joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dce80
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
not di
jmp 0x5dcd01
jmp 0x5dce61
lea esp, [esp + 4]
jle 0x5aecb8
mov dh, byte [esp]
jmp 0x5dccb5
lea ecx, [esi + 8]
jmp 0x5aeca2
bswap edx
lea edx, [esi + ebx*4 + 8]
mov edi, 0xc48b3269
lea eax, [ebx*4]
mov ecx, dword [esp]
jmp 0x5dcc9f
add dword [ebp - 4], 4
cmc
sub esp, 6
mov dword [esp], eax
lea esp, [esp + 2]
jmp 0x5dcd0e
add esp, 0
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x5dcccc
mov eax, dword [edx - 8]
mov edi, dword [esp]
mov edi, dword [ecx - 8]
push si
jmp 0x5dcce2
mov dword [ecx - 8], eax
pushal
clc
bsr ax, ax
mov al, 0x22
jmp 0x5dcd20
push ecx
jmp 0x5dd634
cmp eax, 1
call 0x5dce80
test al, 0x20
mov dh, 0xd1
and dh, ah
salc
pop ebp
int 0x94
shr dword [si], cl
aas
push es
mov cl, 0xb0
pushal
call fcn.005dce55
push dword [esp]
lea esp, [esp + 8]
jle 0x5aece4
neg bl
jmp 0x5dcede
mov ebx, edx
mov bx, 0x4d22
jmp 0x5dcebb
mov dword [ebp - 4], ecx
mov edi, dword [esp]
mov cl, 0xe4
stc
jmp 0x5dcf06
btr dx, bx
mov di, word [esp]
mov dl, byte [esp]
lea ecx, [eax - 1]
xchg dh, bh
jmp 0x5dce91
mov ecx, 0xff
jmp 0x5aecce
mov ecx, edx
lea ecx, [ecx - 4]
mov eax, dword [ecx]
pop ecx
call fcn.005dd463
lea esp, [esp + 4]
dec dword [ebp - 4]
call fcn.005dd8a1

Function at 0x5dcff0
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
not bh
mov ebx, dword [esp]
mov bl, byte [esp]
jmp 0x5dd00f
jmp 0x5dcfca
lea esp, [esp + 1]
mov ebx, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
cmc
call fcn.005dd0a7
invalid
cmp bx, cx
movzx ebx, byte [esi + 2]
sub esp, 0x17
push dx
pop dword [esp + 2]
jmp 0x5dcff2

Function at 0x5dd42f
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x5dd55e
cmc
lea esp, [esp + 0x3c]
xor edi, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
setge dh
mov edx, dword [esp]
jmp 0x5dd47e
mov edx, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
pushal
pushfd
and edx, ecx
jmp 0x5dd4a0

Function at 0x5dd4f0
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, edx
jmp 0x5dd50b
neg di
jmp 0x5dd4da
lea esp, [esp + 2]
jmp 0x5dd542
shr edi, 0x18
sub esp, 2
push word [esp]
push word [esp]
mov dword [esp], ebp
jmp 0x5dd4f5
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
cmc
call fcn.005dd52c
or eax, 0x9d6e0b9b
sub ah, byte [ebp - 4]
xchg edx, eax
cmc
add al, 0xbb
dec ecx
call 0x9572606c
add byte [eax - 0x639fffa5], dl

Function at 0x5dd522
Capabilities:
Encrypt data using aes

Disassembly:
push eax
pop dword [esp + 0xc]
lea esp, [esp + 1]
jmp 0x5dd4d2
Function at 0x5dd52c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
cmc
jmp 0x5dd5be
mov bh, 5
mov ebx, dword [esp]
mov bx, 0xdd26
jmp 0x5dd59e
push word [esp + 0x1e]
pop dword [esp + 0xd]
lea esp, [esp + 2]
lea esp, [esp + 0x38]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x5dd56e
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
pushal
jmp 0x5dd5e1
cmc
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
and ebx, ecx
pushal
jmp 0x5dd584
pop word [esp + 0x11]
push word [esp]
lea esp, [esp + 2]
jmp 0x5dd609
and edx, ecx
mov edx, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
sub esp, 0x12
push dword [esp + 0xc]
jmp 0x5dd5cb
sub esp, 2
lea esp, [esp + 2]
jmp 0x5dd619
and ebx, ecx
stc
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x5dd5f3
and edx, ecx
push sp
add esp, 0
clc
lea esp, [esp + 2]
jmp 0x5dd663
xor edi, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
push cx
mov byte [esp], bh
mov word [esp], bx
push bp
jmp 0x5dd641

Function at 0x5dd677
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
not di
bsr edi, edx
jmp 0x5dcec6
pushfd
push dword [esp + 3]
jmp 0x5dd6c0
movzx ebx, byte [esi + 0x11]
sub esp, 0x14
neg di
xchg word [esp + 8], di
jmp 0x5dcef0
mov dx, 0x78f1
jmp 0x5dcf5a
mov edx, dword [esi]
jmp 0x5dcf3a
lea esp, [esp + 0x14]
add esi, 0x10
bsf edi, ebp
bt di, bp
mov dx, word [esp]
jmp 0x5dcf10
mov edi, edx
push bx
lea esp, [esp + 2]
shr edi, 0x18
jmp 0x5dcf85
mov ebx, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
mov edi, 0x8285248d
lea edi, [ecx + ebx]
mov di, word [esp]
jmp 0x5dcf26
push edx
mov byte [esp], al
add esp, 2
lea esp, [esp + 2]
jmp 0x5dcfae
push esp
pop word [esp]
lea esp, [esp + 2]
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
cmc
jmp 0x5dcf6f
lea esp, [esp + 3]
jmp 0x5dd3ac
and edi, ecx
pushfd
push dword [esp + 3]
lea esp, [esp + 1]
mov word [esp + 1], bp
jmp 0x5dcf98
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
stc
call fcn.005dd140
stc
clc
sub esp, 0xc
jmp 0x5dd3de
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.MSVFW32.dll_DrawDibDraw]
mov bl, byte [esp]
movzx ebx, byte [esi + 0xd]
call fcn.005dd42d
cdq
sbb eax, 0x9227d48d
jmp 0x76f9d06e
mov dword [esp + 2], eax
push dword [esp + 2]
jmp 0x5dd715
mov bh, byte [esp]
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x5dd692
mov edi, dword [esp + 8]
lea esp, [esp + 0xc]
pop esi
mov bl, byte [esp]
mov bx, word [esp]
jmp 0x5dd6a8
lea esp, [esp + 0x10]
jne 0x5aecce
je 0x5aece4
Function at 0x78a3c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, bh
bsr bx, cx
inc cl
mov di, bx
xchg bx, si
bswap ebx
jmp 0x78a3a7
bswap ebp
stc
mov ebp, dword [esp]
mov edi, 0x71865646
cpuid
jmp 0x78a390
mov ch, byte [esp + 0x19]
mov esi, dword [esp + 0xd]
not bh
btr eax, esp
and si, 0xc99a
mov ebp, 0xb4ba0a7e
jmp 0x78a34f
mov ecx, 0x4db64cea
setne bh
xchg ah, bl
xor di, 0x6e44
jmp 0x78a3d0
sub esp, 0x1e
lea esp, [esp + 0x42]
mov bl, bh
btr edx, esp
mov edi, ecx
mov si, word [esp]
jmp 0x78a361
mov byte [esp + 5], ah
mov edx, dword [esp + 0x15]
stc
push edx
jmp 0x78a377
mov bl, 0x48
neg cx
mov edi, 0xd8e110d8
bsr si, bp
mov di, 0x3075
bswap ebp
jmp 0x78a4a8
cld
pop edi
xchg byte [esp + 0xc], dl
pop cx
mov dx, di
mov dh, byte [esp + 0xb]
jmp 0x78a3f7
xchg dh, al
neg cx
push esp
mov al, ah
pushal
btr edi, esp
jmp 0x78a417

Function at 0x78a6fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 4]
xchg byte [esp + 4], bl
mov byte [esp + 5], dh
mov bh, byte [esp + 4]
xchg word [esp + 1], si
mov bx, 0xa959
jmp 0x78a7e7
cpuid
xchg bh, cl
rdtsc
mov di, 0xf92f
mov byte [esp + 3], ah
jmp 0x78a6bb
jmp 0x78a6e3
lea esi, [esi - 0xe5]
neg si
btc ecx, edi
neg ax
mov bx, word [esp]
pushal
jmp 0x78a74a
inc cl
neg ch
ror esi, 9
cpuid
bswap esi
mov al, 0xa6
jmp 0x78a6fc
bsf si, si
neg ch
pop word [esp + 0xd]
pop edi
not ecx
rdtsc
jmp 0x78a7c2
mov dword [esp + 0x1b], eax
bswap esi
mov ebp, eax
mov edi, 0x8f90ab7a
lea ecx, [eax*4]
push edx
jmp 0x78a72a
pushal
lea esp, [esp + 0x47]
cpuid
mov dl, 0x64
not ebp
add cx, 0x4986
jmp 0x78a71b
xchg cx, di
xchg word [esp + 9], bx
rcr bh, 3
pop esi
neg edx
lea ebp, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x78a83a
pop edi
xchg edi, esi
stc
lea edi, [ebx + ebx]
inc cl
rcr ebp, 0x11
jmp 0x78a788
cpuid
mov ebx, 0xc6188e7e
mov byte [esp + 0x14], ch
push word [esp + 3]
cpuid
shr edx, 5
jmp 0x78a7a4
pop dword [esp]
xchg word [esp + 4], bp
clc
pushal
xor cx, 0x268c
xchg di, ax
jmp 0x78a776
not ax
pop bp
push esp
mov ah, byte [esp + 0x17]
mov dword [esp + 5], ecx
mov dh, byte [esp + 5]
jmp 0x78a820

