joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b3e6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f24b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x470ee0
mov dword [esi + 4], 0x4712dc
mov dword [esi + 8], 0x4712cc
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.0040bbbe
lea eax, [esi + 0x6fe8]
mov dword [esi + 0x6fd8], edi
mov dword [esi + 0x6fe0], edi
push eax
mov dword [esi + 0x6fe4], edi
call fcn.00455150
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x7010], edi
mov dword [esi + 0x6fd4], edi
mov dword [esi], 0x4712bc
mov dword [esi + 4], 0x4712ac
mov dword [esi + 8], 0x47129c
mov dword [esi + 0x7000], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x43e060
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.0043d720
push 0x41
mov ecx, esi
call fcn.0043d720
push 0x59
mov ecx, esi
call fcn.0043d720
push 0x26
mov ecx, esi
call fcn.0043d720
push 0x53
mov ecx, esi
call fcn.0043d720
push 0x59
mov ecx, esi
call fcn.0043d720
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x43e0f0
test cl, cl
jbe 0x43e0ec
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x4846f4]
xor eax, edi
dec ecx
jne 0x43e0d6
xor edi, edi
jmp 0x43e11f
cmp bl, cl
jne 0x43e0f7
inc edi
jmp 0x43e102
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x4846f4]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x43e0ae
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.0043d760
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.0043d860
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x43e330
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x170]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.0043e160
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x19c], bl
je 0x43e3ad
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x178]
shl edx, 9
lea ecx, [edx + eax + 0x8cf0]
push ecx
call fcn.004550b0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x43e3ea
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x174
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x43e3bf
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.0043e4c0
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x19c], bl
je 0x43e4b2
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x198]
inc edi
cmp edi, ecx
jne 0x43e435
xor edi, edi
cmp dword [eax + 0x1b0], ebx
je 0x43e48e
lea ebx, [eax + 0x140]
mov ecx, ebx
call fcn.0040c608
mov ecx, eax
mov ebp, edx
mov edx, dword [ebx + 0x28]
mov eax, 0xf
sub eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
cdq
add ecx, eax
adc ebp, edx
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebp
mov eax, dword [edx + 0x1b0]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x178]
sub ecx, edi
shl ecx, 9
lea eax, [edx + ecx + 0x8cf0]
push eax
call fcn.00455070
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x441f20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x46f668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov edx, dword [esp + 0x3c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 8]
push edx
lea eax, [esi + 8]
push eax
mov dword [esp + 0x18], eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x50]
lea edi, [esi + 0x18]
push eax
mov ecx, edi
call fcn.0040c5e1
mov edx, dword [esp + 0x58]
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0xc]
push edx
push eax
call dword [ecx + 0xc]
mov dword [esp + 0x2c], esi
mov byte [esp + 0x30], 1
mov ecx, edi
mov dword [esp + 0x44], 0
call fcn.0040c608
mov ebp, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov ebx, dword [esp + 0x58]
mov dword [esp + 0x4c], 0x40000
test ebx, ebx
je 0x441fdb
mov ecx, edi
call fcn.0040c608
mov ecx, dword [ebx]
mov ebx, dword [esp + 0x14]
add ecx, ebx
mov ebx, dword [esp + 0x58]
mov ebx, dword [ebx + 4]
adc ebx, dword [esp + 0x18]
sub ecx, eax
sbb ebx, edx
mov dword [esp + 0x38], ebx
jne 0x441fdb
cmp ecx, 0x40000
jae 0x441fdb
test ecx, ecx
mov dword [esp + 0x4c], ecx
je 0x442084
mov eax, dword [esp + 0x4c]
mov ecx, esi
push eax
call fcn.004418b0
mov ebx, eax
test ebx, ebx
jne 0x44206c
cmp dword [esi + 0xd54], 0xffffffff
je 0x442084
test ebp, ebp
je 0x441f93
mov eax, dword [esi + 0x48]
mov ebx, dword [esi + 0x50]
sub eax, ebx
cdq
mov ecx, eax
mov ebx, edx
mov edx, dword [esi + 0x40]
mov eax, 0x20
sub eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
cdq
sub ecx, eax
mov eax, dword [esi + 0x58]
sbb ebx, edx
mov edx, dword [esi + 0x5c]
add ecx, eax
adc ebx, edx
mov dword [esp + 0x24], ecx
mov ecx, edi
mov dword [esp + 0x28], ebx
call fcn.0040c608
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
sub eax, ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
sbb edx, ebx
push eax
mov dword [esp + 0x24], edx
mov edx, dword [ebp]
push ecx
push ebp
call dword [edx + 0xc]
mov ebx, eax
test ebx, ebx
jne 0x4420bc
jmp 0x441f93
mov ecx, edi
mov dword [esp + 0x44], 0xffffffff
call fcn.0040c6c1
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4420df
jmp 0x4420d2
mov ecx, edi
mov byte [esp + 0x30], 0
call fcn.0040c6c1
mov edi, eax
mov eax, dword [esi + 0x2c]
test eax, eax
mov dword [esp + 0x44], 0xffffffff
je 0x4420ae
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x2c], 0
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, edi
jmp 0x4420eb
mov ecx, edi
mov dword [esp + 0x44], 0xffffffff
call fcn.0040c6c1
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4420df
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x2c], 0
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, ebx
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 0x14
Function at 0x447580
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [ecx]
push ebx
mov edx, eax
push ebp
shr edx, 2
push esi
mov ebx, dword [esp + 0x20]
mov edx, dword [edx*4 + 0x486e0c]
push edi
mov dword [esp + 0x14], edx
mov edx, 0x800
sub edx, eax
shr edx, 2
mov eax, dword [edx*4 + 0x486e0c]
mov edx, dword [ecx + 4]
mov esi, edx
shr esi, 2
mov esi, dword [esi*4 + 0x486e0c]
add esi, eax
mov dword [esp + 0x18], esi
mov esi, 0x800
sub esi, edx
shr esi, 2
mov edx, dword [esi*4 + 0x486e0c]
add edx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], edx
xor esi, esi
mov dword [esp + 0x10], eax
cmp esi, dword [esp + 0x28]
jae 0x447706
mov edx, esi
xor edi, edi
or edx, 8
cmp edx, 1
je 0x447625
mov eax, edx
shr edx, 1
and eax, 1
lea ebp, [edx + ebx*8]
mov ebp, dword [ecx + ebp*4 + 8]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x486e0c]
add edi, eax
cmp edx, 1
jne 0x4475fa
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add edi, edx
inc esi
mov dword [eax], edi
add eax, 4
cmp esi, 8
mov dword [esp + 0x10], eax
jb 0x4475e4
cmp esi, 0x10
jae 0x4476ac
mov eax, dword [esp + 0x2c]
lea edx, [eax + esi*4]
mov dword [esp + 0x24], edx
cmp esi, dword [esp + 0x28]
jae 0x447706
lea edx, [esi - 8]
xor edi, edi
or edx, 8
cmp edx, 1
je 0x447693
mov eax, edx
shr edx, 1
and eax, 1
lea ebp, [edx + ebx*8]
mov ebp, dword [ecx + ebp*4 + 0x208]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x486e0c]
add edi, eax
cmp edx, 1
jne 0x447665
mov eax, dword [esp + 0x18]
add edi, eax
mov eax, dword [esp + 0x24]
inc esi
mov dword [eax], edi
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x24], eax
jb 0x44764e
cmp esi, dword [esp + 0x28]
jae 0x447706
mov edx, dword [esp + 0x2c]
lea ebx, [edx + esi*4]
lea edx, [esi - 0x10]
xor edi, edi
or dh, 1
cmp edx, 1
je 0x4476f1
mov eax, edx
shr edx, 1
and eax, 1
mov ebp, dword [ecx + edx*4 + 0x408]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x486e0c]
add edi, eax
cmp edx, 1
jne 0x4476c6
mov eax, dword [esp + 0x1c]
add ebx, 4
add edi, eax
mov eax, dword [esp + 0x28]
mov dword [ebx - 4], edi
inc esi
cmp esi, eax
jb 0x4476b9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x44b310
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
xor edi, edi
add ecx, 0x33d14
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
xor esi, esi
mov edx, 1
mov ebx, 4
mov ecx, dword [esp + 0x18]
mov eax, edi
and eax, 1
mov ecx, dword [ecx + edx*4 + 0x28f78]
mov ebp, eax
sub ecx, eax
add edx, edx
neg ebp
xor ecx, ebp
or edx, eax
shr ecx, 2
and ecx, 0x1ff
shr edi, 1
mov ebp, dword [ecx*4 + 0x486e0c]
add esi, ebp
dec ebx
jne 0x44b337
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc edi
mov dword [eax], esi
add eax, 4
cmp edi, 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
jb 0x44b32b
mov edx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [edx + 0x33d54], 0
pop ebx
add esp, 0xc
ret

Function at 0x44d1b6
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x44d1e8
push esi
mov edx, dword [esp + 8]
mov esi, eax
and esi, 0xff
movzx edx, byte [ecx + edx]
xor edx, esi
shr eax, 8
mov edx, dword [edx*4 + 0x487a00]
xor eax, edx
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x44d1c2
pop esi
not eax
ret 8
Function at 0x44dbcc
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x46faf4
call fcn.00461cc8
sub esp, 0x44
push ebx
push esi
push edi
call fcn.0044d0de
test al, al
jne 0x44dbed
push 1
pop eax
jmp 0x44ddb6
call fcn.0044d9fc
mov esi, eax
lea eax, [ebp - 0x50]
push eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x3c]
push edi
push str.CPU_hardware_threads:
push ebx
mov ebx, dword [ebp + 8]
push esi
push str.size:
push ebx
call fcn.0044db82
cmp dword [ebp + 0x10], 0xffffffff
jne 0x44dc22
mov dword [ebp + 0x10], edi
cmp dword [ebp + 0x14], 0xffffffff
jne 0x44dc2f
mov dword [ebp + 0x14], 0x1000000
mov edi, dword [ebp + 0x10]
mov eax, edi
shl eax, 3
push eax
call fcn.00406736
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
and dword [ebp - 4], 0
mov dword [esp], str._n_nSize
push ebx
call fcn.00462ecf
pop ecx
xor eax, eax
test edi, edi
pop ecx
jbe 0x44dc81
lea edi, [eax + 1]
push edi
push str.__5d
push ebx
call fcn.00462ecf
and dword [esi], 0
and dword [esi + 4], 0
mov eax, edi
add esp, 0xc
add esi, 8
cmp eax, dword [ebp + 0x10]
jb 0x44dc5e
push 0x48151c
push ebx
call fcn.00462ecf
xor eax, eax
pop ecx
cmp dword [ebp + 0xc], eax
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
jbe 0x44ddab
mov dword [ebp + 8], 0xa
mov ecx, dword [ebp + 8]
push 1
pop eax
shl eax, cl
cmp eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
ja 0x44dd46
push ecx
push str._2d:
push ebx
call fcn.00462ecf
xor edi, edi
add esp, 0xc
cmp dword [ebp + 0x10], edi
jbe 0x44dd24
mov esi, dword [ebp - 0x10]
call fcn.00401000
test al, al
jne 0x44ddc7
lea eax, [ebp - 0x2c]
inc edi
push eax
push dword [ebp - 0x18]
push edi
call fcn.0044d211
test eax, eax
jne 0x44ddce
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
push 5
push 0x14
pop ecx
call fcn.00462e60
push edx
push eax
push ebx
call fcn.0044d61f
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add dword [esi], eax
adc dword [esi + 4], ecx
add esi, 8
cmp edi, dword [ebp + 0x10]
jb 0x44dcd6
push 0x47ef84
push ebx
call fcn.00462ecf
add dword [ebp - 0x24], 1
pop ecx
pop ecx
adc dword [ebp - 0x20], 0
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x20
jl 0x44dca9
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jb 0x44dca2
mov eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x20]
je 0x44ddab
push str._nAvg:
push ebx
call fcn.00462ecf
cmp dword [ebp + 0x10], 0
pop ecx
pop ecx
jbe 0x44dd9e
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0x10]
push 5
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [esi + 4]
push dword [esi]
call fcn.00461e20
push 0x14
pop ecx
call fcn.00462e60
push edx
push eax
push ebx
call fcn.0044d61f
add esi, 8
dec edi
jne 0x44dd76
push 0x47ef84
push ebx
call fcn.00462ecf
pop ecx
pop ecx
push dword [ebp - 0x10]
call fcn.0040675c
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
mov esi, 0x80004004
jmp 0x44ddd0
mov esi, eax
push dword [ebp - 0x10]
call fcn.0040675c
pop ecx
mov eax, esi
jmp 0x44ddb6
Function at 0x454f60
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.00462f0b
mov ecx, dword [esp + 0x1c]
add esp, 0x18
xor edx, edx
test eax, eax
setne dl
push edx
mov dword [ecx], eax
call fcn.00454f10
ret 0xc

Function at 0x45f860
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x460380
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 0x20], eax
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x24], eax
ret

Function at 0x460860
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [ecx]
push esi
push edi
mov eax, edx
movzx edi, byte [esp + 0xc]
mov esi, 0xff
and eax, esi
xor eax, edi
shr edx, 8
mov eax, dword [eax*4 + 0x487a00]
xor eax, edx
mov edx, dword [ecx + 8]
mov dword [ecx], eax
and eax, esi
add eax, dword [ecx + 4]
mov edi, edx
and edi, esi
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr edx, 8
mov eax, dword [eax*4 + 0x487a00]
pop esi
xor eax, edx
mov dword [ecx + 8], eax
ret 4

Function at 0x4695a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, ecx
mov esi, edx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test edi, edi
je 0x4695cf
test esi, 7
je 0x4695cf
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x4695b4
cmp edi, 0x10
jb 0x469658
mov dword [esp + 0x14], edi
sub edi, 8
and edi, 0xfffffff8
sub dword [esp + 0x14], edi
add edi, esi
xor eax, dword [esi]
mov ebx, dword [esi + 4]
movzx ecx, bl
mov edx, dword [ebp + ecx*4 + 0xc00]
movzx ecx, bh
xor edx, dword [ebp + ecx*4 + 0x800]
shr ebx, 0x10
movzx ecx, bl
xor edx, dword [ebp + ecx*4 + 0x400]
xor edx, dword [esi + 8]
movzx ecx, al
movzx ebx, bh
xor edx, dword [ebp + ebx*4]
mov ebx, dword [esi + 0xc]
xor edx, dword [ebp + ecx*4 + 0x1c00]
movzx ecx, ah
add esi, 8
shr eax, 0x10
xor edx, dword [ebp + ecx*4 + 0x1800]
movzx ecx, al
xor edx, dword [ebp + ecx*4 + 0x1400]
movzx ecx, ah
mov eax, dword [ebp + ecx*4 + 0x1000]
movzx ecx, bl
xor eax, edx
cmp esi, edi
jne 0x4695f0
xor eax, dword [esi]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x46966f
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x46965c
pop ebp
pop edi
pop esi
pop ebx
ret 8

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x73a4263d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x766d05e7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x100195d0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001960f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001960f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001960f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001960f
cmp dword [ecx + 0x74], 0xe
jbe 0x1001960f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001c2cd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001c36a
push ebx
push esi
call fcn.1001c296
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001c22a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001c317
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001c369
push edi
push eax
call fcn.1001a30d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001c337
call fcn.1001ad72
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001c368
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001c22a
add esp, 0x20
test eax, eax
jne 0x1001c356
push edi
call fcn.1001ad72
jmp 0x1001c35e
push ebx
call fcn.1001ad72
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001c5d7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023d10
push 0x10023d08
push str.FlsAlloc
push 0x1f
call fcn.1001c4f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c60b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002214c]
call esi
jmp 0x1001c611
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001c655
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023d20
push 0x10023d18
push str.FlsGetValue
push 0x21
call fcn.1001c4f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c68c
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002214c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001c694
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023d28
push 0x10023d20
push str.FlsSetValue
push 0x22
call fcn.1001c4f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c6ce
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002214c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10021c70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10021c9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10021c9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x101845d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101a1660], 0
mov byte [0x101a1664], 0
mov dword [0x101a1654], 0x25ec
mov dword [0x101a165c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1018463e
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, eax
add edx, 0x2417
mov dword [0x101a165c], 0
add eax, 0xffffd26b
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jmp 0x1018468a
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov dword [0x101a1658], 0xaf6
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101a1658]
mov esi, eax
add esi, 0xffffe4f3
mov dword [0x101a1654], esi
mov esi, dword [0x101a165c]
add esi, 1
mov dword [0x101a165c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x1018463e
jmp 0x10184617
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x1b14
mov edi, 0xfffff02c
mov ebx, 0x100
mov dword [0x101a1668], 0
mov dword [0x101a1654], eax
mov eax, dword [0x101a1660]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + ecx]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x30]
add eax, ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0x3c], edx
mov edx, ecx
mov ecx, dword [ebp - 0x10]
div ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
mov ecx, dword [ebp - 0x38]
add ecx, edx
mov dword [0x101a1668], ecx
mov eax, ecx
cdq
idiv ebx
mov dword [0x101a1660], edx
mov dword [0x101a1654], 0x1802
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x34]
mov cl, byte [ecx + ebx]
mov byte [0x101a1664], cl
mov ecx, dword [ebp - 0x3c]
mov dword [0x101a1654], ecx
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], cl
mov cl, byte [0x101a1664]
mov edx, dword [0x101a1660]
mov ebx, dword [ebp - 0x18]
mov byte [ebx + edx], cl
mov dword [0x101a1654], 0x2b4
mov dword [0x101a1658], 0xfffff6fd
mov edx, dword [0x101a165c]
add edx, 1
mov dword [0x101a165c], edx
cmp edx, 0x100
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], edi
jl 0x1018468a
mov dword [0x101a1654], 0xffffeb3b
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret