joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x10004792
jmp 0x100047c5
mov ecx, dword [ebp + 8]
mov dword [0x1000b1b8], ecx
push 0
push 0
push 0
push 0x10004710
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0
push 0
push 0
push 0x100046e0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000601c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000b134]
jne 0x10006026
repz ret
jmp fcn.10006579

Function at 0x416bb2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x416bc1
pop dword [ebp - 0x1c]
mov eax, 0x416bc1
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x4e2d9
push 0
mov eax, 0x2c2c569
add eax, 0xfd81ed47
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x377b6516
sub ecx, 0x377b257a
mov esi, eax
mov edx, 0x5281ac02
add edx, 0xadc5b1fe
add edx, dword [ebp - 0x1c]
mov edi, 0x6ca96cdc
add edi, 0x6189e00b
add dword [ebp - 0x18], eax
mov ebx, dword [edx]
xor dword [ebp - 0x18], 0x2f09e125
add ebx, edi
mov dword [esi], ebx
xor dword [ebp - 4], 0xfc836d6f
add esi, 4
add edx, 0xb0e8ce2a
sub edx, 0xb0e8ce26
loop 0x416c1b
add eax, 0x4c754a5b
sub eax, 0x4c745918
mov ebx, eax
add eax, 0x9b375349
sub eax, 0x9b375344
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x401040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x419004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
push 4
push 0
push 0
push 0x80000000
push str.part2.bin
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401092
push str.CreateFile_Error
call fcn.00401010
add esp, 4
or eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401106
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4010db
push str.VirtualAlloc_Error
call fcn.00401010
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401106
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
pop esi
call fcn.00401106
mov esp, ebp
pop ebp
ret
Function at 0x402710
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextCharsetInfo]
mov esi, dword [esp + 0xc]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
test edi, edi
jle 0x40275a
mov ecx, dword [esp + 0x10]
mov dl, byte [esp + 0x14]
push ebx
push ebp
mov eax, ecx
sub esi, ecx
mov ebp, edi
mov bl, byte [esi + eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ebp
jne 0x402744
pop ebp
mov byte [edi + ecx], 0
pop ebx
pop edi
pop esi
ret 0xc
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov byte [eax + ecx], 0
ret 0xc

Function at 0x402770
Capabilities:
Get disk information

Disassembly:
sub esp, 0x68
push esi
push edi
push 0
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
push 0xc
push 0
push 0x407154
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
lea edx, [esp + 0x10]
push 0x407150
push edx
call esi
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4027f0
push 0x40714c
push 0x407148
push 0x407144
push 0x407140
push 0x40713c
push 0x407138
lea eax, [esp + 0x24]
push str._s_s_s_s_s_s
push eax
call esi
add esp, 0x20
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
xor ecx, ecx
test eax, eax
je 0x40281c
push eax
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x68
ret
pop edi
mov eax, ecx
pop esi
add esp, 0x68
ret
Function at 0x402a90
Capabilities:
Create process on windows
Delete file

Disassembly:
sub esp, 0x26c
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x71]
mov byte [esp + 0x70], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.00402d00
mov eax, dword [eax + 4]
test eax, eax
jne 0x402ac8
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea ecx, [esp + 0x74]
push 0x407188
push ecx
call ebp
mov eax, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
je 0x402b03
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x402afa
cmp al, 0xff
je 0x402afa
dec al
mov byte [ecx], al
jmp 0x402b03
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edi, dword [esp + 0x27c]
push edi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea edx, [esp + 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x70]
mov ecx, esi
push eax
push edi
call fcn.00402c30
test eax, eax
je 0x402c20
lea ecx, [esp + 0x70]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
je 0x402c20
xor edx, edx
mov ecx, 0x11
mov dword [esp + 0xc], edx
xor eax, eax
lea edi, [esp + 0x2c]
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], edx
mov ecx, 0x40
lea edi, [esp + 0x175]
mov word [esp + 0x5c], ax
mov byte [esp + 0x174], dl
push 0x407184
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x74]
lea ecx, [esp + 0x178]
push eax
push str._s_s
push ecx
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 1
mov dword [esp + 0x28], edx
call ebp
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x174]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402c20
mov eax, dword [esp + 0x280]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0xc]
shl edx, 3
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x26c
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x26c
ret 8
Function at 0x402d00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x40c
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
xor esi, esi
push eax
push 0x3f5
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x18]
push ecx
push esi
push 0x40718c
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ebp, dword [esp + 0x420]
mov al, byte [esp + 0x13]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
mov byte [ebp], al
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 4], esi
mov ebx, ecx
mov dword [ebp + 8], esi
cmp ebx, 0xfffffffd
mov dword [ebp + 0xc], esi
jbe 0x402d68
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x402d9b
mov al, byte [ecx - 1]
test al, al
je 0x402d9b
cmp al, 0xff
je 0x402d9b
cmp ebx, esi
jne 0x402dce
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 4
cmp ebx, esi
jne 0x402db8
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 4
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x402dc4
cmp eax, ebx
jae 0x402dd7
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
pop edi
pop esi
mov byte [eax + ebx], 0
mov eax, ebp
pop ebp
pop ebx
add esp, 0x40c
ret 4
Function at 0x403970
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push edi
push eax
push str.SoftwareASD
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 8]
push ecx
stosb byte es:[edi], al
call sub.MFC42.DLL_CTime::GetTickCount
mov eax, dword [eax]
lea edx, [esp + 0xc]
push 0xa
push edx
push eax
call dword [sym.imp.MSVCRT.dll__ltoa]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [esp + 4]
dec ecx
push ecx
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
push 0x4071d4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x10c
ret
Function at 0x10011360
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x10049880]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov dword [ebp - 0xdc], ebx
call fcn.100107e0
mov esi, eax
test esi, esi
je 0x100113c3
mov ecx, dword [ebp - 0xd8]
sub esi, edi
mov edx, dword [ebp - 0xd4]
mov al, 3
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov byte [ebx + 8], al
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003932e
mov esp, ebp
pop ebp
ret 8
push 0x1003c4e8
push edi
call fcn.1002dfe0
add esp, 8
test eax, eax
je 0x100113f5
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x100113f7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003932e
mov esp, ebp
pop ebp
ret 8
xor ebx, ebx
push ebx
lea eax, [ebp - 0xd8]
push eax
push edi
call fcn.10010770
mov esi, eax
test esi, esi
jne 0x10011491
push 0x2e
push edi
call fcn.10024bb0
mov esi, eax
add esp, 8
test esi, esi
je 0x100113e0
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011425
sub ecx, edx
cmp ecx, 0xc8
ja 0x100113e0
lea edx, [ebp - 0xd0]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10011440
call fcn.1002ac6d
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + esi - 0xd0], al
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.10010770
mov esi, eax
test esi, esi
je 0x100113e0
mov eax, edi
lea ecx, [ebp - 0xd0]
sub eax, ecx
add esi, eax
test esi, esi
je 0x100113e0
mov ebx, dword [ebp - 0xdc]
sub esi, edi
movsd xmm0, qword [ebp - 0xd8]
mov al, 0x13
mov ecx, dword [ebp - 4]
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov byte [ebx + 8], al
lea eax, [esi + 1]
pop esi
pop ebx
call fcn.1003932e
mov esp, ebp
pop ebp
ret 8
Function at 0x10011570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
call fcn.1002ac6d
mov ecx, dword [ebp + 8]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x1003bcf1], 8
je 0x100115c3
nop dword [eax]
mov al, byte [ecx + 1]
inc ecx
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x1003bcf1], 8
jne 0x100115b0
mov al, byte [ebp - 1]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x100115d6
mov dword [ebp - 0x14], 1
jmp 0x100115de
cmp al, 0x2b
mov dword [ebp - 0x14], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x10011717
mov al, byte [edx + 1]
cmp al, 0x78
je 0x100115f6
cmp al, 0x58
jne 0x10011717
movsd xmm2, qword [0x1003c568]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov dword [ebp - 0x10], edx
mov byte [ebp - 1], al
cmp ecx, dword [ebp - 0x18]
jne 0x10011621
cmp dword [ebp - 8], 0
jne 0x10011673
mov dword [ebp - 8], 1
inc edx
jmp 0x10011601
movzx eax, al
test byte [eax + 0x1003bcf1], 0x10
je 0x10011673
test edi, edi
jne 0x1001163c
cmp byte [ebp - 1], 0x30
jne 0x1001163c
inc dword [ebp - 0xc]
jmp 0x10011669
inc edi
cmp edi, 0x1e
jg 0x10011668
test byte [ecx + 0x1003bcf1], 2
je 0x10011650
add ecx, 0xffffffd0
jmp 0x10011656
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x10011669
inc esi
cmp dword [ebp - 8], 0
je 0x10011670
dec esi
inc edx
jmp 0x10011601
mov eax, dword [ebp - 0xc]
add eax, edi
je 0x10011717
mov eax, dword [ebp + 0xc]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x10011690
cmp al, 0x50
jne 0x100116f1
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x100116a5
mov edx, dword [ebp - 0x10]
lea edi, [ecx + 1]
add edx, 2
jmp 0x100116b1
cmp al, 0x2b
jne 0x100116af
mov edx, dword [ebp - 0x10]
add edx, 2
xor edi, edi
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x1003bcf1], 2
je 0x10011717
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x1003bcf1], 2
jne 0x100116c2
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
cmp dword [ebp - 0x14], 0
je 0x100116fe
xorps xmm1, xmmword [0x1003c570]
push esi
sub esp, 8
movsd qword [esp], xmm1
call fcn.1002aa36
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10015c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
xor eax, dword [ebp + 0x10]
test esi, esi
je 0x10015cbf
push edi
mov edi, dword [ebp + 8]
movzx edx, byte [edi + esi - 1]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub esi, 1
jne 0x10015ca4
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10015cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 6], 0
jne 0x10015d1c
mov edx, dword [edi + 8]
push esi
mov esi, dword [edi + 0xc]
xor edx, esi
test esi, esi
je 0x10015d0d
push ebx
lea ebx, [edi + 0xf]
add ebx, esi
mov ecx, edx
lea ebx, [ebx - 1]
mov eax, edx
shl ecx, 5
shr eax, 2
add ecx, eax
movzx eax, byte [ebx + 1]
add ecx, eax
xor edx, ecx
sub esi, 1
jne 0x10015cf0
pop ebx
pop esi
mov dword [edi + 8], edx
mov eax, edx
mov byte [edi + 6], 1
pop edi
pop ebp
ret 4
mov eax, dword [edi + 8]
pop edi
pop ebp
ret 4

Function at 0x10022870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100228d4
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp - 4]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10022893
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10023050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10049880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0x10022bb0
call fcn.10015560
mov esi, eax
test esi, esi
je 0x10023293
push 0x10022c10
push esi
call fcn.10001330
push 1
push 0x10004670
push 0x1003bb20
push esi
call fcn.10003360
push 0xfffffffffffffffe
push esi
call fcn.100024a0
push 1
push 0x10018c60
push str.string
push esi
call fcn.10003360
push 0xfffffffffffffffe
push esi
call fcn.100024a0
push 0
push str.main
push dword [ebp + 0xc]
push edi
push esi
call fcn.10003170
push 0
push 0
push esi
call fcn.10001590
push 0
push 0x10022fd0
push esi
call fcn.10001d80
push 0
push 1
push 0xfffffffffffffffe
push esi
call fcn.10002240
push 0
push 0x10022e10
push esi
call fcn.10001d80
push 0
push 2
push 0xfffffffffffffffe
push esi
call fcn.10002240
push 0
push 0x10022f70
push esi
call fcn.10001d80
push 0
push 3
push 0xfffffffffffffffe
push esi
call fcn.10002240
push 0
push 0x10022d20
push esi
call fcn.10001d80
push 0
push 4
push 0xfffffffffffffffe
push esi
call fcn.10002240
push 0
push 0x10022c30
push esi
call fcn.10001d80
push 0
push 5
push 0xfffffffffffffffe
push esi
call fcn.10002240
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x5a4d
and eax, 0xffff0000
nop dword [eax]
sub eax, 0x10000
cmp word [eax], di
jne 0x10023170
push eax
push esi
call fcn.10001e80
push 0
push 0x3c
push 0xfffffffffffffffe
push esi
call fcn.10002240
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
and eax, 0xffff0000
nop
sub eax, 0x10000
cmp word [eax], di
jne 0x100231a0
push eax
push esi
call fcn.10001e80
push 0
push 0x3d
push 0xfffffffffffffffe
push esi
call fcn.10002240
mov eax, 0xffff0000
and eax, dword [ebp + 4]
cmp word [eax], di
je 0x100231da
nop word [eax + eax]
sub eax, 0x10000
cmp word [eax], di
jne 0x100231d0
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.10001f40
push 0
push 0xc8
push 0xfffffffffffffffe
push esi
call fcn.10002240
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push dword [ebp - 0x10c]
push esi
call fcn.10001d50
push 0
push 0xc9
push 0xfffffffffffffffe
push esi
call fcn.10002240
push 0
push esi
call fcn.10001d50
push 0
push 0xca
push 0xfffffffffffffffe
push esi
call fcn.10002240
push 0
push 0
push 0
push 1
push 1
push esi
call fcn.10001c70
test eax, eax
je 0x10023291
push 0
push 0xffffffffffffffff
push esi
call fcn.100026d0
push esi
call fcn.100154b0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003932e
mov esp, ebp
pop ebp
ret 8
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003932e
mov esp, ebp
pop ebp
ret 8
Function at 0x100243a0
Capabilities:
Listen for remote procedure calls

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x10049880]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x1003e1e8]
mov eax, dword [0x1003e228]
push edi
mov edi, dword [ebp + 8]
movups xmmword [ebp - 0x148], xmm0
mov dword [ebp - 0x108], eax
movups xmm0, xmmword [0x1003e1f8]
movups xmmword [ebp - 0x138], xmm0
movups xmm0, xmmword [0x1003e208]
movups xmmword [ebp - 0x128], xmm0
movups xmm0, xmmword [0x1003e218]
movups xmmword [ebp - 0x118], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [ebp - 0x114]
push dword [eax + 4]
lea eax, [ebp - 0x104]
push str._s_d
push eax
call fcn.10023960
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10024439
mov eax, 0x6aa
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003932e
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x114]
push esi
push 0
mov eax, dword [eax]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x148]
push eax
push 0xa
call dword [sym.imp.RPCRT4.dll_RpcServerUseAllProtseqsIf]
mov esi, eax
test esi, esi
jne 0x100244be
push eax
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf]
mov esi, eax
test esi, esi
jne 0x100244be
push 0x100499dc
push dword [ebp + 0xc]
mov ecx, edi
push fcn.100242e0
call dword [0x1003b174]
call edi
mov esi, eax
test esi, esi
js 0x100244bc
push 1
push 0x4d2
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
test esi, esi
je 0x100244cc
cmp dword [0x100499dc], 0
je 0x100244cc
call fcn.100244e0
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop edi
call fcn.1003932e
mov esp, ebp
pop ebp
ret 8

Function at 0x1002580a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003e8b8
push 0x1003e8b0
push 0x1003e8b8
push 0x21
call fcn.100256e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10025841
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003b174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10025849
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003e8cc
push 0x1003e8c4
push 0x1003e8cc
push 0x22
call fcn.100256e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10025883
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003b174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]