Function at 0x78a9ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, 0x3bc81ba6
xchg word [esp + 9], bp
mov ax, 0xb67b
mov dword [esp + 7], esi
mov di, 0x61a1
jmp 0x78a966

Function at 0x78acfb
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebx, ecx
mov word [esp + 1], dx
rdtsc
mov word [esp + 2], sp
pop word [esp]
jmp 0x78ac95

Function at 0x78f738
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x90], edi
lea esp, [esp + 0x90]
jmp 0x78f765
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40433a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410ce0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004025d5
mov dword [ebp - 0x14], eax
cmp dword [0x411b00], esi
jne 0x40442d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4043ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40450d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40450d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40450d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x411b00], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x411b04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x411b08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411b10], eax
test eax, eax
je 0x40442a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411b0c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x404452
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404445
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x404467
push 4
pop eax
jmp 0x40450f
cmp dword [ebp - 0x14], esi
je 0x404467
push dword [0x411b00]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40444c
mov eax, dword [0x411b0c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4044c5
cmp dword [0x411b10], edi
je 0x4044c5
push eax
call ebx
push dword [0x411b10]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4044c5
test eax, eax
je 0x4044c5
call ecx
test eax, eax
je 0x4044ba
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4044ba
test byte [ebp - 8], 1
jne 0x4044c5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4044f5
mov eax, dword [0x411b04]
cmp eax, edi
je 0x4044f2
push eax
call ebx
test eax, eax
je 0x4044f2
call eax
mov esi, eax
test esi, esi
je 0x4044f2
mov eax, dword [0x411b08]
cmp eax, edi
je 0x4044f2
push eax
call ebx
test eax, eax
je 0x4044f2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x411b00]
call ebx
test eax, eax
je 0x40450d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40450f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404520
mov esp, ebp
pop ebp
ret
Function at 0x10001000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
lea ecx, [edi + 2]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [edx*4 + 1]
push edx
call fcn.100032f3
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, eax
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
add esp, 4
xor edx, edx
test eax, eax
je 0x100010af
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx + edx*2]
mov dword [ebp - 4], eax
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
add eax, eax
shr ebx, 4
movzx eax, byte [ebx + eax*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
and eax, 0xf
shr ebx, 6
movzx eax, byte [ebx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
add esi, 3
dec edx
jne 0x10001050
mov edx, dword [ebp - 4]
cmp edx, edi
jae 0x10001101
movzx eax, byte [esi]
inc edx
cmp edx, edi
jae 0x100010c1
movzx esi, byte [esi + 1]
jmp 0x100010c3
xor esi, esi
mov ebx, eax
shr ebx, 2
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
and eax, 3
mov ebx, esi
shl eax, 4
shr ebx, 4
mov al, byte [eax + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
cmp edx, edi
jae 0x100010f5
and esi, 0xf
mov al, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x100010f7
mov al, 0x3d
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
mov byte [ecx], 0
mov eax, ecx
mov ecx, dword [ebp + 8]
sub eax, dword [ecx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001120
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, ecx
shr eax, 2
mov dl, 0x3d
sub esp, 8
lea eax, [eax + eax*2]
cmp byte [ecx + 0x10010e0f], dl
jne 0x10001139
dec eax
cmp byte [ecx + 0x10010e0e], dl
jne 0x10001142
dec eax
cmp byte [ecx + 0x10010e0d], dl
jne 0x1000114b
dec eax
push eax
call fcn.100032f3
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ecx], eax
xor eax, eax
add esp, 4
mov dword [ebp - 8], eax
cmp byte [str.MIGJAoGBAK7mh7RSMtisKLnJfkq9AUlOHqUe4zjTLVC89ksPux5ZMr9ndtjzdx8bCcSfCQtemKrR2LY4lRr5cZs3jgwaBbHS2SdCezUuNUdrEEsfWX8BlK13G8djFmmYZqKeQFnUrKZnuA0A4nIGPRFKB2fKfBjh4Y5qN2IoyV9Y0e8HHAgMBAAE], al
je 0x10001278
push esi
push ebx
mov esi, 0x10010e12
push edi
jmp 0x10001180
movzx eax, byte [esi - 2]
mov dword [ebp + 8], 0xffffffff
xor ecx, ecx
lea ecx, [ecx]
movsx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
cmp edx, eax
jne 0x1000119e
mov byte [ebp + 8], cl
inc ecx
cmp ecx, 0x40
jl 0x10001190
movzx eax, byte [esi - 1]
xor ecx, ecx
lea ebx, [ebx]
movsx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
cmp edx, eax
jne 0x100011be
mov byte [ebp + 9], cl
inc ecx
cmp ecx, 0x40
jl 0x100011b0
movzx edx, byte [esi]
mov al, byte [ebp + 0xa]
xor ecx, ecx
lea esp, [esp]
movsx edi, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
cmp edi, edx
jne 0x100011dd
mov al, cl
inc ecx
cmp ecx, 0x40
jl 0x100011d0
movzx edi, byte [esi + 1]
mov cl, byte [ebp + 0xb]
xor edx, edx
lea esp, [esp]
movsx ebx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
cmp ebx, edi
jne 0x100011fd
mov cl, dl
inc edx
cmp edx, 0x40
jl 0x100011f0
mov dl, byte [ebp + 8]
mov bl, byte [ebp + 9]
mov edi, dword [ebp - 8]
shr bl, 4
add dl, dl
add dl, dl
and bl, 3
or bl, dl
mov edx, dword [ebp - 4]
mov byte [edi + edx], bl
cmp byte [esi], 0x3d
je 0x10001268
mov dl, byte [ebp + 9]
mov bl, al
shr bl, 2
shl dl, 4
and bl, 0xf
or bl, dl
mov edx, dword [ebp - 4]
mov byte [edi + edx + 1], bl
cmp byte [esi + 1], 0x3d
je 0x10001272
and cl, 0x3f
shl al, 6
or cl, al
mov byte [edi + edx + 2], cl
add edi, 3
add esi, 4
cmp byte [esi - 2], 0
mov dword [ebp - 8], edi
jne 0x10001180
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 1]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 2]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001310
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10010038]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.100092e0
add esp, 0xc
cmp word [0x10010ed8], 0
mov dword [ebp - 0x10c], 0x104
jne 0x1000142e
push esi
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.urlmon.dll_ObtainUserAgentString]
test eax, eax
jne 0x100013ba
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push eax
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
call esi
mov edx, dword [ebp - 0x10c]
add eax, eax
push eax
push 0x10010ed8
push edx
lea eax, [ebp - 0x108]
push eax
push 1
push 0
call esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100032e4
mov esp, ebp
pop ebp
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx edi, al
push str.IsWow64Process
shr eax, 8
push str.kernel32
movzx ebx, al
mov dword [ebp - 0x110], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10001402
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x110], 0
mov eax, 0x1000e248
jne 0x10001415
mov eax, 0x1000e250
push edi
push eax
push ebx
push edi
push str.Mozilla_5.0__Windows_NT__d._d__Win_s__Trident__d.0_CLR_3.5.30729
push 0x10010ed8
call fcn.1000346c
add esp, 0x18
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100032e4
mov esp, ebp
pop ebp
ret
Function at 0x10001750
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x10010038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x101
lea ecx, [ebp - 0x315]
push 0
push ecx
mov dword [ebp - 0x320], eax
mov word [ebp - 0x318], 0x3d62
mov byte [ebp - 0x316], 0
call fcn.100092e0
xor edx, edx
push 0x200
push edx
lea eax, [ebp - 0x212]
push eax
mov word [ebp - 0x214], dx
call fcn.100092e0
add esp, 0x18
lea ecx, [ebp - 0x31c]
xor eax, eax
push ecx
lea edx, [ebp - 0x214]
mov edi, 0x10
push edx
mov byte [ebp - 0x10], 0
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 0x31c], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x10001808
mov dword [ebp - 0x214], 0x6e0055
mov dword [ebp - 0x210], 0x6e006b
mov dword [ebp - 0x20c], 0x77006f
mov dword [ebp - 0x208], 0x6e
jmp 0x10001826
cmp dword [ebp - 0x31c], edi
jbe 0x10001826
mov ecx, 0x2e
mov dword [ebp - 0x1fa], 0x2e002e
mov word [ebp - 0x1f6], cx
xor esi, esi
lea eax, [ebp - 0x214]
mov ecx, eax
cmp word [ebp - 0x214], si
je 0x1000185b
lea esp, [esp]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
cmp dl, 0x7f
jle 0x10001851
mov dl, byte [eax + 1]
mov byte [ecx], dl
inc ecx
inc esi
add eax, 2
inc esi
cmp word [eax], 0
jne 0x10001840
push esi
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x316]
push ecx
call fcn.100099a0
add esp, 0xc
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x214]
mov byte [ebp + esi - 0x316], 0x7c
push eax
add esi, 3
mov dword [ebp - 0x31c], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x100018d3
mov dword [ebp - 0x214], 0x6e0055
mov dword [ebp - 0x210], 0x6e006b
mov dword [ebp - 0x20c], 0x77006f
mov dword [ebp - 0x208], 0x6e
mov dword [ebp - 0x31c], 7
jmp 0x10001900
mov eax, dword [ebp - 0x31c]
dec eax
mov dword [ebp - 0x31c], eax
cmp eax, edi
jbe 0x10001900
mov edx, 0x2e
mov dword [ebp - 0x1fa], 0x2e002e
mov word [ebp - 0x1f6], dx
mov dword [ebp - 0x31c], edi
xor edi, edi
lea eax, [ebp - 0x214]
mov ecx, eax
cmp word [ebp - 0x214], di
je 0x1000192e
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
cmp dl, 0x7f
jle 0x10001924
mov dl, byte [eax + 1]
mov byte [ecx], dl
inc ecx
inc edi
add eax, 2
inc edi
cmp word [eax], 0
jne 0x10001913
push edi
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp + esi - 0x318]
push ecx
call fcn.100099a0
add esi, edi
add esp, 0xc
mov byte [ebp + esi - 0x318], 0x7c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [ebp - 0x10]
push str._08x
push edx
call fcn.100033ae
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + esi - 0x317], eax
mov dword [ebp + esi - 0x313], ecx
mov byte [ebp + esi - 0x30f], 0x31
add esi, 0xa
lea edx, [esi + 1]
push edx
call fcn.100032f3
mov edi, dword [ebp - 0x320]
push esi
lea ecx, [ebp - 0x318]
push ecx
push eax
mov dword [edi], eax
call fcn.100099a0
mov edx, dword [edi]
mov ecx, dword [ebp - 4]
add esp, 0x1c
pop edi
mov byte [esi + edx], 0
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100032e4
mov esp, ebp
pop ebp
ret
Function at 0x100019c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
push esi
push edi
lea ebx, [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call fcn.10001580
mov ebx, dword [ebp - 0x10]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100019e7
sub eax, edx
mov ecx, eax
call fcn.100022f0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, ebx
call fcn.10001600
add esp, 4
jmp 0x10001a10
cmp dword [0x10012358], 0
jne 0x10001a34
lea esp, [esp]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x10012358], 0
je 0x10001a20
cmp dword [0x1001235c], 0
je 0x10001a56
mov esi, 0x12c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x10001a42
mov dword [0x1001235c], esi
mov edx, dword [ebp - 0xc]
mov eax, dword [0x100122dc]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [eax]
push edx
call ecx
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x10001ae2
cmp esi, 4
jb 0x10001ad6
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
lea ebx, [eax + 4]
test ecx, ecx
je 0x10001ad9
lea edi, [esi - 4]
push edi
push ebx
mov dword [ebp - 0x10], edi
call fcn.100023a0
lea ecx, [esi - 4]
add esp, 8
or eax, 0xffffffff
mov edx, ebx
test ecx, ecx
je 0x10001abf
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x10011ed8]
inc edx
dec ecx
jne 0x10001aa1
mov edi, dword [ebp - 0x10]
not eax
cmp eax, dword [ebp - 0x14]
jne 0x10001ad6
cmp edi, 2
jne 0x10001ad6
cmp byte [ebx], 0x6f
jne 0x10001ad6
cmp byte [ebx + 1], 0x6b
je 0x10001b18
mov eax, dword [ebp - 4]
push eax
call fcn.10003432
add esp, 4
mov esi, 0x1e
jmp 0x10001af0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x10001af0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 5
jb 0x10001a10
mov dword [ebp - 8], esi
jmp 0x10001a10
mov edx, dword [ebp - 4]
push edx
call fcn.10003432
mov eax, dword [ebp - 0xc]
push eax
call fcn.10003432
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret