joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb1518c
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
lea ebx, [ebp - 8]
mov eax, dword [0xb6d3ac]
mov dword [ebx], eax
mov eax, dword [0xb6d3b0]
mov dword [ebx + 4], eax
call fcn.00b1500c
xor eax, dword [ebx]
xor edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebp - 0xc], 0xb6d3b8
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x143]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 4], eax
push 0
call sub.kernel32.dll_Sleep_1
call fcn.00b1500c
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov dword [ebx], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0xb1523c
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x143]
xor ecx, ecx
mov edx, 0x103
call fcn.00a1377c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x143]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0xb1528f
lea eax, [ebp - 0x143]
mov edx, dword [ebp - 0x10]
call fcn.00b15150
xor edx, edx
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x38]
mov dword [ebx], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 4], eax
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x143]
xor ecx, ecx
mov edx, 0x103
call fcn.00a1377c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x143]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0xb152e2
lea eax, [ebp - 0x143]
mov edx, dword [ebp - 0x10]
call fcn.00b15150
xor edx, edx
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x40]
mov dword [ebx], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 4], eax
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
xor eax, dword [ebx]
xor edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebx]
call fcn.00b14f90
mov dword [ebx], eax
mov eax, dword [ebx + 4]
call fcn.00b14fb0
mov dword [ebx + 4], eax
mov eax, dword [ebx]
mov dword [0xb6d3b8], eax
mov eax, dword [ebx + 4]
mov dword [0xb6d3bc], eax
mov byte [0xb6d3b4], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb160f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0xb161cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.00b16098
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
mov edx, esi
call fcn.00a150e4
mov edx, dword [ebp - 0x14]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00b15dc8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00a14e60
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
mov edx, esi
call fcn.00a150e4
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.00b15eb8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00a14e60
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00a15424
mov esi, ebx
test esi, esi
jle 0xb161a7
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00a152f0
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0xb16189
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00a14e1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb161d4
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00a14dec
ret
Function at 0xb17828
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, edx
cmp ebx, 0x80
jle 0xb17856
push 0xb17980
mov ecx, 2
mov dl, 1
mov eax, dword [0xb17710]
call fcn.00b17764
call fcn.00a1473c
cmp ebx, 1
jge 0xb17876
push 0xb179a8
mov ecx, 2
mov dl, 1
mov eax, dword [0xb17710]
call fcn.00b17764
call fcn.00a1473c
cmp dword [ebp - 4], 0
jle 0xb17885
cmp dword [ebp - 4], 0x400
jle 0xb178a0
push 0xb179cc
mov ecx, 3
mov dl, 1
mov eax, dword [0xb17710]
call fcn.00b17764
call fcn.00a1473c
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.00a12f0c
mov edx, ebx
cmp edx, 0x7f
jg 0xb178dd
mov eax, dword [ebp + 8]
lea eax, [eax + edx - 1]
mov ecx, edx
sub ecx, ebx
mov esi, dword [ebp + 8]
mov cl, byte [esi + ecx]
add cl, byte [eax]
and ecx, 0xff
mov cl, byte [ecx + 0xb6d900]
mov byte [eax + 1], cl
inc edx
inc eax
cmp edx, 0x80
jne 0xb178b8
mov ebx, dword [ebp - 4]
add ebx, 7
test ebx, ebx
jns 0xb178ea
add ebx, 7
sar ebx, 3
mov ecx, dword [ebp - 4]
add ecx, 8
xor eax, eax
mov al, bl
shl eax, 3
sub ecx, eax
mov eax, 1
shl eax, cl
push eax
mov eax, 0xff
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov eax, edx
mov esi, ebx
and esi, 0xff
mov edx, 0x80
sub edx, esi
mov ecx, dword [ebp + 8]
and al, byte [ecx + edx]
and eax, 0xff
mov ecx, dword [ebp + 8]
mov al, byte [eax + 0xb6d900]
mov byte [ecx + edx], al
mov edx, 0x7f
sub edx, esi
cmp edx, 0
jl 0xb1796f
mov eax, dword [ebp + 8]
lea eax, [eax + edx + 1]
xor ecx, ecx
mov cl, bl
add ecx, edx
mov esi, dword [ebp + 8]
mov cl, byte [esi + ecx]
xor cl, byte [eax]
and ecx, 0xff
mov cl, byte [ecx + 0xb6d900]
mov byte [eax - 1], cl
dec edx
dec eax
cmp edx, 0xffffffff
jne 0xb1794b
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0xb18200
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0xb6da00
mov al, byte [ebx]
dec eax
xor edx, edx
mov dl, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0xb1827b
mov eax, esi
and eax, 0x8000001f
jns 0xb1825a
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0xb18271
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x38
jne 0xb18225
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0xb18288
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0xb6da48
mov al, byte [ebx]
dec eax
xor edx, edx
mov dl, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0xb18303
mov eax, esi
and eax, 0x8000001f
jns 0xb182e2
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0xb182f9
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x30
jne 0xb182ad
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb18a48
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], eax
lea esi, [esp + 8]
mov edi, 0xb6de48
mov byte [esp + 4], 4
mov ebp, dword [esp]
add ebp, 2
mov cl, 4
mov edx, ebp
mov eax, edx
mov dword [esi], eax
mov eax, dword [esi]
movzx eax, byte [eax]
mov al, byte [edi + eax]
mov ebx, dword [esi]
mov byte [ebx], al
inc edx
dec cl
jne 0xb18a6a
add ebp, 4
dec byte [esp + 4]
jne 0xb18a66
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18a90
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], eax
lea esi, [esp + 8]
mov edi, 0xb6df48
mov byte [esp + 4], 4
mov ebp, dword [esp]
add ebp, 2
mov cl, 4
mov edx, ebp
mov eax, edx
mov dword [esi], eax
mov eax, dword [esi]
movzx eax, byte [eax]
mov al, byte [edi + eax]
mov ebx, dword [esi]
mov byte [ebx], al
inc edx
dec cl
jne 0xb18ab2
add ebp, 4
dec byte [esp + 4]
jne 0xb18aae
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18be0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb18c03
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
mov dl, byte [esi]
mov al, 2
call fcn.00b18ba4
push eax
mov ebp, ebx
and ebp, 0xff
mov eax, ebp
inc eax
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 3
call fcn.00b18ba4
pop edx
xor dl, al
mov eax, ebp
add eax, 2
and eax, 3
xor dl, byte [esp + eax + 4]
add ebp, 3
and ebp, 3
xor dl, byte [esp + ebp + 4]
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb18c1b
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb18bf9
lea eax, [esp + 4]
mov edx, 4
call fcn.00b177a8
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb18c84
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb18ca7
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
mov dl, byte [esi]
mov al, 0xe
call fcn.00b18ba4
push eax
mov ebp, ebx
and ebp, 0xff
mov eax, ebp
inc eax
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 0xb
call fcn.00b18ba4
pop edx
xor dl, al
push edx
mov eax, ebp
add eax, 2
and eax, 3
mov dl, byte [esp + eax + 8]
mov al, 0xd
call fcn.00b18ba4
pop edx
xor dl, al
push edx
add ebp, 3
and ebp, 3
mov dl, byte [esp + ebp + 8]
mov al, 9
call fcn.00b18ba4
pop edx
xor dl, al
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb18cbf
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb18c9d
lea eax, [esp + 4]
mov edx, 4
call fcn.00b177a8
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb18d58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x10]
mov byte [esp + 0xc], 0
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0x14], eax
xor eax, eax
mov al, byte [esp + 0xc]
add eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov esi, eax
mov eax, esi
mov dword [ebp], eax
mov edx, edi
mov eax, ebx
call fcn.00b18d44
mov edx, dword [ebp]
xor byte [edx], al
inc ebx
add esi, 4
cmp bl, 4
jne 0xb18d96
inc byte [esp + 0xc]
inc dword [esp + 0x14]
cmp byte [esp + 0xc], 4
jne 0xb18d7d
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb19f34
Capabilities:
Encode data using xor

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, ecx
dec eax
test eax, eax
jl 0xb19f5b
inc eax
mov edx, dword [esp + 4]
mov dl, byte [edx]
mov ecx, dword [esp]
xor byte [ecx], dl
inc dword [esp]
inc dword [esp + 4]
dec eax
jne 0xb19f46
pop ecx
pop edx
ret
Function at 0xb1a168
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a171
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a1fa
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp + ebx - 0x200d], al
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a1a6
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b177a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb1a210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a219
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x2014]
mov eax, dword [ebp + 0xc]
mov ecx, esi
call fcn.00a12f0c
cmp dword [ebp - 0x14], 0
jl 0xb1a2b1
lea edx, [ebp - 0x1014]
lea eax, [ebp - 0x2014]
mov ecx, esi
call fcn.00a12f0c
lea edx, [ebp - 0x1014]
mov ecx, esi
mov eax, dword [ebp - 0xc]
call dword [ebp + 0x14]
mov ecx, esi
dec ecx
lea edx, [ebp - 0x2014]
lea eax, [ebp - 0x2013]
call fcn.00a12f0c
mov eax, dword [ebp - 0x10]
mov bl, byte [eax]
mov byte [ebp + esi - 0x2015], bl
xor bl, byte [ebp - 0x1014]
mov eax, dword [ebp - 0x10]
mov byte [eax], bl
dec dword [ebp - 0x14]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x14], 0
jge 0xb1a259
lea eax, [ebp - 0x1014]
mov edx, esi
call fcn.00b177a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb1a2c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a2d1
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a35b
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov al, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a306
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b177a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb1a370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb1a379
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a12f0c
test esi, esi
jl 0xb1a403
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a12f0c
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a12f0c
mov al, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x100c]
xor byte [eax], dl
dec esi
inc dword [ebp - 0xc]
test esi, esi
jge 0xb1a3ae
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b177a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb3a4d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb3a4dd
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb3a9a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
lea eax, [ebp - 0x18]
call fcn.00a14dc8
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb090ec]
call fcn.00b0b064
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0xb3a977
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0b150
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb3a4d0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb3a4b4
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb3a4b8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
mov dl, byte [0xb3a9b8]
call fcn.00b0a524
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00aeccb8
test al, al
je 0xb3a5b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a9bc
jmp 0xb3a5c2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0aa3c
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b0aabc
xor eax, eax
push ebp
push 0xb3a629
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0a97c
jmp 0xb3a611
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a779e8
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb3a61f
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb3a5f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb3a633
call fcn.01780d20
loop 0xb3a693
movsb byte es:[edi], byte [esi]
popal
fiadd word [edi]
push ebp
cmp al, 0x6d
in al, dx
push ecx
sbb dword [edi + 0xeedcd4c], 0x457153bd
and cl, dh
shr dword [edx], cl
ljmp 0x1ebf
dec ebp
mov eax, 0x3a907daa
outsb dx, byte [esi]
leave
xchg dword [ebx + 0x18659a76], ebp
call 0x9dd7c13c
push ebp
and dl, byte [ebx - 0x4d]
outsd dx, dword [esi]
dec edx
mov bh, 0x9f
mov dl, byte [ebp + 0x64]
pop esi
cwde
retf
jo 0xb3a660
xor al, 0xba
cmpsb byte [esi], byte es:[edi]
fst dword [ecx + 0x2487be66]
fsub dword [0xaf8026a9]
in eax, 0xbb
xchg edx, eax
cmp byte [ebp + esi*2 - 0x7c46def1], 0xa9
js 0xb3a701
sbb byte [esi], dh
pop eax
lahf
pop esp
and cl, al
wait
push ds
in al, dx
ret
wait
add esi, eax
jmp esi
Function at 0xb4dbb4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0x40
call fcn.00b4d3f0
test al, al
jne 0xb4dbf0
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb4
mov dword [esi], 1
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a4d
je 0xb4dc12
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb4
mov dword [esi], 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, 0xf8
cdq
push edx
push eax
call fcn.00b4d3f0
test al, al
jne 0xb4dc41
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb4
mov dword [esi], 3
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0xb4dc7b
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb4
mov dword [esi], 4
mov eax, dword [ebp - 0x10]
cmp word [eax + 4], 0x14c
je 0xb4dc9b
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb4
mov dword [esi], 5
mov eax, dword [ebp - 0x10]
test byte [eax + 0x38], 1
je 0xb4dcb9
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfb4
mov dword [esi], 6
xor eax, eax
push ebp
push 0xb4df9f
push dword fs:[eax]
mov dword fs:[eax], esp
pushfd
call fcn.017794cb
std
pushfd
mov al, 0xb7
push 0xffffffffffffffbc
pop es
mov al, 0x6a
mov edx, 0x4b32359e
xchg ebp, eax
nop
cmpsd dword [esi], dword es:[edi]
mov dl, 0x6a
cmpsb byte [esi], byte es:[edi]
push edi
lodsb al, byte [esi]
mov bh, 0x6a
out 0x3e, al
mov ecx, 0x9a6ab184
and cl, byte [ebp - 0x6b]
and byte [edi - 0x5e], ch
dec ebp
xchg ebp, eax
add edx, 0x54
outsd dx, dword [esi]
mov byte [0xc283954d], al
push esp
dec ecx
xchg ebp, eax
jns 0xb4dcf6
push cs
and byte [ecx - 0x6b], cl
pop edi
popfd
dec ecx
xchg ebp, eax
xor eax, 0xbaa050c9
push 0x5a
mov al, 0xbd
cli
xchg esi, eax
les ebx, [ebx]
add al, byte [esp + edi*8]
sal edx, 0xea
xchg esp, eax
pop edx
add eax, 0xc4ec4cfc
pop edi
and eax, 0xab151654
mov edx, 0x7aaf3cdd
das
aas
mov edx, 0x37c5591e
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0xb576ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.01814058
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0xb74334]
sub eax, dword [edx]
cmp eax, 0x1b7740
jb 0xb57717
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0xb74334]
mov dword [edx], eax
call fcn.00ad0b58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb57759
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.00a14dec
lea eax, [ebp - 0xcc]
mov edx, 2
call fcn.00a15538
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00a14dec
ret