joyce8/EMBER2024-capa huggingface dataset:
Function at 0x341f54ed
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x190
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 0x18c], eax
cmp dword [esp + 0x194], 0
mov ecx, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
lea esi, [ecx + 0x18]
mov ecx, 0x20
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
je 0x341f556a
push 0
push 0x6b39dac7
lea ecx, [esp + 0x98]
call fcn.341f52e4
push 0x80
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x98]
call fcn.34307874
fld qword [esp + 0x6a]
call fcn.341f5463
mov edx, 4
lea ecx, [esp + 0x3a]
mov edi, edi
xor dword [ecx], eax
add edx, 4
add ecx, 4
cmp edx, 0x28
jle 0x341f555d
mov ebx, dword [esp + 0x6a]
xor esi, esi
movzx ebp, byte [esp + esi*2 + 0x42]
lea edi, [esi + 3]
lea ecx, [edi + 1]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
add ecx, 4
shl ebp, cl
lea ecx, [edi - 2]
mov eax, 0xaaaaaaab
mul ecx
movzx eax, byte [esp + esi*2 + 0x3c]
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
add ecx, 1
shl eax, cl
lea ecx, [edi - 1]
xor ebp, eax
mov eax, 0xaaaaaaab
mul ecx
movzx eax, byte [esp + esi*2 + 0x3e]
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov ecx, esi
sub ecx, edx
add ecx, 2
shl eax, cl
xor ebp, eax
mov eax, 0xaaaaaaab
mul edi
movzx eax, byte [esp + esi*2 + 0x40]
shr edx, 4
lea ecx, [edx + edx*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ecx
mov ecx, esi
sub ecx, edx
add ecx, 3
shl eax, cl
xor ebp, eax
mov eax, 0xaaaaaaab
mul esi
movzx eax, byte [esp + esi*2 + 0x3a]
shr edx, 4
lea ecx, [edx + edx*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ecx
mov ecx, esi
sub ecx, edx
shl eax, cl
add esi, 5
xor ebp, eax
xor ebx, ebp
cmp esi, 0x28
jb 0x341f5570
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.341f1b18
add esp, 0x190
ret 4
Function at 0x342ec836
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x220
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 0x21c], eax
cmp dword [esp + 0x228], 0x28
push ebp
mov eax, ecx
mov ecx, dword [esp + 0x230]
mov ebp, dword [eax + 4]
push edi
mov edi, dword [esp + 0x22c]
jae 0x342ec87a
push 1
push 0xfffffbe9
call fcn.341f7675
jmp 0x342ec917
push ebx
push esi
push 0
push 0x6b39dac7
lea ecx, [esp + 0x1c]
call fcn.341f52e4
push 0
push 0x6b39dac7
lea ecx, [esp + 0x128]
call fcn.341f52e4
lea eax, [ebp + 0x18]
push 0x80
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.34307874
fld qword [ebp + 0x72]
lea ebx, [ebp + 0x42]
call fcn.341f5463
mov edx, 4
mov ecx, ebx
sub edx, ebx
xor dword [ecx], eax
add ecx, 4
lea esi, [edx + ecx]
cmp esi, 0x28
jle 0x342ec8c9
mov ecx, 0xa
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
fld qword [ebp + 0x72]
call fcn.341f5463
mov edx, 4
mov ecx, ebx
sub edx, ebx
lea ebx, [ebx]
xor dword [ecx], eax
add ecx, 4
lea esi, [edx + ecx]
cmp esi, 0x28
jle 0x342ec8f2
mov eax, dword [esp + 0x10]
push 0x80
push eax
lea ecx, [esp + 0x128]
call fcn.34307874
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
pop edi
pop ebp
xor ecx, esp
call fcn.341f1b18
add esp, 0x220
ret 0xc
Function at 0x342f231b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
or eax, 0xffffffff
xor ebp, ebp
push esi
mov esi, ecx
mov ecx, 1
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x70], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], ecx
mov ecx, 5
lea eax, [esi + 0x3c]
push edi
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x64], 2
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x74], ebp
mov dword [esi + 0x78], 3
mov dword [esi + 0x7c], 4
mov dword [esi + 0x80], ebp
mov dword [esi + 0x84], ebp
mov dword [esi + 0x8c], ebp
mov dword [esi + 0x90], 5
mov dword [esi + 0x94], 6
mov dword [esi + 0x98], ebp
mov dword [esi + 0x9c], ebp
mov dword [esi + 0xa8], 7
mov dword [esi + 0xac], 8
mov dword [esi + 0xb0], ebp
mov dword [esi + 0xb4], ebp
mov dword [esi + 0xc0], 9
mov dword [esi + 0xc4], 0xa
mov dword [esi + 0xc8], ebp
mov dword [esi + 0xcc], ebp
mov dword [esp + 0x14], ecx
mov ebx, 0xc
mov dword [esp + 0x10], eax
lea edi, [esi + 0xd4]
lea eax, [ecx - 1]
cdq
sub eax, edx
sar eax, 1
mov dword [edi], eax
mov eax, dword [esp + 0x10]
lea edx, [ebx - 1]
mov dword [edi - 4], ecx
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov eax, dword [eax]
mov dword [edi + 0xc], eax
cmp dword [eax + 0x8c], ebp
jne 0x342f243a
mov ecx, eax
call fcn.342f2b16
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x10], eax
jmp 0x342f243d
mov dword [edi + 0x10], ebp
add dword [esp + 0x10], 4
add ecx, 1
add ebx, 2
add edi, 0x18
cmp ebx, 0x16
mov dword [esp + 0x14], ecx
jle 0x342f2403
cmp dword [esi + 0x68], ebp
jne 0x342f2488
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x60]
push edi
push ecx
mov ecx, esi
call fcn.342f22ca
test byte [edi], 8
jne 0x342f2488
mov edx, dword [esi + 0x64]
push edi
push edx
mov ecx, esi
call fcn.342f22ca
test byte [edi], 8
jne 0x342f2488
push edi
push ebp
mov ecx, esi
call fcn.342f200d
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x3431bd4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
movzx eax, ax
sub eax, 0
je 0x3431bd98
dec eax
push esi
je 0x3431bd71
dec eax
je 0x3431bd6d
dec eax
je 0x3431bd66
mov esi, dword [0x3438cc18]
jmp 0x3431bd7f
mov esi, 0x96
jmp 0x3431bd74
push 0x64
jmp 0x3431bd73
push 0x32
pop esi
mov eax, dword [0x3438cc18]
cmp eax, esi
jae 0x3431bd7f
mov esi, eax
push edi
call sub.kernel32.dll_GetTickCount
test esi, esi
mov edi, eax
jbe 0x3431bd96
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, esi
jb 0x3431bd8b
pop edi
pop esi
ret
Function at 0x407163
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
add ecx, eax
push ebx
push edi
mov edi, dword [ecx]
add eax, 4
mov dword [esi], eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044e9ed
mov ecx, dword [esi]
add ecx, dword [ebp + 8]
lea ebx, [edi + edi]
push ebx
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.00450dd0
mov eax, dword [ebp - 4]
add dword [esi], ebx
xor ecx, ecx
add esp, 0x10
cmp edi, ecx
mov word [ebx + eax], cx
jle 0x4071bc
xor word [eax + ecx*2], di
inc ecx
cmp ecx, edi
jl 0x4071b3
pop edi
pop ebx
leave
ret 4

Function at 0x412f5e
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
cmp al, 0x2f
xor byte [ebp + 0x1ba51db1], dl
xchg ebp, eax
mov cl, 0x1d
movsd dword es:[edi], dword [esi]
sbb eax, dword [ebp + 0x7d66df83]
inc eax
xchg ebp, eax
mov cl, 0x1d
movsd dword es:[edi], dword [esi]
sbb eax, dword [ebp + 0x7d66df83]
inc eax
pop ss
das
push 0xffffffffffffffad
jg 0x412f5b
inc ecx
nop
push 0x5806ea8b
adc eax, 0xa865085
inc eax
test byte [ecx], al
invalid

Function at 0x441f88
Capabilities:
Encode data using xor

Disassembly:
jg 0x441fcb
mov ch, byte [ebx - 0x4412f689]
stc
sti
cmp byte [edi], bh
adc ch, byte [esi - 0x66c0cf30]
mov dword [ebx - 0x40], edi
rol byte [edi - 0x72], 0xff
sub esp, dword [ebx]
lodsd eax, dword [esi]
sbb eax, 0x59e26556
jl 0x442000
xchg esi, eax
jge 0x441f94
push 0xffffffffffffff8d
push 8
lahf
mov byte [0x3010c62d], al
fisub dword [ebx]
leave

Function at 0x4516f8
Capabilities:
Encode data using xor

Disassembly:
jl 0x4516ee
mov dword [edi], esi
aas
cmp eax, 0x7ea5cab4
das
sahf
ror byte [ecx], 1
mov dword [0x1ae229bb], eax
ja 0x4516f4
std
mov ebp, 0xb5c663f0
add eax, dword [ebx + 0x32d6b637]
jne 0x45168b
mov ch, 3
xor dword [edi], 0xffffffb6
salc
xor dh, byte [ebp - 9]
mov ebx, 0xe4e99bda
cmp eax, 0x34b0d3d4
mov dl, 3
push ecx
sal dword [eax + 0x5103b234], cl
out dx, eax
mov byte [0xe2a1f3f4], al
mov edi, 0xbeefebbc
fisub dword [edi + 0x1f]
pop edi
cmpsd dword [esi], dword es:[edi]
sahf
out 0x9f, al
je 0x451690
fisub dword [eax]
xor bh, byte [esi]
adc bh, ah
and byte [edx], dh
adc bh, ah
cmp eax, 0xc3a5ff2e
loope 0x451672
dec esp
pop es
pop ecx
xor edi, dword [ebp - 0x5be15ec3]
jno 0x4516b5
mov ecx, 0xce02bbf9
ror bl, 0x55
ret 0x5045
pushal
sbb dword [ecx], eax
sub al, 0xd8
fcomp dword [ebx]
push ebx
fild qword [edi]
test cl, cl
insb byte es:[di], dx
popfd
xchg dword [eax + 0x7e], edx
or byte [ebx + 3], ah
add dword [eax + 0x24], eax
sub al, 0xb
add al, 0
sbb ebp, edx
wait
jg 0x45169b
sahf
insb byte es:[edi], dx
mul dword [ecx - 0x47]
ljmp 0xfc1f

Function at 0x4523ce
Capabilities:
Encode data using xor

Disassembly:
pushal
sar dword [edi + 0x72693fa8], 0xb7
and eax, 0x17615f9a
add byte [eax], dh
xor dword [edi + 0x62], esi
inc eax
add al, byte [eax]
add bh, bh
cli
mov ah, 0x40
insd dword es:[edi], dx
Function at 0x416020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430d48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x443004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.004081b0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x24]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x21], al
lea eax, [esi + 0x24]
push eax
call fcn.00408710
movzx eax, byte [esi + 0x30]
mov byte [edi + 0x30], al
movzx eax, byte [esi + 0x31]
mov byte [edi + 0x31], al
movzx eax, byte [esi + 0x32]
mov byte [edi + 0x32], al
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42647f
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00426384

Function at 0x42e88c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0042e60a
xchg edi, eax
stosd dword es:[edi], eax
mov al, 0x4e
lea eax, [ebp - 0x58]
push eax
call fcn.0042e61a
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0042e5cf
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x42e8f8
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0042e60a
push ebp
sub al, 0x81
dec esi
lea eax, [ebp - 0x40]
push eax
call fcn.0042e61a
push eax
push esi
push dword [ebp + 8]
call fcn.0042e5cf
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0042e60a
movsd dword es:[edi], dword [esi]
mov eax, 0x458d2e8a
call 0x512b4700
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
inc ebp
out dx, eax
retf
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0042e61a
push eax
push esi
push dword [ebp + 8]
call fcn.0042e5cf
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
Function at 0x42e9ed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0042e61a
push eax
push esi
push dword [ebp + 8]
call fcn.0042e5cf
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0042e61a
push eax
push esi
push dword [ebp + 8]
call fcn.0042e5cf
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0042e60a
sysret

Function at 0x42ecd0
Capabilities:
Inspect section memory permissions

Disassembly:
jne 0x42ece1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x42ecff
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax

Function at 0x42ed10
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x42ed5d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x42ed44
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x42ed4d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x42ed57
add ecx, eax
or byte [ecx], 4
inc eax
invalid

Function at 0x42eed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
Function at 0x42eef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
invalid
jmp [ebx]
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0042e61a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000c1ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100710a0]
jne 0x1000c1b6
repz ret
jmp fcn.1000c45d

Function at 0x1000cc20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x1007107c], 0
mov byte [0x10071080], 0
mov dword [0x10071074], 0xee6
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x10071078], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10071078]
add eax, 1
mov dword [0x10071078], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000cc65
mov eax, 0x2322
xor ecx, ecx
mov dword [0x10071070], 0x2322
mov dword [0x10071078], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov dword [0x10071084], 0
mov esi, dword [0x1007107c]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x10071084], ebx
mov edx, ecx
add edx, 0x152a
mov dword [0x10071074], edx
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x2c]
idiv ebx
mov dword [0x1007107c], edx
mov esi, dword [ebp - 0x28]
mov bl, byte [edi + esi]
mov byte [0x10071080], bl
add ecx, 0x3473
mov dword [0x10071074], ecx
mov bl, byte [edi + edx]
mov byte [edi + esi], bl
mov ecx, dword [0x10071070]
add ecx, 0xfffff6d2
mov dword [0x10071074], ecx
mov bl, byte [0x10071080]
mov ecx, dword [0x1007107c]
mov byte [edi + ecx], bl
mov ecx, dword [0x10071074]
mov edx, ecx
add edx, 0xffffee66
mov dword [0x10071074], edx
mov edx, dword [0x10071078]
add edx, 1
mov dword [0x10071078], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
jge 0x1000cd90
mov eax, dword [0x10071070]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x1000ccac
mov eax, dword [ebp - 0x34]
add eax, 0xfffffe9a
mov dword [0x10071070], eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000da50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10071078], 0
cmp eax, 0
sete bl
mov dword [0x1007107c], 0
mov dword [0x10071088], 0
mov dword [0x10071070], 0x1722
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
mov al, byte [ebp - 0x1d]
test al, 1
jne 0x1000daad
jmp 0x1000dabf
mov dword [0x10071070], 0xabc
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000dad0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov edi, ecx
add edi, 1
mov dword [0x10071070], 0x1f96
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv esi
mov dword [0x10071078], edx
mov dword [0x10071074], 0xcea
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x30]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1007107c], edx
mov dword [0x10071074], 0xbf7
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10071080], cl
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov edx, dword [0x10071074]
add edx, 0x9a3
mov dword [0x10071074], edx
mov cl, byte [0x10071080]
mov edx, dword [0x1007107c]
mov byte [ebx + edx], cl
mov edx, dword [0x10071078]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1007107c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x10071088], ecx
mov dword [0x10071074], 0x2aca
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x34]
xor cl, byte [edx + esi]
mov byte [0x1007108c], cl
mov dword [0x10071070], 0x1962
mov dword [0x10071074], 0x7df
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], cl
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x3c], edi
je 0x1000dbec
mov eax, dword [0x10071078]
mov ecx, dword [0x1007107c]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jmp 0x1000dad0
jmp 0x1000daad
Function at 0x1000dd20
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x28]
mov dword [0x10071070], 0x1696
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1000cdd0
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x78], 0x149200
mov ecx, dword [0x1007105c]
mov dword [esp + 0x54], ecx
mov ecx, dword [0x10071060]
mov dword [esp + 0x64], ecx
mov ecx, dword [0x10071064]
mov dword [esp + 0x50], ecx
mov ecx, dword [0x10071068]
mov dword [esp + 0x70], ecx
mov ecx, dword [0x1007106c]
mov dword [esp + 0x68], ecx
mov dword [0x10071074], 0x247b
mov dword [esp + 0x20], eax
lea eax, [0x1000e520]
mov dword [0x10071070], 0x99e
mov dword [esp + 0x1c], eax
jmp 0x1000dddc
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x10071074], 0x1961
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
jmp 0x1000dddc
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x1000ddb6
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
jne 0x1000ddb6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [0x10071074], 0x185e
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x5c], eax
mov dword [0x10071070], 0x2f16
call fcn.1000de90
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x1000de7e
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000e060
mov dword [0x10071074], 0x15cc
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x10071074], 0x250
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret