne 0x1000e2a9
xor eax, eax
jmp 0x1000e2ce
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000e2e5
inc ebp
cmp ebp, dword [esp + 4]
jb 0x1000e296
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x1000f2e7
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x1000f308
mov dword [ebp + 0xc], 0x40
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.10016e60
add esp, 0x1c
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
nop
nop
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x1000f358
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100158a0
Capabilities:
Get file size

Disassembly:
sub esp, 0x100
xor ecx, ecx
push esi
mov esi, dword [esp + 0x108]
test esi, esi
jbe 0x100158c0
cmp esi, 0xc
jae 0x100158c0
mov ecx, dword [esi*4 + 0x1001da98]
lea eax, [esp + 0x108]
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x10015911
cmp word [eax], 0xc483
jne 0x10015911
push ebx
mov bl, byte [eax + 2]
xor edx, edx
cmp bl, 0xc
setge dl
mov eax, edx
pop ebx
test eax, eax
je 0x10015911
mov eax, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
push eax
push edx
push ecx
push esi
lea eax, [esp + 0x14]
push str.program_internal_error_number_is__d.__r_n_s_r_n
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x18
jmp 0x10015926
push ecx
push esi
lea ecx, [esp + 0xc]
push 0x1001dcb4
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x10
mov eax, dword [0x1001e0d8]
test eax, eax
je 0x10015959
mov ecx, dword [0x1001e0dc]
test ecx, ecx
jne 0x10015959
lea edx, [esp + 4]
mov dword [0x1001e0dc], 1
push edx
push esi
call eax
test eax, eax
mov dword [0x1001e0dc], 0
jne 0x1001596d
push 0x10
lea eax, [esp + 8]
push str.error
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
call fcn.10015860
add esp, 4
pop esi
add esp, 0x100
ret

Function at 0x10015980
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x1001e0ec]
test eax, eax
jne 0x10015994
call dword [0x1001910c]
mov dword [0x1001e0ec], eax
mov ecx, dword [esp + 4]
push esi
push ecx
push 8
push eax
call dword [0x1001908c]
mov esi, eax
test esi, esi
jne 0x100159c5
push 0x10
push str.error
push 0x1001dd1c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
call fcn.10015860
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x100159d0
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x1001e0ec]
test eax, eax
jne 0x100159e4
call dword [0x1001910c]
mov dword [0x1001e0ec], eax
mov ecx, dword [esp + 4]
push esi
push ecx
push 0
push eax
call dword [0x1001908c]
mov esi, eax
test esi, esi
jne 0x10015a15
push 0x10
push str.error
push 0x1001dd1c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
call fcn.10015860
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x10015a20
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x1001e0ec]
test eax, eax
jne 0x10015a34
call dword [0x1001910c]
mov dword [0x1001e0ec], eax
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
je 0x10015a4e
mov edx, dword [esp + 0xc]
push edx
push ecx
push 0
push eax
call dword [0x10019090]
jmp 0x10015a5c
mov ecx, dword [esp + 0xc]
push ecx
push 8
push eax
call dword [0x1001908c]
mov esi, eax
test esi, esi
jne 0x10015a7e
push 0x10
push str.error
push 0x1001dd1c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
call fcn.10015860
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x100169c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x100169de
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x100169d3
pop esi
ret
Function at 0x10016e80
Capabilities:
Resume thread

Disassembly:
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10016ec3
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x10016ebb
test cl, cl
je 0x10016eb6
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x10016ebb
add eax, 2
add esi, 2
test cl, cl
jne 0x10016e92
pop esi
xor eax, eax
pop ebx
ret
sbb eax, eax
pop esi
sbb eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call sub.KERNEL32.dll_ResumeThread
add esp, 8
ret

Function at 0x10017bd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size

Disassembly:
sub esp, 0x404
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x418]
push edi
call dword [0x100190e4]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], 0
jne 0x10017c6e
push edi
call dword [0x100190bc]
mov ebx, eax
test ebx, ebx
jne 0x10017c4e
push edi
lea eax, [esp + 0x18]
push 0x1001dddc
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x1001e0d8]
add esp, 0xc
test eax, eax
je 0x10017c30
lea ecx, [esp + 0x14]
push ecx
push ebx
call eax
test eax, eax
mov dword [esp + 0x10], eax
jne 0x10017c44
push 0x10
lea edx, [esp + 0x18]
push str.DLL_ERROR
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
call fcn.10015860
add esp, 4
mov eax, dword [0x1001e48c]
test eax, eax
mov dword [eax*4 + 0x1001e2fc], ebx
jne 0x10017c68
mov dword [0x1001e0f0], 0x10017ba0
inc eax
mov dword [0x1001e48c], eax
mov ebp, dword [esp + 0x41c]
cmp byte [ebp], 0x23
jne 0x10017c8b
lea eax, [ebp + 1]
push eax
call sub.KERNEL32.dll_FreeLibrary
add esp, 4
mov esi, eax
jmp 0x10017cd5
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
lea esi, [esp + 0x18]
push ecx
call sub.KERNEL32.dll_VirtualAllocEx
add esp, 8
test eax, eax
je 0x10017cce
cmp byte [eax + 1], 0x40
jne 0x10017cce
mov byte [eax], 0
mov edi, dword [esp + 0x418]
push esi
push ebx
call dword [0x1001907c]
mov esi, eax
test esi, esi
jne 0x10017d4b
push ebp
push edi
lea edx, [esp + 0x1c]
push 0x1001ddac
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x1001e0d8]
add esp, 0x10
test eax, eax
je 0x10017d0d
lea ecx, [esp + 0x14]
push ecx
push esi
call eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10017d29
push 0x10
lea edx, [esp + 0x18]
push str.DLL_ERROR
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
call fcn.10015860
mov eax, dword [esp + 0x424]
add esp, 4
mov dword [eax], esi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret 0xc
mov ecx, dword [esp + 0x420]
mov eax, esi
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret 0xc