joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402130
Capabilities:
Create process on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.GetShortPathNameA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetEnvironmentVariableA
push ebx
mov dword [ebp - 0x2c], eax
call esi
push eax
call edi
push 0x407304
push ebx
mov dword [ebp - 0x30], eax
call esi
push eax
call edi
push 0x4071e0
push ebx
mov dword [ebp - 0x38], eax
call esi
push eax
call edi
push str.SetPriorityClass
push ebx
mov dword [ebp - 0x24], eax
call esi
push eax
call edi
push str.SetThreadPriority
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push str.WinExec
push ebx
mov dword [ebp - 0x3c], eax
call esi
push eax
call edi
push str.SetFileAttributesA
push ebx
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x34], eax
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x17b]
mov byte [ebp - 0x17c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x383]
mov byte [ebp - 0x384], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x27f]
mov byte [ebp - 0x280], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x17c]
push eax
push ebx
call dword [ebp - 0x38]
jmp loc.0040bae5

Function at 0x40235f
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x402378
push 1
pop eax
jmp fcn.004023ed
jmp loc.0040cf9f

Function at 0x402b47
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp loc.0040d5df

Function at 0x402ee5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.RegCloseKey
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.RegOpenKeyExA
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x30], eax
xor edx, edx
pop ecx
xor eax, eax
jmp loc.0040d250

Function at 0x403044
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406160
push 0x403940
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2dc
push ebx
push esi
push edi
push str.RegCloseKey
mov ebx, str.ADVAPI32.dll
push ebx
jmp loc.0040dd0a
Function at 0x403853
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
jmp loc.0040d382

Function at 0x403910
Capabilities:
Packed with generic packer

Disassembly:
cmp cl, 0x40
jae 0x40392a
cmp cl, 0x20
jae 0x403920
jmp loc.0040d719
mov eax, edx
xor edx, edx
and cl, 0x1f
shr eax, cl
ret
xor eax, eax
xor edx, edx
ret

Function at 0x403ab0
Capabilities:
Packed with generic packer

Disassembly:
push 0x30000
push 0x10000
jmp loc.0040b73d

Function at 0x403b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.lstrcatA
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.lstrcpyA
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0x40]
push 0x104
push eax
call ebx
mov al, 0x65
mov dl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x38], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3c], al
mov cl, 0x72
mov bl, 0x6c
mov dl, 0x78
xor al, al
mov byte [esp + 0x10], 0x5c
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x70
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], 0x2e
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], al
mov byte [esp + 0x42], al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x40]
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x40]
push eax
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret

Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
jmp loc.0040d795
Function at 0x40bfa6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
add dl, bh
pop edi
push ebx
dec edi
pop edi
dec edi
dec ecx
and al, 0
add al, 0
popal
popfd
lea eax, [ebp - 0x25c]
jmp loc.004034fa
Function at 0x4081c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x88]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x58], 2
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x50], 0x10
mov dword [ebp - 0x4c], pe_nt_image_headers32
mov dword [ebp - 0x48], 0x20
mov dword [ebp - 0x44], 0x40
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov eax, dword [edx + 0x3c]
lea eax, [ecx + eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0xf8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
lea ebx, [eax - 1]
mov dword [ebp - 0x24], 0
cmp ebx, dword [ebp - 0x24]
jb 0x408390
sub dword [ebp - 0x24], 1
mov esi, esi
add dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x24]
imul edx, eax, 0x28
mov eax, dword [ebp - 0x10]
lea esi, [edx + eax]
lea edi, [ebp - 0x88]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x3c]
or eax, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x408292
jmp 0x408297
jmp 0x408387
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
and eax, 0x2000000
test eax, 0xffffffff
jne 0x4082ae
jmp 0x4082c4
push 0x4000
push dword [ebp - 0x30]
push dword [ebp - 0x40]
mov eax, dword [ebp - 4]
call dword [eax + 8]
jmp 0x408387
mov eax, dword [ebp - 0x34]
and eax, 0x20000000
test eax, 0xffffffff
jne 0x4082d5
jmp 0x4082de
mov dword [ebp - 0x14], 1
jmp 0x4082e5
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x34]
and eax, 0x40000000
test eax, 0xffffffff
jne 0x4082f6
jmp 0x4082ff
mov dword [ebp - 0x18], 1
jmp 0x408306
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x34]
and eax, 0x80000000
test eax, 0xffffffff
jne 0x408317
jmp 0x408320
mov dword [ebp - 0x1c], 1
jmp 0x408327
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x34]
and eax, 0x4000000
test eax, 0xffffffff
jne 0x408338
jmp 0x408341
mov dword [ebp - 0x20], 1
jmp 0x408348
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x14]
shl eax, 4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + eax - 0x60]
mov edx, dword [ebp - 0x1c]
lea eax, [eax + ecx*8]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x20], 1
je 0x408369
jmp 0x408374
mov eax, dword [ebp - 0x28]
or eax, 0x200
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x30]
push dword [ebp - 0x40]
mov eax, dword [ebp - 4]
call dword [eax + 4]
cmp ebx, dword [ebp - 0x24]
ja 0x40825c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408929
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
inc edi
inc edi
call fcn.0040894c
inc edi
xor dword [esi], ecx
inc esi
sub edx, 0xffdeaa91
add edx, 0x54098d87
cmp esi, ebx
jne fcn.00408929
ret
Function at 0x4774f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72
push ebx
xchg ebp, eax
pop ebp
or byte [edi], cl
invalid

Function at 0x4ad78f
Capabilities:
Encode data using xor

Disassembly:
call fcn.004ad682
mov ecx, 0x374
call 0x4ad78f
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x4ad792
mov bh, ah
fxch st(1)
fdiv qword [ebx - 0xd]
push esi
pop edi
push ebx
inc edx
inc ebp
inc esp
inc edi
dec esp
push ebx
push edx
push ecx
push eax
push edi
inc esp
dec esp
inc ecx
dec esp
inc ecx
sub dword [ebx], ebp
dec edx
inc ebp
sub bl, byte [esi + 0x70]
adc dword [ebx + 0x10], esp
insb byte es:[edi], dx
insd dword es:[edi], dx
push ss
sbb byte [ecx], bl
imul ebp, dword [ecx + 0x6d], 0x6c
insb byte es:[edi], dx
jnp 0x4ad839
jo 0x4ad82d
add dword [ebp + 0x77], esi
add al, 0x75
jp 0x4ad7da
js 0x4ad84c
insd dword es:[edi], dx
push es
jle 0x4ad7db
or ecx, dword [eax]
or bl, byte [0x6057e08]
sbb eax, 0x6057e08
adc eax, dword [ecx]
add byte [ebp + 0x7d], dh
jg 0x4ad7e9
pop ss
imul ebp, dword [edx + 0xa], 0x13106110
add cl, byte [0x140a146b]
push 0xa
adc byte [ecx + 0x10], ah
adc eax, dword [edx]
or eax, 0x140a146b
push ss
push ss
xor byte cs:[edi], ah
push ebx
push edx
xor al, 0x56
xor byte [ecx + esi], ch
daa
cmp byte [esi], ah
and ah, byte [0x43423323]
xor al, 0x2e
cmp ah, byte [esi]
xor eax, 0x2b204141
dec eax
xor esi, dword [0xc9c7cd46]
into
fstp st(7)
xlatb
ffree st(7)
mov eax, 0xc3d4c1c6
rcr edi, 0xdf
enter 0xffffffffffffd8a3, 0xffffffffffffffac
rcr ah, cl
iretd
fmul st(7), st(0)
lodsb al, byte [esi]
into
aam 0xd6
rcr ecx, 1
invalid
out dx, al
in eax, dx
invalid
clc
test dl, bh
lea eax, [eax - 0xd71081e]
ljmp 0x8888

Function at 0x50d7b0
Capabilities:
Execute syscall

Disassembly:
rcr byte [edx], 1
or byte fs:[ecx - 0x2c], ch
jg 0x50d794
ror dword [edi], cl
or edi, ebx
insd dword es:[edi], dx
outsw dx, word [esi]
jp 0x50d758
fmul dword ds:[edi]
fmul dword [edi]
lds esp, fs:[esi - 0x13]
xlatb
jg 0x50d738
punpckldq mm1, dword [edi + ecx]
pop ecx
jecxz 0x50d770
invalid
movups xmmword [ebp - 0x28f81d84], xmm7
punpckhdq xmm4, xmm0
sysenter
push edi
adc byte [edi], cl
and byte [edi - 0x63], ah
push ss
inc edi
xor byte [eax - 0x73], dl
in al, dx
nop
xor ecx, dword [ebx + 0x39965751]
or al, 0x8d
mov ch, byte [ebp + 0x475dc483]
add esp, 0x5d
inc edi
add dword [eax], eax
imul eax, dword [eax], 0xe5345e5f
or dword [ebx - 0x1d], ebp
pop ebx
ret
ja 0x50d74a
aam 0x78
add byte [ecx], ch
int3

Function at 0x53a7e0
Capabilities:
Hash data using fnv

Disassembly:
xlatb
mov dh, 0x42
or byte [0x81545ec5], dh
imul ecx, eax, 0x1000193
enter 0xfffffffffffff1b6, 0xffffffffffffffb7
xor esi, dword [edi + 0xa47b68a]
imul ecx, ecx, 0x100010e
xor esp, dword [edi + 0x690b47b6]
leave
xchg ebx, eax
wait
add byte [eax], ch
xor ecx, eax
imul ebp, ebx, 0x1eafb93
int3
Function at 0x53d1c6
Capabilities:
Encode data using xor

Disassembly:
jle 0x53d1dd
call ecx
int1
pop ebx
inc ebp
stosb byte es:[edi], al
xor eax, 0x4d8d05e0
sbb byte [ebx], bh
les ecx, [esi + edx*2 - 0x7c]
rol byte [ebx - 0x1c10f73c], cl
ja 0x53d1c9
mov eax, dword [ebp - 7]
pop esp
add dword [eax], 0x558b007b
adc al, 0x28
sub eax, 0xf39403ce
sub al, 0xe3
int3
cld
jl 0x53d194
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x43]
invalid
movsd dword es:[edi], dword [esi]
inc edi
jne 0x53d1c9
out 0xc0, al
imul ecx, dword [edi - 0x25f033], 0x8b0cae8b
dec ebp
clc
or dword [ecx + 0x78c1102], 0x1a
add byte [eax], al
mov edx, dword [ebp + 8]
jns 0x53d244
aas
imul edi, dword [ecx + 0x1475ff0c], 0xffffff91
push dword [ebp + 0x14]
xchg ecx, eax
lock adc edi, dword [ebp + 0x7c]
and eax, 0xb30008
mov edx, 0x8ba5ecd8
clc
mov esi, edx
mov ecx, 0x29778708
sub eax, edx
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x3c]
sar eax, 5
push ecx
punpckhdq mm4, qword [ebx + 0x52]
call fcn.0052dfba
cmp byte [ebp + 8], dl
sub dword [ecx + 0x14], 0xffffffaf
xchg ebp, eax
or al, 0x17
add byte [ebx - 0x1c27dfa9], 0xe0
bound eax, qword [ebp - 0x3f]
into
dec ebp
invalid
sti
inc eax
jge 0x53d201
pop edi
or al, 0xfe
mov esp, ebp
pop ebp
sbb ebx, 0xffffff8a
push eax
into
xor eax, 0xb5458de8
push eax
into
push ebp
adc al, 0x83
les edx, [edi + 0x3c7773b5]
mov ebx, dword [ebp - 0x6f]
mov ebx, ebp
cld
lea eax, [ebp + 0x75]
adc eax, 0x49938941
mov dl, 0x9c
mov dl, dl
or byte [edi], ah
je 0x53d220
rep movsd dword es:[edi], dword [esi]
push eax
call dword [ebp + 0x14]
arpl sp, ax
outsd dx, dword [esi]
fcmovb st(0), st(0)
jne 0x53d27d
mov esp, dword [edx + 0x11]
test al, 0x7d
cld
clc
inc ebp
add eax, 0x83c4758d
pmuludq mm6, qword [esi]
mov eax, eax
adc eax, 0x3008b9
sub eax, 0xf314558b
or dl, bh
inc ebp
clc
cmp edx, dword [edx - 0x107ab4f4]
dec ecx
call [edi + 0x28]

Function at 0x5861b8
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0xb]
push ebp
dec ebp
sbb esi, edx
test dword [ebp - 0x7e068277], ecx
or al, 0xd3
mov eax, dword [0x128c28]
mov dword [ebp - 0x88], ecx
pop ds

Function at 0x6e3c2b
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.004560f0
call dword [ebp - 0x72333334]
loope 0x6e3bf3
jmp 0xba4545ab
Function at 0x100033cd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100f8930]
jne 0x100033d7
repz ret
jmp fcn.1000612b

Function at 0x10005e4e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10004c66
and dword [ebp - 4], 0
cmp dword [0x100f9e2c], 0
mov ebx, eax
jne 0x10005eff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10005fb0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10005fb0
push eax
call fcn.10004bf4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100f9e2c], eax
call esi
push eax
call fcn.10004bf4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100f9e30], eax
call esi
push eax
call fcn.10004bf4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100f9e34], eax
call esi
push eax
call fcn.10004bf4
pop ecx
mov dword [0x100f9e3c], eax
test eax, eax
je 0x10005eff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10004bf4
pop ecx
mov dword [0x100f9e38], eax
mov eax, dword [0x100f9e38]
cmp eax, ebx
je 0x10005f57
cmp dword [0x100f9e3c], ebx
je 0x10005f57
push eax
call fcn.10004c6f
push dword [0x100f9e3c]
mov esi, eax
call fcn.10004c6f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10005f57
test edi, edi
je 0x10005f57
call esi
test eax, eax
je 0x10005f4e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10005f4e
test byte [ebp - 0xc], 1
jne 0x10005f57
or dword [ebp + 0x10], 0x200000
jmp 0x10005f90
mov eax, dword [0x100f9e30]
cmp eax, ebx
je 0x10005f90
push eax
call fcn.10004c6f
pop ecx
test eax, eax
je 0x10005f90
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10005f90
mov eax, dword [0x100f9e34]
cmp eax, ebx
je 0x10005f90
push eax
call fcn.10004c6f
pop ecx
test eax, eax
je 0x10005f90
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100f9e2c]
call fcn.10004c6f
pop ecx
test eax, eax
je 0x10005fb0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10005fb2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b200
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [0x100f877c]
add esi, 0xfffff334
mov dword [0x100f877c], esi
mov dword [0x100f8788], 0
mov byte [0x100f878c], 0
mov dword [0x100f8784], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [0x100f8784]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x100f877c], 0x4fb
mov eax, dword [0x100f8784]
add eax, 1
mov dword [0x100f8784], eax
cmp eax, 0x100
jl 0x1000b248
mov dword [0x100f8780], 0x1cd8
mov dword [0x100f8784], 0
mov eax, 0x100
mov dword [0x100f8790], 0
mov ecx, dword [0x100f8788]
mov edx, dword [0x100f8784]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x1c], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x100f8790], edi
mov dword [0x100f877c], 0x253d
mov eax, edi
cdq
mov edi, dword [ebp - 0x1c]
idiv edi
mov dword [0x100f8788], edx
mov dword [0x100f8780], 0x2618
mov ecx, dword [0x100f8784]
mov bl, byte [esi + ecx]
mov byte [0x100f878c], bl
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov dword [0x100f877c], 0x1673
mov bl, byte [0x100f878c]
mov ecx, dword [0x100f8788]
mov byte [esi + ecx], bl
mov ecx, dword [0x100f8784]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [0x100f8784], eax
cmp eax, 0x100
jl 0x1000b28b
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000b460
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [0x100f877c], 0x26ad
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dword [0x100f8780], 0xd73
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x100f877c]
mov edi, esi
add edi, 0x739
mov dword [0x100f877c], edi
add esi, 0xffffeba1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
jmp 0x1000b51f
mov dword [0x100f877c], 0x18db
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000b4fd
jmp 0x1000b5c0
mov eax, 1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x1000b5cf
jmp 0x1000b5c0
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff8
shl eax, 1
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x6c
je 0x1000b4dd
jmp 0x1000b5c0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
je 0x1000b54c
mov eax, dword [ebp - 0x2c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
jl 0x1000b51f
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov dword [0x100f8780], ecx
mov dword [0x100f877c], 0x2024
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1000b5c0
mov dword [0x100f8780], 0x1c0d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1000b5c0
mov dword [0x100f8780], 0x636
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1000b5c0
mov dword [0x100f8780], 0xcfa
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000b4bf
xor eax, eax
mov dword [0x100f877c], 0x224d
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x28
pop esi
pop edi
pop ebp
ret

Function at 0x1000bcb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.1000bcb0]
mov ecx, 0xde1
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x1000bcc9
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [ecx], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x1000bcfb
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1000bcfb
mov eax, dword [ebp - 0xc]
mov dword [0x100f877c], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret
mov eax, 0x1eb3
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
jmp 0x1000bcc9
Function at 0x1000bdb0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x100f8784], 0
mov dword [0x100f8788], 0
mov dword [0x100f8794], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x1000bef1
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x100f8780], 0x341
mov edx, dword [0x100f8784]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x100f8784], edx
mov dword [0x100f877c], 0x2e9
mov esi, dword [0x100f8788]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x100f8788], edx
mov ecx, dword [0x100f8784]
mov bl, byte [edi + ecx]
mov byte [0x100f878c], bl
mov dword [0x100f8780], 0x15f7
mov bl, byte [edi + edx]
mov ecx, dword [0x100f8784]
mov byte [edi + ecx], bl
mov dword [0x100f877c], 0xeac
mov bl, byte [0x100f878c]
mov ecx, dword [0x100f8788]
mov byte [edi + ecx], bl
mov ecx, dword [0x100f8784]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x100f8788]
movzx edx, byte [edi + edx]
add edx, ecx
mov dword [0x100f877c], 0x2123
and edx, 0xff
mov dword [0x100f8794], edx
mov ecx, dword [0x100f8780]
add ecx, 0xffffdc8e
mov dword [0x100f8780], ecx
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov bl, byte [ecx + esi]
xor bl, byte [edi + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], bl
add esi, 1
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov dword [ebp - 0x20], esi
jne 0x1000bdff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001410
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10005320
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.100053c0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.10038723
add esp, 0x68
ret