joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494390
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6b9d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x75d454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
call dword [0x4d95f8]
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
mov dword [edi], vtable.ProxySocks5.0
call dword [0x4d95b4]
lea ecx, [edi + 0xc]
call dword [0x4d95b4]
lea ecx, [edi + 0x10]
call dword [0x4d95b4]
lea ecx, [edi + 0x14]
call dword [0x4d95b4]
lea ecx, [edi + 0x18]
call dword [0x4d95b4]
mov esi, dword [0x4d955c]
push 0
push 0x4da0cc
mov byte [ebp - 4], 5
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call esi
mov dword [edi + 0x3c], eax
push 0
push 0x4da0cc
mov byte [ebp - 4], 6
call esi
mov dword [edi + 0x40], eax
push 9
push str.127.0.0.1
mov byte [ebp - 4], 7
call esi
add esp, 0x18
mov dword [edi + 0x44], eax
lea ecx, [edi + 0x4c]
mov dword [edi + 0x48], 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
mov byte [ebp - 4], 8
jb 0x494471
mov eax, dword [ecx]
jmp 0x494473
mov eax, ecx
push 0
push 0x4da0cc
mov byte [eax], 0
call fcn.00404950
lea ecx, [edi + 0x64]
mov byte [ebp - 4], 9
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4944a1
mov eax, dword [ecx]
jmp 0x4944a3
mov eax, ecx
push 0
push 0x4da0cc
mov byte [eax], 0
call fcn.00404950
push 8
mov byte [ebp - 4], 0xa
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 3
mov byte [edi + 0x88], 0
mov dword [0x75e88c], edi
call fcn.004c3b7c
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
push 0
mov ecx, esi
mov byte [ebp - 4], 0xb
call dword [0x4d9338]
sub esp, 0x28
mov dword [esi], vtable.QProcess.0
mov eax, esp
mov dword [edi + 0x38], esi
mov byte [ebp - 4], 0xa
mov dword [eax], vtable.std::_Func_impl_class__lambda_8aeade96da6198f2b89ef3e710b98ad0___class_std::allocator_int___void__struct_QProcess::CreateProcessArguments__.0
mov dword [eax + 0x24], eax
mov ecx, dword [edi + 0x38]
call dword [0x4d9330]
push 8
call fcn.004c3b7c
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
push edi
mov ecx, esi
mov byte [ebp - 4], 0xc
call dword [0x4d99a8]
mov dword [esi], vtable.QUdpSocket.0
mov ecx, edi
mov byte [ebp - 4], 0xa
mov dword [edi + 0x34], esi
call fcn.00494bc0
mov ecx, edi
call fcn.00494900
mov ecx, edi
call fcn.00495360
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4979c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7410
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x75d454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x497a4b
mov esi, dword [ebx + 4]
jmp 0x497a51
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x497a63
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x497aaa
cmp esi, eax
jne 0x497a57
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x497a93
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x497ae5
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x497b07
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.004c3baf
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x497aed
mov dword [ecx], edi
jmp 0x497b07
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x497b07
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0049a440
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x498480
Capabilities:
Create pipe

Disassembly:
push ebp
lea ebp, [esp - 0xa4]
sub esp, 0xa4
push 0xffffffffffffffff
push 0x4d7580
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x75d454]
xor eax, ebp
mov dword [ebp + 0xa0], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0x40]
lea eax, [esi + 0x40]
cmp edi, 0xc8
je 0x498523
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0xa4]
call fcn.0049ab80
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0xa8]
je 0x4984e8
mov eax, dword [eax + 0xc]
jmp 0x4984ed
mov eax, str.unknown_error
push eax
push edi
push str._html___head____head___meta_http_equiv_content_type__content_text_html_charsetutf_8____________title_error__title___________body_align_center_____________body___________d__s___________html_
push 0xffffffffffffffff
push 0x1000
push dword [esi + 0x54]
call fcn.0049add0
mov ecx, dword [esi + 0x54]
add esp, 0x18
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x498510
sub ecx, edx
mov dword [esi + 0x5c], ecx
mov eax, ecx
jmp 0x498686
cmp byte [esi + 0x45], 0
je 0x498683
mov eax, dword [esi + 8]
cmp eax, 1
je 0x49853e
cmp eax, 2
jne 0x49867f
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x20]
sub ecx, eax
dec ecx
test ecx, ecx
jle 0x49867f
push ecx
inc eax
mov dword [ebp + 0x5c], 0xf
push eax
lea ecx, [ebp + 0x48]
mov dword [ebp + 0x58], 0
mov byte [ebp + 0x48], 0
call fcn.00404950
mov eax, dword [esi + 8]
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x4985bf
push str.QUERY_STRING
lea ecx, [ebp + 0x30]
call fcn.00401730
lea eax, [ebp + 0x48]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.004126a0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x4985a8
mov eax, dword [eax]
push eax
call dword [0x4d9de4]
add esp, 4
lea ecx, [ebp + 0x18]
call fcn.00401840
lea ecx, [ebp + 0x30]
jmp 0x49863a
cmp eax, 2
jne 0x49863f
push str.CONTENT_LENGTH
lea ecx, [ebp + 0x18]
call fcn.00401730
push 0x40
lea eax, [ebp + 0x60]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.004c5306
push 0xa
lea eax, [ebp + 0x60]
push eax
push dword [esi + 0x48]
call dword [0x4d9dd8]
add esp, 0x18
lea ecx, [ebp + 0x30]
push eax
call fcn.00401730
lea eax, [ebp + 0x30]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp]
push eax
call fcn.004126a0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x49861d
mov eax, dword [eax]
push eax
call dword [0x4d9de4]
add esp, 4
lea ecx, [ebp]
call fcn.00401840
lea ecx, [ebp + 0x30]
call fcn.00401840
lea ecx, [ebp + 0x18]
call fcn.00401840
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
movq qword [ebp - 0x1c], xmm0
push eax
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
lea ecx, [ebp + 0x48]
call fcn.00401840
xor eax, eax
jmp 0x498686
mov eax, dword [esi + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0xa0]
xor ecx, ebp
call fcn.004c3b48
lea esp, [ebp + 0xa4]
pop ebp
ret
Function at 0x49a2c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d13cc
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x75d454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x50]
mov dword [edi + 8], 1
mov dword [edi + 0xc], 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov word [edi + 0x44], 0
mov byte [eax], 0
mov eax, dword [edi + 0x54]
mov byte [eax], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x40], 0xc8
lea ecx, [edi + 0x68]
mov dword [ebp - 4], 0
call fcn.0049a970
push 8
lea ecx, [edi + 0x64]
call fcn.0049a580
lea ecx, [edi + 0x88]
mov dword [ebp - 4], 1
call fcn.0049a970
push 8
lea ecx, [edi + 0x84]
call fcn.0049a580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49ab80
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x49abd9
mov ecx, esi
jmp 0x49abde
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x49ac03
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x49abed
mov eax, dword [eax]
jmp 0x49abd1
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8
Function at 0x49ac10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, ecx
mov ebp, dword [ebx + 0x10]
jb 0x49ac2a
mov esi, dword [ebx]
jmp 0x49ac2c
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test ebp, ebp
je 0x49ac48
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebp
jb 0x49ac37
mov ecx, dword [edi + 0x18]
and ecx, edx
mov edx, dword [edi + 0xc]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [esp + 0x10], esi
mov esi, dword [edi + 4]
mov dword [esp + 0x24], esi
lea ecx, [edx + ecx*4]
mov dword [esp + 0x18], ecx
nop dword [eax + eax]
cmp dword [esp + 0x10], esi
jne 0x49ac7a
mov ecx, esi
jmp 0x49ac7e
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x49adb3
cmp dword [ebx + 0x14], 0x10
lea edx, [eax + 8]
jb 0x49ac93
mov edi, dword [ebx]
jmp 0x49ac95
mov edi, ebx
cmp dword [edx + 0x14], 0x10
lea ecx, [edx + 0x10]
jb 0x49aca0
mov edx, dword [edx]
mov ecx, dword [ecx]
mov esi, ebp
cmp ecx, ebp
mov dword [esp + 0x14], ecx
cmovb esi, ecx
test esi, esi
je 0x49ad0a
sub esi, 4
jb 0x49acc7
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x49accc
add edx, 4
add edi, 4
sub esi, 4
jae 0x49acb6
cmp esi, 0xfffffffc
je 0x49ad00
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x49acf9
cmp esi, 0xfffffffd
je 0x49ad00
mov cl, byte [edx + 1]
cmp cl, byte [edi + 1]
jne 0x49acf9
cmp esi, 0xfffffffe
je 0x49ad00
mov cl, byte [edx + 2]
cmp cl, byte [edi + 2]
jne 0x49acf9
cmp esi, 0xffffffff
je 0x49ad00
mov cl, byte [edx + 3]
cmp cl, byte [edi + 3]
je 0x49ad00
sbb ecx, ecx
or ecx, 1
jmp 0x49ad02
xor ecx, ecx
test ecx, ecx
jne 0x49ad10
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
jb 0x49ad10
jbe 0x49ad1f
mov eax, dword [eax]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
jmp 0x49ac70
cmp dword [eax + 0x1c], 0x10
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x49ad2d
mov edx, dword [edx]
cmp dword [ebx + 0x14], 0x10
jb 0x49ad35
mov ebx, dword [ebx]
mov edi, dword [edi]
cmp ebp, edi
mov esi, edi
cmovb esi, ebp
test esi, esi
je 0x49ad97
sub esi, 4
jb 0x49ad58
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x49ad5d
add ebx, 4
add edx, 4
sub esi, 4
jae 0x49ad47
cmp esi, 0xfffffffc
je 0x49ad91
mov cl, byte [ebx]
cmp cl, byte [edx]
jne 0x49ad8a
cmp esi, 0xfffffffd
je 0x49ad91
mov cl, byte [ebx + 1]
cmp cl, byte [edx + 1]
jne 0x49ad8a
cmp esi, 0xfffffffe
je 0x49ad91
mov cl, byte [ebx + 2]
cmp cl, byte [edx + 2]
jne 0x49ad8a
cmp esi, 0xffffffff
je 0x49ad91
mov cl, byte [ebx + 3]
cmp cl, byte [edx + 3]
je 0x49ad91
sbb ecx, ecx
or ecx, 1
jmp 0x49ad93
xor ecx, ecx
test ecx, ecx
jne 0x49ad9d
cmp ebp, edi
jb 0x49ad9d
jbe 0x49ada1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, ecx
pop ebx
add esp, 0xc
ret 8
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x49af70
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1f8
mov eax, dword [0x75d454]
xor eax, esp
mov dword [esp + 0x1f4], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x49b015
push 0x64
lea eax, [esp + 0x194]
push 0
push eax
call fcn.004c5306
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x276c
jne 0x49aff9
mov ecx, dword [esp]
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x198]
push str.Startup_____WSAStartup___error._nRequested_v2.0_highest_v2.2___found_only_v_d._d.
push eax
call fcn.0049ae10
add esp, 0x10
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x1f4]
xor ecx, esp
call fcn.004c3b48
add esp, 0x1f8
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [esp + 0x194]
push str.Startup_____WSAStartup___error__d
push eax
call fcn.0049ae10
add esp, 0xc
mov ecx, dword [esp + 0x1f4]
xor ecx, esp
call fcn.004c3b48
add esp, 0x1f8
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x453638f8
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2087427
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x55350ec7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x154247b6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x100218ea
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp ecx, 0
sete dl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x15], dl
mov eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
sete dl
mov dh, byte [ebp - 0x15]
and dh, dl
test dh, 1
mov dword [ebp - 0x1c], eax
jne 0x10021ab7
mov dword [0x1006b790], 0x185d
mov dword [0x1006b78c], 0x205
mov ecx, dword fs:[0x18]
mov dword [0x1006b78c], 0x212c
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0xc]
mov ecx, eax
add ecx, 0x14
mov dword [0x1006b790], 0x13d0
mov eax, dword [eax + 0x14]
cmp eax, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
je 0x10021aa8
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x24]
mov byte [ebp - 0x25], cl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [0x1006b790], 0xaad
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x25]
and bh, bl
test bh, 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], esi
jne 0x100219ca
jmp 0x100219e0
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
jmp 0x10021ab7
xor eax, eax
mov ecx, dword [ebp - 0x34]
mov dx, word [ecx]
mov dword [0x1006b78c], 0xffffe74d
shr dx, 1
movzx esi, dx
cmp dx, 0
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], eax
je 0x10021a8b
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x38]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x4e], dx
mov word [ebp - 0x50], di
jb 0x10021a3e
mov ax, word [ebp - 0x4e]
mov word [ebp - 0x50], ax
mov ax, word [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x4c]
cmp word [ecx + edx*2], ax
sete bl
add edx, 1
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x44]
cmp edx, esi
setb bh
and al, bh
test al, 1
mov byte [ebp - 0x51], bl
mov dword [ebp - 0x48], edx
jne 0x10021a0a
mov dword [0x1006b78c], 0x1b01
mov al, byte [ebp - 0x51]
test al, 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], ecx
jne 0x10021ab7
mov dword [0x1006b78c], 0x25ac
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
cmp ecx, edx
mov dword [ebp - 0x2c], ecx
jne 0x1002198f
xor eax, eax
mov dword [0x1006b790], 0x23cc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10021ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1006b78c], 0x23d1
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x10021b1d
xor eax, eax
mov ecx, dword [0x1006b790]
mov edx, ecx
add edx, 0x411
mov dword [0x1006b790], edx
add ecx, 0x5d3
mov dword [0x1006b78c], ecx
mov dword [ebp - 0x13c], eax
jmp 0x10021b80
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
mov esi, ecx
add esi, 1
imul edi, ecx, 0x17c
mov ebx, edx
add ebx, edi
add ebx, 0xec
imul ecx, ecx, 0x17c
add edx, ecx
add edx, 0x11c
mov ecx, dword [edx]
movzx edx, word [ebx]
xor edx, ecx
add edx, eax
cmp esi, 0x2e2
mov eax, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x138], eax
je 0x10021af3
jmp 0x10021b1d
mov eax, dword [ebp - 0x13c]
mov cl, byte [eax + 0x10025b78]
mov dl, byte [eax + 0x10025b49]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x13c], eax
jne 0x10021b80
lea eax, [ebp - 0x12c]
mov dword [0x1006b78c], 0x1b8b
mov dword [ebp - 0x144], eax
call fcn.100227ee
mov dword [esp], eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
call fcn.10022267
mov ecx, eax
mov dword [0x1006b7ac], eax
mov eax, esp
mov edx, dword [ebp - 0x140]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x1006b78c], 0x829
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0x17c
mov edi, edx
add edi, esi
add edi, 0xd8
imul esi, eax, 0x17c
mov ebx, edx
add ebx, esi
add ebx, 0xec
mov esi, eax
add esi, 1
imul eax, eax, 0x17c
add edx, eax
add edx, 0x11c
mov eax, dword [ebp - 0x148]
add eax, ecx
mov edx, dword [edx]
mov edi, dword [edi]
movzx ebx, word [ebx]
xor ebx, edx
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], ebx
call fcn.10021d6d
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
cmp edx, 0x2e2
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], eax
jne 0x10021c27
lea eax, [0x10025b57]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.10022b36
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x140]
mov dword [esp + 0xc], edx
call fcn.10021dcd
xor eax, eax
mov ecx, dword [ebp - 0x148]
add ecx, 0x5d7cf
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x128200
mov ecx, dword [ebp - 0x148]
add ecx, 0x4c8b6
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f50
mov dword [0x1006b790], 0xe43
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10021dcd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1006b794], 0
mov dword [0x1006b798], 0
mov dword [0x1006b7a4], 0
mov dword [0x1006b78c], 0x819
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x10021f43
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1006b794], edx
mov dword [0x1006b78c], 0x110a
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1006b798], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1006b79c], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1006b79c]
mov edx, dword [0x1006b798]
mov byte [edi + edx], cl
mov edx, dword [0x1006b794]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1006b798]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov edx, dword [0x1006b78c]
mov ecx, edx
add ecx, 0x154a
mov dword [0x1006b78c], ecx
and ebx, 0xff
mov dword [0x1006b7a4], ebx
mov ecx, dword [0x1006b790]
add ecx, 0x880
mov dword [0x1006b790], ecx
mov cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov ch, byte [ebx + esi]
add edx, 0xfffff523
mov dword [0x1006b78c], edx
mov byte [0x1006b7a9], ch
mov byte [0x1006b7aa], cl
xor ch, cl
mov byte [0x1006b7a8], ch
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x38], esi
je 0x10021f43
mov eax, dword [0x1006b798]
mov ecx, dword [0x1006b794]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x10021e30
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret