joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417dce
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
push str..PhysicalDrive0
mov dword [ebp - 0x414], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x417eaa
push edi
push 0xc
lea eax, [ebp - 0x410]
push esi
push eax
call sub.MSVCR80.dll_memset
mov edi, 0x400
push edi
lea eax, [ebp - 0x404]
push esi
push eax
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x418], esi
call sub.MSVCR80.dll_memset
add esp, 0x18
push esi
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
push 0xc
lea eax, [ebp - 0x410]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
pop edi
je 0x417ea3
mov esi, dword [ebp - 0x3f4]
lea esi, [ebp + esi - 0x404]
movsx eax, byte [esi]
push eax
call dword [sym.imp.MSVCR80.dll_isalnum]
test eax, eax
pop ecx
je 0x417ea3
mov ecx, dword [ebp - 0x414]
push esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x417eac
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ec06
leave
ret 4

Function at 0x418641
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push str.M_GetAdaptersAddresses_begin.
mov edi, str.bugreport
push edi
call fcn.004151bb
xor ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 8], ebx
xor esi, esi
mov dword [ebp - 4], ebx
lea eax, [ebp - 8]
push eax
push esi
push ebx
push ebx
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
mov dword [ebp - 0xc], eax
jne 0x4186d9
cmp esi, ebx
je 0x418687
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 8]
call fcn.0041ebf4
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4186c4
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x418666
cmp esi, ebx
je 0x4186aa
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 0xc]
push str.GetAdaptersAddresses_failed___ld_.
push edi
call fcn.004151bb
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Allocate_memory_failed___ld__in_M_GetAdaptersAddresses.
push edi
call fcn.004151bb
add esp, 0xc
cmp dword [ebp - 0xc], ebx
jne 0x41869f
cmp esi, ebx
je 0x4186aa
push dword [ebp + 8]
mov ecx, esi
call fcn.00418707
mov edi, eax
cmp edi, ebx
je 0x4186fc
push dword [ebp + 8]
call fcn.00419083
mov edi, eax
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, edi
jmp 0x4186bd
Function at 0x4196a3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
test edx, edx
push edi
mov edi, dword [ebp + 8]
jle 0x41970d
sub ecx, edi
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push esi
inc byte [eax + 0x100]
movzx ecx, byte [eax + 0x100]
lea esi, [ecx + eax]
mov cl, byte [esi]
add byte [eax + 0x101], cl
movzx ecx, byte [eax + 0x101]
mov dl, byte [esi]
add ecx, eax
mov bl, byte [ecx]
mov byte [esi], bl
mov byte [ecx], dl
movzx ecx, byte [eax + 0x101]
movzx edx, byte [eax + 0x100]
mov cl, byte [ecx + eax]
add cl, byte [edx + eax]
mov edx, dword [ebp - 8]
movzx ecx, cl
mov cl, byte [ecx + eax]
xor cl, byte [edx + edi]
mov byte [edi], cl
inc edi
dec dword [ebp - 4]
jne 0x4196ba
pop esi
pop ebx
pop edi
leave
ret
Function at 0x419710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x419742
lea esp, [esp]
test cl, 3
je 0x419742
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4248d8]
add ecx, 1
sub esi, 1
jne 0x419720
cmp esi, 0x20
push ebx
push edi
jb 0x41992c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x424cd8]
xor edx, dword [ebx*4 + 0x4250d8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4248d8]
add ecx, 4
xor edx, dword [eax*4 + 0x4254d8]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x424cd8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4250d8]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4248d8]
add ecx, 4
xor eax, dword [edx*4 + 0x4254d8]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x424cd8]
xor edx, dword [ebx*4 + 0x4250d8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4248d8]
xor edx, dword [eax*4 + 0x4254d8]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x424cd8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4250d8]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4248d8]
xor eax, dword [edx*4 + 0x4254d8]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x424cd8]
xor edx, dword [ebx*4 + 0x4250d8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4248d8]
xor edx, dword [eax*4 + 0x4254d8]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x424cd8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4250d8]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4248d8]
and edx, 0xff
xor eax, dword [edx*4 + 0x4254d8]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x424cd8]
xor edx, dword [ebx*4 + 0x4250d8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4248d8]
add ecx, 4
xor edx, dword [eax*4 + 0x4254d8]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x424cd8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4250d8]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4248d8]
and edx, 0xff
xor eax, dword [edx*4 + 0x4254d8]
sub edi, 1
jne 0x419752
cmp esi, 4
jb 0x419979
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x424cd8]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x4250d8]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4248d8]
and eax, 0xff
xor edi, dword [eax*4 + 0x4254d8]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x419936
test esi, esi
pop edi
pop ebx
je 0x41999d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4248d8]
add ecx, 1
sub esi, 1
jne 0x419980
not eax
pop esi
ret
Function at 0x41a570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
cmp eax, edx
mov dword [esp + 0xc], edi
jb 0x41a600
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call sub.MSVCR80.dll_memcpy
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x41a5cf
sub eax, ebp
jmp 0x41a5d1
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x41a5c0
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x41a5f0
sub eax, ebp
jmp 0x41a5f2
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x41a5e1
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x41a732
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [esp + 0xc]
mov ebx, eax
cmp ebx, ecx
mov dword [esp + 0x10], edx
jbe 0x41a628
mov ebx, ecx
test ebx, ebx
je 0x41a67c
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x41a64a
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.0041b4b0
jmp 0x41a663
cmp eax, 2
jne 0x41a66a
mov ecx, dword [edi]
test ecx, ecx
mov eax, dword [edi + 0x30]
jne 0x41a65c
xor eax, eax
jmp 0x41a667
mov edx, ebx
call fcn.00419710
mov edx, dword [esp + 0x10]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call sub.MSVCR80.dll_memcpy
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x41a6a6
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x41a6ba
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x41a580
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x41a732
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x41a701
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x41a6e1
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x41a732
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x41a71b
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x41d15b
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call sub.MSVCR80.dll_memset
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
ret
Function at 0x41ea75
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x433024]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0041e9b4
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x41eac4
cmp dword [ebp - 0x1c], 5
jb 0x41eadc
jmp 0x41ead8
cmp dword [ebp - 0x10], 1
jne 0x41eadc
cmp dword [ebp - 0x1c], 4
ja 0x41ead8
jne 0x41eadc
cmp dword [ebp - 0x18], 0
jbe 0x41eadc
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x423798
call fcn.0041e88e
test eax, eax
jge 0x41eafd
mov byte [0x4340a8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041ec06
add ebp, 0x78
leave
ret
Function at 0x6b4be9a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6b4c103c
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp sym._mark_section_writable

Function at 0x6b4bea00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6b4c2378]
test esi, esi
jle 0x6b4beaed
mov edi, dword [0x6b4c237c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6b4bea34
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6b4beae6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6b4bea20
mov dword [esp], eax
mov esi, eax
call sym.___mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x6b4beb2a
mov esi, dword [0x6b4c237c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call sym.__GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6b4c237c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6b4beb0a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6b4beadf
sub eax, 0x40
and eax, 0xffffffbf
je 0x6b4beadf
mov eax, dword [esp + 0x20]
add ebx, dword [0x6b4c237c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6b4beaf4
add dword [0x6b4c2378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6b4bea3e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
mov eax, dword [0x6b4c237c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
Function at 0x6b4bee10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6b4c2388
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ebx, dword [0x6b4c2380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test ebx, ebx
je 0x6b4bee65
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6b4bee5e
test esi, esi
je 0x6b4bee5e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6b4bee40
mov dword [esp], 0x6b4c2388
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10024ee
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x1000
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1002566
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10014d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002566
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10014ac
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100255d
cmp dword [ebp - 0xc], 4
jne 0x100255d
cmp dword [ebp - 0x10], eax
je 0x100255d
mov byte [ebx + 0x28], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret

Function at 0x10064ad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
and dword [ebp - 0x14], 0
mov byte [ebp - 0xe], 0x2f
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x6b
mov byte [ebp - 8], 0x75
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0x61
push ebx
mov byte [ebp - 4], 0x74
mov byte [ebp - 3], 0x65
push esi
mov byte [ebp - 2], 0x2f
push edi
mov byte [ebp - 1], 0
mov al, byte [ebp - 0xe]
push 0xd
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x448]
push eax
call fcn.0100644e
push 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 0x43b]
push eax
call fcn.0100644e
lea eax, [ebp - 0x428]
mov word [ebp - 0x42b], 0x613f
push eax
mov byte [ebp - 0x429], 0x3d
call fcn.01006898
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
movzx eax, word [esi + 0x8e]
lea edi, [esi + 0x1b0]
push eax
push edi
lea eax, [ebp - 0x448]
push eax
lea ebx, [esi + 0xe]
push ebx
call fcn.01006664
add esp, 0x30
jmp 0x1006597
push 0x7530
push 0x5a2bc0
push 0xb9f5b9c
call fcn.01006a98
pop ecx
pop ecx
call eax
lea eax, [ebp - 0x14]
push eax
movzx eax, word [esi + 0x8e]
push eax
push edi
lea eax, [ebp - 0x448]
push eax
push ebx
call fcn.01006664
add esp, 0x14
test eax, eax
je 0x1006562

Function at 0x10065c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0xb], 0x2f
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x6f
mov byte [ebp - 8], 0x77
mov byte [ebp - 7], 0x6e
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6f
push ebx
mov byte [ebp - 4], 0x61
mov byte [ebp - 3], 0x64
push esi
mov byte [ebp - 2], 0x2f
push edi
mov byte [ebp - 1], 0
mov al, byte [ebp - 0xb]
push 0xa
lea eax, [ebp - 0xb]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0100644e
push 0x10
push dword [ebp + 0x10]
lea eax, [ebp - 0x1e]
push eax
call fcn.0100644e
mov esi, dword [ebp + 8]
add esp, 0x18
mov byte [ebp - 0xe], 0
lea edi, [esi + 0x1b0]
lea ebx, [esi + 0xe]
Function at 0x1006664
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc0
push ebx
mov byte [ebp - 4], 0x47
xor ebx, ebx
push esi
mov byte [ebp - 3], 0x45
push edi
mov byte [ebp - 2], 0x54
mov edi, 0x2fecbec
mov byte [ebp - 1], bl
mov al, byte [ebp - 4]
mov byte [ebp - 5], bl
mov al, byte [ebp - 5]
push 0xceca331
in al, dx
or al, 0x57

Function at 0x1006692
Capabilities:
Check http status code

Disassembly:
in al, dx
or al, 0x57
call fcn.01006a98
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 5]
push ecx
call eax
mov esi, eax
test esi, esi
je 0x1006840
push 0xae577c1
push edi
call fcn.01006a98
pop ecx
pop ecx
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp + 0x14]
invalid
invalid

Function at 0x10066c8
Capabilities:
Check http status code

Disassembly:
or byte [esi - 1], dl
shr byte [eax - 0x4f], 1
xchg edx, eax
jmp 0xf18bbddd

Function at 0x10066fe
Capabilities:
Check http status code

Disassembly:
add byte [esi - 0x75], dl
clc
call fcn.01006a98
push 0xfa0
mov esi, ebx
call fcn.01006388
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
pop ecx
push eax
push 0xfa0
lea eax, [ebp - 0xfc0]
push eax
push edi
push 0x7e90405
push 0x2fecbec
call fcn.01006a98
pop ecx
pop ecx
call eax
cmp dword [ebp - 4], ebx
je 0x1006837
xor eax, eax
add eax, 0xfa0
push eax
mov dword [ebp - 0x20], eax
call fcn.01006388
mov dword [ebp - 0x1c], eax
pop ecx
test esi, esi
je 0x10067ec
push esi
push ebx
push eax
call fcn.0100644e
push 1
push ebx
call fcn.01006353
mov eax, dword [ebp - 0x1c]
add esp, 0x14
push dword [ebp - 4]
lea ecx, [ebp - 0xfc0]
mov ebx, eax
push ecx
add eax, esi
push eax
call fcn.0100644e
add esi, dword [ebp - 4]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
add esp, 0xc
push eax
push 0xfa0
lea eax, [ebp - 0xfc0]
push eax
push edi
push 0x7e90405
push 0x2fecbec
call fcn.01006a98
pop ecx
pop ecx
call eax
cmp dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
jne 0x10067c0
mov ecx, dword [ebp + 0x18]
mov eax, esi
mov dword [ecx], ebx
jmp 0x1006842
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1006707
Capabilities:
Check http status code

Disassembly:
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0x1f
push edi
call eax
test eax, eax
je 0x1006739
or dword [ebp - 0xc], 0x2180
lea eax, [ebp - 0xc]
push 4
push eax
push 0x1f
push edi
push 0x7b6d601
push esi
call fcn.01006a98
pop ecx
pop ecx
call eax
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0x10]
push edi
push 0x92b78b1
push esi
call fcn.01006a98
pop ecx
pop ecx
call eax
push ebx
lea eax, [ebp - 0x18]
invalid
Function at 0x1006898
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x208
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.0100647f
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x104
push eax
push 0
push 0xdfa8b17
push 0xb9f5b9c
call fcn.01006a98
pop ecx
pop ecx
call eax
lea eax, [ebp - 0x208]
push eax
call fcn.01006d90
pop ecx
mov cl, byte [ebp - 0x208]
xor cl, 0xcc
sub cl, 0x30
lea edx, [eax + eax]
mov byte [ebp - 0x208], cl
xor ecx, ecx
inc ecx
cmp edx, ecx
jle 0x100691f
mov al, byte [ebp + ecx - 0x209]
invalid
invalid
invalid
clc
std
invalid

Function at 0x1006968
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov ecx, 0x10b
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
cmp word [eax + esi + 0x18], cx
jne 0x10069ce
mov edi, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add edi, esi
mov dword [ebp - 0xc], eax
mov ebx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebx, esi
mov ecx, dword [edi + 0x18]
add eax, esi
mov dword [ebp + 8], eax
test ecx, ecx
je 0x10069ce
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebx]
dec ecx
add eax, esi
mov dword [ebp - 8], ecx
push eax
call fcn.01006934
pop ecx
cmp dword [ebp - 4], eax
je 0x10069d5
add dword [ebp + 8], 2
add ebx, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x10069ac
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + esi]
add edx, esi
cmp edx, edi
jbe 0x1006a91
mov eax, dword [ebp - 0xc]
add eax, edi
cmp edx, eax
jae 0x1006a91
xor ebx, ebx
cmp byte [edx], 0x2e
invalid
Function at 0x1006abd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
in al, dx
sub esp, 0x38
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.01006cd4
pop ecx
test eax, eax
jne 0x1006cbc
cmp dword [esi], 0x2fecbec
je 0x1006c71
cmp dword [esi], 0x56290ac
je 0x1006c2b
mov edi, 0xb9f5b9c
cmp dword [esi], edi
je 0x1006b73
cmp dword [esi], 0xc068d9c
jne 0x1006b8a
push 0x4b
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x90f7c8c
push eax
call fcn.01006cd4
mov edi, eax
pop ecx
test edi, edi
jne 0x1006b91
xor eax, eax
jmp 0x1006cbc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xbf460e7
push eax
push edi
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x33
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x2e
push 0x6c
pop eax
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], al
push 0xaadf0f1
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0x17]
push 0xb9f5b9c
call fcn.01006a98
pop ecx
pop ecx
lea ecx, [ebp - 0x17]
jmp 0x1006cb9
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x2e
push 0x6c
pop eax
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], al
push 0xaadf0f1
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0x18]
push 0xb9f5b9c
call fcn.01006a98
pop ecx
pop ecx
lea ecx, [ebp - 0x18]

Function at 0x1006cd4
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x14]
test esi, esi
je 0x1006d4c
xor ecx, ecx
mov edi, dword [esi + 0x28]
test edi, edi
je 0x1006d4c
movzx eax, word [esi + 0x24]
mov ebx, ecx
jmp 0x1006d37
test eax, eax
je 0x1006d3f
movzx ecx, word [edi]
cmp ecx, 0x61
lea eax, [ecx - 0x20]
movzx edx, ax
mov eax, ecx
cmovb edx, eax
shl ebx, 4
movzx eax, dx
add edi, 2
add ebx, eax
mov ecx, ebx
and ecx, 0xf0000000
je 0x1006d31
mov eax, ecx
not ecx
shr eax, 0x18
xor ebx, eax
and ebx, ecx
mov eax, dword [ebp - 4]
dec eax
xor ecx, ecx
mov dword [ebp - 4], eax
cmp word [edi], cx
jne 0x1006cfc
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
je 0x1006d53
mov esi, dword [esi]
test esi, esi
jne 0x1006ced
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0x10]
jmp 0x1006d4e