joyce8/EMBER2024-capa huggingface dataset:
Function at 0x906891a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14c
mov eax, 0x90a4789
call fcn.090070c5
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x14c]
push eax
push 0x20019
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x144], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x9068986
mov dword [ebp - 0x14c], ebx
jmp 0x9068b06
lea eax, [ebp - 0x140]
push eax
push 0x20019
push ebx
push str.Adobe
push dword [ebp - 0x14c]
call edi
test eax, eax
je 0x90689af
mov dword [ebp - 0x140], ebx
jmp 0x9068b06
lea eax, [ebp - 0x148]
push eax
push 0x20019
push ebx
push str.Color
push dword [ebp - 0x140]
call edi
test eax, eax
je 0x90689d8
mov dword [ebp - 0x148], ebx
jmp 0x9068b06
lea eax, [ebp - 0x13c]
push eax
push 0x20019
push ebx
push str.Monitor
push dword [ebp - 0x148]
call edi
test eax, eax
je 0x9068a01
mov dword [ebp - 0x13c], ebx
jmp 0x9068b06
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Primary_Monitor
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9068a52
cmp dword [ebp - 0x154], 4
jne 0x9068a52
mov eax, dword [ebp - 0x120]
cmp eax, 0x3e7
ja 0x9068b06
jmp 0x9068a54
mov eax, ebx
push eax
push str.Monitor_u
lea eax, [ebp - 0x1c]
push 0xb
push eax
call fcn.09090f1c
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x13c]
call edi
test eax, eax
je 0x9068a90
mov dword [ebp - 0x144], ebx
jmp 0x9068b17
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x154]
push eax
push ebx
push str.Monitor_Profile
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x9068b06
cmp dword [ebp - 0x154], 1
jne 0x9068b06
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.090160db
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x138]
push eax
mov dword [ebp - 4], ebx
call fcn.09090f1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.0900e42b
mov bl, 1
cmp dword [ebp - 0x144], 0
je 0x9068b17
push dword [ebp - 0x144]
call esi
cmp dword [ebp - 0x13c], 0
je 0x9068b28
push dword [ebp - 0x13c]
call esi
cmp dword [ebp - 0x148], 0
je 0x9068b39
push dword [ebp - 0x148]
call esi
cmp dword [ebp - 0x140], 0
je 0x9068b4a
push dword [ebp - 0x140]
call esi
cmp dword [ebp - 0x14c], 0
je 0x9068b5b
push dword [ebp - 0x14c]
call esi
mov al, bl
call fcn.09008ed9
ret
Function at 0x9069ce6
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a482f
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1430
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x1424], edi
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x143c], edi
call fcn.09015fe5
xor ecx, ecx
push 0xf
mov eax, ecx
mov dword [ebp - 4], ecx
pop esi
mov dword [ebp - 0x142c], eax
mov dword [ebp - 0x1438], esi
xor edx, edx
mov edi, ecx
div esi
mov dword [ebp - 0x141c], edi
lea esi, [ebp - 0x416]
mov dword [ebp - 0x1420], eax
mov eax, edi
xor edx, edx
push 0xf
pop edi
div edi
mov edi, ecx
mov dword [ebp - 0x1434], eax
mov edx, dword [ebp - 0x1420]
mov byte [esi - 1], dl
xor edx, edx
mov byte [esi], al
mov eax, edi
div dword [ebp - 0x1438]
mov edx, 0xff
mov byte [esi + 1], al
add edi, edx
mov eax, dword [ebp - 0x1434]
add esi, 4
cmp edi, 0xff0
jb 0x9069d8d
mov edi, dword [ebp - 0x141c]
add edi, edx
mov dword [ebp - 0x141c], edi
cmp edi, 0xff0
jb 0x9069d7c
push ecx
mov ecx, dword [ebp - 0x1424]
lea esi, [edx + 1]
push 0x5058595a
push 0x706c6162
push esi
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.09090f1c
push esi
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [0x90e15f0]
add esp, 0xc
mov dword [ebp - 0x1420], 0x100
xor esi, esi
mov dword [ebp - 0x141c], esi
movzx eax, word [ebp + esi - 0x1416]
movzx ecx, word [ebp + esi - 0xc16]
sub ecx, eax
mov eax, ecx
movzx ecx, word [ebp + esi - 0xc14]
cdq
mov edi, eax
movzx eax, word [ebp + esi - 0x1414]
sub ecx, eax
xor edi, edx
mov eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x141c]
cdq
mov esi, eax
xor esi, edx
movzx eax, word [ebp + ecx - 0x1412]
sub esi, edx
movzx ecx, word [ebp + ecx - 0xc12]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x1430]
cdq
xor eax, edx
sub eax, edx
cmp ecx, edi
cmovl ecx, edi
cmp ecx, esi
cmovl ecx, esi
mov esi, dword [ebp - 0x141c]
cmp ecx, eax
cmovl ecx, eax
add esi, 8
dec dword [ebp - 0x1420]
mov dword [ebp - 0x1430], ecx
mov dword [ebp - 0x141c], esi
jne 0x9069e25
cmp ecx, 0xa
ja 0x9069ede
mov eax, dword [ebp - 0x142c]
push 0
pop ecx
add eax, 0xff
mov dword [ebp - 0x142c], eax
push 0xf
pop esi
cmp eax, 0xff0
jb 0x9069d64
mov byte [ebp - 0x1428], 1
mov ecx, dword [ebp - 0x1424]
or dword [ebp - 4], 0xffffffff
call fcn.09090f1c
mov al, byte [ebp - 0x1428]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x90785fd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a4d68
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x8060
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x8058], esi
mov edi, dword [ebx + 8]
push 0
mov dword [ebp - 0x8054], edi
mov eax, dword [edi + 4]
add eax, 0x94
push eax
call fcn.09090f1c
cmp dword [esi], 0
pop ecx
pop ecx
jne 0x9078682
push 0
push 0x4000
push 0x40000
push dword [edi + 4]
call fcn.09090f1c
add esp, 0x10
mov dword [esi], eax
push 7
lea esi, [ebp - 0x34]
pop ecx
push 0xf
mov eax, ecx
xor edx, edx
pop edi
div edi
add ecx, 0x8000
mov word [esi], ax
lea esi, [esi + 2]
cmp ecx, 0x80007
jb 0x9078688
and dword [ebp - 0x8048], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x804c], ecx
movzx eax, word [ecx]
xor edx, edx
mov dword [ebp - 0x8040], edx
lea ecx, [ebp - 0x8036]
mov dword [ebp - 0x8050], eax
movzx eax, word [ebp + edx*2 - 0x34]
xor esi, esi
mov dword [ebp - 0x803c], esi
mov dword [ebp - 0x8044], eax
movzx edx, word [ebp + esi*2 - 0x34]
xor edi, edi
mov esi, dword [ebp - 0x8044]
mov eax, dword [ebp - 0x8050]
mov word [ecx - 2], ax
mov ax, word [ebp + edi*2 - 0x34]
inc edi
mov word [ecx], si
mov word [ecx + 2], dx
mov word [ecx + 4], ax
add ecx, 8
cmp edi, 0x10
jb 0x90786ec
mov esi, dword [ebp - 0x803c]
inc esi
mov dword [ebp - 0x803c], esi
cmp esi, 0x10
jb 0x90786df
mov edx, dword [ebp - 0x8040]
inc edx
mov dword [ebp - 0x8040], edx
cmp edx, 0x10
jb 0x90786cc
mov ecx, dword [ebp - 0x8054]
mov eax, 0x434d594b
push 0
push eax
push eax
push 0x1000
lea eax, [ebp - 0x8038]
push eax
push eax
call fcn.09090f1c
mov eax, dword [ebp - 0x8058]
lea ecx, [ebp - 0x806c]
push 1
push 0x4000
push dword [ebp - 0x8048]
push dword [eax]
call fcn.09090f1c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x806c]
call fcn.09005a8c
lea edi, [ebp - 0x8038]
mov dword [ebp - 0x8044], 0x10
lea esi, [eax + 2]
mov dword [ebp - 0x803c], 0x10
mov dword [ebp - 0x8040], 0x10
mov ecx, dword [edi]
mov edx, dword [edi + 4]
add edi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [esi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [esi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [esi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [esi + 1], al
add esi, 4
dec dword [ebp - 0x8040]
jne 0x90787aa
dec dword [ebp - 0x803c]
jne 0x90787a0
dec dword [ebp - 0x8044]
jne 0x9078796
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x806c]
call fcn.09005ab3
mov eax, dword [ebp - 0x8048]
mov ecx, dword [ebp - 0x804c]
add eax, 0x4000
add ecx, 2
mov dword [ebp - 0x8048], eax
mov dword [ebp - 0x804c], ecx
cmp eax, 0x40000
jb 0x90786b5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x9078cb8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a4de4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09090f1c
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x9078d3d
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09090f1c
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09015fe5
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x9078d54
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x9078db0
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x9078da3
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.09090f1c
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09090f1c
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005a8c
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
dec dword [ebp - 0x13d4]
jne 0x9078e4c
dec dword [ebp - 0x13d8]
jne 0x9078e42
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005ab3
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x9078d8c
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09090f1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x9078f1f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a4de4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09090f1c
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x9078fa4
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.09090f1c
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09015fe5
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x9078fbb
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x9079017
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907900a
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.09090f1c
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.09090f1c
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005a8c
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
dec dword [ebp - 0x13d4]
jne 0x90790b0
dec dword [ebp - 0x13d8]
jne 0x90790a6
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005ab3
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x9078ff3
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09090f1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x907952b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a4de4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.0909ff00
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09090f1c
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90795b0
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09090f1c
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09015fe5
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90795c7
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x9079623
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x9079616
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.09090f1c
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09090f1c
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005a8c
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
dec dword [ebp - 0x13d4]
jne 0x90796bf
dec dword [ebp - 0x13d8]
jne 0x90796b5
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005ab3
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90795ff
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09090f1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x9090f1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x9090f2b
pop dword [ebp - 0x2c]
mov eax, 0x9090f2b
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x90c39977
add dword [ebp - 0x3c], 0xbd8eabd4
mov dword [ebp - 0x38], 0x1e99a763
sub dword [ebp - 0x38], 0xec665b1e
mov dword [ebp - 0x34], 0x6ce78744
sub dword [ebp - 0x34], 0x209b4316
mov dword [ebp - 0x30], 0xcc7ba4f3
sub dword [ebp - 0x30], 0xcc7ba4f3
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x20dc5d78
sub eax, 0x17d1ed40
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x5f349854
add dword [ebp - 0x3c], 0x153dd102
mov dword [ebp - 0x38], 0x3aec43f2
sub dword [ebp - 0x38], 0xf97fe27d
mov dword [ebp - 0x34], 0xc859c405
sub dword [ebp - 0x34], 0x64ea5799
mov dword [ebp - 0x30], 0x91a90cd1
add dword [ebp - 0x30], 0x6e56f32f
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x5f5e9
push 0
call eax
mov ecx, 0x159ca8be
add ecx, 0xea63a67c
xor ebx, ebx
add ebx, eax
mov esi, 0x90eba00
add esi, dword [ebp - 0x2c]
mov edx, 0x4edd11b7
add dword [ebp - 0x1c], edx
mov edi, dword [esi]
xor dword [ebp - 0xc], edi
xor edi, edx
sub dword [ebp - 0x10], edi
mov dword [ebx], edi
add ebx, 4
add esi, 0x2d733f1c
add esi, 0xd28cc0e8
loop 0x9091039
add eax, 0x959ca454
sub eax, 0x959b7499
xor ebx, ebx
add ebx, eax
add eax, 0x1f5e0ee8
sub eax, 0x1f5e0ee3
mov ecx, 0x9000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x9098510
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a588d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb18
mov eax, dword [0x90dee5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb1c], eax
call fcn.09090f1c
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.09090f1c
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09007f5f
add esp, 0x3c
lea ecx, [ebp - 0xb28]
push eax
call fcn.09090f1c
mov byte [ebp - 4], 1
xor eax, eax
jmp 0x90985c0
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x90985c0
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.09090f1c
movzx edi, word [ebp - 0x914]
movzx edx, word [ebp - 0x11c]
cmp edx, edi
ja 0x9098615
push 0x6250726f
call fcn.09090f1c
mov ecx, edx
sub ecx, edi
xor esi, esi
mov dword [ebp - 0xb20], ecx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x9098631
xor eax, eax
jmp 0x9098656
cmp eax, edx
jb 0x909863c
mov eax, 0x8000
jmp 0x9098656
sub eax, edi
shr ecx, 1
shl eax, 0xf
xor edx, edx
add eax, ecx
mov ecx, dword [ebp - 0xb20]
div ecx
movzx edx, word [ebp - 0x11c]
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x9098621
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], 0
call fcn.090166cb
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.09019f2d
mov esi, dword [ebp - 0xb1c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb1c], eax
call fcn.09090f1c
add esp, 8
mov dword [ebp - 0xb20], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x90986c2
push esi
mov ecx, eax
call fcn.09090f1c
mov edx, eax
jmp 0x90986c4
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90b6910]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x90986f2
subsd xmm1, qword [0x90ac1b8]
jmp 0x90986fa
addsd xmm1, qword [0x90ac1b8]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.090020f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4010b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x4032d8
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x4010b8
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x4032d8
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret