joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015df0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
cmp dword [edi + 0x18], 0x10
push esi
lea esi, [edi + 4]
jb 0x10015dfe
mov eax, dword [esi]
jmp 0x10015e00
mov eax, esi
push 0
push eax
call fcn.10062018
add esp, 8
test eax, eax
je 0x10015e13
mov al, 1
pop esi
ret
cmp dword [edi + 0x18], 0x10
jb 0x10015e1d
mov eax, dword [esi]
jmp 0x10015e1f
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x10015e2d
and eax, 0xfffffffe
cmp dword [edi + 0x18], 0x10
jb 0x10015e35
mov esi, dword [esi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
pop esi
ret

Function at 0x10015f30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1011ba0b
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x1016b2e8]
xor eax, esp
mov dword [esp + 0x258], eax
push ebp
push edi
mov eax, dword [0x1016b2e8]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x27c]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
call fcn.10001c70
mov dword [esp + 0x274], 0
mov eax, dword [esp + 0x44]
mov ebp, 0x10
cmp dword [esp + 0x58], ebp
jae 0x10015fb1
lea eax, [esp + 0x44]
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.10062d32
add esp, 8
test eax, eax
jne 0x10015fcd
test dword [esp + 0x12], 0x4000
jne 0x1001601f
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x58], ebp
jae 0x10015fdb
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x58], ebp
jae 0x10015ff0
lea eax, [esp + 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015ff3
mov ecx, dword [esp + 0x54]
sub eax, edx
cmp eax, ecx
ja 0x10016012
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x48]
call fcn.10001be0
jmp 0x1001601f
push 0
sub eax, ecx
lea edi, [esp + 0x44]
call fcn.100041e0
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x58], ebp
jae 0x1001602d
lea eax, [esp + 0x44]
lea edx, [esp + 0x5c]
push edx
push 0
push str.UPGTMP
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1001605b
cmp dword [esp + 0x58], ebp
jb 0x10016057
mov eax, dword [esp + 0x44]
push eax
call fcn.100618cf
add esp, 4
xor al, al
jmp 0x1001608d
lea eax, [esp + 0x5c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016062
sub eax, edx
push eax
lea ecx, [esp + 0x60]
push ecx
mov ecx, esi
call fcn.10002270
cmp dword [esp + 0x58], ebp
jb 0x1001608b
mov edx, dword [esp + 0x44]
push edx
call fcn.100618cf
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.10061731
add esp, 0x26c
ret
Function at 0x100168b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x400
push esi
mov esi, eax
cmp byte [esi + 0x400], 0
jne 0x10016a2b
mov byte [esi + 0x400], 1
xor edx, edx
nop
mov ecx, edx
mov eax, edx
and al, 1
dec al
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x12477ce0
add eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and cl, 1
dec cl
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0x12477ce0
shr eax, 1
add ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
dec al
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x12477ce0
add eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and cl, 1
dec cl
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0x12477ce0
shr eax, 1
add ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
dec al
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x12477ce0
add eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and cl, 1
dec cl
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0x12477ce0
shr eax, 1
add ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
dec al
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x12477ce0
add eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and cl, 1
dec cl
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0x12477ce0
add ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esp + edx*4 + 4], ecx
inc edx
cmp edx, 0x100
jl 0x100168d0
xor eax, eax
lea edx, [esi + 8]
lea ecx, [esp + 0x3fc]
push edi
mov esi, dword [esp + eax*4 + 8]
mov edi, dword [ecx + 4]
shl esi, 8
shr edi, 8
add esi, edi
mov edi, dword [ecx]
mov dword [edx - 8], esi
mov esi, dword [esp + eax*4 + 0xc]
shl esi, 8
shr edi, 8
add esi, edi
mov edi, dword [ecx - 4]
mov dword [edx - 4], esi
mov esi, dword [esp + eax*4 + 0x10]
shl esi, 8
shr edi, 8
add esi, edi
mov edi, dword [ecx - 8]
mov dword [edx], esi
mov esi, dword [esp + eax*4 + 0x14]
shl esi, 8
shr edi, 8
add esi, edi
mov dword [edx + 4], esi
add eax, 4
sub ecx, 0x10
add edx, 0x10
cmp eax, 0x100
jl 0x100169d4
pop edi
pop esi
add esp, 0x400
ret
Function at 0x10017360
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x1016b2e8]
xor eax, esp
mov dword [esp + 0x34], eax
push ebp
push edi
test ebx, ebx
je 0x10017441
cmp dword [esp + 0x44], 0
je 0x10017441
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x1a]
movzx edx, word [esp + 0x18]
movzx eax, word [esp + 0x16]
push ecx
movzx ecx, word [esp + 0x18]
push edx
movzx edx, word [esp + 0x1a]
push eax
movzx eax, word [esp + 0x1a]
push ecx
movzx ecx, word [esp + 0x1c]
push edx
push eax
push ecx
push str.__04d__02d__02d__02d:_02d:_02d._03d_
lea edx, [esp + 0x3c]
push 0x20
push edx
call fcn.10061dad
add esp, 0x28
test esi, esi
je 0x100173db
push esi
mov edi, esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x100173dd
xor edi, edi
mov edx, dword [esi + 0x18]
test edx, edx
je 0x10017436
lea eax, [esp + 0x1c]
lea ebp, [eax + 1]
jmp 0x100173f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100173f0
push edx
sub eax, ebp
push eax
lea eax, [esp + 0x24]
push 1
push eax
call fcn.10062c36
mov ecx, dword [esi + 0x18]
mov edx, dword [esp + 0x54]
push ecx
push edx
push 1
push ebx
call fcn.10062c36
mov eax, dword [esi + 0x18]
push eax
push 1
push 1
push 0x101644a0
call fcn.10062c36
mov ecx, dword [esi + 0x18]
push ecx
call fcn.10063616
add esp, 0x34
test edi, edi
je 0x10017441
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x3c]
pop edi
pop ebp
xor ecx, esp
call fcn.10061731
add esp, 0x38
ret 4

Function at 0x10017880
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x100178ef
xor eax, eax
lea edx, [esp + 8]
mov ecx, esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.100176b0
test eax, eax
je 0x100178e6
mov eax, dword [esp + 0x20]
push eax
push str.Shenzhen_DriveTheLife_Software_Technology_Co.Ltd
call fcn.10063a8a
add esp, 8
test eax, eax
jne 0x100178e6
lea edi, [esp + 8]
call fcn.10017480
mov eax, 1
pop edi
add esp, 0x20
ret
lea edi, [esp + 8]
call fcn.10017480
xor eax, eax
pop edi
add esp, 0x20
ret
Function at 0x10018410
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
xor edx, edx
mov eax, 0x34
div ebx
mov edx, dword [esi]
push ebp
push edi
add eax, 6
mov edi, eax
imul edi, edi, 0x9e3779b9
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov eax, edi
shr eax, 2
and eax, 3
lea ecx, [ebx - 1]
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x1001849d
jmp 0x10018450
mov edi, dword [esi + ecx*4 - 4]
mov ebx, edx
shr ebx, 3
mov eax, edi
shl eax, 4
xor eax, ebx
mov ebx, edi
shr ebx, 5
lea ebp, [edx*4]
xor ebx, ebp
mov ebp, dword [esp + 0x20]
add eax, ebx
mov ebx, ecx
and ebx, 3
xor ebx, dword [esp + 0xc]
mov ebx, dword [ebp + ebx*4]
xor ebx, edi
mov edi, dword [esp + 0x10]
xor edx, edi
add ebx, edx
xor eax, ebx
sub dword [esi + ecx*4], eax
sub ecx, 1
mov edx, dword [esi + ecx*4 + 4]
jne 0x10018450
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + ebx*4 - 4]
mov ebp, eax
mov ebx, edx
shl ebp, 4
shr ebx, 3
xor ebp, ebx
lea ebx, [edx*4]
shr eax, 5
and ecx, 3
xor ecx, dword [esp + 0xc]
xor eax, ebx
mov ebx, dword [esp + 0x1c]
add ebp, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + ecx*4]
xor ecx, dword [esi + ebx*4 - 4]
xor edx, edi
add ecx, edx
xor ebp, ecx
sub dword [esi], ebp
mov edx, dword [esi]
add edi, 0x61c88647
sub dword [esp + 0x14], 1
mov dword [esp + 0x10], edi
jne 0x10018438
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1001e200
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x29c
mov eax, dword [0x1016b2e8]
xor eax, esp
mov dword [esp + 0x298], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
xor ebx, ebx
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1001e2f1
mov eax, dword [esp + 0x10]
push eax
call fcn.1002cf61
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x1001e2e8
lea ecx, [esp + 0x10]
push ecx
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x1001e2e8
mov esi, edi
mov edi, edi
mov eax, dword [esi + 0x190]
cmp eax, 0x400
jae 0x1001e2c6
cmp eax, ebx
ja 0x1001e2a9
mov esi, dword [esi]
cmp esi, ebx
jne 0x1001e270
push edi
call fcn.100618cf
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.10061731
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x14]
mov edx, eax
push edx
lea eax, [esi + 0x194]
push eax
push ecx
call fcn.100683a0
mov ebx, dword [esi + 0x190]
add esp, 0xc
push edi
call fcn.100618cf
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.10061731
mov esp, ebp
pop ebp
ret 4
push edi
call fcn.100618cf
add esp, 4
mov ecx, dword [esp + 0x2a4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10061731
mov esp, ebp
pop ebp
ret 4
Function at 0x1001e6a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp ebp, 0x1a
jle 0x1001e817
movzx eax, byte [ebx]
mov byte [esi], al
movzx ecx, byte [ebx + 1]
mov byte [esi + 1], cl
movzx ax, byte [ebx + 3]
shl ax, 8
mov word [esi + 2], ax
movzx edx, byte [ebx + 2]
add dx, ax
mov word [esi + 2], dx
movzx ax, byte [ebx + 5]
shl ax, 8
mov word [esi + 4], ax
movzx ecx, byte [ebx + 4]
add cx, ax
mov word [esi + 4], cx
movzx ax, byte [ebx + 7]
shl ax, 8
mov word [esi + 6], ax
movzx edx, byte [ebx + 6]
add dx, ax
mov word [esi + 6], dx
movzx ax, byte [ebx + 9]
shl ax, 8
mov word [esi + 8], ax
movzx ecx, byte [ebx + 8]
add cx, ax
mov word [esi + 8], cx
movzx ax, byte [ebx + 0xb]
shl ax, 8
mov word [esi + 0xa], ax
movzx edx, byte [ebx + 0xa]
add dx, ax
mov word [esi + 0xa], dx
movzx ax, byte [ebx + 0xd]
shl ax, 8
mov word [esi + 0xc], ax
movzx ecx, byte [ebx + 0xc]
add cx, ax
mov word [esi + 0xc], cx
movzx edx, byte [ebx + 0xe]
mov byte [esi + 0xe], dl
movzx eax, byte [ebx + 0xf]
mov byte [esi + 0xf], al
movzx ecx, byte [ebx + 0x10]
mov byte [esi + 0x10], cl
movzx edx, byte [ebx + 0x11]
mov byte [esi + 0x11], dl
movzx eax, byte [ebx + 0x12]
mov byte [esi + 0x12], al
movzx ax, byte [ebx + 0x14]
shl ax, 8
mov word [esi + 0x14], ax
movzx ecx, byte [ebx + 0x13]
add cx, ax
mov word [esi + 0x14], cx
movzx ax, byte [ebx + 0x16]
shl ax, 8
mov word [esi + 0x16], ax
movzx edx, byte [ebx + 0x15]
add dx, ax
mov word [esi + 0x16], dx
movzx eax, byte [ebx + 0x17]
mov byte [esi + 0x18], al
movzx ecx, byte [ebx + 0x18]
mov byte [esi + 0x19], cl
movzx edx, byte [ebx + 0x19]
mov byte [esi + 0x1a], dl
movzx eax, byte [ebx + 0x1a]
mov dl, byte [esi + 0x18]
push edi
mov byte [esi + 0x1b], al
movzx eax, byte [esi + 1]
mov edi, ebp
sub edi, eax
add eax, ebx
push eax
lea ecx, [esi + 0x20]
push ecx
call fcn.1001e370
movzx eax, byte [esi + 1]
mov dl, byte [esi + 0x19]
mov edi, ebp
sub edi, eax
add eax, ebx
lea ecx, [esi + 0x74]
push eax
push ecx
call fcn.1001e370
movzx eax, byte [esi + 1]
mov edi, ebp
sub edi, eax
add eax, ebx
lea edx, [esi + 0x58]
push eax
push edx
mov dl, byte [esi + 0x1a]
call fcn.1001e370
movzx eax, byte [esi + 1]
mov dl, byte [esi + 0x1b]
mov edi, ebp
sub edi, eax
add eax, ebx
push eax
lea eax, [esi + 0x74]
push eax
call fcn.1001e370
pop edi
pop ebp
ret 4
Function at 0x1001e850
Capabilities:
Check os version

Disassembly:
sub esp, 0xa4
mov eax, dword [0x1016b2e8]
xor eax, esp
mov dword [esp + 0xa0], eax
mov ax, word [0x101781a0]
push esi
mov esi, 0x20
test ax, ax
jne 0x1001ea4a
push edi
push str.IsWow64Process
xor eax, eax
push str.kernel32
mov word [0x101781a0], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1001e8bd
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x1001e8bd
cmp dword [esp + 8], 0
je 0x1001e8bd
mov esi, 0x40
push 0x9c
lea edx, [esp + 0x10]
push 0
push edx
call fcn.10068c80
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
pop edi
test eax, eax
je 0x1001ea44
mov eax, dword [esp + 0xc]
cmp eax, 4
jne 0x1001e916
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001e90c
cmp eax, 0xa
je 0x1001e90c
cmp eax, 0x5a
jne 0x1001ea44
mov ecx, 1
jmp 0x1001ea3d
cmp eax, 5
jne 0x1001e9a1
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1001e938
mov edx, 2
mov word [0x101781a0], dx
jmp 0x1001ea44
cmp eax, 1
jne 0x1001e967
cmp si, 0x20
jne 0x1001e953
mov eax, 4
mov word [0x101781a0], ax
jmp 0x1001ea44
cmp si, 0x40
jne 0x1001ea44
mov ecx, 8
jmp 0x1001ea3d
cmp eax, 2
jne 0x1001ea44
cmp si, 0x20
jne 0x1001e987
mov edx, 0x10
mov word [0x101781a0], dx
jmp 0x1001ea44
cmp si, 0x40
jne 0x1001ea44
mov eax, 0x20
mov word [0x101781a0], ax
jmp 0x1001ea44
cmp eax, 6
jne 0x1001ea25
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1001e9f9
cmp byte [esp + 0xa2], 3
jne 0x1001e9d9
cmp si, 0x20
jne 0x1001e9c5
mov ecx, pe_nt_image_headers32
jmp 0x1001ea3d
cmp si, 0x40
jne 0x1001ea44
mov edx, 0x200
mov word [0x101781a0], dx
jmp 0x1001ea44
cmp si, 0x20
jne 0x1001e9ec
mov eax, 0x40
mov word [0x101781a0], ax
jmp 0x1001ea44
cmp si, 0x40
jne 0x1001ea44
mov ecx, 0x80
jmp 0x1001ea3d
cmp eax, 1
jne 0x1001ea27
cmp si, 0x20
jne 0x1001ea12
mov edx, 0x400
mov word [0x101781a0], dx
jmp 0x1001ea44
cmp si, 0x40
jne 0x1001ea44
mov eax, 0x800
mov word [0x101781a0], ax
jmp 0x1001ea44
jb 0x1001ea44
xor ecx, ecx
cmp si, 0x40
setne cl
dec ecx
and ecx, 0x1000
add ecx, 0x1000
mov word [0x101781a0], cx
mov ax, word [0x101781a0]
mov ecx, dword [esp + 0xa4]
pop esi
xor ecx, esp
call fcn.10061731
add esp, 0xa4
ret
Function at 0x1001edd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
cmp dword [edi + 4], ebx
jne 0x1001eddc
xor eax, eax
pop ebx
ret
movzx eax, byte [edi]
dec eax
push esi
cmp eax, 0x10
ja case.0x1001edf1.2
movzx eax, byte [eax + 0x1001ef58]
jmp dword [eax*4 + 0x1001ef44]
push 0xc4
call fcn.10061972
add esp, 4
cmp eax, ebx
je 0x1001ee12
call fcn.1001e310
mov esi, eax
jmp 0x1001ee14
xor esi, esi
push 0xc4
push ebx
push esi
call fcn.10068c80
mov ecx, dword [edi + 4]
mov ebx, dword [edi + 8]
add esp, 0xc
push ecx
call fcn.1001e440
mov eax, esi
pop esi
pop ebx
ret
push 0x7c
call fcn.10061972
add esp, 4
cmp eax, ebx
je 0x1001ee72
mov dword [eax + 0x20], ebx
mov ecx, 0xf
mov dword [eax + 0x24], ecx
mov byte [eax + 0x10], bl
mov dword [eax + 0x40], ecx
mov dword [eax + 0x3c], ebx
mov byte [eax + 0x2c], bl
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x58], ebx
mov byte [eax + 0x48], bl
mov dword [eax + 0x78], ecx
mov dword [eax + 0x74], ebx
mov byte [eax + 0x64], bl
mov byte [eax], 3
mov esi, eax
jmp 0x1001ee74
xor esi, esi
push 0x7c
push ebx
push esi
call fcn.10068c80
mov edx, dword [edi + 4]
mov ebx, dword [edi + 8]
add esp, 0xc
push edx
call fcn.1001e550
mov eax, esi
pop esi
pop ebx
ret
push 0x2c
call fcn.10061972
add esp, 4
cmp eax, ebx
je 0x1001eeb3
mov dword [eax + 0x28], 0xf
mov dword [eax + 0x24], ebx
mov byte [eax + 0x14], bl
mov byte [eax], 6
mov esi, eax
jmp 0x1001eeb5
xor esi, esi
push 0x2c
push ebx
push esi
call fcn.10068c80
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
add esp, 0xc
mov eax, esi
call fcn.1001e610
mov eax, esi
pop esi
pop ebx
ret
push 0x90
call fcn.10061972
add esp, 4
cmp eax, ebx
je 0x1001ef1a
mov dword [eax + 0x34], ebx
mov ecx, 0xf
mov dword [eax + 0x38], ecx
mov byte [eax + 0x24], bl
mov dword [eax + 0x54], ecx
mov dword [eax + 0x50], ebx
mov byte [eax + 0x40], bl
mov dword [eax + 0x70], ecx
mov dword [eax + 0x6c], ebx
mov byte [eax + 0x5c], bl
mov dword [eax + 0x8c], ecx
mov dword [eax + 0x88], ebx
mov byte [eax + 0x78], bl
mov byte [eax], 0x11
mov esi, eax
jmp 0x1001ef1c
xor esi, esi
push 0x90
push ebx
push esi
call fcn.10068c80
mov eax, dword [edi + 4]
mov ebx, dword [edi + 8]
add esp, 0xc
push eax
call fcn.1001e6a0
mov eax, esi
pop esi
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10023be0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [ecx + 0x14]
mov eax, 0xcccccccd
mul ebx
push ebp
push esi
mov esi, edx
shr esi, 3
push edi
inc esi
xor edi, edi
mov ebp, 0x811c9dc5
cmp esi, ebx
jae 0x10023c05
sub ebx, esi
test ebx, ebx
jbe 0x10023c3e
lea esp, [esp]
cmp edi, dword [ecx + 0x14]
jbe 0x10023c1e
call fcn.10061d20
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x18], 8
jb 0x10023c29
mov eax, dword [ecx + 4]
jmp 0x10023c2c
lea eax, [ecx + 4]
movzx eax, word [eax + edi*2]
imul ebp, ebp, 0x1000193
add edi, esi
xor ebp, eax
cmp edi, ebx
jb 0x10023c10
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
Function at 0x10025e10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov eax, edx
and eax, 1
neg eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x101797e0], ecx
inc edx
cmp edx, 0x100
jb 0x10025e13
mov eax, 0x101797e4
mov edx, 0x1c0
mov ecx, dword [eax - 4]
mov esi, ecx
shr ecx, 8
and esi, 0xff
xor ecx, dword [esi*4 + 0x101797e0]
add eax, 0x10
mov dword [eax + 0x3ec], ecx
mov ecx, dword [eax - 0x10]
mov esi, ecx
shr ecx, 8
and esi, 0xff
xor ecx, dword [esi*4 + 0x101797e0]
mov dword [eax + 0x3f0], ecx
mov ecx, dword [eax - 0xc]
mov esi, ecx
shr ecx, 8
and esi, 0xff
xor ecx, dword [esi*4 + 0x101797e0]
mov dword [eax + 0x3f4], ecx
mov ecx, dword [eax - 8]
mov esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x101797e0]
sub edx, 1
mov dword [eax + 0x3f8], ecx
jne 0x10025eb7
mov eax, 0x1002ab90
mov esi, 0x1002ac40
mov dword [0x1017b7e8], eax
mov dword [0x1017b7e0], eax
mov dword [0x1017b7e4], esi
call fcn.1002ae40
test eax, eax
jne 0x10025f54
mov dword [0x1017b7e0], esi
pop esi
ret
Function at 0x10028a50
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x10028a61
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x10028a7f
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x10028ab6
test ecx, ecx
je 0x10028aaf
test esi, esi
ja 0x10028a70
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x1002c3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [ecx]
push edi
xor edi, edi
and esi, 7
cmp eax, 5
jae 0x1002c3cf
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
sub eax, 4
push ebp
lea ebp, [ebx + eax]
mov dword [esp + 0x10], ebp
lea ebx, [ebx]
lea edx, [edi + ebx]
cmp edx, ebp
jae 0x1002c3f4
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x1002c3f4
inc edx
cmp edx, ebp
jb 0x1002c3e7
mov ecx, edx
sub ecx, edi
mov eax, edx
sub eax, ebx
sub ecx, ebx
mov edi, eax
cmp edx, ebp
jae 0x1002c4c4
cmp ecx, 2
jbe 0x1002c493
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x1002c4b9
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
add edi, 5
mov eax, ecx
sub eax, edi
test esi, esi
je 0x1002c471
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x1002c467
mov ebx, pe_nt_image_headers32
shl ebx, cl
dec ebx
xor eax, ebx
sub eax, edi
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x1002c3e0
shr esi, cl
test esi, esi
je 0x1002c413
cmp esi, 4
ja 0x1002c4b9
cmp esi, 3
je 0x1002c4b9
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0x1002c413
or esi, 8
shr esi, 1
inc edi
jmp 0x1002c3e0
pop ebp
cmp ecx, 2
jbe 0x1002c4d9
mov edx, dword [esp + 0x18]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x18]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebx
pop ecx
ret

Function at 0x1002c540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and ecx, 0xfffffffe
push edi
mov eax, esi
lea edi, [ecx + esi - 4]
lea ebx, [ebx]
cmp eax, edi
ja 0x1002c5b6
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 3]
xor ecx, 8
and edx, ecx
add eax, 2
cmp edx, 0xf8
jb 0x1002c550
movzx edx, byte [eax - 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [eax + 1]
and ecx, 7
lea ecx, [ecx + edx*8]
movzx edx, byte [eax]
add eax, 2
shl ecx, 8
add ecx, edx
mov edx, eax
sub edx, esi
shr edx, 1
sub ecx, edx
mov edx, ecx
shr edx, 0xb
mov byte [eax - 4], dl
mov edx, ecx
shr edx, 0x13
and dl, 7
mov byte [eax - 2], cl
or dl, 0xf0
shr ecx, 8
or cl, 0xf8
mov byte [eax - 3], dl
mov byte [eax - 1], cl
jmp 0x1002c550
sub eax, esi
pop edi
ret
Function at 0x1002d600
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1016b2e8]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1002d652
mov eax, dword [esp]
cmp al, 2
jne 0x1002d64c
shr eax, 8
cmp al, 2
jne 0x1002d64c
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.10061731
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.10061731
add esp, 0x194
ret