joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10061050
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10061197
mov edx, dword [esp + 0xc]
test edx, edx
je 0x10061197
mov dword [esi], 0x61707865
mov dword [esi + 4], 0x3320646e
mov dword [esi + 8], 0x79622d32
mov dword [esi + 0xc], 0x6b206574
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [esi + 0x2c], ecx
pop esi
ret
mov eax, 0xffffffaf
pop esi
ret
Function at 0x10061250
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
jne 0x10061268
pop edi
lea eax, [ebp - 0x51]
pop ebp
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x20]
push esi
test ebx, ebx
je 0x100612b3
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100613c6
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x100613c6
mov esi, eax
mov ecx, edx
sub esi, edx
mov edx, dword [edi + 0x80]
cmp edx, 0x40
jae 0x100612b3
mov al, byte [esi + ecx]
inc ebp
xor al, byte [edx + edi + 0x40]
mov byte [ecx], al
inc ecx
inc dword [edi + 0x80]
dec ebx
mov dword [esp + 0x24], ebx
jne 0x10061290
cmp ebx, 0x40
jb 0x1006137c
lea eax, [edi + 0x41]
mov dword [esp + 0x14], eax
lea edx, [edi + 0x40]
mov eax, dword [esp + 0x28]
mov ecx, eax
sub ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
lea esi, [eax + 2]
mov eax, ebx
add esi, ebp
shr eax, 6
mov dword [esp + 0x10], eax
push edx
push edi
call fcn.10060d10
inc dword [edi + 0x30]
add esp, 8
mov eax, dword [esp + 0x2c]
mov edi, 8
mov edx, dword [esp + 0x14]
add eax, ebp
mov ebx, dword [esp + 0x18]
movzx ecx, byte [eax + ebx]
lea eax, [eax + 8]
xor cl, byte [edx - 1]
lea edx, [edx + 8]
mov byte [eax - 8], cl
movzx ecx, byte [esi - 1]
xor cl, byte [edx - 8]
mov byte [eax - 7], cl
movzx ecx, byte [edx - 7]
xor cl, byte [esi]
mov byte [eax - 6], cl
movzx ecx, byte [edx - 6]
xor cl, byte [esi + 1]
mov byte [eax - 5], cl
movzx ecx, byte [edx - 5]
xor cl, byte [esi + 2]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor cl, byte [esi + 3]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor cl, byte [esi + 4]
mov byte [eax - 2], cl
movzx ecx, byte [edx - 2]
xor cl, byte [esi + 5]
add esi, 8
mov byte [eax - 1], cl
dec edi
jne 0x10061302
mov ebx, dword [esp + 0x24]
add ebp, 0x40
mov edi, dword [esp + 0x20]
sub ebx, 0x40
dec dword [esp + 0x10]
mov dword [esp + 0x24], ebx
lea edx, [edi + 0x40]
jne 0x100612e2
test ebx, ebx
je 0x100613bc
lea esi, [edi + 0x40]
push esi
push edi
call fcn.10060d10
inc dword [edi + 0x30]
add esp, 8
xor edx, edx
test ebx, ebx
je 0x100613b6
mov edi, dword [esp + 0x28]
sub edi, dword [esp + 0x2c]
add ebp, dword [esp + 0x2c]
lea ecx, [edx + ebp]
mov al, byte [edi + ecx]
xor al, byte [esi + edx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x100613a2
mov edi, dword [esp + 0x20]
mov dword [edi + 0x80], ebx
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret
pop esi
pop ebx
pop edi
mov eax, 0xffffffaf
pop ebp
add esp, 0xc
ret
Function at 0x422040
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x422062
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x422069
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x422058
mov eax, 1
add ebx, ebx
jne 0x42207b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x422070
jne 0x42208c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422070
xor ecx, ecx
sub eax, 3
jb 0x4220a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x422112
mov ebp, eax
add ebx, ebx
jne 0x4220ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4220b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4220dc
inc ecx
add ebx, ebx
jne 0x4220c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4220bd
jne 0x4220d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4220bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4220fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4220ed
jmp 0x42205e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4220fc
add edi, ecx
jmp 0x42205e
pop esi
mov edi, esi
mov ecx, 0x810
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42211a
cmp byte [edi], 0xd
jne 0x42211a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42211f
lea edi, [esi + 0x20000]
mov eax, dword [edi]
or eax, eax
je 0x422197
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23b94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23c48]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42214c
mov ecx, edi
jns 0x42217b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23c4c]
or eax, eax
je 0x422191
mov dword [ebx], eax
add ebx, 4
jmp 0x422169
call dword [esi + 0x23c50]
popal
jmp section.UPX0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401cd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
fldz
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
xor eax, eax
mov dword [esp + 0xc], eax
fstp qword [esp + 0x14]
push edi
mov dword [esp + 0x14], eax
push ebx
call fcn.0040b271
mov edi, dword [esp + 0x28]
push ebx
mov esi, eax
push edi
push esi
call fcn.0040b340
mov eax, dword [0x4258d4]
mov ecx, dword [esp + 0x20]
add eax, 0x8c26e7fa
add ecx, eax
mov dword [0x4258d4], ecx
fld qword [esp + 0x28]
fsub qword [0x41f3f0]
lea ebp, [esi + ebx]
sub edi, 0x42302c
add esp, 0x10
fmul qword [esp + 0x18]
mov ecx, dword [0x4276e4]
add ecx, edi
mov eax, esi
fstp qword [esp + 0x18]
mov dx, word [0x42595c]
mov bx, word [0x4241c0]
movsx ebx, bx
movsx edx, dx
add edx, ebx
mov ebx, dword [0x423310]
add ebx, edx
or edx, 0xffffffff
mov word [0x4241c0], bx
add word [0x42595c], dx
add dword [0x423310], edx
cmp esi, ebp
je 0x401d82
mov dl, byte [ecx]
xor byte [eax], dl
inc eax
inc ecx
cmp eax, ebp
jne 0x401d76
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x402070
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x64
fldz
xor ecx, ecx
mov dword [esp + 4], ecx
fstp qword [esp + 8]
xor eax, eax
mov word [esp], ax
mov dword [0x425960], 0xace10ab5
fld qword [esp + 8]
fsub qword [0x41f428]
mov word [esp + 0x52], ax
mov edx, 1
mov dword [esp + 0x20], 0x44
fcomp qword [0x41f420]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x4c], edx
fnstsw ax
mov dword [esp + 0x54], ecx
fld qword [esp + 8]
fsub qword [0x41f370]
fstp qword [esp + 8]
test ah, 0x44
jnp 0x4020f4
fld qword [esp + 8]
mov eax, dword [0x423258]
sub eax, 0x3bb2ba8f
mov dword [esp], eax
fild dword [esp]
fsubp st(1)
fstp qword [esp + 8]
mov eax, edx
mov word [esp + 0x50], ax
add dword [esp + 4], edx
mov edx, dword [esp + 4]
sub edx, 0x39cc0ec8
mov dword [esp + 4], edx
fild dword [esp + 4]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x24]
fstp dword [0x423134]
push edx
push ecx
push ecx
push 8
push ecx
push ecx
push ecx
mov ecx, dword [esp + 0x88]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x64
ret
Function at 0x402940
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
fldz
push ebx
push esi
fstp dword [esp + 8]
fldz
push edi
push 3
fst qword [esp + 0x14]
push 0x425304
fstp qword [esp + 0x18]
call fcn.00401cd0
mov ebx, dword [esp + 0x24]
mov esi, eax
push esi
push ebx
call fcn.0040ba4f
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4029b9
fld dword [0x4253b4]
push 0x3e8
fsubr qword [0x41f4b0]
fsub dword [esp + 0x10]
fmul dword [esp + 0x10]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fsub qword [0x41f370]
fstp dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
call fcn.0040ba4f
mov edi, eax
add esp, 8
test edi, edi
je 0x4029d1
push edi
push 1
lea eax, [esp + 0x28]
push 4
push eax
call fcn.0040b909
push edi
call fcn.0040b72b
add esp, 0x14
fldz
xor eax, eax
fstp dword [esp + 0xc]
mov word [esi], ax
fldz
push esi
fstp qword [esp + 0x14]
mov byte [esi + 2], al
call fcn.0040b194
fld dword [esp + 0x10]
fld dword [esp + 0x10]
add esp, 4
fsub qword [0x41f3d0]
pop edi
pop esi
pop ebx
fsubp st(1)
fstp dword [esp]
add esp, 0xc
ret
Function at 0x403b80
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
fldz
push ebx
xor eax, eax
mov word [esp + 4], ax
fstp dword [esp + 8]
push 0x2e
push 0x425354
mov dword [esp + 0x10], eax
call fcn.00401cd0
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov ebx, eax
push ebx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403c27
push esi
push edi
push 0x34
push 0x423284
call fcn.00401cd0
mov edx, dword [esp + 0x2c]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403bd7
sub eax, edi
push eax
push edx
mov edx, dword [esp + 0x1c]
push 1
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
fldz
push 0x34
fstp dword [esp + 0x14]
fldz
push 0
fstp qword [esp + 0x20]
push esi
call fcn.0040b0e0
push esi
call fcn.0040b194
fld dword [esp + 0x20]
fld dword [esp + 0x20]
add esp, 0x10
fsub qword [0x41f3d0]
pop edi
pop esi
fsubp st(1)
fstp dword [esp + 8]
mov ax, word [esp + 4]
movsx ecx, ax
mov dword [esp + 8], ecx
fild dword [esp + 8]
fld qword [0x423300]
fsub qword [0x41f560]
fsubp st(1)
call fcn.0040b030
fldz
mov word [esp + 4], ax
fstp dword [esp + 8]
fldz
push 0x2e
push 0
fstp qword [esp + 0x18]
push ebx
call fcn.0040b0e0
push ebx
call fcn.0040b194
fld dword [esp + 0x18]
fld dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
fsub qword [0x41f3d0]
add esp, 0x10
push edx
fsubp st(1)
fstp dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
add esp, 0x14
ret
Function at 0x40b6a5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425ed0]
jne 0x40b6af
repz ret
jmp fcn.0040f8a1

Function at 0x4166c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410dfd
and dword [ebp - 4], 0
cmp dword [0x428154], 0
mov ebx, eax
jne 0x416775
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416826
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420ab8
push edi
call esi
test eax, eax
je 0x416826
push eax
call fcn.00410d8b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428154], eax
call esi
push eax
call fcn.00410d8b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428158], eax
call esi
push eax
call fcn.00410d8b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42815c], eax
call esi
push eax
call fcn.00410d8b
pop ecx
mov dword [0x428164], eax
test eax, eax
je 0x416775
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410d8b
pop ecx
mov dword [0x428160], eax
mov eax, dword [0x428160]
cmp eax, ebx
je 0x4167cd
cmp dword [0x428164], ebx
je 0x4167cd
push eax
call fcn.00410e06
push dword [0x428164]
mov esi, eax
call fcn.00410e06
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4167cd
test edi, edi
je 0x4167cd
call esi
test eax, eax
je 0x4167c4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4167c4
test byte [ebp - 0xc], 1
jne 0x4167cd
or dword [ebp + 0x10], 0x200000
jmp 0x416806
mov eax, dword [0x428158]
cmp eax, ebx
je 0x416806
push eax
call fcn.00410e06
pop ecx
test eax, eax
je 0x416806
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416806
mov eax, dword [0x42815c]
cmp eax, ebx
je 0x416806
push eax
call fcn.00410e06
pop ecx
test eax, eax
je 0x416806
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428154]
call fcn.00410e06
pop ecx
test eax, eax
je 0x416826
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416828
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40215e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40219d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40219d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40219d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40219d
cmp dword [ecx + 0x74], 0xe
jbe 0x40219d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40cc59
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040cacf

Function at 0x4156d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4156fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4156fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100061fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10240ec4], 0
mov dword [0x10240ec8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [0x10240ed0], 0
mov dword [0x10240ebc], 0x1a14
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
je 0x10006350
jmp 0x1000627c
mov eax, dword [0x10240ec4]
mov ecx, dword [0x10240ec8]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10240ec4], edx
mov dword [0x10240ebc], 0xfbe
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x10240ec8], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10240ecc], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x10240ebc], 0x1d46
mov cl, byte [0x10240ecc]
mov edx, dword [0x10240ec8]
mov byte [edi + edx], cl
mov edx, dword [0x10240ec4]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10240ec8]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10240ed0], ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov ecx, dword [0x10240ec0]
add ecx, 0x374
mov dword [0x10240ec0], ecx
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x2c], edx
jne 0x10006265
mov dword [0x10240ec0], 0x20c0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10006362
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [fcn.10006362]
mov ecx, dword [0x10240ec0]
add ecx, 0xffffe02f
mov edx, dword [0x10240ebc]
add edx, 0xffffdbc5
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
jmp 0x100063a2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x100063b7
jmp 0x100063c7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
je 0x10006391
jmp 0x100063c7
mov eax, dword [ebp - 0x14]
mov dword [0x10240ec0], eax
mov eax, dword [ebp - 0x10]
add esp, 0x14
pop ebp
ret
mov eax, dword [ebp - 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
jmp 0x100063a2
Function at 0x100065df
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10240ec8], 0
mov byte [0x10240ecc], 0
mov dword [0x10240ebc], 0x21
mov dword [0x10240ec4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1000663f
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x10240ec4], 0
mov dword [ebp - 0x20], eax
jmp 0x10006671
mov eax, dword [ebp - 0x1c]
mov dword [0x10240ec0], 0x10da
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10240ec4]
add eax, 1
mov dword [0x10240ec4], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000663f
jmp 0x1000662e
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x10240ec8]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov eax, esi
cdq
idiv ecx
mov dword [0x10240ec8], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10240ecc], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x10240ecc]
mov esi, dword [0x10240ec8]
mov byte [ebx + esi], cl
mov dword [0x10240ebc], 0x2cc
mov esi, dword [0x10240ec4]
add esi, 1
mov dword [0x10240ec4], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x10006671
jmp 0x10006626
Function at 0x100066fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x10240ec0], 0x9dd
mov dword [ebp - 0x10], eax
call fcn.100063df
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov eax, dword [eax + esi]
cmp eax, 0x4550
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
je 0x1000673f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x78]
mov ecx, eax
add ecx, 0x20
mov edx, dword [ebp - 0x14]
add edx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
add ecx, dword [edx]
mov dword [0x10240ec0], 0x5a7
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov ebx, dword [esi + edi + 0x18]
cmp ebx, 0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
je 0x10006871
jmp 0x10006801
mov eax, dword [ebp - 0x34]
add eax, 2
mov dword [ebp - 0x38], eax
xor eax, eax
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov edx, dword [ebp - 0x28]
cmp ecx, edx
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x30], eax
jb 0x100067e5
jmp 0x10006871
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x50], eax
jne 0x10006815
jmp 0x10006842
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x2c]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], edx
jmp 0x10006815
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], eax
jmp 0x100067e5
mov eax, dword [ebp - 0x50]
mov ecx, eax
mov edx, dword [ebp - 0x54]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
jne 0x100067bb
mov al, byte [ebp - 0x4a]
test al, 1
jne 0x1000684e
jmp 0x1000678d
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x14]
add edi, dword [edx + ecx*4]
mov dword [0x10240ebc], 0x1fbc
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10006cd3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x10240ec0], 0x1981
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x100086d6]
mov dl, byte [eax + 0x100086a7]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x10006cf5
lea eax, [ebp - 0x24]
mov dword [0x10240ebc], 0x1811
mov dword [ebp - 0x34], eax
call fcn.10006aab
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10006b85
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x10006df5
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10240ebc], 0x886
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.100068cd
xor eax, eax
mov dword [0x10240ec0], 0x263c
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x50], ecx
mov dword [0x10240ebc], 0xf39
add ecx, 0x1bd7
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10006dec
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret