joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf1c4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf3aa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4cf366
mov eax, dword [ebp - 4]
call fcn.004d0b6c
cmp ebx, eax
jge 0x4cf366
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004c57b8
mov edx, dword [0x4c7324]
call fcn.0040478c
mov esi, eax
mov eax, esi
call fcn.004c81e8
test al, al
je 0x4cf35c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4cf350
xor eax, eax
push ebp
push 0x4cf349
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004cf77c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041dbac
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405c34
mov eax, dword [ebp - 8]
call fcn.00405a04
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004cf540
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf394
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4cf348
mov eax, dword [ebp - 4]
call fcn.004cf800
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b88c
jmp 0x4cf394
mov eax, dword [ebp - 8]
call fcn.004054f8
jmp 0x4cf394
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040ac78
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x418870]
call fcn.0040efd4
call fcn.00404e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf3b1
lea eax, [ebp - 0x54]
call fcn.004054f8
ret
Function at 0x4d482c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403bd0
ret

Function at 0x4d4c18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
xor edx, edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4d4d5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4d4d70
call fcn.004d4a80
lea eax, [ebp - 0x3f0]
call fcn.004054f8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004059a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d4d23
xor edx, edx
push ebp
push 0x4d4d1c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x3e9
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4d4db0
call fcn.004d4a80
mov eax, dword [ebp - 0x408]
call fcn.004059a4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d4d02
push ebp
mov eax, 0x4d4ddc
call fcn.004d4b70
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4d23
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4d64
lea eax, [ebp - 0x408]
call fcn.004054f8
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4d4f78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4d513c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4d5150
call fcn.004d4de0
lea eax, [ebp - 0x3f0]
call fcn.004054f8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004059a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d50fd
xor eax, eax
push ebp
push 0x4d50f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x4d5188
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d5052
push ebp
mov eax, 0x4d51a4
call fcn.004d4ed0
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4d51b0
call fcn.004d4de0
mov eax, dword [ebp - 0x408]
call fcn.004059a4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d50dc
push dword [ebp - 0x3f0]
push 0x4d51d4
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405768
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004058a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d50fd
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5143
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4dbd38
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4dbe73
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4dbe43
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004059a4
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040ae9c
test al, al
jne 0x4dbdb3
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.0040392c
lea eax, [ebp - 0x1d0]
call fcn.004036c8
call fcn.004030f4
push dword [0x4f5dd0]
push 0x4dbe8c
push dword [0x4f5dd4]
push 0x4dbe8c
push dword [0x4f5dd8]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004058a8
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004e26f8
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405cc4
call fcn.00404024
call fcn.004030f4
lea eax, [ebp - 0x1d0]
call fcn.004039f4
call fcn.004030f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dbe4d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbe7a
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x4dcff4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4dd15c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004dc1cc
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004dc1ec
mov ebx, eax
jmp 0x4dd12e
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405768
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040b430
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409d84
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409d84
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040593c
je 0x4dd10e
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405768
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409d84
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409d84
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040593c
jne 0x4dd123
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004dc20c
mov ebx, eax
test ebx, ebx
jne 0x4dd06f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd163
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret

Function at 0x4df4d8
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x4df4f4
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
setne al
ret
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
setne al
ret

Function at 0x4df66c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4df746
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4df75c
mov edx, dword [ebp - 4]
call fcn.0040582c
mov eax, dword [ebp - 8]
call fcn.004059a4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4df6b6.0
jmp dword [eax*4 + 0x4df6bd]
mov eax, ebx
mov edx, 0x4df768
call fcn.0040554c
jmp 0x4df72b
mov eax, ebx
mov edx, 0x4df778
call fcn.0040554c
jmp 0x4df72b
mov eax, ebx
mov edx, 0x4df788
call fcn.0040554c
jmp 0x4df72b
mov eax, ebx
mov edx, 0x4df79c
call fcn.0040554c
jmp 0x4df72b
mov eax, ebx
mov edx, 0x4df7ac
call fcn.0040554c
jmp 0x4df72b
mov eax, ebx
mov edx, 0x4df7c0
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df74d
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4dfa00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4dfa95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4dfaac
mov edx, dword [ebp - 4]
call fcn.0040582c
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.004059a4
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfa9c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040551c
ret

Function at 0x4e2e44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e2f15
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.0040b88c
lea ecx, [ebp - 0x108]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043e7b8
mov eax, dword [ebp - 0x108]
mov edx, 0x4e2f2c
call fcn.0040593c
je 0x4e2ee5
lea ecx, [ebp - 0x10c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043e7b8
mov eax, dword [ebp - 0x10c]
mov edx, 0x4e2f38
call fcn.0040593c
je 0x4e2ee5
lea eax, [ebp - 4]
mov edx, 0x4e2f38
call fcn.004057e0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2f1c
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x415672
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
xor eax, eax
mov al, byte [0x424cfd]
test eax, eax
je 0x4156bf
mov esi, esp
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00419202
jmp 0x41573b
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x41561d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.00419202
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415736
mov esi, esp
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.00419202
mov esi, esp
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00419202
mov eax, dword [ebp - 0xc]
jmp 0x41573b
mov eax, 2
pop esi
add esp, 0x1c
cmp ebp, esp
call fcn.00419202
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10002d80
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10002f30
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x10002e7e
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10002e21
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x10002e64
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x10002e38
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10002e53
test al, 0x40
je 0x10002e4a
mov ecx, dword [edi + 0x20]
jmp 0x10002e51
test al, 0x80
je 0x10002e64
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x10002e64
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x10002df0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x1000364d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
ret
Function at 0x10015a61
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x30]
leave
ret

Function at 0x10015a86
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x28]
leave
ret

Function at 0x1001711a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x10017138
mov eax, 0x101e149e
push eax
push 1
mov ebx, 0x1009a8a0
call fcn.1009a2bd
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10017162
mov eax, 0
jmp 0x100171d6
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x100171c3
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x100171ac
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x1001719b
xor ecx, eax
xor edx, ebx
dec edi
jne 0x1001718c
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x1004ef70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x1004ef8e
mov eax, 0x101e149e
push eax
push 1
mov ebx, 0x1009a8a0
call fcn.1009a2bd
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1004efb8
mov eax, 0
jmp 0x1004f02c
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x1004f019
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x1004f002
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x1004eff1
xor ecx, eax
xor edx, ebx
dec edi
jne 0x1004efe2
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4

Function at 0x10057774
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x10057796
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov dword [ebp - 4], 0
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, ioctlsocket
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, cl
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
imul esi, esi, 0x666
mov dword [ebp - 4], esi
nop
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 4]
jmp 0x100578bc
mov esp, ebp
pop ebp
ret
Function at 0x10060c1b
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x10060e68
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x10060d65
cmp byte [edx + edi], 0xd
jne 0x10060d65
cmp byte [edx + edi + 1], 0xa
je 0x10060d9e
mov al, byte [edx + edi]
cmp al, 0xa
je 0x10060d9e
cmp al, 0x3d
jne 0x10060d7a
inc ecx
cmp ecx, 2
ja 0x10060e76
cmp al, 0x7f
ja 0x10060e76
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x10060e76
cmp al, 0x40
jae 0x10060d9d
test ecx, ecx
jne 0x10060e76
inc esi
inc edx
cmp edx, ebx
jb 0x10060d4f
test esi, esi
je 0x10060e68
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x10060e87
cmp dword [ecx], eax
jb 0x10060e87
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x10060e57
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x10060e53
cmp al, 0xa
je 0x10060e53
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x10060e53
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x10060e3e
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x10060e4b
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x10060e53
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x10060def
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10