joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7b60
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
cmp dword [ebp], 0
jne 0x4d7d07
cmp dword [ebp + 4], 0xffffffff
jne 0x4d7d07
push esi
lea esi, [ebp + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d7b90
sub ecx, edx
sar ecx, 1
movzx eax, word [ebp + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x4d7bc5
cmp eax, 0x2f
je 0x4d7bc5
push 0x51b4bc
push 0x104
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
push ebx
push edi
mov edi, dword [esp + 0x20]
cmp edi, 1
jne 0x4d7bf2
mov esi, dword [esp + 0x18]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4d7c0d
pop edi
pop ebx
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
cmp edi, 2
je 0x4d7c09
cmp edi, 3
je 0x4d7c09
pop edi
pop ebx
pop esi
mov eax, 0x10000
pop ebp
pop ecx
ret 0xc
mov esi, dword [esp + 0x18]
xor ebx, ebx
xor al, al
mov byte [esp + 0x13], al
mov byte [esp + 0x20], bl
cmp edi, 1
je 0x4d7c58
cmp edi, 2
jne 0x4d7c76
push ecx
push 0x80
push 3
push ecx
push 1
mov edx, GetEffectiveClientRect
mov ecx, esi
call fcn.0048bdf0
mov ebx, eax
add esp, 0x14
cmp ebx, 0xffffffff
jne 0x4d7c51
pop edi
pop ebx
pop esi
mov eax, 0x200
pop ebp
pop ecx
ret 0xc
mov byte [esp + 0x20], 1
jmp 0x4d7c5f
mov ebx, esi
mov byte [esp + 0x20], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [esp + 0x13], al
push 0x20
call dword [sym.imp.mfc140u.dll_operator_2]
add esp, 4
mov esi, eax
cmp edi, 1
je 0x4d7cb4
cmp edi, 2
je 0x4d7cb4
mov eax, dword [esp + 0x18]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x1c]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x4d7ce7
mov al, byte [esp + 0x20]
mov byte [esi + 0x10], al
mov al, byte [esp + 0x13]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x4d7ce7
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
mov ecx, esi
call fcn.00432b20
pop edi
xor ecx, ecx
mov dword [ebp], eax
test eax, eax
mov edx, 0x200
pop ebx
cmove ecx, edx
pop esi
mov eax, ecx
pop ebp
pop ecx
ret 0xc
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc
Function at 0x4dacb0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e45b6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x55b090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 7
mov word [esi + 4], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 7
mov word [esi + 0x1c], ax
mov byte [ebp - 4], 1
mov word [esi + 0x34], ax
mov eax, dword [ebp + 0xc]
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4dad12
sub eax, ebx
lea ecx, [esi + 0x1c]
sar eax, 1
push eax
push dword [ebp + 0xc]
call fcn.0045b530
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4dad50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x521200]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
mov dword [edi + 8], ecx
pop edi
pop esi
ret
Function at 0x512050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f24a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea ecx, [eax + 0x49]
mov byte [esi + 0x18], al
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, 0x69
mov word [ebp - 0x38], cx
lea ecx, [ebp - 0x3c]
mov word [ebp - 0x1e], ax
lea edx, [ecx + 2]
mov eax, 0x61
mov dword [ebp - 0x1c], 0x6c006c
mov dword [ebp - 0x3c], 0x53004e
mov dword [ebp - 0x36], 0x5f0053
mov dword [ebp - 0x26], 0x4d0028
mov dword [ebp - 0x32], 0x6e0049
mov dword [ebp - 0x16], 0x29
mov dword [ebp - 0x2a], 0x200063
mov dword [ebp - 0x2e], 0x740065
mov dword [ebp - 0x22], 0x7a006f
mov word [ebp - 0x18], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x512100
sub ecx, edx
lea eax, [ebp - 0x3c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0045b530
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482396
mov esp, ebp
pop ebp
ret
Function at 0x41420e
Capabilities:
Encode data using xor

Disassembly:
add al, cl
jno 0x41424b
enter 0xfffffffffffff571, 0xffffffffffffffa8
ror byte [ebp + 0x3a1c65dd], cl
cdq
lea eax, [ecx - 0x28]
fadd dword [esi]
fadd dword [esi]
popal
fsubr st(5), st(0)
sbb dword [ecx - 0x30], edi
lea eax, [eax]
enter 0x4a71, 0xffffffffffffffc8
jno 0x41428b
test eax, 0x65dd8dd2
cli
cmp bl, byte [ecx + 0x6d8418d]
popal
fsubr st(5), st(0)
lds edi, [eax - 0x30]
lea eax, [eax]
enter 0x4a71, 0xffffffffffffffc8
jno 0x4141fd
test eax, 0x65dd8dd2
sar byte [edx], 1
cdq
lea eax, [ecx - 0x19]
mov dword [0x8dd501f4], esi
out 0x89, eax
xor eax, 0x8dd501f4
imul edx, ebp, 0xffffff99
aad 0x99
invalid
inc edx
jb 0x4142e9
rcl edx, cl
dec esi
fadd dword [esi]
popal
fcmovnu st(0), st(2)
jb 0x414290
popfd
push es
je 0x41430e
clc
xor dword [edx - 8], 0x68a0685
std
popfd
push es
inc ebx
jb 0x414242
lodsd eax, dword [esi]
pop es
aam 0x8d
push es
inc edx
jb 0x41430d
rcl bl, cl
ror byte [edi - 0x7f], 1
invalid
add bl, cl
cdq
fnsave dword [edx - 8]
sbb edx, 0x98cf6165
invalid
ror byte [edi - 0x7f], 1
lea esi, [0x8dd45a99]
dec edi
or dword [ebp - 0x2ba566cb], 0x29354e8d
pop ebx
aam 0x8d
cdq
pop edx
aam 0x8d
dec esi
xor eax, 0x8dd45b29
dec esi
xor eax, 0x8dd45b51
dec esi
xor eax, 0x8dd45be1
dec esi
fild dword [esi]
jl 0x414312
or eax, 0x8d8d8d
retf

Function at 0x423f8a
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x6dd8dd4
fld qword [esi]
inc ebx
test byte fs:[ebp - 0x6b2f773], cl
xchg dword [esi], eax
dec ebx
sbb dh, dl
sahf
lea ecx, [edi - 0x77]
lea esp, [ebp + 0x2f]
test byte [ebp + 0x4dbe418d], cl
dec edx
mov word [ebp + 0x48dd47b], ss
int3
out 0x89, eax
xor eax, 0x8dd518e8
adc edx, esi
sahf
lea eax, [esi]
jl 0x423f9d
clc
jge 0x423f5a
dec ebp
add al, 0xcb
mov dword [ebx + ecx*8], eax
test dword [ebx + ecx*8], eax
add dword [eax + ecx*8], 0x85c80671
dec edx
mov edi, dword [0x68dd47b]
lds ebp, [ebp - 0x22663500]
fadd qword [ebx + eax*8]
popfd
jb 0x423f57
fisttp qword [edx]
aam 0x8d
fld qword [esi]
inc ebx
or eax, 0x88d8d84
dec ebp
stc
xchg dword [esi], eax
dec ebx
mov eax, dword gs:[0x4f8d9ed6]
mov dword [ebp - 0x727b4b9b], ecx
lea eax, [ecx - 0x19]
mov dword [0x8dd518b6], esi
invalid
Function at 0xfece7d
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x68f00000], 0x5a4d
jne 0xfecea2
mov ecx, dword [0x68f0003c]
cmp dword [ecx + 0x68f00000], 0x4550
lea edx, [ecx + 0x68f00000]
je 0xfecead
ret
cmp word [ecx + 0x68f00018], 0x10b
jne 0xfecea2
push esi
movzx eax, word [ecx + 0x68f00014]
push ebx
movzx esi, word [ecx + 0x68f00006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x68f00000
test esi, esi
je 0xfecef5
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xfeceeb
add edx, dword [eax + 8]
cmp ebx, edx
jb 0xfecef7
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0xfecedd
xor eax, eax
pop ebx
pop esi
ret

Function at 0xff921d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [0x69aba2b4]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x69aba3e8]
cmp byte [esp + 0x3c], 0
je 0xff92f8
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0xff92ca
cmp eax, 0x6a
je 0xff92e7
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0xff92c5
cmp eax, 0x6a
je 0xff92e7
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [0x69aba314]
sub esp, 4
call fcn.010011ed
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0xff92dd
Function at 0x1099d27
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x2c
push 0x40f948
call fcn.0109a2f5
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [ebp - 0x1c], eax
mov ebx, dword [eax + 0x78]
mov dword [ebp - 0x30], ebx
mov edx, dword [ebx + esi + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
mov edi, dword [ebx + esi + 0x24]
add edi, esi
mov dword [ebp - 0x38], edi
mov edx, dword [ebx + esi + 0x20]
add edx, esi
mov dword [ebp - 0x2c], edx
mov edx, dword [ebx + esi + 0x18]
mov dword [ebp - 0x20], edx
mov edx, dword [ebx + esi + 0x14]
mov dword [ebp - 0x24], edx
mov edx, ecx
mov dword [ebp - 0x34], edx
cmp edx, dword [ebp - 0x20]
jae 0x1099e06
movsx edi, word [edi + edx*2]
cmp edi, dword [ebp - 0x24]
jae 0x1099def
mov eax, dword [ebp - 0x28]
mov edi, dword [eax + edi*4]
cmp edi, ebx
mov eax, dword [ebp - 0x1c]
jb 0x1099d9f
mov eax, dword [eax + 0x7c]
add eax, ebx
cmp edi, eax
jb 0x1099de9
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + edx*4]
add eax, esi
mov cl, byte [eax]
mov byte [ebp + 0xb], cl
cmp cl, byte [ebx]
push 0
pop ecx
jne 0x1099dd8
cmp byte [ebp + 0xb], cl
je 0x1099dd4
mov cl, byte [eax + 1]
mov byte [ebp + 0xb], cl
cmp cl, byte [ebx + 1]
push 0
pop ecx
jne 0x1099dd8
add eax, 2
add ebx, 2
cmp byte [ebp + 0xb], cl
jne 0x1099daa
mov eax, ecx
jmp 0x1099ddd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1099de6
lea ecx, [edi + esi]
jmp 0x1099e03
mov ebx, dword [ebp - 0x30]
inc edx
mov edi, dword [ebp - 0x38]
jmp 0x1099d74
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x1099e0f
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0109a33a
ret 8

Function at 0x10ebdad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push dword [esi + 0x14]
call dword [0x1002e08c]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
test ebx, ebx
jg 0x10ebdee
lea eax, [ebp - 0x30]
push eax
call dword [0x1002e088]
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
mov eax, 1
cmove ebx, eax
test ebx, ebx
jle 0x10ebe75
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x100016e0
push 0
push 0
call fcn.010faa4e
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x10ebe6d
cmp edi, 0xffffffff
je 0x10ebe6d
mov eax, dword [esi + 8]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x10ebe4f
mov ecx, dword [esi + 4]
lea edx, [ebp - 4]
cmp ecx, edx
ja 0x10ebe4f
mov edi, edx
sub edi, ecx
sar edi, 2
cmp eax, dword [esi + 0xc]
jne 0x10ebe3e
push ecx
lea ecx, [esi + 4]
call fcn.010f2aed
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10ebe66
mov eax, dword [esi + 4]
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
jmp 0x10ebe66
cmp eax, dword [esi + 0xc]
jne 0x10ebe5d
push ecx
lea ecx, [esi + 4]
call fcn.010f2aed
mov eax, dword [esi + 8]
test eax, eax
je 0x10ebe66
mov dword [eax], edi
add dword [esi + 8], 4
mov esi, dword [ebp - 8]
dec ebx
jne 0x10ebdef
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10ef5fd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x1003b180
mov esi, ecx
call dword [0x1002e0a8]
cmp dword [0x1003a178], 0xffffffff
je 0x10ef67c
cmp dword [0x1003a17c], 0xffffffff
jne 0x10ef67c
test esi, esi
je 0x10ef67c
push dword [0x1003a16c]
mov dword [0x1003b064], esi
mov esi, dword [0x1002e08c]
call esi
push dword [0x1003a168]
call esi
push dword [0x1003a164]
call esi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x100037a0
push 0
push 0
call fcn.010faa4e
add esp, 0x18
test eax, eax
jne 0x10ef691
push dword [0x1003a168]
call dword [0x1002e084]
mov dword [0x1003a17c], 0xffffffff
push 0x1003b180
or esi, 0xffffffff
call dword [0x1002e0a0]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [0x1003a164]
mov dword [0x1003a17c], eax
call dword [0x1002e080]
push 0x1003b180
xor esi, esi
call dword [0x1002e0a0]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x18077b4
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
xor eax, eax
push 4
push eax
push 0x1000ae3a
push eax
mov esi, ecx
push eax
call fcn.018672af
add esp, 0x18
mov dword [esi + 0x34], eax
pop esi
pop ecx
ret

Function at 0x180e53d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1006ad14
call fcn.018670b8
push ecx
push ebx
push esi
mov esi, ecx
push 4
mov dword [ebp - 0x10], esi
or dword [esi], 0xffffffff
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.0180e379
mov dword [ebx], 0x100717d0
xor ebx, ebx
mov dword [esi + 0x28], 4
mov dword [ebp - 4], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x18], 0x100717e8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [esi + 0x2c], 1
call fcn.0180e644
lea ecx, [esi + 0x8c]
mov byte [esi + 0x88], bl
push 3
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea ecx, [esi + 0x9c]
mov byte [esi + 0x98], bl
mov byte [esi + 0x99], bl
push 3
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea ecx, [esi + 0xac]
mov byte [esi + 0xa8], bl
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], bl
push 3
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea ecx, [esi + 0xb8]
push 3
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xc4]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 8
mov dword [eax], 0x100717e0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x180e644
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1006ad5f
call fcn.018670b8
push ecx
push ebx
push esi
push edi
push 3
mov esi, ecx
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.01807124
lea ecx, [esi + 0xc]
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea ecx, [esi + 0x18]
push edi
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea ecx, [esi + 0x24]
push edi
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], bl
push edi
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1810d8c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1006b216
call fcn.018670b8
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 3
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.01807124
lea edi, [esi + 0x24]
push 3
mov ecx, edi
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.01807124
push 0x100874c0
mov ecx, edi
mov byte [ebp - 4], 1
mov byte [esi], bl
mov dword [esi + 4], 0x10084850
call fcn.01806c56
mov ecx, esi
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call fcn.0181104d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x181b3f6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006bf1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100720a0
mov dword [esi + 4], 0x10072090
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.01818e8e
lea eax, [esi + 0x6ff8]
mov dword [esi + 0x6fe4], edi
push eax
mov dword [esi + 0x6ff4], edi
call fcn.01866c60
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword [esi + 0x7020], edi
mov dword [esi + 0x6fec], edi
mov dword [esi + 0x6ff0], edi
mov dword [esi + 0x7010], eax
mov byte [esi + 0x6fe0], al
mov dword [esi], 0x10072078
mov dword [esi + 4], 0x10072068
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x181e520
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.0181dbe0
push 0x41
mov ecx, esi
call fcn.0181dbe0
push 0x59
mov ecx, esi
call fcn.0181dbe0
push 0x26
mov ecx, esi
call fcn.0181dbe0
push 0x53
mov ecx, esi
call fcn.0181dbe0
push 0x59
mov ecx, esi
call fcn.0181dbe0
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x181e5b0
test cl, cl
jbe 0x181e5ac
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x10087ef0]
xor eax, edi
dec ecx
jne 0x181e596
xor edi, edi
jmp 0x181e5df
cmp bl, cl
jne 0x181e5b7
inc edi
jmp 0x181e5c2
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x10087ef0]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x181e56e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.0181dc20
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.0181dd20
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x181e7f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x16c]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.0181e620
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x198], bl
je 0x181e86d
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x174]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
push ecx
call fcn.01866ad0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x181e8aa
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x170
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x181e87f
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.0181e980
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x198], bl
je 0x181e969
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x194]
inc edi
cmp edi, ecx
jne 0x181e8f5
xor edi, edi
cmp dword [eax + 0x1ac], ebx
je 0x181e945
lea ebx, [eax + 0x138]
mov ecx, ebx
call fcn.0181a4f5
mov ebp, dword [ebx + 0x28]
mov ecx, 0xf
sub ecx, ebp
xor ebx, ebx
shr ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1ac]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x174]
sub ecx, edi
shl ecx, 9
lea eax, [edx + ecx + 0x8cf0]
push eax
call fcn.01866b40
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x182adba
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1006cb07
call fcn.018670b8
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x10072a64
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x10072a5c
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
push 3
mov byte [ebp - 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.01807124
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret