joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018d50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
mov esi, dword [edi + 0xc]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edi, [esi + ecx*8]
mov esi, eax
cmp esi, edx
jne 0x10018da8
mov ecx, edx
jmp 0x10018dad
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10018dca
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x10018dbc
mov eax, dword [eax]
jmp 0x10018da0
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8

Function at 0x10019570
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x10019598
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x100195a0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x100195b9
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x100195c1
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x100195da
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100195e2
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x100195fb
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x10019603
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x10019644
add dword [esp], 5
retf
Function at 0x100198e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ef00
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10052198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x100199a3
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x100199a3
mov esi, dword [esi + 4]
mov cx, word [edi]
cmp cx, word [esi + 8]
jne 0x10019956
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.100336df
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100199d3
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x100199ea
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x10019a0c
cmp eax, esi
jne 0x100199f2
mov dword [ecx], edi
jmp 0x10019a0c
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10019a0c
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1001ae60
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001af40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
mov ecx, dword [ebx + 0x18]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1001af9b
cmp eax, edi
jne 0x1001af93
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1001afa3
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1001afa3
cmp eax, edi
jne 0x1001afa6
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.100336df
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1001f2a3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10034e20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x10052198]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x10034e47
mov ecx, 5
int 0x29
push 2
call fcn.10034518
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x10034f52
test esi, esi
jne 0x10034f52
push 2
call fcn.10034518
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100336f6
mov esp, ebp
pop ebp
ret
Function at 0x10038730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.10038760
mov esi, dword [ebp + 8]
test al, al
je 0x1003874e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10038770
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1003d4f0
Capabilities:
Get process heap force flags

Disassembly:
call fcn.10037cb0
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x1003d51a
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x1003d526
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x1003d530
Capabilities:
Get process heap force flags

Disassembly:
call fcn.10037cb0
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x1003d55a
sub eax, 0xffffff80
ret
add eax, 0x90
ret
Function at 0x41675a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x41678e
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x416787
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x416793
add edx, 0x28
cmp edx, esi
jne 0x416778
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x416790
Function at 0x100018bd
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x21c
mov eax, 0x10009fce
call fcn.10009193
mov ebx, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1000f07c]
cmp eax, 0x1000f07c
je 0x10001902
test dword [eax + 0x1c], 0x100
je 0x10001902
cmp byte [eax + 0x19], 6
jb 0x10001902
push ebx
push 0x1000bb98
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003f53
test esi, esi
jne 0x10001910
mov eax, 0x80004005
jmp 0x10001add
push dword [esi]
lea ecx, [ebp - 0x224]
call fcn.10004ad1
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], edi
call fcn.10003f53
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
mov esi, 0x104
mov dword [ebp - 0x21c], edi
push esi
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
jne 0x1000195e
push 0x1000b648
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.10003f53
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.10004ad1
push str.Join.ocsmeet
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.10003f53
push 0x1000b66c
push dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x100019e4
cmp dword [ebp - 0x21c], eax
je 0x100019e4
push dword [ebp - 0x21c]
push dword [ebp - 0x224]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
pop ecx
pop ecx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x228]
call fcn.10003f53
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov dword [ebp - 0x21c], edi
mov esi, dword [ebp - 0x228]
cmp dword [esi - 0xc], edi
jne 0x100019f9
mov edi, 0x80004005
jmp 0x10001a89
push 0xa
mov eax, 0x1000bb94
push eax
push eax
push esi
push 0x1000b670
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x10001a89
cmp eax, 0x1b
ja 0x10001a59
je 0x10001a7d
dec eax
sub eax, 1
je 0x10001a52
sub eax, 1
je 0x10001a4b
dec eax
sub eax, 1
je 0x10001a44
sub eax, 3
je 0x10001a3d
sub eax, 3
jne 0x100019ef
mov edi, 0x8007000b
jmp 0x10001a89
mov edi, 0x8007000e
jmp 0x10001a89
mov edi, 0x80070005
jmp 0x10001a89
mov edi, 0x80070003
jmp 0x10001a89
mov edi, 0x80070002
jmp 0x10001a89
sub eax, 0x1c
je 0x10001a84
sub eax, 1
je 0x10001a84
sub eax, 1
je 0x10001a84
sub eax, 1
je 0x10001a7d
sub eax, 1
jne 0x100019ef
mov edi, 0x80070485
jmp 0x10001a89
mov edi, 0x80070483
jmp 0x10001a89
mov edi, 0x80070484
mov eax, dword [0x1000f07c]
cmp eax, 0x1000f07c
je 0x10001ab7
test dword [eax + 0x1c], 0x100
je 0x10001ab7
cmp byte [eax + 0x19], 6
jb 0x10001ab7
push ebx
push 0x1000bb98
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10003f53
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.100052bf
lea ecx, [esi - 0x10]
call fcn.100052bf
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.100052bf
mov eax, edi
call fcn.10009148
ret 8
Function at 0x10003f53
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10003f62
pop dword [ebp - 8]
mov eax, 0x82b045d7
sub eax, 0x72b00675
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x6ea227db
sub dword [ebp - 0x18], 0x204fe290
mov dword [ebp - 0x14], 0xf823e06a
add dword [ebp - 0x14], 0x3a0f6bdb
mov dword [ebp - 0x10], 0xa26cc958
sub dword [ebp - 0x10], 0x5620852a
mov dword [ebp - 0xc], 0x75c307d2
add dword [ebp - 0xc], 0x8a3cf82e
lea eax, [ebp - 0x18]
push eax
mov eax, 0xddea9822
add eax, 0x32161896
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xde6eab67
add dword [ebp - 0x18], 0x9603bdef
mov dword [ebp - 0x14], 0x761a9a2c
add dword [ebp - 0x14], 0xcb51c749
mov dword [ebp - 0x10], 0x9991fc22
sub dword [ebp - 0x10], 0x36228fb6
mov dword [ebp - 0xc], 0xf859af87
add dword [ebp - 0xc], 0x7a65079
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x157b8399
add eax, 0xfa852cdb
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37495
push 0
call eax
mov ecx, 0xa7e9c3cd
sub ecx, 0xa7e97eec
mov ebx, eax
mov esi, 0x96ab593d
sub esi, 0x86aa173d
add esi, dword [ebp - 8]
mov edx, 0x74639717
xor dword [ebp - 4], esi
mov edi, dword [esi]
xor dword [ebp - 4], esi
add edi, edx
add dword [ebp - 4], 0xe8248077
mov dword [ebx], edi
sub dword [ebp - 4], edx
add ebx, 0xbb8ff23a
add ebx, 0x44700dca
add esi, 4
loop 0x1000407e
add eax, 0x10657
xor ebx, ebx
add ebx, eax
add eax, 0x9fdab09c
sub eax, 0x9fdab097
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x61de50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x170000]
push edi
jmp 0x61de6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x61de71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61de60
mov eax, 1
add ebx, ebx
jne 0x61de83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x61de94
jne 0x61deb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61deb3
dec eax
add ebx, ebx
jne 0x61dea0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x61de78
add ebx, ebx
jne 0x61deaf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x61df05
xor ecx, ecx
sub eax, 3
jb 0x61decb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x61df3a
sar eax, 1
mov ebp, eax
jmp 0x61ded6
add ebx, ebx
jne 0x61ded6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61dea4
inc ecx
add ebx, ebx
jne 0x61dee4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61dea4
add ebx, ebx
jne 0x61def1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x61dee6
jne 0x61df02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x61dee6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x61df24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x61df16
jmp 0x61de66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x61df24
add edi, ecx
jmp 0x61de66
pop esi
mov edi, esi
mov ecx, 0x62f5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x61df42
cmp byte [edi], 0x27
jne 0x61df42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x61df47
lea edi, [esi + 0x211000]
mov eax, dword [edi]
or eax, eax
je 0x61dfbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2adab4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2adca8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x61df74
mov ecx, edi
jns 0x61dfa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2adcb0]
or eax, eax
je 0x61dfb9
mov dword [ebx], eax
add ebx, 4
jmp 0x61df91
call dword [esi + 0x2adcac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x61dff0
cmp al, 0xef
ja 0x61dfe3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x61dfc5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x61dfd2
mov ebp, dword [esi + 0x2adcb4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x257]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x61e024
sub esp, 0xffffff80
jmp 0x4e283a
Function at 0x59b80d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x6c9740
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x716880], 1
jge 0x6c97af
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x6c9785
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x6c9785
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x6c9762
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x6c979b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x6c97a2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x6c989f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x6c9870
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x6c9865
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x6c9859
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x6c9860
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x6c989f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x6c989a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x6c9883
mov eax, dword [ebx + 8]
jmp 0x6c989f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x6c9891
xor eax, eax
jmp 0x6c989f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x6c97cf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x6c28f0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00597f5f
mov eax, dword [0x714010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x717880]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x6c2ac8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x6c2a17
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x6c2a17
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x6c29f5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x6c2979
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x6c2a81
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x6c2ae8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x6c2ac3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x6c2ae8
jmp 0x6c2952
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059945e
mov esp, ebp
pop ebp
ret