joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.100374d9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1003748e
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.100374d9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1003748e
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.100374c9
cdq
sbb byte [ebx], 0x19
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
invalid
test esp, ecx
cli
invalid
Function at 0x100394c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x10039513
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x10039518
jmp 0x10038e6b
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1003955f
lea eax, [ebp - 0x714]
push eax
call fcn.100374d9
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1003748e
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1003956a
jmp 0x1003956f
jmp 0x10038e6b

Function at 0x1003bf50
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0xbc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc8]
add eax, 7
cdq
push ebx
push ebp
mov ebp, dword [esp + 0xcc]
and edx, 7
push esi
add eax, edx
mov esi, eax
push edi
lea eax, [ebp + 1]
mov edi, ecx
push eax
mov dword [esp + 0x18], edi
mov byte [esp + 0x17], 0
sar esi, 3
call fcn.10087e65
add esp, 4
mov ebx, eax
add edi, esi
lea ebx, [ebx]
mov ecx, dword [esp + 0x18]
push ebp
push ecx
push ebx
call fcn.1008d020
mov dl, byte [esp + 0x1f]
add esp, 0xc
mov byte [ebx + ebp], dl
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x1003c005
mov dword [esp + 0x6c], 0x67452301
mov dword [esp + 0x70], 0xefcdab89
mov dword [esp + 0x74], 0x98badcfe
mov dword [esp + 0x78], 0x10325476
mov dword [esp + 0x7c], 0xc3d2e1f0
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
lea eax, [ebp + 1]
push eax
lea eax, [esp + 0x70]
push ebx
push eax
call fcn.10022ac0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x7c]
push edx
call fcn.10022ba0
add esp, 0x14
cmp esi, 0x14
jl 0x1003c060
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub edi, 0x14
mov dword [edi], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x2c]
sub esi, 0x14
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
test esi, esi
je 0x1003c077
inc byte [esp + 0x13]
jmp 0x1003bfb0
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x30]
push esi
sub edx, esi
push edx
push edi
call fcn.1008d020
add esp, 0xc
jmp 0x1003c07b
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0xd8]
and esi, 7
je 0x1003c091
mov al, 1
mov ecx, esi
shl al, cl
dec al
and byte [edi], al
test ebx, ebx
je 0x1003c09e
push ebx
call fcn.10087d88
add esp, 4
mov ecx, dword [esp + 0xc8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10087a66
add esp, 0xbc
ret
Function at 0x10041820
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
mov ebp, dword [eax + 4]
mov eax, dword [edi + 0x84]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x100418ec
mov esi, dword [esp + 0x24]
mov ecx, ebp
sub ecx, eax
cmp ecx, esi
mov dword [esp + 0x10], esi
jg 0x10041858
mov dword [esp + 0x10], ecx
xor eax, eax
cmp dword [esp + 0x10], ebx
jle 0x1004187f
mov ecx, dword [edi + 0x84]
mov edx, dword [esp + 0x20]
mov dl, byte [eax + edx]
add ecx, eax
xor dl, byte [ecx + edi + 4]
add ecx, edi
inc eax
cmp eax, dword [esp + 0x10]
mov byte [ecx + 0x44], dl
jl 0x10041860
mov eax, dword [esp + 0x10]
add dword [edi + 0x84], eax
cmp dword [edi + 0x84], ebp
jne 0x100418e2
mov ecx, dword [edi]
lea edx, [edi + 0x44]
lea eax, [edi + 4]
test ecx, ecx
je 0x100418cf
test ebp, ebp
jl 0x100418cf
cmp dword [ecx + 0x20], ebx
je 0x100418bc
push edx
lea edx, [esp + 0x18]
push edx
push eax
mov eax, ebp
mov esi, ecx
call fcn.1000f620
mov esi, dword [esp + 0x30]
jmp 0x100418c8
push ebp
push edx
lea edx, [esp + 0x1c]
push edx
call fcn.1000f790
add esp, 0xc
test eax, eax
je 0x100418dc
pop edi
pop esi
pop ebp
mov eax, 0x602005a
pop ebx
add esp, 8
ret
mov dword [edi + 0x84], ebx
sub esi, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
jmp 0x100418f4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
jle 0x10041975
lea ebx, [ebx]
mov ecx, dword [esp + 0x1c]
sub ecx, ebx
cmp ebp, ecx
jg 0x10041975
test ebp, ebp
jle 0x1004192e
mov edx, dword [esp + 0x10]
lea eax, [edx + ebx]
add eax, dword [esp + 0x20]
lea ecx, [edi + 0x44]
mov esi, ebp
mov edi, edi
mov dl, byte [ecx - 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub esi, 1
jne 0x10041920
mov ecx, dword [edi]
add ebx, ebp
lea edx, [edi + 0x44]
lea eax, [edi + 4]
test ecx, ecx
je 0x100418cf
test ebp, ebp
jl 0x100418cf
cmp dword [ecx + 0x20], 0
je 0x10041958
push edx
lea edx, [esp + 0x18]
push edx
push eax
mov eax, ebp
mov esi, ecx
call fcn.1000f620
jmp 0x10041964
push ebp
push edx
lea edx, [esp + 0x1c]
push edx
call fcn.1000f790
add esp, 0xc
test eax, eax
jne 0x100418cf
cmp ebx, dword [esp + 0x1c]
jl 0x10041900
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [edi + 0x84], eax
test eax, eax
jle 0x100419b5
mov ecx, dword [esp + 0x10]
add ecx, ebx
add ecx, dword [esp + 0x20]
mov esi, 0xffffffbc
lea eax, [edi + 0x44]
sub esi, edi
lea esp, [esp]
mov dl, byte [eax - 0x40]
xor dl, byte [ecx]
inc eax
mov byte [eax - 1], dl
lea edx, [eax + esi]
inc ecx
cmp edx, dword [edi + 0x84]
jl 0x100419a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x10041be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x818], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [esp + 8], eax
push esi
mov eax, ebx
and eax, 0x80000007
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x1c], ecx
jns 0x10041c1f
dec eax
or eax, 0xfffffff8
inc eax
push 0x3ff
lea edx, [esp + 0x25]
push 0
push edx
mov dword [esp + 0x20], eax
mov byte [esp + 0x2c], 0
call fcn.1008e320
add esp, 0xc
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x10041e05
push 0xc4
call fcn.10087e65
mov esi, eax
add esp, 4
test esi, esi
je 0x10041c7f
push 0xc4
push 0
push esi
call fcn.1008e320
mov al, byte [0x100fd914]
add esp, 0xc
cmp al, 1
jne 0x10041c99
mov edi, 0x90100f0
jmp 0x10041df4
mov eax, 0x901003c
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.10087a66
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x10041def
test ebx, ebx
je 0x10041def
cmp dword [esp + 0x10], 0
je 0x10041def
mov ecx, dword [edi]
mov edx, dword [edi + 4]
lea ebx, [edi + 8]
mov edi, dword [ebp + 0x10]
sub edi, 8
mov dword [esp + 0x420], ecx
mov dword [esp + 0x424], edx
mov dword [ebp + 0x10], edi
jns 0x10041cf3
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [eax], edx
mov dword [eax + 4], ecx
xor edi, edi
jmp 0x10041df4
mov edi, dword [ebp + 0x10]
mov eax, dword [esp + 0x10]
push 1
push 0x101012f8
push eax
push 0x2000120
push esi
mov dword [esp + 0x2c], 0
call sym.inicrypto_v5.4.1.dll_ISC_Init_BLOCK_CIPHER
add esp, 0x14
test eax, eax
jne 0x10041dda
cmp dword [esi + 0x20], 0
lea ecx, [esp + 0x420]
lea edx, [esp + 0xc]
lea eax, [esp + 0x20]
je 0x10041d41
push ecx
push edx
push eax
mov eax, 8
call fcn.1000f620
jmp 0x10041d4c
push 8
push ecx
push edx
mov ecx, esi
call fcn.1000f790
add esp, 0xc
test eax, eax
jne 0x10041de1
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea edx, [esp + ecx + 0x24]
push edx
push esi
call sym.inicrypto_v5.4.1.dll_ISC_Final_BLOCK_CIPHER
add esp, 0xc
test eax, eax
jne 0x10041de8
push esi
call sym.inicrypto_v5.4.1.dll_ISC_Clean_BLOCK_CIPHER_Unit
add esp, 4
cmp edi, 8
jl 0x10041d87
mov edi, 8
jmp 0x10041da0
cmp dword [ebp + 0x10], 0
jne 0x10041da0
cmp dword [esp + 0x14], 0
jne 0x10041cd5
mov dword [esp + 0x14], 1
xor eax, eax
test edi, edi
jle 0x10041db2
mov cl, byte [ebx]
xor byte [esp + eax + 0x20], cl
inc eax
inc ebx
cmp eax, edi
jl 0x10041da6
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x428]
push ecx
call fcn.1008d020
add esp, 0xc
sub dword [ebp + 0x10], edi
jns 0x10041cf0
jmp 0x10041cd5
mov edi, 0x9010021
jmp 0x10041df4
mov edi, 0x901005a
jmp 0x10041df4
mov edi, 0x9010017
jmp 0x10041df4
mov edi, 0x9010049
push esi
call sym.inicrypto_v5.4.1.dll_ISC_Clean_BLOCK_CIPHER_Unit
push esi
call fcn.10087d88
add esp, 8
mov eax, edi
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10087a66
mov esp, ebp
pop ebp
ret
Function at 0x1006ee20
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, eax
or ebp, 0xffffffff
test esi, esi
je 0x1006eec5
push 0x100da2a8
push esi
call fcn.10088770
add esp, 8
test eax, eax
jne 0x1006eec5
push ebx
push 0x100da2ac
push esi
call fcn.100888ba
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1006eec4
push 2
push 0
push ebx
call fcn.10088e5c
push ebx
call fcn.10088d64
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006eebb
push 0
push 0
push ebx
call fcn.10088e5c
add esp, 0xc
test eax, eax
jne 0x1006eebb
push edi
push esi
call fcn.10087e65
mov edi, eax
add esp, 4
test edi, edi
je 0x1006eeba
push ebx
push esi
push 1
push edi
call fcn.10088b71
add esp, 0x10
cmp eax, esi
jne 0x1006eeb1
mov eax, dword [esp + 0x14]
mov dword [eax], edi
mov ebp, esi
test esi, esi
jge 0x1006eeba
push edi
call fcn.10087d88
add esp, 4
pop edi
push ebx
call fcn.10088f58
add esp, 4
pop ebx
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x10070e70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
cmp ebp, eax
jne 0x10070e9a
mov eax, 0x1c060049
pop edi
pop esi
pop ebp
add esp, 8
ret
cmp edi, 0xe
jg 0x10070fa3
mov esi, 0x5000200
mov ecx, dword [esp + 0x18]
cmp dword [ecx], eax
jne 0x10070ecc
push esi
call sym.inicrypto_v5.4.1.dll_ISC_Get_DIGEST_Length
add esp, 4
cmp edi, eax
mov dword [ebp], eax
jg 0x10070fd0
mov dword [esp + 0xc], 1
mov edx, dword [esp + 0x24]
mov edi, dword [ebp]
push esi
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.10070bd0
mov esi, dword [esp + 0x20]
add esp, 0x10
test eax, eax
je 0x10070f0e
mov edx, dword [esp + 0x1c]
push edx
call fcn.10087d88
add esp, 4
test esi, esi
je 0x10070f0e
call fcn.10070930
push esi
call fcn.10087d88
add esp, 4
cmp dword [esp + 0xc], 0
je 0x10070f1f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov edi, dword [esp + 0x20]
cmp dword [edi], 0
jne 0x10070f74
mov eax, dword [ebp]
cdq
sub eax, edx
sar eax, 1
push eax
mov dword [ebx], eax
call fcn.10087e65
add esp, 4
mov dword [edi], eax
mov edx, dword [ebx]
push edx
push 0
push eax
call fcn.1008e320
xor ecx, ecx
add esp, 0xc
cmp dword [ebx], ecx
jle 0x10070f74
xor edx, edx
mov eax, ecx
div dword [esi + 0x14]
mov eax, dword [esi + 0x1c]
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp]
inc ecx
mov dl, byte [edx + eax]
xor dl, byte [ecx + ebp - 1]
mov eax, dword [edi]
mov byte [ecx + eax - 1], dl
cmp ecx, dword [ebx]
jl 0x10070f51
cmp dword [esp + 0xc], 0
jne 0x10070f88
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.10087d88
add esp, 4
test esi, esi
je 0x10070f9a
call fcn.10070930
push esi
call fcn.10087d88
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 8
ret
cmp edi, 0x10
jg 0x10070fb2
mov esi, 0x5000300
jmp 0x10070ea8
cmp edi, 0x18
jg 0x10070fc1
mov esi, 0x5000400
jmp 0x10070ea8
cmp edi, 0x20
jg 0x10070fd0
mov esi, 0x5000500
jmp 0x10070ea8
pop edi
pop esi
mov eax, 0x1c06002b
pop ebp
add esp, 8
ret
Function at 0x100713b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x1f8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1f4], eax
mov eax, dword [esp + 0x1fc]
push ebx
push esi
xor ebx, ebx
push 0x3f
lea ecx, [esp + 0x1c1]
push ebx
push ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x1c8], bl
call fcn.1008e320
xor eax, eax
push 0x3f
lea edx, [esp + 0x14d]
push ebx
push edx
xor esi, esi
mov byte [esp + 0x144], bl
mov dword [esp + 0x145], eax
mov dword [esp + 0x149], eax
mov dword [esp + 0x14d], eax
mov word [esp + 0x151], ax
mov byte [esp + 0x153], al
mov byte [esp + 0x154], bl
call fcn.1008e320
push 0x3f
lea eax, [esp + 0x199]
push ebx
push eax
mov byte [esp + 0x1a0], bl
call fcn.1008e320
push 0x11c
lea ecx, [esp + 0x38]
push ebx
push ecx
call fcn.1008e320
add esp, 0x30
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100715c7
mov eax, dword [esp + 0x14]
cmp eax, 6
jb 0x100715c7
jne 0x1007148f
cmp dword [esp + 0x18], 1
jbe 0x100715c7
push str.bcrypt.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x101012d4], eax
cmp eax, ebx
je 0x100715c7
push str.BCryptGenRandom
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101012d0], eax
cmp eax, ebx
je 0x10071594
push ebp
call sym.inicrypto_v5.4.1.dll_ISC_New_HMAC_Unit
mov ebp, eax
push edi
lea esp, [esp]
push 0x10
lea eax, [esp + 0x138]
push eax
push 0x5000300
push ebp
call sym.inicrypto_v5.4.1.dll_ISC_Init_HMAC
add esp, 0x10
xor edi, edi
lea ebx, [ebx]
push 2
push 0x10
lea ecx, [esp + 0x14c]
push ecx
push ebx
call dword [0x101012d0]
test eax, eax
jne 0x1007157f
push 0x10
lea edx, [esp + 0x148]
push edx
push ebp
call sym.inicrypto_v5.4.1.dll_ISC_Update_HMAC
inc edi
add esp, 0xc
cmp edi, 0x80
jl 0x100714f0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x188]
push ecx
push ebp
call sym.inicrypto_v5.4.1.dll_ISC_Final_HMAC
push ebp
call sym.inicrypto_v5.4.1.dll_ISC_Clean_HMAC_Unit
mov edi, dword [esp + 0x24]
push edi
lea edx, [esp + 0x198]
push edx
lea eax, [esp + esi + 0x1dc]
push eax
call fcn.1008d020
add esi, edi
add esp, 0x1c
cmp esi, 0x40
jl 0x100714d0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x1c4]
push 0x40
push ecx
mov edi, 0x40
call fcn.100709a0
add esp, 8
pop edi
cmp ebp, ebx
je 0x10071593
push ebp
call sym.inicrypto_v5.4.1.dll_ISC_Clean_HMAC_Unit
push ebp
call fcn.10087d88
add esp, 8
pop ebp
push 0x40
lea edx, [esp + 0x140]
push ebx
push edx
call fcn.1008e320
push 0x40
lea eax, [esp + 0x18c]
push ebx
push eax
call fcn.1008e320
mov eax, dword [0x101012d4]
add esp, 0x18
cmp eax, ebx
je 0x100715c7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x1fc]
pop esi
pop ebx
xor ecx, esp
call fcn.10087a66
add esp, 0x1f8
ret
Function at 0x100715e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 8
rdtsc
push esi
push edi
push 0
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
sub eax, esi
sbb edx, edi
mov dword [esp + 8], eax
or eax, edx
mov dword [esp + 0xc], edx
je 0x1007161d
mov esi, dword [esp + 0x14]
lea eax, [esp + 8]
push 2
push eax
mov edi, 8
call fcn.100709a0
add esp, 8
pop edi
pop esi
add esp, 8
ret

Function at 0x10071630
Capabilities:
Read file via mapping

Disassembly:
push ebp
push str._M_B_M_5_S_D_
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebp, eax
test ebp, ebp
je 0x1007167d
push ebx
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x10071675
push edi
push 6
push ebx
mov edi, 0x2000
call fcn.100709a0
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
ret

Function at 0x100717c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x100717fb
mov eax, esi
call fcn.10071680
mov eax, esi
call fcn.10071700
mov eax, esi
call fcn.10071770
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.10087a66
add esp, 0x19c
ret
Function at 0x10087a66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10087a70
repz ret
jmp fcn.10089222

Function at 0x1009118d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1008939a
and dword [ebp - 4], 0
cmp dword [0x10100da0], 0
mov ebx, eax
jne 0x1009123e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100912ef
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100912ef
push eax
call fcn.10089328
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10100da0], eax
call esi
push eax
call fcn.10089328
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10100da4], eax
call esi
push eax
call fcn.10089328
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10100da8], eax
call esi
push eax
call fcn.10089328
pop ecx
mov dword [0x10100db0], eax
test eax, eax
je 0x1009123e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10089328
pop ecx
mov dword [0x10100dac], eax
mov eax, dword [0x10100dac]
cmp eax, ebx
je 0x10091296
cmp dword [0x10100db0], ebx
je 0x10091296
push eax
call fcn.100893a3
push dword [0x10100db0]
mov esi, eax
call fcn.100893a3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10091296
test edi, edi
je 0x10091296
call esi
test eax, eax
je 0x1009128d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1009128d
test byte [ebp - 0xc], 1
jne 0x10091296
or dword [ebp + 0x10], 0x200000
jmp 0x100912cf
mov eax, dword [0x10100da4]
cmp eax, ebx
je 0x100912cf
push eax
call fcn.100893a3
pop ecx
test eax, eax
je 0x100912cf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100912cf
mov eax, dword [0x10100da8]
cmp eax, ebx
je 0x100912cf
push eax
call fcn.100893a3
pop ecx
test eax, eax
je 0x100912cf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10100da0]
call fcn.100893a3
pop ecx
test eax, eax
je 0x100912ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100912f1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x661366a6
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x5e4f0c80
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x403120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403198
xor eax, eax
push ebp
push 0x403191
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4031d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403198
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403a64
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a044], 0
je 0x403ac5
cmp word [0x40a218], 0xd7b2
jne 0x403a8d
cmp dword [0x40a220], 0
jbe 0x403a8d
mov eax, 0x40a214
call dword [0x40a230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403aec
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409020], 0
jne 0x403ae1
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret