joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509e50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, eax
mov ebx, 0xffffffff
lea esi, [esi]
add ebx, 1
mov edx, ecx
and edx, 1
cmp edx, 1
jne 0x509e83
mov edx, ecx
shr edx, 1
xor edx, 0xedb88320
mov ecx, edx
jmp 0x509e85
shr ecx, 1
cmp ebx, 7
jl 0x509e68
mov dword [eax*4 + 0x6ed270], ecx
cmp eax, 0xff
jl 0x509e58
pop ebx
ret

Function at 0x509ea0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x509ed4
mov edi, 0xffffffff
nop
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x6ed270]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x509eb0
pop edi
pop esi
pop ebx
ret
Function at 0x50bae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 0x10]
mov edi, eax
mov eax, dword [edi + 0x20]
mov dword [esp + 4], eax
mov edx, edi
mov eax, dword [edx + 0x30]
mov ecx, dword [edx + 0x68]
sub eax, ecx
sub eax, dword [edx + 0x60]
mov dword [esp], eax
test eax, eax
jne 0x50bb1e
mov eax, edi
cmp dword [eax + 0x60], 0
jne 0x50bb1e
cmp dword [eax + 0x68], 0
jne 0x50bb1e
mov eax, dword [esp + 4]
mov dword [esp], eax
jmp 0x50bc24
cmp dword [esp], 0xffffffff
jne 0x50bb2d
sub dword [esp], 1
jmp 0x50bc24
mov eax, dword [esp + 4]
xor edx, edx
mov ecx, eax
mov eax, edx
mov edx, ecx
mov esi, eax
sub edx, 0x106
sbb esi, 0
add edx, ecx
adc esi, eax
mov eax, dword [edi + 0x60]
xor ecx, ecx
cmp esi, ecx
jl 0x50bb5f
jg 0x50bc24
cmp edx, eax
ja 0x50bc24
mov eax, dword [edi + 0x2c]
add eax, dword [esp + 4]
mov edx, dword [edi + 0x2c]
mov ecx, dword [esp + 4]
call fcn.004038c0
mov eax, dword [esp + 4]
sub dword [edi + 0x64], eax
mov eax, dword [esp + 4]
sub dword [edi + 0x60], eax
mov eax, dword [esp + 4]
sub dword [edi + 0x50], eax
mov ebx, dword [edi + 0x40]
mov eax, dword [edi + 0x38]
lea eax, [eax + ebx*2]
mov dword [esp + 0xc], eax
lea esi, [esi]
sub dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
movzx edx, word [eax]
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
ja 0x50bbc3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov word [edx], ax
jmp 0x50bbcc
mov eax, dword [esp + 0xc]
mov word [eax], 0
sub ebx, 1
jne 0x50bb98
mov ebx, dword [esp + 4]
mov eax, dword [edi + 0x34]
lea eax, [eax + ebx*2]
mov dword [esp + 0xc], eax
nop
sub dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
movzx edx, word [eax]
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
ja 0x50bc0b
mov edx, dword [esp + 8]
sub edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov word [eax], dx
jmp 0x50bc14
mov eax, dword [esp + 0xc]
mov word [eax], 0
sub ebx, 1
jne 0x50bbe0
mov eax, dword [esp]
add eax, dword [esp + 4]
mov dword [esp], eax
nop
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x50bc93
mov eax, edi
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x60]
mov eax, dword [eax + 0x68]
add eax, ecx
add edx, eax
mov eax, dword [edi]
mov ecx, dword [esp]
call fcn.0050b700
mov ebx, eax
ret
add dword [edi + 0x68], ebx
cmp dword [edi + 0x68], 3
jb 0x50bc7c
mov eax, edi
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x60]
movzx eax, byte [edx + eax]
mov dword [edi + 0x3c], eax
mov eax, edi
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x60]
movzx edx, byte [edx + ecx + 1]
mov esi, dword [eax + 0x3c]
mov ecx, dword [eax + 0x4c]
shl esi, cl
xor edx, esi
and edx, dword [eax + 0x48]
mov dword [edi + 0x3c], edx
mov eax, edi
cmp dword [eax + 0x68], 0x106
jae 0x50bc93
mov eax, dword [eax]
cmp dword [eax + 4], 0
jne 0x50baf0
lea esp, [esp + 0x10]
pop edi
pop esi
pop ebx
ret
Function at 0x514850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x514874
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x51493a
mov esi, esi
xor eax, eax
push 0x51491b
push ebp
push 0x4151f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040dbd0
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x675a0c
call fcn.00450150
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00514ad0
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.00514b40
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.00514bb0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x514910
cmp dword [ebp - 4], 0
je 0x514910
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x51493a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51cd40
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x51cd74
mov eax, esi
call fcn.00521860
cmp byte [esi + 0x40], 0
je 0x51cd6c
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x51ce25
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x51ce04
mov eax, dword [esi + 0x188]
cmp byte [eax + 0x10], 0
je 0x51cdfc
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x51cda8
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x188]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x51cdc0
xor bl, bl
jmp 0x51ce25
cmp edi, 2
je 0x51cdfa
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x51cd98
cmp edi, 3
je 0x51cdd8
cmp edi, 1
jne 0x51cd98
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x51cd98
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x114]
add dword [edx + 8], eax
mov esi, esi
jmp 0x51cd98
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x51ce1c
cmp dword [esi + 0x14], 0xcc
je 0x51ce1c
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.0051d160
lea esi, [esi]
mov eax, esi
call fcn.0051ce30
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x573330
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00573310
push ebp
push 0x414e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x6c4e80]
lea eax, [ebp - 0x10]
call fcn.0040a840
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040ac50
cmp dword [ebp - 0xc], 0
jle 0x5733a8
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x57339a
mov eax, 0x6ea2f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov esi, esi
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040ac50
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040b5c0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x5733d1
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x5733dd
mov eax, 0x6ea2f0
call fcn.004c9b20
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00573310
mov esp, ebp
pop ebp
ret
Function at 0x574980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, ecx
mov edx, 0x6c5578
call fcn.0040f380
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00574970
push ebp
push 0x414e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
add eax, 0x34
xor edx, edx
call fcn.00408d70
mov eax, dword [ebp - 0xc]
mov edx, fcn.0042f500
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
xor dx, dx
call fcn.004096c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, 0x30
call fcn.00408d70
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.005729b0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00575010
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
jne 0x574a9c
mov eax, dword [ebp - 4]
call fcn.004ae1a0
test al, al
jne 0x574a9c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00574970
mov esp, ebp
pop ebp
ret
Function at 0x5c9450
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
cmp word [ebx], 0x5a4d
jne 0x5c9478
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
jne 0x5c9478
lea edx, [esi + edx*8 + 0x78]
mov dword [ecx], edx
mov edx, dword [edx]
lea eax, [ebx + edx]
lea esi, [esi]
pop esi
pop ebx
ret
Function at 0x5e3a80
Capabilities:
Hash data using murmur3

Disassembly:
xchg ecx, edx
push ebp
push edi
lea ebp, [ecx + edx]
push esi
push ebx
sub esp, 8
cmp edx, 0xf
mov ebx, eax
mov dword [esp], edx
lea eax, [ebx + 0x165667b1]
jbe 0x5e3b28
lea eax, [ebp - 0x10]
lea edi, [ebx + 0x24234428]
lea esi, [ebx - 0x7a143589]
mov dword [esp + 4], ebp
mov edx, eax
lea eax, [ebx + 0x61c8864f]
mov ebp, edx
mov edx, dword [ecx]
imul edx, edx, 0x85ebca77
add edi, edx
rol edi, 0xd
imul edi, edi, 0x9e3779b1
mov edx, dword [ecx + 4]
imul edx, edx, 0x85ebca77
add esi, edx
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov edx, dword [ecx + 8]
imul edx, edx, 0x85ebca77
add ebx, edx
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
mov edx, dword [ecx + 0xc]
lea ecx, [ecx + 0x10]
imul edx, edx, 0x85ebca77
add eax, edx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp ebp, ecx
jae 0x5e3abd
rol edi, 1
rol esi, 7
rol ebx, 0xc
add esi, edi
mov ebp, dword [esp + 4]
ror eax, 0xe
add ebx, esi
add eax, ebx
lea esi, [ecx + 4]
add eax, dword [esp]
cmp ebp, esi
jb 0x5e3b5a
mov ebx, esi
nop
imul edx, dword [ebx - 4], 0xc2b2ae3d
add ebx, 4
add eax, edx
ror eax, 0xf
imul eax, eax, 0x27d4eb2f
cmp ebp, ebx
jae 0x5e3b35
lea edx, [ebp - 4]
sub edx, ecx
mov ecx, edx
and ecx, 0xfffffffc
add ecx, esi
cmp ebp, ecx
jbe 0x5e3b7a
movzx edx, byte [ecx]
add ecx, 1
imul edx, edx, 0x165667b1
add eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
cmp ebp, ecx
jne 0x5e3b5e
nop
mov edx, eax
add esp, 8
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
pop ebx
pop esi
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
pop edi
pop ebp
mov edx, eax
shr edx, 0x10
xor eax, edx
ret
Function at 0x5e4920
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 0x14]
mov dword [esp + 8], eax
mov dword [esp], edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
lea eax, [ecx + edx]
mov dword [esp + 4], eax
cmp dword [esp + 0xc], 0x10
jl 0x5e49ff
mov edx, dword [esp + 4]
lea ebx, [edx - 0x10]
mov edx, dword [esp + 8]
mov dword [esp + 0x10], edx
sub edx, 0x7a143589
lea eax, [edx - 0x61c8864f]
mov ecx, dword [esp + 0x10]
add ecx, 0x61c8864f
mov edi, dword [esp]
mov esi, dword [edi]
imul esi, esi, 0x85ebca77
add esi, eax
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov eax, esi
mov esi, dword [esp]
mov edi, dword [esi + 4]
imul edi, edi, 0x85ebca77
lea esi, [edi + edx]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov edx, esi
mov edi, dword [esp]
mov esi, dword [edi + 8]
imul esi, esi, 0x85ebca77
add esi, dword [esp + 0x10]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov dword [esp + 0x10], esi
mov esi, dword [esp]
mov edi, dword [esi + 0xc]
imul edi, edi, 0x85ebca77
lea esi, [edi + ecx]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov ecx, esi
add dword [esp], 0x10
cmp ebx, dword [esp]
jae 0x5e4970
mov ebx, eax
rol ebx, 1
mov eax, edx
rol eax, 7
add eax, ebx
mov edx, dword [esp + 0x10]
rol edx, 0xc
add edx, eax
mov eax, ecx
rol eax, 0x12
add edx, eax
jmp 0x5e4a09
mov eax, dword [esp + 8]
lea edx, [eax + 0x165667b1]
add edx, dword [esp + 0xc]
jmp 0x5e4a2e
mov ecx, dword [esp]
mov eax, dword [ecx]
imul eax, eax, 0xc2b2ae3d
add edx, eax
mov eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
mov edx, eax
add dword [esp], 4
mov eax, dword [esp]
lea ecx, [eax + 4]
cmp ecx, dword [esp + 4]
jbe 0x5e4a10
jmp 0x5e4a5f
mov eax, dword [esp]
movzx ecx, byte [eax]
imul ecx, ecx, 0x165667b1
add edx, ecx
mov eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
mov edx, eax
add dword [esp], 1
mov eax, dword [esp + 4]
cmp eax, dword [esp]
ja 0x5e4a40
mov eax, edx
shr eax, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae3d
mov eax, edx
shr eax, 0x10
xor eax, edx
lea esp, [esp + 0x14]
pop edi
pop esi
pop ebx
ret

Function at 0x5e4aa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov eax, 0xffffffff
nop
add eax, 1
mov edx, eax
xor ebx, ebx
nop
add ebx, 1
mov ecx, edx
and ecx, 1
je 0x5e4ac8
mov ecx, edx
shr ecx, 1
xor ecx, 0x82f63b78
mov edx, ecx
jmp 0x5e4aca
shr edx, 1
cmp ebx, 8
jl 0x5e4ab0
mov dword [eax*4 + 0x7037c0], edx
cmp eax, 0xff
jl 0x5e4aa8
mov ecx, 0xffffffff
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x7037c0]
xor ebx, ebx
lea esi, [esi]
add ebx, 1
mov esi, edx
shr esi, 8
movzx eax, dl
xor esi, dword [eax*4 + 0x7037c0]
mov edx, esi
mov eax, ebx
shl eax, 0xa
mov dword [eax + ecx*4 + 0x7037c0], edx
cmp ebx, 7
jl 0x5e4af8
cmp ecx, 0xff
jl 0x5e4ae8
pop esi
pop ebx
ret
Function at 0x5eb8b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x5eb8d4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x5eb9ba
mov esi, esi
xor eax, eax
push 0x5eb99b
push ebp
push 0x4151f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
mov word [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 8]
mov word [eax + 0x14], 0x1010
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x1c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x5eb990
cmp dword [ebp - 4], 0
je 0x5eb990
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x5eb9ba
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001410f
pop dword [ebp - 0x40]
mov eax, 0x1001410f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x4e264d91
add dword [ebp - 0x50], 0x2bf7ba
mov dword [ebp - 0x4c], 0xba155dbb
add dword [ebp - 0x4c], 0x781dee8a
mov dword [ebp - 0x48], 0xa568b57a
add dword [ebp - 0x48], 0xa6e38eb4
mov dword [ebp - 0x44], 0xf4f37492
add dword [ebp - 0x44], 0xb0c8b6e
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x20a8cea6
sub dword [ebp - 0x50], 0xac366550
mov dword [ebp - 0x4c], 0x389383c9
sub dword [ebp - 0x4c], 0xf7272254
mov dword [ebp - 0x48], 0xd239093c
sub dword [ebp - 0x48], 0x6ec99cd0
mov dword [ebp - 0x44], 0xc0677878
add dword [ebp - 0x44], 0x3f988788
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x9df155a4
add eax, 0x72103a94
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35d2e
push 0
call eax
mov ecx, 0xcefadd1a
add ecx, 0x310567d5
xor edi, edi
add edi, eax
mov edx, 0x7be2e356
add edx, 0x941f44aa
add edx, dword [ebp - 0x40]
mov esi, 0x96a71ea6
add esi, 0x94a6af38
mov ebx, dword [edx]
xor dword [ebp - 0x10], edx
xor ebx, esi
xor dword [ebp - 0x34], 0xae784033
mov dword [edi], ebx
sub dword [ebp - 0x30], 0xd3ab3973
add edi, 0xf831b76d
sub edi, 0xf831b769
add edx, 0xc07cf18d
sub edx, 0xc07cf189
loop 0x10014229
add eax, 0x1068f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x30c24666
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x128e0763
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x1e8ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov al, byte [esi + 0x70]
mov ebx, dword [esi + 0x138]
mov byte [ebp - 2], al
mov eax, dword [esi + 0x134]
push edi
mov edi, dword [ebp + 0x10]
movzx ecx, byte [edi + 5]
mov dword [ebp - 0xc], eax
movzx eax, byte [esi + 3]
imul eax, ecx
movzx ecx, byte [edi + 6]
add eax, ecx
mov ecx, dword [esi + 0x13c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x28]
and dword [eax + ecx + 0x24], 0
push edi
push esi
mov byte [ebp + 0xf], 1
call fcn.00017492
movzx eax, al
cmp eax, dword [esi + 0x70]
jb 0x1e962
mov eax, dword [ebp - 8]
cmp byte [eax + 0x2a], 0
je 0x1e95e
mov byte [edi + 3], 0xa
mov al, 0xa
jmp 0x1e992
mov al, 6
jmp 0x1e992
mov ecx, dword [esi + 0x13c]
mov edx, dword [ecx + eax*4]
mov cl, byte [edx + 0x2a]
and cl, 3
cmp cl, 1
mov dword [ebp - 8], edx
mov byte [ebp - 1], cl
jne 0x1e999
push 0xff
push eax
push edi
push esi
push dword [ebp + 8]
call fcn.0001c318
mov byte [ebp + 0xf], al
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
leave
ret 0xc
and byte [ebp + 0x13], 0
test byte [esi + 0x10], 1
mov dl, byte [edx + 0x2d]
je 0x1e9aa
mov al, 1
jmp 0x1e992
movzx ecx, dl
lea eax, [ecx + ecx*2]
shl eax, 4
add eax, dword [esi + 0x120]
mov dl, byte [eax + 0x1c]
cmp dl, 1
jne 0x1e9e2
movzx ecx, byte [ebx + ecx*4]
and byte [ebp + 0xf], 0
push esi
push ecx
push dword [ebp + 8]
mov byte [eax + 0x1f], 2
mov dword [eax], edi
mov byte [esi + 0x11c], 0xa
call fcn.00019bf0
jmp 0x1e9f1
cmp dl, 3
jne 0x1e9ed
and byte [eax + 0x27], 0
jmp 0x1e9c1
and byte [eax + 0x1f], 0
or dword [esi + 0x10], 0x10
cmp byte [ebp - 1], 2
je 0x1e98f
inc byte [ebp + 0x13]
cmp byte [ebp + 0x13], 2
jae 0x1e98f
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x2c]
movzx eax, byte [eax + 0x2e]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0xc]
xor eax, 1
movzx eax, byte [eax + ecx]
movzx ecx, byte [ebp - 2]
cmp eax, ecx
jae 0x1e98f
mov ecx, dword [esi + 0x13c]
mov eax, dword [ecx + eax*4]
mov dl, byte [eax + 0x2d]
jmp 0x1e9aa
Function at 0x23539
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xb0]
push esi
mov dword [ebp - 0x10], 0xffff
mov dword [ebp - 8], eax
mov word [ebp - 0xa], 0x40
call fcn.00022d99
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x2358a
push esi
call fcn.000233f6
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x2358a
push esi
call fcn.00023124
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x2362a
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
push 4
lea edi, [esi + 0x348]
mov dword [ebp + 8], ebx
pop esi
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x70]
push 0x23518
push eax
call dword [sym.imp.ntoskrnl.exe_sprintf]
add esp, 0x10
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitString]
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
movzx eax, word [ebp - 0xc]
mov ecx, dword [ebp - 8]
shr eax, 1
mov word [ecx + eax*2], bx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x48], eax
push ebx
lea eax, [ebp - 0x10]
push ebx
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x4c], 0x20
push 0x40000000
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x44], edi
call dword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
inc dword [ebp + 8]
add edi, 0x90
cmp dword [ebp + 8], 2
jl 0x235a1
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
pop ebx
leave
ret 4