joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4536e5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x47aa03
call fcn.004586d4
sub esp, 0x250
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x14]
or ecx, 0x100000
mov dword [ebx + 0x14], ecx
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
movzx eax, cx
sub eax, 1
je 0x45372a
sub eax, 1
je 0x453726
sub eax, 1
jne 0x453730
push 0x17
jmp 0x45372c
push 2
jmp 0x45372c
push 0x11
pop edi
mov dword [ebp - 0x18], edi
and dword [ebp - 0x20], 0
test edi, edi
js 0x453748
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebx]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebx + 0x14]
test ecx, 0x80000
je 0x45378b
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00453e7e
pop ecx
pop ecx
push 0
sub esp, 0xc
mov esi, esp
mov ecx, esi
call fcn.00426589
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0042bfe9
lea esi, [ebx + 0x18]
push esi
call fcn.0044013d
add esp, 0x14
lea ecx, [ebp - 0x2c]
call fcn.00423fb2
jmp 0x45378e
lea esi, [ebx + 0x18]
push esi
call fcn.0043cac7
push 0
push 0x20
lea eax, [ebp - 0x4c]
push eax
call fcn.0042735d
add esp, 0x10
mov eax, dword [ebx]
mov dword [ebp - 0x4c], eax
mov eax, 0x47c724
cmp dword [ebx + 8], 0
cmovne eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x450392
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
push 0x41
pop eax
test dword [ebx + 0x14], 0x20000
mov ecx, 0x8041
cmove eax, ecx
mov dword [ebp - 0x3c], eax
test dword [ebx + 0x14], 0x40000
je 0x4537ed
or eax, 0x10
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x4538d3
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
setne byte [ebp - 0x11]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x453852
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x453852
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x453859
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
jmp 0x45386f
cmp byte [ebp - 0x11], 0
je 0x4538d3
push bind
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebx + 0x24]
call fcn.0042c488
test dword [ebx + 0x14], 0x80000
je 0x4538c5
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00453e7e
push ecx
mov esi, esp
mov ecx, esi
call fcn.00426589
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0042bfe9
lea eax, [ebx + 0x24]
push eax
call fcn.0043f3d9
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00423fb2
mov al, 1
jmp 0x4538d5
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453c2c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0042e574
pop ecx
test al, al
je 0x453c48
push 0x7b
call fcn.004479b9
pop ecx
xor al, al
pop ebp
ret
call fcn.004479b0
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x14]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 5
jne 0x453c9b
cmp dword [ebp + 0x14], 0
je 0x453c82
push 0x47c744
push dword [ebp + 0x14]
call fcn.0042e639
pop ecx
pop ecx
test al, al
je 0x453c44
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x453c44
call fcn.004479b0
mov al, 1
pop ebp
ret

Function at 0x45556b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp word [ebp - 0x218], 0
je 0x4555b7
mov ecx, dword [ebp + 8]
call fcn.00426589
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push bind
push eax
call fcn.0042c488
jmp 0x4555fd
call fcn.00446c34
test al, al
lea eax, [ebp - 0xc]
push eax
je 0x4555d2
call fcn.00447c8b
mov dword [esp], str.System32
jmp 0x4555de
call fcn.00447c8b
mov dword [esp], str.System
cmp dword [eax], 0
mov ecx, 0x47c724
cmovne ecx, dword [eax]
push ecx
push dword [ebp + 8]
call fcn.0043f19d
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.00423fb2
mov eax, dword [ebp + 8]
leave
ret

Function at 0x455ba4
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.0042d578
pop ecx
test al, al
je 0x455bc0
call fcn.004479c7
xor al, al
jmp 0x455c03
push ebx
mov ecx, esi
call fcn.00455ce9
call fcn.004479b0
push dword [ebp + 8]
mov bl, byte [ebp + 0xc]
movzx eax, bl
push eax
push 0
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
test eax, eax
je 0x455c00
test bl, bl
je 0x455bf9
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x455c00
mov byte [esi + 4], bl
mov al, 1
jmp 0x455c02
xor al, al
pop ebx
pop esi
pop ebp
ret 8

Function at 0x45651c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x456529
xor al, al
pop ebp
ret
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
setne al
pop ebp
ret

Function at 0x45658c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x45659e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ebp
ret
Function at 0x4565a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
mov eax, dword [ebp + 0x14]
and eax, 1
mov dword [ebp - 4], edi
shl eax, 2
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push edi
call fcn.0046e03a
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4565ed
cmp dword [ebp + 0x10], 3
je 0x4565e0
push dword [ebp + 0x10]
push esi
call fcn.0045653b
pop ecx
pop ecx
push edi
push dword [ebp - 4]
call fcn.0045647e
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x45c740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045c9f0

Function at 0x45e1f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045e200
Function at 0x844390
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x413000]
push edi
or ebp, 0xffffffff
jmp 0x8443b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8443b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8443a8
mov eax, 1
add ebx, ebx
jne 0x8443cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8443dc
jne 0x8443fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8443fb
dec eax
add ebx, ebx
jne 0x8443e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8443c0
add ebx, ebx
jne 0x8443f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x84444d
xor ecx, ecx
sub eax, 3
jb 0x844413
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x844482
sar eax, 1
mov ebp, eax
jmp 0x84441e
add ebx, ebx
jne 0x84441e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8443ec
inc ecx
add ebx, ebx
jne 0x84442c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8443ec
add ebx, ebx
jne 0x844439
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x84442e
jne 0x84444a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x84442e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x84446c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x84445e
jmp 0x8443ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x84446c
add edi, ecx
jmp 0x8443ae
pop esi
lea edi, [esi + 0x442000]
mov eax, dword [edi]
or eax, eax
je 0x8444cb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x444e08]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x444ea4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x844489
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x444eac]
or eax, eax
je 0x8444c5
mov dword [ebx], eax
add ebx, 4
jmp 0x8444a6
call dword [esi + 0x444ea8]
mov ebp, dword [esi + 0x444eb0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8444ff
sub esp, 0xffffff80
jmp 0x41668a
Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401029
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401021
cmp al, 0x22
jne 0x401015
cmp byte [esi], 0x22
jne 0x401033
inc esi
jmp 0x401033
cmp al, 0x20
jle 0x401033
inc esi
cmp byte [esi], 0x20
jg 0x40102d
mov al, byte [esi]
test al, al
je 0x40103d
cmp al, 0x20
jle 0x401026
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00402aca
push 0x404004
push section..data
call fcn.00402ab0
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40106d
movzx eax, word [ebp - 0x14]
jmp 0x401070
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00402ae2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4012a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x404280], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.trast
push str.bask
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4012e8
xor eax, eax
jmp 0x401303
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x71a72bae
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x509a38a6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x77ba4047
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, edx
push esi
test eax, eax
push edi
je 0x77ba40fb
cmp dword [0x77ba4a8c], 0
jne 0x77ba40f7
mov ecx, 0x40000
mov dword [0x77ba4a8c], 1
call fcn.77ba4882
test eax, eax
mov dword [0x77ba4a90], eax
je 0x77ba40f7
mov esi, 0x50ea
mov ecx, esi
call fcn.77ba4882
mov edi, eax
test edi, edi
je 0x77ba40f7
push esi
push 0
push edi
call sub.MSVCRT.dll_memset
mov ecx, 0x77ba10c0
add esp, 0xc
mov eax, edi
sub ecx, edi
mov esi, 0x2875
mov dl, byte [ecx + eax]
xor dl, 0x5b
mov byte [eax], dl
inc eax
dec esi
jne 0x77ba40ae
mov esi, dword [0x77ba4a90]
lea eax, [ebp - 8]
push eax
mov edx, esi
mov ecx, edi
call fcn.77ba3d8c
test eax, eax
jne 0x77ba40da
mov ecx, esi
call fcn.77ba4893
jmp 0x77ba40f7
mov ecx, edi
call fcn.77ba4893
lea edx, [ebp - 4]
mov ecx, esi
call fcn.77ba3ef9
mov eax, dword [ebp - 4]
push 0
push 1
push esi
add eax, esi
call eax
xor eax, eax
jmp 0x77ba4112
mov eax, dword [0x77ba4a90]
test eax, eax
je 0x77ba410f
mov edx, ecx
mov ecx, eax
call fcn.77ba3f86
jmp 0x77ba4112
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x77ba4275
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
push 0xf01ff
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x77ba42a7
lea eax, [esp + 4]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x77ba4882
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret
Function at 0xe9e88ee
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0x449
call fcn.0ea1451f
cmp al, 0x11
jne 0xe9e8908
or dword [ebp - 4], 0xffffffff
jmp 0xe9e8918
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov eax, dword [eax*4 + 0xea45550]
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x485
call fcn.0ea1451f
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0xea5c440]
movzx eax, al
lea esi, [edx + ecx*4]
mov dword [ebp + 0x10], eax
cmp ebx, 1
jne 0xe9e8972
test eax, eax
jbe 0xe9e89b4
mov ebx, dword [ebp + 0x18]
shl ebx, 2
push edi
call fcn.0ea1451f
movzx eax, al
mov ecx, eax
shl ecx, 8
or eax, ecx
mov ecx, eax
shl ecx, 0x10
or ecx, eax
and ecx, dword [ebp - 4]
inc edi
xor dword [esi], ecx
add esi, ebx
dec dword [ebp + 0x10]
jne 0xe9e894c
jmp 0xe9e89b4
mov ecx, dword [ebp + 0x18]
sub ecx, ebx
test eax, eax
jbe 0xe9e89b4
mov eax, ecx
shl eax, 2
mov dword [ebp + 0x18], eax
push edi
call fcn.0ea1451f
movzx ecx, al
mov eax, ecx
shl eax, 8
or ecx, eax
mov eax, ecx
shl eax, 0x10
or eax, ecx
and eax, dword [ebp - 4]
inc edi
mov ecx, ebx
test ebx, ebx
jbe 0xe9e89ac
xor dword [esi], eax
add esi, 4
dec ecx
jne 0xe9e89a4
add esi, dword [ebp + 0x18]
dec dword [ebp + 0x10]
jne 0xe9e8983
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0xe9e9368
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0xea42008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x485
call fcn.0ea1451f
movzx esi, al
mov ebx, 0x44a
push ebx
mov dword [ebp - 0x108], esi
call fcn.0ea14532
movzx edi, ax
imul edi, esi
imul edi, dword [ebp + 0xc]
push 0x44c
call fcn.0ea14532
movzx esi, ax
imul esi, dword [ebp + 0x10]
add esi, edi
add esi, dword [ebp + 8]
xor edi, edi
cmp dword [ebp - 0x108], edi
jle 0xe9e9401
cmp edi, 0x100
jae 0xe9e9401
mov eax, dword [0xea5c440]
mov eax, dword [eax + esi*4]
mov ecx, eax
sar ecx, 0x10
or eax, ecx
mov ecx, eax
sar ecx, 8
or cl, al
push ebx
mov byte [ebp + edi - 0x104], cl
call fcn.0ea14532
movzx eax, ax
add esi, eax
inc edi
cmp edi, dword [ebp - 0x108]
jl 0xe9e93c8
push dword [ebp - 0x108]
lea eax, [ebp - 0x104]
push eax
call fcn.0e9e92f2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0e9d57d5
leave
ret 0xc
Function at 0xe9ec78b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xea42008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0xea4aaac], esi
jne 0xe9ec858
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 3]
mov dword [0xea5c56c], eax
lea eax, [edi + 6]
mov dword [0xea5c568], edi
mov dword [0xea5c55c], eax
movzx eax, byte [esi + 0xea4aa88]
push eax
mov eax, dword [0xea5c568]
add eax, esi
push eax
call fcn.0ea14546
movzx eax, byte [esi + 0xea4aa8c]
push eax
mov eax, dword [0xea5c56c]
add eax, esi
push eax
call fcn.0ea14546
movzx eax, byte [esi + 0xea4aa68]
push eax
mov eax, dword [0xea5c55c]
add eax, esi
push eax
call fcn.0ea14546
mov ax, word [esi*2 + 0xea44484]
mov word [ebp + esi*2 - 0xc], ax
inc esi
cmp esi, 3
jl 0xe9ec7c6
lea eax, [ebp - 0xc]
push eax
push 3
push edi
call fcn.0ea03fb4
lea eax, [edi + 0xc]
push eax
call fcn.0ea14532
movzx ecx, ax
lea eax, [edi + 0xe]
mov dword [0xea5c564], eax
add eax, ecx
mov dword [0xea5c558], eax
inc eax
mov dword [0xea5c570], eax
add eax, 2
mov dword [0xea5c560], eax
mov dword [0xea4aaac], 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0e9d57d5
leave
ret 4

Function at 0xe9ee3ca
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
xor ebx, ebx
and al, 0x1f
mov dword [ebp - 4], ebx
cmp al, 3
jne 0xe9ee40a
push edi
mov edi, 0xea7cb80
mov al, byte [esi + 1]
push dword [ebp + 0xc]
xor al, bl
and al, 3
xor byte [esi + 1], al
push esi
call dword [edi]
add edi, 0x1c
inc ebx
cmp edi, 0xea7cbf0
jl 0xe9ee3e8
mov eax, dword [ebp - 4]
pop edi
jmp 0xe9ee41f
movzx eax, byte [esi + 1]
push dword [ebp + 0xc]
and eax, 3
imul eax, eax, 0x1c
push esi
call dword [eax + 0xea7cb80]
cwde
pop esi
pop ebx
leave
ret 8
Function at 0xea1a504
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push edi
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
sub eax, 3
je 0xea1a531
dec eax
dec eax
je 0xea1a52c
dec eax
dec eax
jne 0xea1a536
lea eax, [ebp - 0x60]
jmp 0xea1a539
lea eax, [ebp - 0x58]
jmp 0xea1a539
lea eax, [ebp - 0x50]
jmp 0xea1a539
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push eax
push 1
call fcn.0ea1a35e
xor edi, edi
cmp eax, edi
jl 0xea1a614
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call dword [0xe9d156c]
test al, al
jne 0xea1a571
mov eax, 0x80070003
jmp 0xea1a614
mov eax, dword [ebp - 0x20]
push ebx
mov ebx, dword [ebp - 4]
xor ecx, ecx
push esi
cmp cx, ax
je 0xea1a58b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0xea1a58e
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
push 0x4020
lea eax, [ebp - 8]
mov dword [ebp - 0x30], eax
push 7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x100100
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [0xe9d14d0]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call dword [0xe9d1568]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [fcn.0e9d1530]
cmp esi, edi
jl 0xea1a610
push 4
push 0x28
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [0xe9d1510]
push dword [ebp + 8]
mov esi, eax
call dword [0xe9d145c]
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret 0xc
Function at 0xea1b0ce
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
lea eax, [ebp - 0x18]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call dword [0xe9d156c]
test al, al
jne 0xea1b0fc
mov eax, 0x80070003
jmp 0xea1b1bf
mov eax, dword [ebp - 0x18]
push esi
xor ecx, ecx
push edi
mov edi, dword [ebp - 4]
cmp cx, ax
je 0xea1b116
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0xea1b119
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [0xe9d1578]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call dword [0xe9d1568]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [fcn.0e9d1530]
cmp esi, ebx
jge 0xea1b16f
mov eax, esi
jmp 0xea1b1bd
mov eax, dword [ebp + 8]
sub eax, 4
je 0xea1b189
dec eax
dec eax
je 0xea1b184
dec eax
dec eax
jne 0xea1b18e
lea eax, [ebp - 0x68]
jmp 0xea1b191
lea eax, [ebp - 0x60]
jmp 0xea1b191
lea eax, [ebp - 0x58]
jmp 0xea1b191
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0ea1a667
neg eax
sbb eax, eax
and eax, 0x10
push eax
call fcn.0ea1a35e
cmp eax, ebx
jge 0xea1b1bd
cmp eax, 0x8007000d
jne 0xea1b1bd
cmp dword [ebp + 8], 4
jne 0xea1b1bd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0xea266b0
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push edi
add ecx, ecx
push ecx
push 0
push dword [eax + 0x18]
call dword [fcn.0e9d1548]
mov edi, eax
test edi, edi
jne 0xea266ec
push 8
call dword [fcn.0e9d1090]
xor eax, eax
pop edi
pop esi
leave
ret 8
mov ax, word [esi]
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
call dword [fcn.0e9d1354]
test eax, eax
jne 0xea26726
xor esi, esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [fcn.0e9d1530]
mov eax, esi
jmp 0xea266e6
push edi
lea eax, [ebp - 0x10]
push eax
call dword [fcn.0e9d1460]
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [fcn.0e9d149c]
movzx eax, word [ebp - 8]
mov dword [esi], eax
xor esi, esi
inc esi
jmp 0xea2670d

Function at 0xea276e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ax, word [0xea599f4]
mov word [ebp - 4], ax
jmp 0xea27768
movzx edx, word [ebp - 4]
mov eax, dword [0xea7e83c]
shr edx, 3
shl edx, 3
add eax, edx
cmp byte [eax + 5], 0
jne 0xea27713
cmp byte [eax + 7], 0x80
je 0xea27760
xor eax, eax
xor ecx, ecx
mov ax, word [ebp - 4]
or eax, 7
lsl ecx, eax
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xffff
jne 0xea27760
mov eax, dword [0xea7e83c]
add eax, edx
movzx ecx, byte [eax + 7]
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
movzx edx, word [eax + 2]
shl ecx, 0x10
or ecx, edx
cmp dword [ebp + 8], ecx
jne 0xea27760
movzx eax, byte [eax + 5]
movzx ecx, byte [ebp + 0xc]
xor eax, ecx
test eax, 0xfffffffe
je 0xea27777
add dword [ebp - 4], 8
mov ax, word [ebp - 4]
cmp ax, word [0xea599f0]
jb 0xea276f6
xor eax, eax
leave
ret 8
mov eax, dword [ebp - 4]
or eax, 7
jmp 0xea27773