joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011e06
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push 0xc
call fcn.1001978b
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10011e71
push 0x47
push 0x4018f9e
push 6
call fcn.1001977f
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 1
push dword [ebp - 0x10]
push 8
push 0xffff
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10011eb2
push 0x47
push 0x4018f9e
push 6
call fcn.1001977f
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1001205a
cmp dword [ebp + 0xc], 1
jne 0x10012050
cmp dword [ebp + 0x14], 0
jne 0x10011eda
mov dword [ebp + 0x10], 0x1388
cmp dword [ebp + 0x1c], 0
jne 0x10011eeb
mov dword [ebp + 0x18], 0x3e8
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebx], 1
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp - 0xc]
mov dword [ebx], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10011f50
push 0x21c
push 0x4018f9e
push 6
call fcn.1001977f
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10011f7f
push 0x246
push 0x4018f9e
push 6
call fcn.1001977f
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 4]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10011fb6
push 0x260
push 0x4018f9e
push 6
call fcn.1001977f
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x10011fe5
push 0x28a
push 0x4018f9e
push 6
call fcn.1001977f
add esp, 0xc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esp
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push 0x98000004
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x10012034
push 0x28a
push 0x4018f9e
push 6
call fcn.1001977f
add esp, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x1001204b
mov eax, 1
jmp 0x10012064
jmp 0x1001205a
mov eax, 1
jmp 0x10012064
mov eax, 0
jmp 0x10012064
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.10019791
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1001301d
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x10013129
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10013058
push 0
push 0x4017e3f
push 6
call fcn.1001977f
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10013060
mov esp, ebp
pop ebp
ret 4

Function at 0x1001a8e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1001a8fe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1001a8f3
pop esi
ret

Function at 0x1001c560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x1001c581
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1001c5db
inc edi
cmp edi, esi
jl 0x1001c575
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x1001c610
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x1001c5ca
cmp byte [eax], bl
je 0x1001c5e5
cmp byte [eax + 1], bl
je 0x1001c5ee
cmp byte [eax + 2], bl
je 0x1001c5f8
cmp byte [eax + 3], bl
je 0x1001c604
add eax, 4
cmp eax, edi
jb 0x1001c5a1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x1001dec0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x1001decc
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x1001df5f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x1001df29
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.1001df70
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x1001defe
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x1001df90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x1001e08d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x1001dfe2
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x1001e00e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.1001df70
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x1001e04f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x1001dfd1
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x1001fdb0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x1004b514]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x1001fdc3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x1001fe04
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x1004b5bc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x1001fe36
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001fe3a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x1001fe2b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x1001fe58
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001fe5c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x1001fe4d
xor ecx, ecx
mov eax, 0x1004b524
xor ebx, ebx
mov bl, byte [ecx + 0x1004b5cc]
cmp byte [esp + ebx + 0x14], 0
je 0x1001fe87
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x1004b5e4]
cmp byte [esp + ebx + 0x14], 0
je 0x1001fe9e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x1001fe6e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x1001fdf7
lea edx, [esp + 0x84]
push edx
call fcn.1001fee0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x10022858
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b400
push 0x10023cf4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x100228de
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x100228b6
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x100228e4
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x100228ae
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x100228ae
mov al, 1
jmp 0x100228b0
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10022943
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [0x1004fe74]
test esi, esi
je 0x10022967
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect_1]
mov esi, dword [esi + 4]
jmp 0x1002294b
pop esi
pop ecx
ret

Function at 0x1002296a
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId_1]
cmp dword [0x1004fe80], eax
je 0x10022980
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x1004fe90]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x100229cd
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_VirtualProtect_1]
cmp dword [esi + 4], ebx
jne 0x100229be
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x100229be
push eax
call fcn.10022a34
pop ecx
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.10023dcc
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x1002298f
mov dword [0x1004fe90], ebx
call fcn.10022a0d
mov esi, dword [0x1004fe8c]
cmp esi, ebx
je 0x100229fa
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.10023dcc
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x100229e2
pop edi
mov dword [0x1004fe8c], ebx
mov dword [0x1004fe80], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10022cb7
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x1004fe84]
push esi
test eax, eax
push edi
jne 0x10022d21
call dword [sym.imp.kernel32.dll_GetCurrentThread_1]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x10022d1f
push 8
call fcn.10023e38
mov esi, eax
pop ecx
test esi, esi
jne 0x10022ce3
push 8
pop edi
jmp 0x10022cfe
push edi
call dword [sym.imp.kernel32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10022d0f
call dword [sym.imp.kernel32.dll_GetLastError_1]
push esi
mov edi, eax
call fcn.10023dcc
pop ecx
and dword [0x1004fe88], 0
mov dword [0x1004fe84], edi
mov eax, edi
jmp 0x10022d21
mov dword [esi + 4], edi
mov eax, dword [0x1004fe8c]
mov dword [esi], eax
mov dword [0x1004fe8c], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x10022fde
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x10023002
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x10023005
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x10023018
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x1002301f
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x1004fe78]
mov ecx, dword [0x1004fe74]
test eax, eax
jne 0x10023039
test ecx, ecx
je 0x1002304e
mov eax, ecx
mov dword [0x1004fe78], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x1002304e
cmp edx, dword [ebp + 8]
jb 0x1002304e
cmp edx, dword [ebp - 4]
jbe 0x100231a7
mov eax, ecx
test ecx, ecx
mov dword [0x1004fe78], eax
je 0x1002307e
test eax, eax
je 0x10023072
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10023072
cmp ecx, dword [ebp + 8]
jb 0x10023072
cmp ecx, dword [ebp - 4]
jbe 0x100231a7
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x1004fe78], eax
jne 0x1002305d
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x100230e6
cmp edi, 0x70000000
jb 0x100230a3
cmp edi, 0x80000000
ja 0x100230a3
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x100230e6
cmp dword [ebp - 0x10], ebx
jne 0x100230be
cmp dword [ebp - 0x14], ebx
jae 0x100230ce
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x1002308e
jmp 0x100230e6
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.kernel32.dll_VirtualAlloc_1]
test eax, eax
mov dword [0x1004fe78], eax
jne 0x1002315d
cmp esi, dword [ebp - 4]
jae 0x100231ce
cmp esi, 0x70000000
jb 0x10023104
cmp esi, 0x80000000
ja 0x10023104
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x100231ce
cmp dword [ebp - 0x10], ebx
jne 0x10023152
cmp dword [ebp - 0x14], ebx
jb 0x10023152
mov ecx, esi
and ecx, 0xffff
je 0x1002313a
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.kernel32.dll_VirtualAlloc_1]
test eax, eax
mov dword [0x1004fe78], eax
jne 0x1002315d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x100230e6
mov dword [eax], 0x52727464
mov eax, dword [0x1004fe78]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x1004fe78]
mov edx, dword [0x1004fe74]
mov dword [eax + 4], edx
mov eax, dword [0x1004fe78]
mov dword [0x1004fe74], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x1002318f
mov eax, dword [0x1004fe78]
mov dword [eax + 8], ecx
mov eax, dword [0x1004fe78]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x100231ce
cmp esi, dword [ebp - 4]
ja 0x100231ce
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.10023de0
add esp, 0xc
mov eax, esi
jmp 0x100231d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100231d5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b410
push 0x10023cf4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x1002324a
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x10023246
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x10023246
cmp word [eax + 0x14], 0
jne 0x1002323b
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x1002324c
mov eax, ecx
jmp 0x10023235
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002325b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_GetCurrentThreadId_1]
cmp dword [0x1004fe80], eax
je 0x1002327a
mov eax, 0x10dd
jmp 0x10023350
mov eax, dword [0x1004fe84]
test eax, eax
jne 0x10023350
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10023296
push 6
pop eax
jmp 0x10023350
cmp dword [edi], 0
jne 0x100232a8
push 6
pop eax
mov dword [0x1004fe84], eax
jmp 0x1002334a
push 0x18
call fcn.10023e38
mov esi, eax
pop ecx
test esi, esi
jne 0x100232bb
push 8
pop edi
jmp 0x10023334
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.100227f0
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x10023329
cmp ecx, 0x17
ja 0x10023329
cmp dword [edi + 0x1c], eax
jne 0x10023329
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
push 0x40
push ecx
push ebx
call dword [sym.imp.kernel32.dll_VirtualProtect_1]
test eax, eax
jne 0x100232ff
call dword [sym.imp.kernel32.dll_GetLastError_1]
mov edi, eax
jmp 0x10023334
mov eax, dword [ebp + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x1004fe90]
mov dword [esi], eax
mov dword [0x1004fe90], esi
xor eax, eax
jmp 0x10023350
cmp dword [0x1004fe7c], edx
push 9
pop edi
jne 0x1002333a
mov dword [0x1004fe84], edi
test esi, esi
je 0x10023345
push esi
call fcn.10023dcc
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x1004fe88], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x401156
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebp
mov ebp, esp
pop ebp
mov ebp, esp
pushal
push 0x3c
push str.AHQ222_S
push 0x40117d
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp fcn.0040159b

Function at 0x4015b5
Capabilities:
Check os version

Disassembly:
sub eax, eax
push ebp
mov ebp, esp
pop ebp
mov eax, dword fs:[eax + 0x30]
push ebp
mov ebp, esp
pop ebp
mov eax, dword [eax + 0xa4]
cmp eax, 6
jne 0x401614
push 0x4015e3
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp 0x4015f3
push dword [0x401709]
push 0x401612
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x401629
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp 0x401639
push dword [0x401705]
push 0x401658
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp dword [sym.imp.KERNEL32.DLL_GetProcAddress]

Function at 0x40165a
Capabilities:
Check os version

Disassembly:
sub eax, eax
push ebp
mov ebp, esp
pop ebp
mov eax, dword fs:[eax + 0x30]
push ebp
mov ebp, esp
pop ebp
mov eax, dword [eax + 0xa4]
cmp eax, 6
jne 0x4016bb
push 0x401688
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp 0x40169a
push dword [0x401709]
push 0x4016b9
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4016d0
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp 0x4016e2
push dword [0x401705]
push 0x401701
xchg ecx, edx
xchg edx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
pop ecx
pop ecx
pop ecx
pop ecx
pop ecx
jmp dword [sym.imp.KERNEL32.DLL_GetProcAddress]
Function at 0x401a70
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x18
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
xor ebx, ebx
push 0x1000
push ebx
push 0x48f920
mov dword [esp + 0x14], ebx
call fcn.00451da0
add esp, 0xc
xor eax, eax
push ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
push 0x1000
push 0x48f920
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0x2d1400
push esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x401af2
push 0x1000
push 0x48f920
push esi
push edi
mov eax, 0x2d1400
call fcn.00401ef0
test eax, eax
lea eax, [ebx + 1]
jne 0x401af4
mov eax, ebx
mov ecx, dword [esp + 0x18]
pop ebx
xor ecx, esp
call fcn.0044f3b0
add esp, 0x18
ret
Function at 0x402630
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10c
mov eax, dword [0x487fb0]
xor eax, esp
mov dword [esp + 0x104], eax
xor eax, eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ebx, ebx
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x10]
push eax
push 0x18
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push 0x70000
mov dword [esi], ebx
push edi
mov dword [esi + 4], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x50], ebx
call ebp
push ebx
test eax, eax
je 0x402723
mov eax, dword [esp + 0x30]
mul dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push ecx
push edx
push eax
call fcn.0045bda0
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push edx
push eax
call fcn.0045bda0
mov dword [esi], eax
jmp 0x4027cc
lea edx, [esp + 0x10]
push edx
push 0x28
lea eax, [esp + 0xec]
push eax
push ebx
push ebx
push 0x700a0
push edi
call ebp
test eax, eax
je 0x402750
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0xfc]
jmp 0x4027ca
push ebx
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push 0x7405c
push edi
call ebp
test eax, eax
je 0x40277a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], eax
jmp 0x4027cf
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x20
lea edx, [esp + 0x3c]
push edx
push ebx
push ebx
push 0x74004
push edi
call ebp
test eax, eax
je 0x4027a4
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x4027cf
push ebx
lea edx, [esp + 0x10]
push edx
push 0x90
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push 0x70048
push edi
call ebp
test eax, eax
je 0x4027cf
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov ecx, dword [esp + 0x10c]
pop ebp
pop ebx
xor ecx, esp
mov eax, esi
call fcn.0044f3b0
add esp, 0x10c
ret