joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10139f88
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov dword [0x10167624], 0x122e
cmp eax, 0
sete bl
cmp ecx, 0
sete bh
and bh, bl
test bh, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x1013a1a0
jmp 0x10139ffe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x24]
cmp edx, esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
je 0x1013a189
jmp 0x1013a053
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x30]
mov byte [ebp - 0x31], cl
mov dword [ebp - 0x2c], edx
jmp 0x1013a053
mov dword [0x10167624], 0xc01
mov ecx, dword fs:[0x18]
xor eax, eax
mov dword [0x10167624], 0x1973
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
add edx, 0x14
mov dword [0x10167628], 0x177a
mov ecx, dword [ecx + 0x14]
mov dword [0x10167624], 0x1eb7
cmp ecx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], eax
je 0x1013a1a0
jmp 0x10139fe8
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x31]
and bh, bl
test bh, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], esi
jne 0x1013a084
jmp 0x1013a0a8
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff8
mov dword [0x10167624], 0xdfa
mov dword [0x10167628], 0xa7
mov dword [ebp - 0x18], eax
jmp 0x1013a1a0
mov eax, 0xdfa
xor ecx, ecx
mov edx, dword [ebp - 0x38]
mov si, word [edx]
shr si, 1
movzx edi, si
cmp si, 0
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], ecx
je 0x10139fcd
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x44]
add ecx, 0x264a
mov edx, eax
add edx, 1
mov esi, dword [ebp - 0x3c]
mov di, word [esi + eax*2]
mov bx, di
add bx, 0xffbf
mov si, di
add si, 0x20
cmp bx, 0x1a
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], edx
mov word [ebp - 0x5a], di
mov word [ebp - 0x5c], si
jb 0x1013a120
mov ax, word [ebp - 0x5a]
mov word [ebp - 0x5c], ax
mov ax, word [ebp - 0x5c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x50]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x58]
mov edi, dword [ebp - 0x48]
cmp esi, edi
setb bh
and al, bh
test al, 1
mov eax, dword [ebp - 0x54]
mov byte [ebp - 0x5d], bl
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], eax
jne 0x1013a0d5
mov al, byte [ebp - 0x5d]
test al, 1
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x1c], ecx
jne 0x1013a16f
jmp 0x10139fcd
mov eax, dword [ebp - 0x54]
mov dword [0x10167624], eax
mov dword [0x10167628], 0x671
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x18], ecx
jmp 0x1013a1a0
mov eax, dword [ebp - 0x28]
mov dword [0x10167624], eax
xor eax, eax
mov dword [0x10167628], 0x671
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1013a2ef
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x10167624]
add eax, 0xffffda07
mov dword [0x10167624], eax
call fcn.10001070
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x1013a347
jmp 0x1013a473
mov eax, dword [esp + 0x20]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
je 0x1013a3e6
jmp 0x1013a3fa
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
jmp 0x1013a473
lea eax, [esp + 0x28]
mov dword [0x10167624], 0xbdc
mov dword [esp + 0x14], eax
call fcn.1013b5d2
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
jne 0x1013a33a
lea eax, [esp + 0x80]
mov dword [esp], eax
call fcn.1013a522
lea ecx, [0x1013b83c]
mov dword [0x10167628], 0xb1d
mov edx, dword [esp + 0x80]
mov dword [esp + 0x50], edx
mov dword [esp + 0x2c], 0x13c000
mov edx, dword [0x10167610]
mov dword [esp + 0x78], edx
mov edx, dword [0x10167614]
mov dword [esp + 0x60], edx
mov edx, dword [0x10167618]
mov dword [esp + 0x40], edx
mov edx, dword [0x1016761c]
mov dword [esp + 0x44], edx
mov dword [0x10167624], 0x135a
mov edx, dword [0x10167620]
mov dword [esp + 0x68], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
jmp 0x1013a322
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1013a411
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x20], eax
jmp 0x1013a322
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x74], ecx
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x5c], esi
mov dword [0x10167624], 0x111c
mov esi, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1013a7dd
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x10167624]
add ecx, 0xfffff0fe
mov dword [0x10167624], ecx
mov dword [esp + 0x18], eax
jmp 0x1013a33a
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x1013a7dd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x1013d565]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x10167624], 0x90d
mov dword [0x10167628], 0xb59
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.1013af00
mov eax, dword [0x10167624]
add eax, 0x1da2
mov dword [0x10167628], eax
call fcn.1013aa9a
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1013acf8
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x1013a932
jmp 0x1013a885
mov eax, dword [ebp - 0x44]
add eax, 0x20d0
mov dword [ebp - 0x48], eax
mov dword [0x10167628], 0x1479
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
jmp 0x1013a932
mov eax, dword [ebp - 0x3c]
mov dword [0x10167628], 0xc01
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10167624], 0x1a95
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.1013ab3e
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
mov dword [0x10167628], 0x539
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x48], ecx
mov ecx, dword [0x10167628]
add ecx, 0xffffeed3
mov dword [0x10167628], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x30], ecx
mov dword [0x10167624], 0x147
cmp ecx, 0
mov dword [ebp - 0x40], eax
jne 0x1013a865
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
Function at 0x1013b070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1016762c], 0
mov dword [0x10167630], 0
mov dword [0x1016763c], 0
mov ebx, dword [0x10167624]
add ebx, 0x5f1
mov dword [0x10167624], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1013b1fa
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add ecx, 1
add edx, 0x214e
mov ebx, esi
add ebx, 1
mov dword [0x10167624], edx
mov dword [ebp - 0x30], eax
mov eax, ecx
cdq
idiv edi
mov dword [0x1016762c], edx
mov dword [0x10167628], 0xe94
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ecx + edx]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x30]
add ecx, edx
mov eax, ecx
cdq
idiv edi
mov dword [0x10167630], edx
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x34]
mov cl, byte [ecx + edi]
mov byte [0x10167634], cl
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x24]
mov byte [edx + edi], cl
mov dword [0x10167624], 0x20fe
mov cl, byte [0x10167634]
mov edx, dword [0x10167630]
mov edi, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov edx, dword [0x1016762c]
movzx edx, byte [edi + edx]
mov ecx, dword [0x10167630]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1016763c], ecx
mov dword [0x10167624], 0x211
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x1c]
mov ch, byte [edx + esi]
mov byte [0x10167641], ch
mov byte [0x10167642], cl
mov dword [0x10167624], 0x1106
xor ch, cl
mov byte [0x10167640], ch
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x38], ebx
je 0x1013b1fa
mov eax, dword [0x10167624]
mov ecx, dword [0x1016762c]
mov edx, dword [0x10167630]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], edx
jmp 0x1013b0de
mov eax, dword [0x10167628]
add eax, 0x221
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [0x10167628], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1013b2be
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10167630], 0
mov byte [0x10167634], 0
mov dword [0x10167624], 0x9b7
mov dword [0x1016762c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1013b316
xor eax, eax
mov dword [0x1016762c], 0
mov dword [ebp - 0x20], eax
jmp 0x1013b348
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10167624], 0x1a34
mov eax, dword [0x1016762c]
add eax, 1
mov dword [0x1016762c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1013b316
jmp 0x1013b305
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10167638], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10167628], 0xa70
mov edi, dword [0x10167630]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10167638], esi
mov dword [0x10167624], 0x2605
mov eax, esi
cdq
idiv ecx
mov dword [0x10167630], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10167634], cl
mov dword [0x10167628], 0x1d7f
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x10167624], 0x14bd
mov cl, byte [0x10167634]
mov esi, dword [0x10167630]
mov byte [ebx + esi], cl
mov esi, dword [0x1016762c]
add esi, 1
mov dword [0x1016762c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1013b348
mov dword [0x10167624], 0x20f6
mov dword [0x10167628], 0xbda
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1013b419
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [0x10167624]
add ecx, 0x89f
mov dword [0x10167624], ecx
mov dword [0x10167628], 0x1fa4
mov dword [ebp - 0x10], eax
call fcn.1013a1ab
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1013b471
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x10167624], 0xfffff354
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x10167628], 0x1e93
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x1013b5c7
jmp 0x1013b4ec
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x34], eax
jb 0x1013b504
jmp 0x1013b5c7
mov eax, 0xfffff354
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x2c]
add edx, esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
xor esi, esi
add edx, 0x89f
mov edi, dword [ebp - 0x28]
mov ebx, dword [edi + ecx*4]
mov dword [0x10167624], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x54], esi
mov eax, dword [ebp - 0x54]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x59], bh
mov byte [ebp - 0x5a], cl
je 0x1013b58e
mov eax, dword [ebp - 0x58]
add eax, 1
mov cl, byte [ebp - 0x59]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x5a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x61], ch
mov al, byte [ebp - 0x61]
test al, 1
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x54], ecx
jne 0x1013b530
jmp 0x1013b58e
mov al, byte [ebp - 0x5a]
test al, 1
jne 0x1013b59a
jmp 0x1013b4bd
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x10167624], 0x5ea
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x10167628], 0x19e
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1013b5d2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x10167624]
add eax, 0xfffff2a7
mov dword [0x10167624], eax
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [0x10167628], 0x1944
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10167624], 0x2173
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x1013b64f
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], eax
jl 0x1013b622
mov eax, dword [ebp - 0x24]
mov dword [0x10167628], 0x1341
mov dword [0x10167624], 0x356f
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
jne 0x1013b72c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x6f
jne 0x1013b72c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1013b72c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1013b72c
mov dword [0x10167624], 0x8c1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1013b72c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1013b72c
mov eax, 0xb8a
mov ecx, 0x23bc
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
mov di, word [edx + esi*2 - 0xe]
cmp di, 0x6c
sete bl
cmp di, 0x6c
mov byte [ebp - 0x2b], bl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
je 0x1013b713
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [0x10167624], eax
mov cl, byte [ebp - 0x2b]
and cl, 1
movzx eax, cl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403cd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov eax, 0xffffb4b1
xor ebx, ebx
push edi
mov word [0x433608], ax
mov dword [0x434fec], 0xe8eb1f8f
push ebx
call fcn.0041edc9
pop ecx
mov ecx, dword [0x434cc8]
mov esi, eax
and ecx, 0x79aa2051
mov edi, edx
xor dword [0x4345b8], ecx
dec dword [0x434cc8]
cmp dword [0x436310], ebx
jne 0x403de1
cmp dword [0x436b28], ebx
jne 0x403de1
inc word [0x43348e]
mov ax, word [0x43348e]
cwde
imul eax, eax, 0x17c40c40
add eax, 0x317f767d
cmp eax, 0x8a31bce8
je 0x403d77
movsx eax, word [0x43324e]
cmp eax, 0xa5d69ef
jg 0x403d77
movsx ecx, word [0x4335ce]
movzx eax, word [0x43375e]
and ecx, 0x9d37b1b4
or eax, ecx
mov word [0x43371c], ax
push ebx
call fcn.0041edc9
sub eax, esi
pop ecx
sbb edx, edi
cmp edx, ebx
jg 0x403dd7
jge 0x403dd3
or dword [0x435184], 0xda97653f
push 0x3e8
call dword [0x436d30]
mov ecx, dword [0x434498]
movzx eax, word [0x4333c0]
not ecx
xor ecx, 0xa28046a
or ecx, 0xb1d3e315
imul eax, ecx
push ebx
mov word [0x4333c0], ax
call fcn.0041edc9
sub eax, esi
pop ecx
sbb edx, edi
mov dword [ebp - 4], edx
js 0x403d88
jg 0x403dd7
cmp eax, ebx
jb 0x403d88
add dword [0x434d80], 0x51243810
inc dword [0x4353dc]
mov eax, dword [0x4353dc]
pop edi
pop esi
pop ebx
cmp eax, dword [0x435dc4]
jl 0x403e07
mov eax, dword [0x4355a0]
or eax, 0x9a048a17
sub dword [0x4345f4], eax
mov esp, ebp
pop ebp
ret
Function at 0x4064b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
dec dword [0x4353fc]
mov eax, dword [0x4353fc]
cmp eax, 0x25380b6
jge 0x4064e5
mov eax, dword [0x434d38]
sar eax, 9
imul eax, eax, 0xe5c5fe96
cmp dword [0x434b00], eax
jg 0x4064e5
add dword [0x4348c0], 0xe3e0eb63
mov ecx, dword [0x436040]
movzx eax, word [0x4337e0]
and ecx, 0xb450a0
shl ecx, 7
or ecx, 0x5428cdb
xor eax, ecx
mov word [0x4337e0], ax
imul eax, dword [0x435948], 0xe0ac8600
cmp eax, 0x5a0d36a9
je 0x406526
mov dword [0x435580], 0xfeffefff
jmp 0x406540
movsx ecx, word [0x4332ee]
mov eax, dword [0x4347ec]
or ecx, 0x2f48bdf5
imul eax, ecx
mov dword [0x4347ec], eax
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jle 0x4066a6
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
sub ebx, esi
and dword [0x434ea8], 0x10069010
mov ecx, 0x5709ac7c
cmp dword [esi], edi
mov eax, dword [0x4356f4]
sbb edx, edx
sar eax, 8
imul eax, eax, 0x5ec4a549
neg edx
sub ecx, eax
xor dword [0x435de4], ecx
sub dword [esi], edi
and dword [0x435428], 0xf4b82165
mov eax, dword [esi]
cmp eax, dword [ebx + esi]
movzx eax, word [0x433ca4]
sbb edi, edi
xor eax, 0x8212d802
mov word [0x433ca4], ax
neg edi
mov eax, dword [ebx + esi]
add edi, edx
sub dword [esi], eax
add esi, 4
add dword [0x435b38], 0xe7e73fef
dec dword [ebp + 8]
jne 0x406556
test edi, edi
je 0x4066a4
add dword [0x435c7c], 0x924d7a97
cmp dword [esi], edi
mov eax, dword [0x435024]
mov ecx, dword [0x435618]
sbb edx, edx
imul eax, eax, 0x6eaf76e8
neg edx
sar ecx, 9
sub ecx, eax
mov eax, dword [0x434ef0]
imul eax, ecx
mov dword [0x434ef0], eax
sub dword [esi], edi
movsx eax, word [0x433952]
shl eax, 4
sub eax, 0x1702ce41
cmp eax, 0x4ce8a67
je 0x406635
mov ax, word [0x4332a2]
movsx ecx, ax
mov eax, dword [0x435b78]
add eax, 0x105db76e
add eax, ecx
mov dword [0x435b78], eax
dec word [0x4332a2]
movsx eax, word [0x43406c]
mov edi, edx
add eax, 0x7f8cd3c
cmp eax, 0x966c1fbf
jl 0x406667
mov ecx, dword [0x435714]
mov eax, dword [0x434d1c]
not ecx
add eax, ecx
cmp eax, 0xbe63de08
jl 0x406676
mov eax, dword [0x434950]
jmp 0x406676
imul eax, dword [0x4347d0], 0xb7fedc4
mov dword [0x4347d0], eax
movsx ecx, word [0x4338a4]
add esi, 4
movzx eax, word [0x4333c4]
shl ecx, 8
and eax, ecx
mov word [0x4333c4], ax
or dword [0x4357a4], 0x80a5bbbf
test edx, edx
jne 0x4065c9
pop esi
pop ebx
dec dword [0x43445c]
mov eax, dword [0x43445c]
mov dword [0x434c1c], eax
pop edi
pop ebp
ret
Function at 0x4080a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x436060]
or eax, 0xb75c5a02
sub dword [0x4351c4], eax
dec dword [0x436060]
and dword [ecx], 0
movzx eax, word [0x433438]
or eax, 0x20a8a680
mov word [0x433438], ax
and dword [ecx + 4], 0
and dword [0x434b70], 0xeac2e17a
mov dword [ecx + 8], 0x67452301
mov dword [0x435e08], 0x8004030e
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x434ff8]
not eax
cmp eax, 0x887c3cc8
jge 0x40810e
imul eax, dword [0x434b54], 0x2f1eef76
mov dword [0x434b54], eax
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [0x435b50]
not eax
or eax, 0x29082256
cmp eax, 0x1dd3a874
jg 0x408132
add dword [0x435cc4], 0xea7bc6b9
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x435e90]
add eax, 0x8f6bc62e
xor dword [0x434e40], eax
ret

Function at 0x40a81b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x433744]
mov ecx, dword [ebp + 0x10]
imul eax, eax, 0xd52d15a8
mov word [0x433744], ax
test ecx, ecx
jne 0x40a84e
movzx eax, word [0x433df6]
xor eax, 0x61440e62
mov word [0x433df6], ax
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [0x4358c0], 0xd8b0c387
dec ecx
je 0x40a86c
mov al, byte [esi]
cmp al, byte [edx]
jne 0x40a86c
inc esi
inc edx
jmp 0x40a85f
mov ecx, dword [0x435fbc]
movzx eax, byte [esi]
add ecx, 0x2edc5cd3
xor dword [0x434498], ecx
movzx ecx, byte [edx]
sub eax, ecx
add dword [0x434b90], 0xf1df455b
pop esi
pop ebp
ret
Function at 0x10001820
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.1000bad0
mov eax, dword [0x10014004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x1000
mov dword [ebp - 0x1014], edx
push edi
mov dword [ebp - 0x100c], ecx
mov dword [ebp - 0x1010], eax
call dword [sym.imp.ProcessHacker.exe__PhAllocate_4]
push edi
mov ebx, eax
xor esi, esi
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.10004380
add esp, 0xc
lea eax, [ebp - 0x1008]
push eax
push edi
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x100c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov edx, dword [sym.imp.ProcessHacker.exe__PhReAllocate_8]
test eax, eax
je 0x100018f7
mov ecx, dword [ebp - 0x1008]
test ecx, ecx
je 0x100018f7
lea eax, [ecx + esi]
cmp edi, eax
jae 0x100018b4
add edi, edi
push edi
push ebx
call edx
mov ecx, dword [ebp - 0x1008]
mov ebx, eax
push ecx
lea eax, [ebp - 0x1004]
push eax
lea eax, [esi + ebx]
push eax
call fcn.1000bb00
add esi, dword [ebp - 0x1008]
lea eax, [ebp - 0x1008]
add esp, 0xc
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x100c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov edx, dword [sym.imp.ProcessHacker.exe__PhReAllocate_8]
test eax, eax
jne 0x10001895
lea eax, [esi + 1]
cmp edi, eax
jae 0x10001907
lea eax, [edi + 1]
push eax
push ebx
call edx
mov ebx, eax
mov eax, dword [ebp - 0x1010]
mov ecx, dword [ebp - 4]
mov byte [esi + ebx], 0
xor ecx, ebp
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 0x1014]
pop esi
mov dword [eax], ebx
mov al, 1
pop ebx
call fcn.100033b8
mov esp, ebp
pop ebp
ret 4
Function at 0x419655
Capabilities:
Encode data using xor

Disassembly:
sbb dword [eax], esp
movsd dword es:[edi], dword [esi]
lcall 0xb384, 0x50e45f8
out 0x96, al
das
int 0xec
mov al, 0x61
mov byte [0xb176fdde], al
out 0xf9, eax
retf 0xac58
movsd dword es:[edi], dword [esi]
jnp 0x419638
invalid

Function at 0x421655
Capabilities:
Check for software breakpoints

Disassembly:
add eax, 0x223cc166
fsubr qword [esi + 0x312d014a]
jmp 0x4216c9
insd dword es:[edi], dx
invalid