joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063ba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4063de
xor eax, eax
test eax, eax
je 0x4063f1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4063f1
xor ecx, ecx
jmp 0x4063f4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4064db
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x406512
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064ec
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x4064e7
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406543
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x406525
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x31fa1124
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x64bc689b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40633c
pop dword [ebp - 0x18]
mov eax, 0xf6ca9186
sub eax, 0xf68a2e4a
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x415c5292
sub dword [ebp - 0x28], 0xf30a0d47
mov dword [ebp - 0x24], 0xa72d72b6
sub dword [ebp - 0x24], 0x74fa2671
mov dword [ebp - 0x20], 0xd3e1d10e
add dword [ebp - 0x20], 0x786a7320
mov dword [ebp - 0x1c], 0x559cacd7
sub dword [ebp - 0x1c], 0x559cacd7
lea eax, [ebp - 0x28]
push eax
mov eax, 0xcb277886
sub eax, 0xcae70826
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x9362669f
add dword [ebp - 0x28], 0xe11002b7
mov dword [ebp - 0x24], 0x5ee9ea05
sub dword [ebp - 0x24], 0x1d7d8890
mov dword [ebp - 0x20], 0x33e9020e
sub dword [ebp - 0x20], 0xd07995a2
mov dword [ebp - 0x1c], 0x98971cd8
sub dword [ebp - 0x1c], 0x98971cd8
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xda185e05
add eax, 0x262812fb
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37c01
push 0
call eax
mov ecx, 0x4c87
xor edi, edi
add edi, eax
mov esi, 0x410000
add esi, dword [ebp - 0x18]
mov ebx, 0x3e8ae71e
xor dword [ebp - 0xc], ebx
mov edx, dword [esi]
sub dword [ebp - 8], 0xd962851a
xor edx, ebx
xor dword [ebp - 0x10], 0x886c4cdd
mov dword [edi], edx
xor dword [ebp - 8], 0xb481c379
add edi, 0x676ad948
add edi, 0x989526bc
add esi, 4
loop 0x40644e
add eax, 0x124ef
mov ebx, eax
add eax, 0xdd64d55e
sub eax, 0xdd64d559
mov ecx, 0xd63922a
sub ecx, 0xd23922a
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401250
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call fcn.004014f0
push 0x13b8
mov dword [ebp - 0x10], eax
call fcn.00401a2a
push 0x13b8
mov esi, eax
call fcn.00401a2a
push 0x1f40
call fcn.00401a2a
mov ebx, eax
push 0x12c
mov dword [ebp - 4], ebx
call fcn.00401a2a
movq xmm0, qword [str._silent]
movq qword [ebp - 0x20], xmm0
movq xmm0, qword [0x4094e8]
add esp, 0x10
mov edi, eax
movq qword [ebp - 0x18], xmm0
call section..text
test eax, eax
je 0x40140d
test esi, esi
je 0x401417
test ebx, ebx
je 0x401417
test edi, edi
je 0x401417
push 0x40969c
push 4
push edi
call fcn.004017cf
mov eax, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
je 0x401381
cmp byte [eax], 0
je 0x401381
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, 1
mov ebx, eax
cmp dword [ebp - 8], esi
jle 0x40133d
lea esp, [esp]
push dword [ebx + esi*4]
push edi
push str._ls__ls
push 0x12c
push edi
call fcn.00401760
inc esi
add esp, 0x14
cmp esi, dword [ebp - 8]
jl 0x401320
mov ecx, dword [ebx + esi*4 - 4]
lea eax, [ebp - 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40136a
test dx, dx
je 0x401366
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40136a
add eax, 4
add ecx, 4
test dx, dx
jne 0x401344
xor eax, eax
jmp 0x40136f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401381
push ebx
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00401430
mov ebx, eax
push ebx
push edi
push str._ls__ls
push 0x12c
push edi
call fcn.00401760
call fcn.004015b0
push edi
push str._fileassoc.tcl
push dword [ebp - 0x10]
mov esi, eax
push esi
push str.__ls_____ls_ls___ls
push 0x1f40
push dword [ebp - 4]
call fcn.00401760
add esp, 0x30
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4013dd
push dword [ebp + 0x14]
push dword [ebp - 0xc]
push dword [ebp - 4]
push esi
call fcn.00401660
add esp, 0x10
push dword [ebp - 0x10]
call fcn.004019f2
push dword [ebp - 4]
call fcn.004019f2
push edi
call fcn.004019f2
push esi
call fcn.004019f2
push ebx
call fcn.004019f2
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Please_note_that_in_order_to_run_File_Association_Utility_you_will_need_to_be_logged_in_as_a_user_with_administrative_privileges.__n_n___..._Exiting_File_Association_Utility.
call fcn.004014d0
push str.Memory_allocation_in_this_executable
call fcn.004014d0
int3

Function at 0x4014d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x10
push str.File_Association_Utility
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401660
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3ed8
call fcn.00401ad0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x44
lea eax, [ebp - 0x3ed8]
push 0
push eax
call fcn.00401ca0
add esp, 0xc
cmp dword [ebp + 0x10], 1
mov dword [ebp - 0x3ed8], 0x44
jne 0x4016b0
mov dword [ebp - 0x3eac], 1
xor eax, eax
jmp 0x4016b4
mov ax, word [ebp + 0x14]
mov word [ebp - 0x3ea8], ax
lea eax, [ebp - 0x3e94]
push eax
lea eax, [ebp - 0x3ed8]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
xorps xmm0, xmm0
push esi
push edi
movq qword [ebp - 0x3e94], xmm0
movq qword [ebp - 0x3e8c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40171a
push dword [ebp - 0x3e94]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3e90]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401abc
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CreateProcessW__s__failed_with_error_number__d.
lea eax, [ebp - 0x3e84]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
inc eax
push eax
lea eax, [ebp - 0x3e84]
push eax
call fcn.00401760
add esp, 0x14
lea eax, [ebp - 0x3e84]
push eax
call fcn.004014d0
int3
Function at 0x406c6a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004047f5
mov dword [ebp - 0x14], eax
cmp dword [0x40d9e0], edi
jne 0x406d5b
push 0x800
push edi
push 0x40a6d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x406ce8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x406e3b
push 0x40a6d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x406e3b
push 0x40a6ec
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406e3b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x40d9e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x40d9e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x40d9e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x40d9f0], eax
test eax, eax
je 0x406d58
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x40d9ec], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x406d80
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x406d73
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x406d95
push 4
pop eax
jmp 0x406e3d
cmp dword [ebp - 0x14], edi
je 0x406d95
push dword [0x40d9e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x406d7a
mov eax, dword [0x40d9ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x406df3
cmp dword [0x40d9f0], esi
je 0x406df3
push eax
call ebx
push dword [0x40d9f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x406df3
test eax, eax
je 0x406df3
call ecx
test eax, eax
je 0x406de8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x406de8
test byte [ebp - 8], 1
jne 0x406df3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x406e23
mov eax, dword [0x40d9e4]
cmp eax, esi
je 0x406e20
push eax
call ebx
test eax, eax
je 0x406e20
call eax
mov edi, eax
test edi, edi
je 0x406e20
mov eax, dword [0x40d9e8]
cmp eax, esi
je 0x406e20
push eax
call ebx
test eax, eax
je 0x406e20
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x40d9e0]
call ebx
test eax, eax
je 0x406e3b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x406e3d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401abc
leave
ret
Function at 0x10009d00
Capabilities:
Hash data using crc32b

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push edi
lea edi, [edx + eax]
cmp edx, edi
mov eax, dword [esp + 0x10]
jae 0x10009d3c
push esi
mov ecx, eax
mov esi, 8
lea esp, [esp]
mov eax, ecx
shl ecx, 1
test eax, eax
jge 0x10009d2e
xor ecx, 0x4c11db7
dec esi
jne 0x10009d20
movzx eax, byte [edx]
xor eax, ecx
inc edx
cmp edx, edi
jb 0x10009d15
pop esi
not eax
pop edi
ret
Function at 0x1000b060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax]
cmp esi, edi
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 0x100]
movzx edx, byte [eax + 0x101]
mov dword [esp + 0x10], edi
je 0x1000b0db
push ebx
push ebp
jmp 0x1000b090
mov ecx, dword [esp + 0x14]
nop
lea edi, [ecx + 1]
and edi, 0xff
mov bl, byte [edi + eax]
movzx ebp, bl
xor ecx, ecx
add edx, ebp
and edx, 0xff
mov cl, byte [edx + eax]
mov byte [edi + eax], cl
mov byte [edx + eax], bl
mov bl, byte [esi]
mov dword [esp + 0x14], edi
add ecx, ebp
and ecx, 0xff
mov cl, byte [ecx + eax]
xor cl, bl
mov byte [esi], cl
movzx ecx, bl
add edx, ecx
mov ecx, dword [esp + 0x18]
inc esi
cmp esi, ecx
jne 0x1000b08b
mov cl, byte [esp + 0x14]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
ret

Function at 0x1000ccf0
Capabilities:
Encode data using xor

Disassembly:
movzx edx, word [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
mov cl, byte [esi + 0x16]
add edx, eax
cmp eax, edx
jae 0x1000cd15
push ebx
mov bl, byte [eax]
add cl, 0x3b
xor bl, cl
mov byte [eax], bl
inc eax
cmp eax, edx
jb 0x1000cd06
pop ebx
mov byte [esi + 0x16], cl
pop esi
ret

Function at 0x1000cd20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x10]
push ebx
movzx ebx, word [esp + 0x10]
push ebp
push esi
mov esi, dword [eax]
mov eax, dword [esp + 0x14]
mov ecx, ebx
mov ebp, ecx
shr ecx, 2
push edi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + eax]
cmp eax, ecx
jae 0x1000cd6a
nop
mov bl, byte [eax]
add dl, 0x3b
xor bl, dl
mov byte [eax], bl
inc eax
cmp eax, ecx
jb 0x1000cd50
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov byte [eax + 0x10], dl
pop ebx
ret
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov byte [ecx + 0x10], dl
pop ebx
ret

Function at 0x1000cd80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
movzx esi, word [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov dl, byte [edi + 1]
mov cl, byte [edi]
add esi, eax
cmp eax, esi
jae 0x1000cdae
push ebx
jmp 0x1000cda0
mov bl, byte [eax]
xor bl, cl
add cl, dl
mov byte [eax], bl
inc eax
cmp eax, esi
jb 0x1000cda0
pop ebx
mov byte [edi], cl
pop edi
pop esi
ret
Function at 0x100117c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push str.WS2_32.DLL
call ebx
mov esi, eax
test esi, esi
jne 0x100117de
push str.WSOCK32.DLL
call ebx
mov esi, eax
cmp esi, 0x20
mov dword [edi + 0x6c], esi
jae 0x100117eb
pop esi
xor al, al
pop ebx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.closesocket
push esi
xor bl, bl
call ebp
test eax, eax
mov dword [edi], eax
je 0x100119b9
push str.connect
push esi
call ebp
test eax, eax
mov dword [edi + 4], eax
je 0x100119b9
push str.getsockopt
push esi
call ebp
test eax, eax
mov dword [edi + 0xc], eax
je 0x100119b9
push str.recv
push esi
call ebp
test eax, eax
mov dword [edi + 0x18], eax
je 0x100119b9
push str.send
push esi
call ebp
test eax, eax
mov dword [edi + 0x1c], eax
je 0x100119b9
push str.recvfrom
push esi
call ebp
test eax, eax
mov dword [edi + 0x40], eax
je 0x100119b9
push str.sendto
push esi
call ebp
test eax, eax
mov dword [edi + 0x3c], eax
je 0x100119b9
push str.setsockopt
push esi
call ebp
test eax, eax
mov dword [edi + 0x20], eax
je 0x100119b9
push str.socket
push esi
call ebp
test eax, eax
mov dword [edi + 0x24], eax
je 0x100119b9
push str.bind
push esi
call ebp
test eax, eax
mov dword [edi + 0x28], eax
je 0x100119b9
push str.listen
push esi
call ebp
test eax, eax
mov dword [edi + 0x2c], eax
je 0x100119b9
push str.select
push esi
call ebp
test eax, eax
mov dword [edi + 0x30], eax
je 0x100119b9
push str.accept
push esi
call ebp
test eax, eax
mov dword [edi + 0x34], eax
je 0x100119b9
push str.shutdown
push esi
call ebp
test eax, eax
mov dword [edi + 0x38], eax
je 0x100119b9
push str.getsockname
push esi
call ebp
test eax, eax
mov dword [edi + 8], eax
je 0x100119b9
push str.WSAGetLastError
push esi
call ebp
test eax, eax
mov dword [edi + 0x58], eax
je 0x100119b9
push str.WSACleanup
push esi
mov dword [edi + 0x5c], eax
call ebp
test eax, eax
mov dword [edi + 0x60], eax
je 0x100119b9
push str.WSAStartup
push esi
call ebp
test eax, eax
mov dword [edi + 0x64], eax
je 0x100119b9
push str.gethostbyaddr
push esi
call ebp
test eax, eax
mov dword [edi + 0x44], eax
je 0x100119b9
push str.gethostbyname
push esi
call ebp
test eax, eax
mov dword [edi + 0x48], eax
je 0x100119b9
push str.inet_addr
push esi
call ebp
test eax, eax
mov dword [edi + 0x4c], eax
je 0x100119b9
push str.gethostname
push esi
call ebp
test eax, eax
mov dword [edi + 0x54], eax
je 0x100119b9
push str.getprotobyname
push esi
call ebp
test eax, eax
mov dword [edi + 0x50], eax
je 0x100119b9
push str.htons
push esi
call ebp
test eax, eax
mov dword [edi + 0x10], eax
je 0x100119b9
push str.ntohs
push esi
call ebp
test eax, eax
mov dword [edi + 0x14], eax
je 0x100119b9
pop ebp
mov bl, 1
pop esi
mov al, bl
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebp
pop esi
mov al, bl
pop ebx
ret
Function at 0x100139c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [ebp + 0x28]
mov ax, word [ecx + 2]
cmp bx, ax
ja 0x100139d7
cmp ax, 0xffff
jne 0x100139df
mov ax, word [ecx]
cmp bx, ax
jne 0x100139e3
xor al, al
pop ebp
ret
cmp bx, ax
push esi
push edi
ja 0x10013a01
cmp ax, 0xffff
je 0x10013a07
mov edi, dword [ecx + 0x10]
mov edi, dword [edi + 0xc]
cmp word [edi + 2], bx
jb 0x100139f3
jmp 0x10013abe
cmp ax, 0xffff
jne 0x10013a0e
mov edi, 1
jmp 0x10013a11
lea edi, [eax + 1]
mov eax, dword [ebp + 0x1c]
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
sub eax, edx
movzx edx, di
movzx esi, bx
sub esi, edx
inc esi
cmp eax, esi
jge 0x10013a37
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov byte [eax], 1
mov al, 1
pop ebp
ret
mov esi, dword [ecx + 0x10]
test esi, esi
jne 0x10013a44
mov dword [esp + 0x10], esi
jmp 0x10013a4b
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
cmp di, bx
jae 0x10013a8a
mov edx, dword [ebp + 0x1c]
call fcn.10013120
xor ecx, ecx
cmp eax, ecx
je 0x10013aa2
cmp esi, ecx
mov word [eax + 2], di
mov word [eax + 4], cx
mov word [eax + 6], cx
jne 0x10013a74
mov dword [esp + 0x10], eax
jmp 0x10013a77
mov dword [esi + 0xc], eax
mov esi, eax
mov eax, dword [ebp + 0x28]
mov dl, byte [eax + 0xc]
inc dl
inc edi
cmp di, bx
mov byte [eax + 0xc], dl
jb 0x10013a50
mov edx, dword [ebp + 0x1c]
call fcn.10013120
mov edi, eax
test edi, edi
je 0x10013aa2
test esi, esi
mov word [edi + 2], bx
jne 0x10013aa8
jmp 0x10013aaf
pop edi
pop esi
xor al, al
pop ebp
ret
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], edi
mov dword [edi + 0xc], eax
mov edx, dword [ebp + 0x28]
mov dword [edx + 0x10], edi
mov eax, dword [ebp + 0x28]
inc byte [eax + 0xc]
mov ax, word [esp + 0x14]
mov cx, word [esp + 0x18]
mov edx, dword [edi + 8]
mov esi, dword [esp + 0x1c]
mov word [edi + 4], ax
mov word [edi + 6], cx
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x20], edx
mov dword [edi + 8], eax
mov ecx, dword [ebp + 0x28]
mov edx, ebx
call fcn.100138d0
mov ebp, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0xc], edi
jne 0x10013b32
mov cl, byte [ebp + 0xc]
test cl, cl
je 0x10013b2c
xor ecx, ecx
mov cx, word [ebp + 2]
cmp cx, 0xffff
je 0x10013b2c
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
cmp word [edx + 4], 0
jbe 0x10013b2c
sub cx, word [edx + 2]
inc ecx
test cx, cx
je 0x10013b2c
mov cx, word [edi + 6]
pop edi
pop esi
mov word [ebp + 0xa], cx
pop ebp
ret
mov word [ebp + 0xa], 0
pop edi
pop esi
pop ebp
ret
Function at 0x10022950
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov al, byte [ebp + 0x31]
mov cl, byte [ebp + 0x30]
push esi
push edi
mov edx, ebp
call fcn.10021990
movzx ebx, byte [ebp + 0x32]
movzx edi, byte [ebx + ebp + 0x2b]
dec ebx
inc edi
mov eax, edi
cdq
idiv ebx
test ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
jle 0x100229a7
lea esi, [ebp + 0x2c]
mov eax, ebx
movzx ecx, byte [esi]
mov edx, dword [esp + 0x18]
add edx, ecx
cmp edx, 0xff
jl 0x1002299d
mov edx, 0xff
sub ecx, edx
add edi, ecx
mov byte [esi], dl
inc esi
dec eax
jne 0x10022987
test edi, edi
je 0x100229dd
jmp 0x100229b0
test ebx, ebx
jle 0x100229d9
mov edx, 0xffffffd4
lea ecx, [ebp + 0x2c]
sub edx, ebp
mov edi, edi
movzx eax, byte [ecx]
cmp eax, 0xff
jge 0x100229d1
inc al
dec edi
mov byte [ecx], al
je 0x100229dd
inc ecx
lea eax, [ecx + edx]
cmp eax, ebx
jl 0x100229c0
test edi, edi
jne 0x100229b0
mov esi, ebp
call fcn.10021e80
movzx ebx, byte [ebp + 0x31]
mov esi, dword [ebp + 4]
mov ecx, ebx
mov edi, esi
mov dword [esp + 0x18], esi
call fcn.10020cb0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + ecx*4 + 0x1c]
mov eax, dword [esi + ebx*4 + 4]
mov ecx, dword [ebp + 8]
push 0x202
lea edi, [esi + ebx*4 + 4]
push edx
push eax
push ecx
call fcn.10034cb0
mov cl, byte [ebp + 0x32]
mov eax, dword [ebp + 8]
dec cl
mov byte [ebp + 0x32], cl
mov edx, dword [edi]
push edx
push eax
call fcn.10034bb0
movzx ecx, byte [esi + 1]
sub ecx, ebx
shl ecx, 2
mov edx, ecx
shr ecx, 2
lea esi, [esi + ebx*4 + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x30]
mov dl, byte [esi + 1]
add esp, 0x18
dec dl
movzx eax, dl
cmp ebx, eax
mov byte [esi + 1], dl
jg 0x10022a84
lea ecx, [ecx]
xor ecx, ecx
mov cl, bl
push 0
inc cl
push ebx
push 0xff
push 0
mov eax, ebp
push ecx
call fcn.10021b10
movzx edx, byte [esi + 1]
add esp, 0x14
inc ebx
cmp ebx, edx
jle 0x10022a60
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret