joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1071b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xa4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x1073c4
call fcn.00065094
xor edx, edx
push ebp
push 0x10738b
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00086da4
neg al
sbb esi, esi
lea eax, [ebp - 0xc8]
xor ecx, ecx
mov edx, 0x24
call fcn.00012cd0
lea eax, [ebp - 0xc8]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0xa4]
xor ecx, ecx
mov edx, 0x9c
call fcn.00012cd0
mov dword [ebp - 0xa4], 0x9c
lea eax, [ebp - 0xa4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x10733e
mov ebx, 0x52e
push 0x1073e4
call sub.kernel32.dll_LoadLibraryA
mov edi, eax
test edi, edi
je 0x10733e
push 0x1073f4
push edi
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
test edi, edi
je 0x10733e
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
call edi
test eax, eax
je 0x10733e
mov eax, dword [ebp - 8]
cmp eax, 0x1b
jg 0x1072df
je 0x107308
cmp eax, 0xb
ja case.0x1072a8.0
jmp dword [eax*4 + 0x1072af]
sub eax, 0x1c
je 0x1072fa
sub eax, 0x14
je 0x107324
dec eax
je 0x107332
sub eax, 0x14
je 0x10732b
jmp case.0x1072a8.0
mov ebx, 0x530
jmp 0x10733e
mov ebx, 0x530
jmp 0x10733e
mov ebx, 0x536
jmp 0x10733e
mov ebx, 0x536
jmp 0x10733e
mov ebx, 0x535
jmp 0x10733e
mov ebx, 0x534
jmp 0x10733e
mov ebx, 0x52e
jmp 0x10733e
mov ebx, 0x52f
jmp 0x10733e
mov ebx, 0x52f
jmp 0x10733e
mov ebx, 0x52f
jmp 0x10733e
mov ebx, 0x52e
test esi, esi
je 0x107372
mov eax, ebx
sub eax, 0x52e
je 0x10736d
dec eax
je 0x107358
dec eax
je 0x107366
sub eax, 6
je 0x10735f
jmp 0x107372
mov ebx, 0x532
jmp 0x107372
mov ebx, 0x537
jmp 0x107372
mov ebx, 0x533
jmp 0x107372
mov ebx, 0x531
mov dword [ebp - 4], ebx
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1073af
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10769c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xa4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x107830
call fcn.00065094
xor edx, edx
push ebp
push 0x1077f8
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00086da4
neg al
sbb esi, esi
lea eax, [ebp - 0xc8]
xor ecx, ecx
mov edx, 0x24
call fcn.00012cd0
lea eax, [ebp - 0xc8]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0xa4]
xor ecx, ecx
mov edx, 0x9c
call fcn.00012cd0
mov dword [ebp - 0xa4], 0x9c
lea eax, [ebp - 0xa4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x1077bf
mov ebx, 0x58b
push 0x107850
call sub.kernel32.dll_LoadLibraryA
mov edi, eax
test edi, edi
je 0x1077bf
push 0x107860
push edi
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
test edi, edi
je 0x1077bf
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
call edi
test eax, eax
je 0x1077bf
mov eax, dword [ebp - 8]
cmp eax, 0x30
jg 0x10778b
je 0x1077a5
sub eax, 4
je 0x107797
sub eax, 0x17
je 0x10779e
jmp 0x1077ba
sub eax, 0x31
je 0x1077b3
sub eax, 0x14
je 0x1077ac
jmp 0x1077ba
mov ebx, 0x58d
jmp 0x1077bf
mov ebx, 0x58d
jmp 0x1077bf
mov ebx, 0x58b
jmp 0x1077bf
mov ebx, 0x58b
jmp 0x1077bf
mov ebx, 0x58b
jmp 0x1077bf
mov ebx, 0x58b
test esi, esi
je 0x1077df
mov eax, ebx
sub eax, 0x58b
je 0x1077d3
sub eax, 2
je 0x1077da
jmp 0x1077df
mov ebx, 0x58c
jmp 0x1077df
mov ebx, 0x58e
mov dword [ebp - 4], ebx
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10781c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x107870
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xa0]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x107974
call fcn.00065094
xor ecx, ecx
push ebp
push 0x10793d
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc4]
xor ecx, ecx
mov edx, 0x24
call fcn.00012cd0
lea eax, [ebp - 0xc4]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0xa0]
xor ecx, ecx
mov edx, 0x9c
call fcn.00012cd0
mov dword [ebp - 0xa0], 0x9c
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x107924
xor eax, eax
mov al, byte [ebp - 6]
movzx edx, word [ebp - 8]
dec eax
jne 0x107907
mov ebx, 0x3ea
jmp 0x107924
test dl, 0x80
je 0x107913
mov ebx, 0x3ed
jmp 0x107924
test dl, 2
je 0x10791f
mov ebx, 0x3ec
jmp 0x107924
mov ebx, 0x3eb
mov dword [ebp - 4], ebx
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x107961
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x107994
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xa4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x107b30
call fcn.00065094
xor edx, edx
push ebp
push 0x107afa
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00086da4
lea eax, [ebp - 0xc8]
xor ecx, ecx
mov edx, 0x24
call fcn.00012cd0
lea eax, [ebp - 0xc8]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0xa4]
xor ecx, ecx
mov edx, 0x9c
call fcn.00012cd0
mov dword [ebp - 0xa4], 0x9c
lea eax, [ebp - 0xa4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x107ae1
call fcn.00080018
test al, al
je 0x107a31
mov ebx, 0x57d
jmp 0x107a36
mov ebx, 0x566
push 0x107b50
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x107ae1
push 0x107b60
push esi
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
test esi, esi
je 0x107ae1
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
call esi
test eax, eax
je 0x107ae1
mov eax, dword [ebp - 8]
sub eax, 8
je 0x107a95
sub eax, 0x1d
je 0x107a95
sub eax, 0xd
je 0x107aac
jmp 0x107ac3
call fcn.00080018
test al, al
je 0x107aa5
mov ebx, 0x57c
jmp 0x107ae1
mov ebx, 0x565
jmp 0x107ae1
call fcn.00080018
test al, al
je 0x107abc
mov ebx, 0x57e
jmp 0x107ae1
mov ebx, 0x566
jmp 0x107ae1
call fcn.00080188
test al, al
je 0x107ae1
call fcn.00080018
test al, al
je 0x107adc
mov ebx, 0x580
jmp 0x107ae1
mov ebx, 0x57f
mov dword [ebp - 4], ebx
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x107b1e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x107b70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xa4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x107cb0
call fcn.00065094
xor edx, edx
push ebp
push 0x107c7a
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00086da4
lea eax, [ebp - 0xc8]
xor ecx, ecx
mov edx, 0x24
call fcn.00012cd0
lea eax, [ebp - 0xc8]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0xa4]
xor ecx, ecx
mov edx, 0x9c
call fcn.00012cd0
mov dword [ebp - 0xa4], 0x9c
lea eax, [ebp - 0xa4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x107c61
mov ebx, 0x592
push 0x107cd8
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x107c61
push 0x107ce8
push esi
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
test esi, esi
je 0x107c61
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
call esi
test eax, eax
je 0x107c61
mov eax, dword [ebp - 8]
sub eax, 8
je 0x107c55
sub eax, 0x1d
je 0x107c55
sub eax, 0xd
je 0x107c5c
jmp 0x107c61
mov ebx, 0x591
jmp 0x107c61
mov ebx, 0x590
mov dword [ebp - 4], ebx
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x107c9e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x107cf8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xa4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x107e70
call fcn.00065094
xor edx, edx
push ebp
push 0x107e39
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00086da4
mov ebx, eax
lea eax, [ebp - 0xc8]
xor ecx, ecx
mov edx, 0x24
call fcn.00012cd0
lea eax, [ebp - 0xc8]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0xa4]
xor ecx, ecx
mov edx, 0x9c
call fcn.00012cd0
mov dword [ebp - 0xa4], 0x9c
lea eax, [ebp - 0xa4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x107e0e
xor eax, eax
mov al, byte [ebp - 0xa]
mov dword [ebp - 8], eax
movzx edi, word [ebp - 0xc]
push 0x59
call sub.user32.dll_GetSystemMetrics
dec eax
jne 0x107da4
mov esi, 0x3f7
jmp 0x107dc7
cmp edi, 0x2000
jne 0x107db3
mov esi, 0x3f7
jmp 0x107dc7
cmp edi, 0x8000
jne 0x107dc2
mov esi, 0x3f7
jmp 0x107dc7
mov esi, 0x3f7
cmp dword [ebp - 8], 1
je 0x107e0e
test edi, 0x4000
je 0x107ddc
mov esi, 0x3f7
jmp 0x107e0e
test edi, 0x80
je 0x107deb
mov esi, 0x3f8
jmp 0x107e0e
test edi, 2
je 0x107dfa
mov esi, 0x3f7
jmp 0x107e0e
test edi, 0x400
je 0x107e09
mov esi, 0x3f5
jmp 0x107e0e
mov esi, 0x3f6
test bl, bl
je 0x107e20
mov eax, esi
sub eax, 0x3f7
jne 0x107e20
mov esi, 0x51c
mov dword [ebp - 4], esi
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x107e5d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x110720
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x11083c
call fcn.00065094
xor edx, edx
push ebp
push 0x110807
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, edi
call fcn.00013de4
mov eax, ebx
call fcn.0001ac8c
test al, al
je 0x1107f1
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.00014228
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x1107f1
mov eax, esi
call fcn.0001a430
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1107ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push esi
push 0
mov eax, ebx
call fcn.00014228
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x110854
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 4], 0
jbe 0x1107d4
mov ecx, edi
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.001106b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1107f1
mov eax, dword [ebp - 8]
call fcn.000127f8
ret
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x11082b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11389c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014218
xor eax, eax
push ebp
push 0x113958
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x113936
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00012cd0
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00012cd0
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.0001b490
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x113942
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x11395f
lea eax, [ebp - 4]
call fcn.00013de4
ret
Function at 0x11e96c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x14942c
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x11e98b
mov esi, 1
mov edx, 0x149534
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x11ea05
dec ebx
je 0x11ea29
dec ebx
je 0x11ea4d
dec ebx
je 0x11ea70
jmp 0x11ea89
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x11ea89
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x11ea89
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x11ea89
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x11e9f2
inc esi
add edx, 0x40
cmp esi, 9
jne 0x11e9a7
mov esi, 0x20
mov eax, 0x14945c
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x11eaae
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x11eae8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x1494e3]
test bl, bl
jbe 0x11eb19
lea eax, [esi + 0x3e0]
call fcn.0011eac8
lea eax, [esi + 0x3fc]
call fcn.0011eac8
dec bl
jne 0x11eaff
mov cl, 0x30
mov edi, 0x1494b4
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x11eb3b
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x11eb4a
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x11eb23
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x11eb58
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.0011e900
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x11eb74
mov bl, 0x1c
mov esi, 0x14947c
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.0011e900
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.0011e900
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x11eb90
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.0011eae8
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x11ebb8
mov bl, 1
mov eax, 0x1493ac
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x11ebf1
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x11ebfe
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x11ebdd
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x11ec28
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.0011e96c
jmp 0x11ec50
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.0011e96c
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x11ec58
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x11ec10
mov bl, 0x40
mov esi, 0x1493ec
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x11ecbe
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x11eccd
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x11eca6
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0011e928
inc ebx
inc esi
cmp bl, 0x41
jne 0x11ecdb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x11fb34
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x11fbe0
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x11fbdb
mov eax, ebp
mov edx, 8
call fcn.00014398
push 1
mov eax, ebp
call fcn.00014234
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.0011eb58
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1216f4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x1216fd
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x1218a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00121a3c
xor eax, eax
push ebp
push 0x12187f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 8
je 0x12174c
call fcn.0001387c
jmp 0x121886
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 8
je 0x12180e
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 1
je 0x12179c
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x12179c
lea eax, [ebp - 0x10]
call fcn.001214c8
push dword [ebp - 0x10]
push 0x1218bc
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00014124
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x2c]
call dword [edi + 0x28]
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 4
je 0x1217d1
lea eax, [ebp - 0x18]
call fcn.001214c8
push dword [ebp - 0x18]
push 0x1218bc
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00014124
mov eax, dword [ebp - 0x14]
call fcn.00014228
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 2
je 0x121869
lea eax, [ebp - 0x20]
call fcn.001214c8
push dword [ebp - 0x20]
push 0x1218bc
push ebx
push 0x1218c8
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00014124
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.001216c4
jmp 0x121869
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 1
je 0x121830
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x121830
push ebx
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x2c]
call dword [edi + 0x28]
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 4
je 0x121846
mov eax, ebx
call fcn.00014228
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x24], 2
je 0x121869
lea eax, [ebp - 0x24]
mov ecx, 0x1218c8
mov edx, ebx
call fcn.000140b0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.001216c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x121886
mov eax, dword [ebp - 4]
call fcn.00121a48
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1218a8
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00013e08
ret