joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bd220
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ecx + 8]
push esi
push ebx
mov ebx, ecx
lea esi, [ebx + 0x2c]
sub esp, 0x2c
mov dword [ecx], method.0RIPEMD_128E.virtual_0
mov dword [ecx + 4], 0x70cbf0
mov ecx, edi
mov dword [esp], 0x40
call fcn.005afd30
mov eax, 0x101
mov dword [ebx + 0x28], 8
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov word [ebx + 0x24], ax
mov dword [ebx], 0x70e414
mov dword [ebx + 4], 0x70e44c
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x30], 0
mov dword [esp], 1
call fcn.0047cd10
mov dword [ebx + 0x38], eax
mov ecx, esi
mov dword [esp], 5
call fcn.005af370
sub esp, 4
mov dword [ebx + 0x3c], 0
lea eax, [ebx + 0x3c]
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x40], 0
mov dword [esp], 1
mov dword [ebp - 0x1c], eax
call fcn.0047cd10
mov dword [ebx + 0x48], eax
lea ecx, [ebx + 0x3c]
mov dword [esp], 0x50
call fcn.005af370
mov eax, dword [ebx + 0xc]
sub esp, 4
test eax, eax
jne 0x5bd350
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
test eax, eax
jne 0x5bd370
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
jmp 0x5bd307
mov edx, dword [ebx + 0x3c]
shl eax, 2
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], edx
call sub.msvcrt.dll_memset
jmp 0x5bd323

Function at 0x5bd630
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ecx + 8]
push ebx
mov ebx, ecx
lea edi, [ebx + 0x2c]
sub esp, 0x2c
mov dword [ecx], method.0RIPEMD_128E.virtual_0
mov dword [ecx + 4], 0x70cbf0
mov ecx, esi
mov dword [esp], 0x40
call fcn.005afd30
mov eax, 0x101
mov dword [ebx + 0x28], 8
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov word [ebx + 0x24], ax
mov dword [ebx], 0x70e4b4
mov dword [ebx + 4], 0x70e4ec
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x30], 0
mov dword [esp], 1
call fcn.0047cd10
mov dword [ebx + 0x38], eax
mov ecx, edi
mov dword [esp], 8
call fcn.005af370
mov eax, dword [ebx + 0xc]
sub esp, 4
test eax, eax
jne 0x5bd730
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
jmp 0x5bd6d4
Function at 0x5bd890
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ecx + 8]
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [ecx], method.0RIPEMD_128E.virtual_0
mov dword [ecx + 4], 0x70cbf0
mov ecx, esi
mov dword [esp], pe_nt_image_headers32
call fcn.005afd30
mov eax, 0x101
mov dword [ebx + 0x28], 0x10
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov word [ebx + 0x24], ax
mov dword [ebx], 0x70e504
mov dword [ebx + 4], 0x70e53c
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x30], 0
mov dword [esp], 1
call fcn.0047cd10
mov edx, dword [ebx + 0x34]
mov dword [ebx + 0x38], eax
cmp edx, 7
jbe 0x5bd9e0
cmp dword [ebx + 0x30], 8
mov eax, 8
cmovbe eax, dword [ebx + 0x30]
sub edx, eax
jne 0x5bda70
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x30], 8
test eax, eax
jne 0x5bda54
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [eax]
mov ecx, eax
mov dword [esp], 0x40
call dword [edx]
mov edi, eax
mov eax, dword [ebx + 0x30]
sub esp, 4
mov dword [esp], edi
shl eax, 3
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memmove
mov ecx, dword [ebx + 0x38]
test ecx, ecx
je 0x5bda38
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x1c], edx
test edx, edx
je 0x5bda38
test eax, eax
je 0x5bda38
shl eax, 3
mov edx, dword [ecx]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [edx + 4]
sub esp, 8
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], 8
mov dword [ebx + 0x34], 8
test eax, eax
je 0x5bd94c
mov edx, dword [ebx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
jmp 0x5bd94c
mov ecx, dword [ebx + 0x2c]
shl edx, 3
mov dword [esp + 4], 0
mov dword [esp + 8], edx
lea eax, [ecx + eax*8]
mov dword [esp], eax
call sub.msvcrt.dll_memset
jmp 0x5bd93a
Function at 0x5bdbd0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ecx + 8]
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [ecx], method.0RIPEMD_128E.virtual_0
mov dword [ecx + 4], 0x70cbf0
mov ecx, esi
mov dword [esp], pe_nt_image_headers32
call fcn.005afd30
mov eax, 0x101
mov dword [ebx + 0x28], 0x10
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov word [ebx + 0x24], ax
mov dword [ebx], 0x70e554
mov dword [ebx + 4], 0x70e58c
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x30], 0
mov dword [esp], 1
call fcn.0047cd10
mov edx, dword [ebx + 0x34]
mov dword [ebx + 0x38], eax
cmp edx, 7
jbe 0x5bdd20
cmp dword [ebx + 0x30], 8
mov eax, 8
cmovbe eax, dword [ebx + 0x30]
sub edx, eax
jne 0x5bddb0
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x30], 8
test eax, eax
jne 0x5bdd94
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [eax]
mov ecx, eax
mov dword [esp], 0x40
call dword [edx]
mov edi, eax
mov eax, dword [ebx + 0x30]
sub esp, 4
mov dword [esp], edi
shl eax, 3
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp + 4], eax
call sub.msvcrt.dll_memmove
mov ecx, dword [ebx + 0x38]
test ecx, ecx
je 0x5bdd78
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x1c], edx
test edx, edx
je 0x5bdd78
test eax, eax
je 0x5bdd78
shl eax, 3
mov edx, dword [ecx]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [edx + 4]
sub esp, 8
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], 8
mov dword [ebx + 0x34], 8
test eax, eax
je 0x5bdc8c
mov edx, dword [ebx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
jmp 0x5bdc8c
mov ecx, dword [ebx + 0x2c]
shl edx, 3
mov dword [esp + 4], 0
mov dword [esp + 8], edx
lea eax, [ecx + eax*8]
mov dword [esp], eax
call sub.msvcrt.dll_memset
jmp 0x5bdc7a
Function at 0x5be320
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], edx
cmp edx, 7
jbe 0x5be37d
lea esi, [edx - 8]
shr esi, 3
lea ebp, [esi*8 + 8]
xor esi, esi
nop
lea esi, [esi]
mov ebx, dword [esp + 0x28]
mov edi, dword [ecx + esi]
xor edi, dword [ebx + esi]
mov dword [eax + esi], edi
mov edi, dword [ecx + esi + 4]
xor edi, dword [ebx + esi + 4]
mov dword [eax + esi + 4], edi
add esi, 8
cmp esi, ebp
jne 0x5be350
add dword [esp + 0x28], esi
add eax, esi
add ecx, esi
and dword [esp + 4], 7
mov edx, dword [esp + 4]
test edx, edx
je 0x5be418
lea esi, [ecx + 4]
lea ebp, [eax + 4]
cmp eax, esi
setae bl
cmp ecx, ebp
mov edi, ebx
setae bl
mov esi, ebx
mov ebx, dword [esp + 0x28]
or esi, edi
lea edi, [ebx + 4]
cmp eax, edi
setae bl
cmp dword [esp + 0x28], ebp
mov edi, ebx
setae bl
mov ebp, ebx
or edi, ebp
mov ebp, dword [esp + 4]
and esi, edi
lea edi, [ebp - 1]
cmp edi, 3
seta bl
mov edi, ebx
mov ebx, esi
mov edx, edi
test bl, dl
je 0x5be420
mov esi, dword [esp + 0x28]
or esi, ecx
or esi, eax
and esi, 3
jne 0x5be420
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov esi, dword [ebx]
xor esi, dword [ecx]
mov dword [eax], esi
movzx ebx, byte [ecx + 4]
xor bl, byte [edx + 4]
mov byte [eax + 4], bl
cmp ebp, 5
je 0x5be418
mov ebx, dword [esp + 0x28]
movzx edx, byte [ecx + 5]
xor dl, byte [ebx + 5]
mov byte [eax + 5], dl
cmp ebp, 6
je 0x5be418
movzx ecx, byte [ecx + 6]
xor cl, byte [ebx + 6]
mov byte [eax + 6], cl
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x28]
movzx edx, byte [ecx]
xor dl, byte [ebx]
mov ebx, dword [esp + 4]
mov byte [eax], dl
cmp ebx, 1
je 0x5be418
mov edi, dword [esp + 0x28]
movzx edx, byte [ecx + 1]
xor dl, byte [edi + 1]
mov byte [eax + 1], dl
cmp ebx, 2
je 0x5be418
movzx edx, byte [ecx + 2]
xor dl, byte [edi + 2]
mov byte [eax + 2], dl
cmp ebx, 3
je 0x5be418
movzx edx, byte [ecx + 3]
xor dl, byte [edi + 3]
mov byte [eax + 3], dl
cmp ebx, 4
je 0x5be418
movzx edx, byte [ecx + 4]
xor dl, byte [edi + 4]
mov byte [eax + 4], dl
cmp ebx, 5
je 0x5be418
movzx edx, byte [ecx + 5]
xor dl, byte [edi + 5]
mov byte [eax + 5], dl
cmp ebx, 6
je 0x5be418
movzx ecx, byte [ecx + 6]
xor cl, byte [edi + 6]
mov byte [eax + 6], cl
jmp 0x5be418
Function at 0x5be490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp esi, 7
jbe 0x5be561
lea edx, [esi - 8]
shr edx, 3
lea edi, [edx*8 + 8]
mov edx, ebx
lea ecx, [eax + edi]
nop
lea esi, [esi]
mov ebp, dword [edx]
xor dword [eax], ebp
add edx, 8
mov ebp, dword [edx - 4]
xor dword [eax + 4], ebp
add eax, 8
cmp eax, ecx
jne 0x5be4c0
add ebx, edi
and esi, 7
test esi, esi
je 0x5be52c
lea eax, [ecx + 4]
lea edx, [ebx + 4]
cmp ebx, eax
setae al
cmp ecx, edx
setae dl
or eax, edx
lea edx, [esi - 1]
cmp edx, 2
seta dl
test al, dl
je 0x5be531
mov eax, ebx
or eax, ecx
test al, 3
jne 0x5be531
mov eax, dword [ebx]
xor dword [ecx], eax
cmp esi, 4
je 0x5be52c
movzx eax, byte [ebx + 4]
xor byte [ecx + 4], al
cmp esi, 5
je 0x5be52c
movzx eax, byte [ebx + 5]
xor byte [ecx + 5], al
cmp esi, 6
je 0x5be52c
movzx eax, byte [ebx + 6]
xor byte [ecx + 6], al
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx]
xor byte [ecx], al
cmp esi, 1
je 0x5be52c
movzx eax, byte [ebx + 1]
xor byte [ecx + 1], al
cmp esi, 2
je 0x5be52c
movzx eax, byte [ebx + 2]
xor byte [ecx + 2], al
cmp esi, 3
je 0x5be52c
movzx eax, byte [ebx + 3]
xor byte [ecx + 3], al
cmp esi, 4
jne 0x5be50d
jmp 0x5be52c
mov ecx, eax
jmp 0x5be4d9
Function at 0x5d6650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x6fbde5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x6fbe49]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0057aae8
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.00669c60
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x6c6bd0], 0
jne 0x5d6776
mov byte [0x6c6bd0], 1
call fcn.00674690
test eax, eax
je 0x5d6744
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0057a8d0
mov dword [esp], 2
mov esi, dword [fcn.00585f10]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x5d6734
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6faf4d
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x6a1874
jmp 0x6a186c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x5d66fa
mov dword [esp], 2
call dword [0x6c5144]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x6a1867
mov dword [esp], 2
call dword [0x6c5144]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x70ed5c
call fcn.00667660
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.00674250
add esp, 0x18
pop ebx
ret
Function at 0x6a1580
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00585f10
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00585f10
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x410414
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x410423
pop dword [ebp - 0x44]
mov eax, 0x8ddaa39e
sub eax, 0x8d999f7b
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x9be60153
sub dword [ebp - 0x54], 0x4d93bc08
mov dword [ebp - 0x50], 0xa3214ecf
add dword [ebp - 0x50], 0x8f11fd76
mov dword [ebp - 0x4c], 0x78be9f3
add dword [ebp - 0x4c], 0x44c05a3b
mov dword [ebp - 0x48], 0x78adf3f5
add dword [ebp - 0x48], 0x87520c0b
lea eax, [ebp - 0x54]
push eax
mov eax, 0x106a50a8
sub eax, 0x10282034
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x2f3e1b3a
add dword [ebp - 0x54], 0x45344e1c
mov dword [ebp - 0x50], 0xb3595054
sub dword [ebp - 0x50], 0x71eceedf
mov dword [ebp - 0x4c], 0x403832a8
add dword [ebp - 0x4c], 0x233739c4
mov dword [ebp - 0x48], 0x1cc2e549
add dword [ebp - 0x48], 0xe33d1ab7
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3e03e
push 0
call eax
mov ecx, 0xdf554925
add ecx, 0x20aafff5
mov edi, eax
mov ebx, 0x5a8a23db
add ebx, 0xa5b92025
add ebx, dword [ebp - 0x44]
mov edx, 0x12fd8ed5
add edx, 0x80d14f9c
mov dword [ebp - 0x1c], 0x2441f05f
mov esi, dword [ebx]
xor dword [ebp - 0x20], 0xb6cff8ce
xor esi, edx
mov dword [ebp - 4], 0x10404b01
mov dword [edi], esi
sub dword [ebp - 0x2c], 0x2fc4acff
add edi, 0x6e6f81e2
add edi, 0x91907e22
add ebx, 0x53f15702
sub ebx, 0x53f156fe
loop 0x410540
add eax, 0x7492945d
add eax, 0x8b6e82de
mov ebx, eax
add eax, 5
mov ecx, 0x49cf03ca
sub ecx, 0x498f03ca
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x404a4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x404a5d
pop dword [ebp - 0x30]
mov eax, 0x88ac6947
sub eax, 0x886c1eea
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3d589
push 0
mov eax, 0x437ff1e5
add eax, 0xbcc26033
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xd2ac565
sub ecx, 0xd2a7f40
mov esi, eax
mov edx, 0x435400
add edx, dword [ebp - 0x30]
mov ebx, 0x316790a5
mov dword [ebp - 0x20], 0xfa5ea122
mov edi, dword [edx]
mov dword [ebp - 0x20], 0x7db7984b
sub edi, ebx
xor dword [ebp - 8], 0xe7e4b0fb
mov dword [esi], edi
add esi, 0xa739f994
add esi, 0x58c60670
add edx, 0x2e69680c
sub edx, 0x2e696808
loop 0x404ab0
add eax, 0x1344bcb2
add eax, 0xecbc4eb5
mov ebx, eax
add eax, 0x921d944e
sub eax, 0x921d9449
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001f0c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002f130]
jne 0x10001f16
repz ret
jmp fcn.100021bd

Function at 0x10002750
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1002f110], 0
mov byte [0x1002f114], 0
mov dword [0x1002f104], 0x7e8
mov dword [0x1002f10c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x100027ab
mov dword [0x1002f10c], 0
jmp 0x100027dd
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1002f108], 0x126
mov eax, dword [0x1002f10c]
add eax, 1
mov dword [0x1002f10c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100027ab
jmp 0x10002797
mov eax, 0x100
mov dword [0x1002f118], 0
mov ecx, dword [0x1002f110]
mov edx, dword [0x1002f10c]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x20], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x1002f118], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x20]
idiv edi
mov dword [0x1002f110], edx
mov dword [0x1002f104], 0x1c92
mov ecx, dword [0x1002f10c]
mov bl, byte [esi + ecx]
mov byte [0x1002f114], bl
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x1002f114]
mov ecx, dword [0x1002f110]
mov byte [esi + ecx], bl
mov ecx, dword [0x1002f10c]
add ecx, 1
mov dword [0x1002f10c], ecx
cmp ecx, 0x100
jl 0x100027dd
jmp 0x100027a3

Function at 0x10002c60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.10002c60]
mov ecx, 0x20fb
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10002c79
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [ecx], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x10002cab
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10002cab
mov eax, dword [ebp - 0xc]
mov dword [0x1002f104], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret
mov eax, 0x207e
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
jmp 0x10002c79
Function at 0x10002cd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [0x1002f108], 0x1aa4
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1002f104], 0x82f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x10002d23
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [0x1002f104], ecx
add esp, 0x24
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x10002d66
jmp 0x10002d4f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10002d7d
jmp 0x10002e04
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
jl 0x10002d23
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
je 0x10002d3b
jmp 0x10002e04
mov dword [0x1002f104], 0x1ebc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10002e04
mov dword [0x1002f104], 0x716
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10002e04
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10002e04
mov dword [0x1002f104], 0x90f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10002e04
mov eax, 0x1f9
mov ecx, 1
mov dword [0x1002f108], 0x201d
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x28]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
je 0x10002d11
xor eax, eax
mov ecx, dword [0x1002f104]
add ecx, 0x544
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x10002d11