joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004cdd0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0xffffffff
jne 0x1004ce2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
je 0x1004ce1f
cmp dword [ebp - 0xc], 5
je 0x1004ce1f
mov dword [ebp - 0x14], 0xa0000002
jmp 0x1004ce26
mov dword [ebp - 0x14], 0x80070005
mov eax, dword [ebp - 0x14]
jmp 0x1004cf12
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1004ce49
cmp dword [ebp - 4], 0
jle 0x1004ce6a
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], 0xffffffff
mov eax, 0xa0000006
jmp 0x1004cf12
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x10], ecx
push 0
push 0
push 0
push 2
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 8], 0
jne 0x1004ceb7
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], 0xffffffff
mov eax, 0xa0000006
jmp 0x1004cf12
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
jne 0x1004cf10
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0xffffffff
mov eax, 0xa0000006
jmp 0x1004cf12
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1004d1c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx], 0xffffffff
jne 0x1004d21c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
je 0x1004d20d
cmp dword [ebp - 0x10], 5
je 0x1004d20d
mov dword [ebp - 0x20], 0xa0000002
jmp 0x1004d214
mov dword [ebp - 0x20], 0x80070005
mov eax, dword [ebp - 0x20]
jmp 0x1004d30d
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1004d236
cmp dword [ebp - 4], 0
jle 0x1004d255
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1c]
mov dword [edx], 0xffffffff
mov eax, 0xa0000006
jmp 0x1004d30d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
push eax
call fcn.10079e01
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 4], 0
jne 0x1004d29e
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xffffffff
mov eax, 0x8007000e
jmp 0x1004d30d
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004d2cd
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 8]
je 0x1004d308
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.10079ee7
add esp, 4
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0xffffffff
mov eax, 0xa0000006
jmp 0x1004d30d
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x10061310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100934c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 9], 0x41
mov byte [ebp - 8], 0x5a
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x66
mov dword [ebp - 0x18], 0
jmp 0x10061361
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0x1006137e
mov ecx, dword [ebp - 0x18]
movzx edx, byte [ebp + ecx - 0x10]
xor edx, 0x22
sub edx, 2
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x10], dl
jmp 0x10061358
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
jmp 0x10061397
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp + 0xc]
jae 0x100613d5
mov eax, dword [ebp - 0x14]
movzx ecx, byte [ebp + eax - 0x10]
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
cmp dword [ebp - 0x14], 0xb
jb 0x100613d3
mov dword [ebp - 0x14], 0
jmp 0x1006138e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079e7c
mov esp, ebp
pop ebp
ret 8
Function at 0x10062480
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1006248f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100624ad
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1006250b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100624f2
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100624fb
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10062505
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100624e7
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10062471
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10062558
dec eax
je 0x1006254f
sub eax, 3
je 0x10062546
mov dword [ebp - 4], 0x40
jmp 0x10062575
mov dword [ebp - 4], 4
jmp 0x1006255b
mov dword [ebp - 4], 0x20
jmp 0x1006255b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100625a7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10062527
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10061db8
sahf
mov esp, 0x75ffbf7b
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x100625b3
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1006ad40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 8], 0x10000
jae 0x1006ad66
mov ecx, dword [ebp + 8]
call fcn.10060080
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0xc], eax
jb 0x1006ad70
mov eax, 0x80004005
jmp 0x1006ae67
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov esi, dword [ecx + 0xc]
add esi, dword [ebp - 8]
mov ecx, dword [ebp + 8]
call fcn.10060080
cmp esi, eax
jbe 0x1006ad9f
mov ecx, dword [ebp + 8]
call fcn.10060080
mov edx, dword [ebp + 0x10]
sub eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10058860
test eax, eax
jne 0x1006adb9
mov eax, 0x80004005
jmp 0x1006ae67
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.100282b0
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + 0xc]
push eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.1007c4c0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov dl, byte [ecx + 0x10]
mov byte [ebp - 1], dl
mov dword [ebp - 0xc], 0
jmp 0x1006adf8
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jae 0x1006ae65
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1006ae17
cmp dword [ebp - 0x14], 1
je 0x1006ae36
jmp 0x1006ae53
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
movzx edx, byte [edx + ecx]
xor edx, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
jmp 0x1006ae53
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
movzx edx, byte [edx + ecx]
sub edx, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx + 0x11]
movzx eax, byte [ebp - 1]
add eax, edx
mov byte [ebp - 1], al
jmp 0x1006adef
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10079b40
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
xor esi, esi
push esi
push ebx
call fcn.1007c830
push 0x20a
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], 0x20a
mov dword [ebp - 0x10], 1
call fcn.1007ae24
mov esi, eax
add esp, 0x10
or edi, 0xffffffff
test esi, esi
je 0x10079c86
mov ecx, dword [ebp - 4]
push ecx
push 0
push esi
call fcn.1007c830
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallBaidu_Antivirus
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10079bec
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallBaidu_Antivirus
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10079c86
mov edx, dword [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push esi
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x10088524
push edx
call ebx
mov edi, eax
cmp edi, 0xea
jne 0x10079c5b
mov eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 4], eax
add eax, eax
push eax
push esi
call fcn.1007cac5
mov esi, eax
add esp, 8
test esi, esi
je 0x10079c83
mov ecx, dword [ebp - 4]
push ecx
push 0
push esi
call fcn.1007c830
mov ecx, dword [ebp - 8]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x10088524
push ecx
call ebx
mov edi, eax
cmp edi, 0xea
je 0x10079c12
test edi, edi
jne 0x10079c83
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0xffffffffffffffff
push esi
push ebx
push edx
call fcn.1007ab04
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0x10088520
push ebx
push eax
call fcn.1007b04e
add esp, 0x20
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push str.BavCommon.dll
push ecx
push ebx
call fcn.1007b04e
add esp, 0x10
test edi, edi
jne 0x10079cc1
push 4
push ebx
call fcn.1007ca3c
add esp, 8
test eax, eax
je 0x10079cc1
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push str.BavCommon.dll
push edx
push ebx
call fcn.1007ab04
add esp, 0x10
test esi, esi
je 0x10079cce
push esi
call fcn.1007af0b
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
test eax, eax
je 0x10079cdf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10079e7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100934c8]
jne 0x10079e86
repz ret
jmp fcn.1007cde8
Function at 0x1007ca3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1007ca6d
call fcn.1007e4c7
mov dword [eax], esi
call fcn.1007e4b4
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.1007a7cb
add esp, 0x14
push 0x16
pop eax
jmp 0x1007cac2
test dword [ebp + 0xc], 0xfffffff9
jne 0x1007ca49
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1007ca9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1007e4da
pop ecx
call fcn.1007e4b4
mov eax, dword [eax]
jmp 0x1007cac2
test al, 0x10
jne 0x1007cac0
test al, 1
je 0x1007cac0
test byte [ebp + 0xc], 2
je 0x1007cac0
call fcn.1007e4c7
mov dword [eax], 5
call fcn.1007e4b4
mov dword [eax], 0xd
jmp 0x1007ca91
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10082f15
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1007d376
and dword [ebp - 4], 0
cmp dword [0x100ad628], 0
mov ebx, eax
jne 0x10082fc6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10083077
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10083077
push eax
call fcn.1007d304
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100ad628], eax
call esi
push eax
call fcn.1007d304
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100ad62c], eax
call esi
push eax
call fcn.1007d304
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100ad630], eax
call esi
push eax
call fcn.1007d304
pop ecx
mov dword [0x100ad638], eax
test eax, eax
je 0x10082fc6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1007d304
pop ecx
mov dword [0x100ad634], eax
mov eax, dword [0x100ad634]
cmp eax, ebx
je 0x1008301e
cmp dword [0x100ad638], ebx
je 0x1008301e
push eax
call fcn.1007d37f
push dword [0x100ad638]
mov esi, eax
call fcn.1007d37f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1008301e
test edi, edi
je 0x1008301e
call esi
test eax, eax
je 0x10083015
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10083015
test byte [ebp - 0xc], 1
jne 0x1008301e
or dword [ebp + 0x10], 0x200000
jmp 0x10083057
mov eax, dword [0x100ad62c]
cmp eax, ebx
je 0x10083057
push eax
call fcn.1007d37f
pop ecx
test eax, eax
je 0x10083057
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10083057
mov eax, dword [0x100ad630]
cmp eax, ebx
je 0x10083057
push eax
call fcn.1007d37f
pop ecx
test eax, eax
je 0x10083057
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100ad628]
call fcn.1007d37f
pop ecx
test eax, eax
je 0x10083077
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10083079
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001000
Capabilities:
Get remote cert context via schannel

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
xor esi, esi
mov dword [0x1000637c], 0x10004944
and dword [esp + 0x10], esi
lea ecx, [esp + 0x1c]
xor edi, edi
mov dword [0x10006378], 0x10004954
xor ebx, ebx
call fcn.10001140
test eax, eax
jne 0x100010f0
mov eax, dword [ebp + 0xc]
lea edx, [esp + 0x1c]
mov dword [0x100063e0], eax
inc esi
mov eax, dword [ebp + 0x10]
mov dword [0x100063d4], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.100012af
add esp, 0xc
test eax, eax
jne 0x100010f0
lea eax, [esp + 0x10]
mov edi, esi
push eax
push 0x53
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.Secur32.dll_QueryContextAttributesA]
test eax, eax
jne 0x100010f0
mov ecx, dword [esp + 0x10]
call fcn.10001a7e
push ecx
mov ecx, dword [esp + 0x14]
call fcn.10001b5e
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
and dword [esp + 0x10], ebx
lea eax, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.100015ad
pop ecx
pop ecx
test eax, eax
jne 0x100010f0
push ecx
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x28]
call fcn.10001705
add esp, 0xc
test eax, eax
jne 0x100010f0
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
call fcn.100011e2
pop ecx
test eax, eax
jne 0x100010f0
xor edi, edi
mov ebx, esi
cmp dword [esp + 0x10], 0
je 0x10001106
push dword [esp + 0x10]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
and dword [esp + 0x10], 0
test edi, edi
je 0x10001115
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.Secur32.dll_DeleteSecurityContext]
test esi, esi
je 0x10001124
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.Secur32.dll_FreeCredentialsHandle]
mov ecx, dword [0x1000634c]
test ecx, ecx
je 0x10001137
push 0
push ecx
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001140
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, ecx
push 0x100041b4
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.CRYPT32.dll_CertOpenSystemStoreA]
mov dword [0x1000634c], eax
test eax, eax
jne 0x1000116b
mov eax, 0x8009030e
jmp 0x100011dc
push ebx
push 0x38
push edi
mov ebx, 0x10006380
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [0x10006380], 4
cmp dword [ebp - 4], edi
je 0x1000119e
lea eax, [ebp - 4]
mov dword [0x10006384], 1
mov dword [0x10006388], eax
lea eax, [ebp - 0xc]
mov dword [0x100063a0], 0xa80
push eax
push esi
push edi
push edi
push ebx
push edi
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push edi
mov dword [0x100063b0], 0x400018
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
mov esi, eax
pop ebx
cmp dword [ebp - 4], edi
je 0x100011da
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret