joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57df10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x155000]
push edi
or ebp, 0xffffffff
jmp 0x57df32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x57df39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57df28
mov eax, 1
add ebx, ebx
jne 0x57df4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x57df5c
jne 0x57df7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57df7b
dec eax
add ebx, ebx
jne 0x57df68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x57df40
add ebx, ebx
jne 0x57df77
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x57dfcd
xor ecx, ecx
sub eax, 3
jb 0x57df93
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x57e002
sar eax, 1
mov ebp, eax
jmp 0x57df9e
add ebx, ebx
jne 0x57df9e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57df6c
inc ecx
add ebx, ebx
jne 0x57dfac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57df6c
add ebx, ebx
jne 0x57dfb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x57dfae
jne 0x57dfca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x57dfae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x57dfec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x57dfde
jmp 0x57df2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x57dfec
add edi, ecx
jmp 0x57df2e
pop esi
mov edi, esi
mov ecx, 0x1461
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x57e00a
cmp byte [edi], 0xa
jne 0x57e00a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x57e00f
lea edi, [esi + 0x17a000]
mov eax, dword [edi]
or eax, eax
je 0x57e087
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17ed98]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17eef8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x57e03c
mov ecx, edi
jns 0x57e06b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17ef00]
or eax, eax
je 0x57e081
mov dword [ebx], eax
add ebx, 4
jmp 0x57e059
call dword [esi + 0x17eefc]
mov ebp, dword [esi + 0x17ef04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x57e0bb
sub esp, 0xffffff80
jmp 0x4317d2
Function at 0x402b78
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x434f50]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402c0c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402bc9
cmp dword [ebp + 0x10], ebx
jne 0x402c00
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402b78
test eax, eax
jne 0x402bdb
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402bb0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.0040610b
cmp eax, ebx
je 0x402c13
push ebx
push dword [0x434f50]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402c0c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x434f50], ebx
jne 0x402c09
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402c09
jmp 0x402c0c
Function at 0x40551c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x430200], 0x44
push eax
xor eax, eax
push 0x430200
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405557
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4055e1
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004059e8
mov edi, eax
cmp edi, 0xffffffff
je 0x405622
test byte [esp + 0x10], 1
push esi
je 0x405604
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40560a
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405613
xor eax, eax
inc eax
jmp 0x405624
test byte [esp + 0x10], 4
jne 0x405622
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x405629
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004058f4
test bl, 8
mov dword [ebp - 8], eax
je 0x405668
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434f28], eax
jmp 0x4057e5
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405682
test eax, eax
je 0x405793
test bl, 2
je 0x405793
mov esi, 0x42f200
push edi
push esi
call fcn.00405da1
cmp dword [ebp + 8], 0
je 0x4056a1
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x4056a7
push edi
call fcn.00405838
cmp word [edi], 0
jne 0x4056b7
cmp word [0x42f200], 0x5c
jne 0x4056c2
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405788
cmp word [ebp - 0x22c], 0x2e
jne 0x40570c
cmp word [ebp - 0x22a], 0
je 0x40576b
cmp word [ebp - 0x22a], 0x2e
jne 0x40570c
cmp word [ebp - 0x228], 0
je 0x40576b
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00405da1
test byte [ebp - 0x258], 0x10
je 0x405737
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40576b
push dword [ebp + 0xc]
push edi
call fcn.00405629
jmp 0x40576b
push dword [ebp - 4]
push edi
call fcn.004055e1
test eax, eax
jne 0x405763
cmp dword [ebp - 4], eax
je 0x40575b
push edi
push 0xfffffffffffffff1
call fcn.0040504b
push 0
push edi
call fcn.00405c3b
jmp 0x40576b
inc dword [0x434f28]
jmp 0x40576b
push edi
push 0xfffffffffffffff2
call fcn.0040504b
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4056e4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405793
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4057e5
cmp dword [ebp - 8], esi
jne 0x4057a7
inc dword [0x434f28]
jmp 0x4057e5
push edi
call fcn.004060e4
test eax, eax
je 0x4057e5
push edi
call fcn.004057ec
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004055e1
test eax, eax
jne 0x4057dd
cmp dword [ebp - 4], esi
je 0x40579f
push edi
push 0xfffffffffffffff1
call fcn.0040504b
push esi
push edi
call fcn.00405c3b
jmp 0x4057e5
push edi
push 0xffffffffffffffe5
call fcn.0040504b
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4058f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa00
push esi
call fcn.00405da1
push esi
call fcn.00405897
mov edi, eax
test edi, edi
jne 0x405915
xor eax, eax
jmp 0x40596d
push edi
call fcn.00406035
test byte [0x434eb8], 0x80
je 0x405932
mov ax, word [edi]
test ax, ax
je 0x405911
cmp ax, 0x5c
je 0x405911
sub edi, esi
sar edi, 1
jmp 0x40594c
call fcn.004060e4
test eax, eax
je 0x405946
test byte [eax], 0x10
je 0x405911
push esi
call fcn.00405838
push esi
call sub.KERNEL32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405938
call fcn.004057ec
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4059e8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405a07
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405a0d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405a3c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a50c]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a510]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405a8c
test edi, edi
jne 0x405a49
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405a86
Function at 0x405abf
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebx, 0x430898
push 0x40a530
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
mov edi, 0x400
je 0x405b0e
push 1
push 0
push esi
call fcn.00405a0d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x405c35
cmp eax, edi
jg 0x405c35
mov esi, 0x431098
push edi
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x405c35
cmp eax, edi
jg 0x405c35
push esi
push ebx
push str._ls_ls_r_n
push 0x430498
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x434eb0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405dc3
push 4
push 0xc0000000
push esi
call fcn.00405a0d
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x405c35
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405c2e
push edi
push esi
push ebp
call fcn.00405a90
test eax, eax
je 0x405c2e
push str._Rename__r_n
push esi
call fcn.00405972
test eax, eax
jne 0x405bc4
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405bf9
add eax, 0xa
push 0x40a514
push eax
call fcn.00405972
mov ebp, eax
test ebp, ebp
je 0x405bf5
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405be6
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405be0
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x1c]
jmp 0x405bfb
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
add eax, esi
push 0x430498
push eax
call fcn.004059c8
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405c6e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0x18]
push edi
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov word [esi], di
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405ce2
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x800
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405ccf
cmp dword [ebp + 0x14], 1
je 0x405cd2
cmp dword [ebp + 0x14], 2
je 0x405cd2
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x7fe], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x4061b9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43189c], 0
push esi
jne 0x4061f0
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061ca
mov dword [ecx*4 + 0x431898], eax
inc ecx
cmp ecx, 0x100
jl 0x4061c5
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406221
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431898]
xor eax, esi
inc ecx
dec edx
jne 0x406203
pop edi
not eax
pop esi
ret 0xc
Function at 0x100014fb
Capabilities:
Parse pe header

Disassembly:
jmp 0x1003c340
mov edx, dword [esp + 4]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x1003c399
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x1003c399
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
test byte [eax + 0x24], 0x20
jne 0x1003c379
nop word [eax + eax]
add eax, 0x28
test byte [eax + 0x24], 0x20
je 0x1003c370
mov ecx, dword [esp + 8]
add edx, dword [eax + 0xc]
mov dword [ecx], edx
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0xc]
and ecx, 0xfffff000
add ecx, 0x1000
add ecx, edx
mov dword [eax], ecx
xor eax, eax
ret

Function at 0x10001708
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x100168a0
sub esp, 0x24
mov eax, dword [0x100d3e14]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0xc]
push ebx
push ebp
push esi
movsx eax, byte [ecx + 1]
movsx bp, byte [ecx]
mov word [esp + 0x1a], ax
movsx eax, byte [ecx + 2]
mov word [esp + 0x1c], ax
movsx eax, byte [ecx + 3]
mov word [esp + 0x1e], ax
movsx eax, byte [ecx + 4]
mov word [esp + 0x20], ax
movsx eax, byte [ecx + 5]
mov word [esp + 0x22], ax
movsx eax, byte [ecx + 6]
mov word [esp + 0x24], ax
movsx eax, byte [ecx + 7]
mov word [esp + 0x26], ax
movsx eax, byte [ecx + 8]
lea ecx, [edx + 2]
push edi
mov word [esp + 0x1c], bp
mov word [esp + 0x2c], ax
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016910
mov eax, dword [esp + 0x3c]
sub edx, ecx
sar edx, 1
mov dword [esp + 0x18], edx
cmp edx, eax
ja 0x100169f2
mov ecx, dword [esp + 0x38]
test edx, edx
jne 0x1001694f
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10002cf7
add esp, 0x24
ret
sub eax, edx
inc eax
lea ebx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x10], ebx
nop dword [eax + eax]
mov ecx, ebx
mov esi, 0
sub ecx, eax
sar ecx, 1
je 0x10016982
cmp word [eax], bp
je 0x10016980
cmp ecx, 1
je 0x10016982
add eax, 2
dec ecx
cmp word [eax], bp
jne 0x10016972
mov esi, eax
mov eax, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100169f2
mov edi, edx
movzx esi, bp
movzx edx, word [eax]
lea ecx, [esp + 0x1c]
cmp dx, si
jb 0x100169c6
mov ebx, eax
mov eax, ecx
sub ebx, eax
mov eax, dword [esp + 0x14]
cmp dx, si
ja 0x100169c2
cmp edi, 1
je 0x100169cf
movzx edx, word [ebx + ecx + 2]
add ecx, 2
dec edi
movzx esi, word [ecx]
cmp dx, si
jae 0x100169aa
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add eax, 2
jmp 0x10016960
mov ecx, dword [esp + 0x38]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x100169f2
pop edi
pop esi
pop ebp
lea eax, [ecx + eax*2]
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10002cf7
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002cf7
add esp, 0x24
ret
Function at 0x10001ac8
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1003c230
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10e9477c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10e9436c]
cmp eax, dword [ecx + 0xeb68]
jg 0x1003c278
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, 0x10e93dc8
nop
push edi
push dword [esi]
call ebx
test eax, eax
jne 0x1003c274
add esi, 4
cmp esi, 0x10e94278
jne 0x1003c260
pop edi
pop esi
pop ebx
ret
push 0x10e9436c
call fcn.1000545c
add esp, 4
cmp dword [0x10e9436c], 0xffffffff
jne 0x1003c24c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100d5458
push 0x4b0
push 0x10e93dc8
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
push 0x10e9436c
mov dword [0x10e94368], eax
call fcn.100054e8
add esp, 4
jmp 0x1003c24c

Function at 0x100020f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10016c30
sub esp, 0x38
mov eax, dword [0x100d3e14]
xor eax, esp
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x44]
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
movq xmm0, qword [ecx + edx]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [esp + ecx*2 + 0xc], xmm0
add ecx, 8
cmp ecx, 0x10
jl 0x10016c50
cmp ecx, 0x14
jge 0x10016c80
movsx ax, byte [ecx + edx]
mov word [esp + ecx*2 + 0xc], ax
inc ecx
cmp ecx, 0x14
jl 0x10016c70
push ebx
push ebp
push esi
lea ebx, [esp + 0x18]
push edi
lea ecx, [ebx + 2]
nop dword [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10016c90
mov eax, dword [esp + 0x50]
sub ebx, ecx
sar ebx, 1
mov dword [esp + 0x14], ebx
cmp ebx, eax
ja 0x10016d71
mov ecx, dword [esp + 0x4c]
test ebx, ebx
jne 0x10016ccf
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10002cf7
add esp, 0x38
ret
mov bp, word [esp + 0x1c]
sub eax, ebx
inc eax
lea edx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x18], edx
mov ecx, edx
mov edx, 0
sub ecx, eax
sar ecx, 1
je 0x10016d02
cmp word [eax], bp
je 0x10016d00
cmp ecx, 1
je 0x10016d02
add eax, 2
dec ecx
cmp word [eax], bp
jne 0x10016cf2
mov edx, eax
mov eax, edx
test eax, eax
je 0x10016d71
movzx edx, word [eax]
lea ecx, [esp + 0x1c]
movzx esi, bp
mov edi, ebx
cmp dx, si
jb 0x10016d45
mov ebx, ecx
mov dword [esp + 0x10], eax
sub dword [esp + 0x10], ebx
cmp dx, si
mov ebx, dword [esp + 0x14]
ja 0x10016d45
cmp edi, 1
je 0x10016d4e
mov edx, dword [esp + 0x10]
add ecx, 2
dec edi
movzx edx, word [edx + ecx]
movzx esi, word [ecx]
cmp dx, si
jae 0x10016d2a
mov edx, dword [esp + 0x18]
add eax, 2
jmp 0x10016ce0
mov ecx, dword [esp + 0x4c]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x10016d71
pop edi
pop esi
pop ebp
lea eax, [ecx + eax*2]
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10002cf7
add esp, 0x38
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002cf7
add esp, 0x38
ret
Function at 0x10002667
Capabilities:
Parse pe header

Disassembly:
jmp 0x1003c2e0
mov edx, dword [esp + 4]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x1003c31f
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x1003c31f
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x1003c31f
mov edx, dword [esp + 8]
cmp dword [eax], edx
je 0x1003c321
add eax, 4
cmp eax, ecx
jb 0x1003c314
xor eax, eax
ret

Function at 0x100028ab
Capabilities:
Create thread

Disassembly:
jmp 0x10012aa0
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x10012470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0
mov dword [esi + 0x1f4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1f8], eax
mov al, 1
pop esi
ret

Function at 0x10003102
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10016710
sub esp, 0x18
mov eax, dword [0x100d3e14]
xor eax, esp
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xc]
push ebx
push ebp
push esi
movsx eax, byte [ecx + 1]
movsx bp, byte [ecx]
mov word [esp + 0x1a], ax
movsx eax, byte [ecx + 2]
lea ecx, [edx + 2]
push edi
mov word [esp + 0x1c], bp
mov word [esp + 0x20], ax
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016750
mov eax, dword [esp + 0x30]
sub edx, ecx
sar edx, 1
mov dword [esp + 0x18], edx
cmp edx, eax
ja 0x10016832
mov ecx, dword [esp + 0x2c]
test edx, edx
jne 0x1001678f
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10002cf7
add esp, 0x18
ret
sub eax, edx
inc eax
lea ebx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x10], ebx
nop dword [eax + eax]
mov ecx, ebx
mov esi, 0
sub ecx, eax
sar ecx, 1
je 0x100167c2
cmp word [eax], bp
je 0x100167c0
cmp ecx, 1
je 0x100167c2
add eax, 2
dec ecx
cmp word [eax], bp
jne 0x100167b2
mov esi, eax
mov eax, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10016832
mov edi, edx
movzx esi, bp
movzx edx, word [eax]
lea ecx, [esp + 0x1c]
cmp dx, si
jb 0x10016806
mov ebx, eax
mov eax, ecx
sub ebx, eax
mov eax, dword [esp + 0x14]
cmp dx, si
ja 0x10016802
cmp edi, 1
je 0x1001680f
movzx edx, word [ebx + ecx + 2]
add ecx, 2
dec edi
movzx esi, word [ecx]
cmp dx, si
jae 0x100167ea
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add eax, 2
jmp 0x100167a0
mov ecx, dword [esp + 0x2c]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x10016832
pop edi
pop esi
pop ebp
lea eax, [ecx + eax*2]
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10002cf7
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002cf7
add esp, 0x18
ret

Function at 0x10003274
Capabilities:
Terminate process

Disassembly:
jmp 0x10053330
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x10053341
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.100051af
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret