joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4221b0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
xor ebx, ebx
mov ebp, edx
cmp edi, 0x38
je 0x4221e5
jmp 0x4221d0
and edi, 0x3f
jne 0x4221db
push esi
call fcn.00421d00
mov byte [esi + edi + 0x28], bl
inc edi
cmp edi, 0x38
jne 0x4221d0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.00421d00
xor eax, eax
mov ecx, dword [esi + eax*4]
bswap ecx
mov dword [ebp], ecx
inc eax
add ebp, 4
cmp eax, 8
jb 0x422207
pop edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0x4222a0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x4222c8
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4222d7
mov eax, 1
ret 4
Function at 0x4a0b58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5e5540
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x630258], 1
jge 0x5e55af
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x5e5585
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x5e5585
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5e5562
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5e559b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x5e55a2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5e569f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x5e5670
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5e5665
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x5e5659
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x5e5660
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5e569f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5e569a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5e5683
mov eax, dword [ebx + 8]
jmp 0x5e569f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5e5691
xor eax, eax
jmp 0x5e569f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5e55cf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4a42b7
Capabilities:
Query environment variable

Disassembly:
jmp 0x5c06c2
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5c06d6
xor edi, edi
jmp 0x5c071a
push ebx
push esi
call fcn.005c05b9
sub eax, esi
sar eax, 1
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
lea ebx, [eax + eax]
push ebx
call fcn.004a1dcd
mov edi, eax
add esp, 0x14
test edi, edi
je 0x5c0707
push ebx
push esi
push edi
call fcn.004a08fb
add esp, 0xc
push 2
push 0
call fcn.0049fee7
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x4b8620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
lea edi, [ebp - 0x100]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x61d278]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x4b865f
mov eax, 0xa
jmp 0x4b8783
mov byte [ebp - 0x3c], 0x68
mov byte [ebp - 0x3b], 0xaa
mov byte [ebp - 0x3a], 0xaa
mov byte [ebp - 0x39], 0xaa
mov byte [ebp - 0x38], 0xaa
mov byte [ebp - 0x37], 0xaa
mov byte [ebp - 0x36], 0xaa
mov byte [ebp - 0x35], 0x68
mov byte [ebp - 0x34], 0x14
mov byte [ebp - 0x33], 0x1c
mov byte [ebp - 0x32], 0x40
mov byte [ebp - 0x31], 0x47
mov byte [ebp - 0x30], 0x33
mov byte [ebp - 0x2f], 0x37
mov byte [ebp - 0x2e], 0x34
mov byte [ebp - 0x2d], 0x35
mov byte [ebp - 0x2c], 0xcf
mov byte [ebp - 0x2b], 0x34
mov byte [ebp - 0x2a], 0xf4
mov byte [ebp - 0x29], 0x2e
mov byte [ebp - 0x28], 0x36
mov byte [ebp - 0x27], 0x86
mov byte [ebp - 0x26], 0x83
mov byte [ebp - 0x25], 0x77
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x33
mov byte [ebp - 0x22], 0x33
mov byte [ebp - 0x21], 0x33
mov byte [ebp - 0x20], 0x33
mov byte [ebp - 0x1f], 0x5a
mov byte [ebp - 0x1e], 0xa1
mov byte [ebp - 0x1d], 0x6d
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x43
mov byte [ebp - 0x1a], 0x67
mov byte [ebp - 0x19], 0x23
mov byte [ebp - 0x18], 0x58
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0xe6
mov byte [ebp - 0x15], 0x16
mov eax, 1
shl eax, 0
lea ecx, [ebp + eax - 0x3c]
push ecx
push 0
call fcn.004a349d
add esp, 8
mov eax, 1
imul ecx, eax, 0xe
lea edx, [ebp + ecx - 0x3c]
push edx
push 0x24
push 4
push 1
call fcn.004a1193
add esp, 0x10
push 0x26
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x3c]
push edx
call fcn.004a2c2d
add esp, 8
mov ecx, 1
imul edx, ecx, 0x26
mov byte [ebp + edx - 0x3c], al
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0x28
jb 0x4b8779
push 0x28
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a08fb
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x28
jmp 0x4b8780
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x4b87b4]
call fcn.004a3191
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a33b2
add esp, 0x100
cmp ebp, esp
call fcn.004a14e0
mov esp, ebp
pop ebp
ret
Function at 0x4e2e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea edi, [ebp - 0x104]
mov ecx, 0x41
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x61d278]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x34], 0x68
mov byte [ebp - 0x33], 0x33
mov byte [ebp - 0x32], 0
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0
mov byte [ebp - 0x2d], 0x68
mov byte [ebp - 0x2c], 0x91
mov byte [ebp - 0x2b], 0x12
mov byte [ebp - 0x2a], 0x34
mov byte [ebp - 0x29], 0x48
mov byte [ebp - 0x28], 0x33
mov byte [ebp - 0x27], 0x37
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x33
mov byte [ebp - 0x24], 0x33
mov byte [ebp - 0x23], 0x33
mov byte [ebp - 0x22], 0x33
mov byte [ebp - 0x21], 0x33
mov byte [ebp - 0x20], 0x33
mov byte [ebp - 0x1f], 0x33
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x33
mov byte [ebp - 0x1c], 0x33
mov byte [ebp - 0x1b], 0x33
mov byte [ebp - 0x1a], 0xdd
mov byte [ebp - 0x19], 0xdd
mov byte [ebp - 0x18], 0xaa
mov byte [ebp - 0x17], 0x16
mov eax, 0x1e
mov word [ebp - 0x40], ax
mov eax, 1
shl eax, 0
lea ecx, [ebp + eax - 0x34]
push ecx
push 0
call fcn.004a349d
add esp, 8
movzx eax, word [ebp - 0x40]
sub eax, 2
push eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0x34]
push eax
call fcn.004a2c2d
add esp, 8
movzx ecx, word [ebp - 0x40]
mov byte [ebp + ecx - 0x36], al
push 1
movzx eax, word [ebp - 0x40]
push eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x1c
push edx
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
call fcn.004a41db
add esp, 0x14
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x4e2f50]
call fcn.004a3191
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a33b2
add esp, 0x104
cmp ebp, esp
call fcn.004a14e0
mov esp, ebp
pop ebp
ret
Function at 0x4e77c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
push ebx
push esi
push edi
lea edi, [ebp - 0x1f4]
mov ecx, 0x7d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x61d278]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x99
mov byte [ebp - 0xf], 0x99
mov byte [ebp - 0xe], 0x99
mov byte [ebp - 0xd], 0x99
mov byte [ebp - 0xc], 0x99
mov byte [ebp - 0xb], 0x99
cmp dword [ebp + 8], 0
je 0x4e780c
cmp dword [ebp + 0xc], 6
je 0x4e7813
xor eax, eax
jmp 0x4e79ea
mov dword [ebp - 0xfc], 0
push 0xdd
push 0
lea eax, [ebp - 0xf8]
push eax
call fcn.004a094b
add esp, 0xc
mov eax, dword [ebp - 0x23]
and eax, 0xfffff0ff
or eax, 0x100
mov dword [ebp - 0x23], eax
mov eax, dword [ebp - 0x23]
and eax, 0xff0fffff
or eax, 0x100000
mov dword [ebp - 0x23], eax
mov eax, dword [ebp - 0x23]
and eax, 0xfff0ffff
or eax, 0x20000
mov dword [ebp - 0x23], eax
mov dword [ebp - 0xfc], 0x708
mov dword [ebp - 0x1f], 0
mov eax, dword [ebp - 0x23]
and eax, 0xfbffffff
mov dword [ebp - 0x23], eax
mov eax, dword [ebp - 0x23]
and eax, 0xfcffffff
mov dword [ebp - 0x23], eax
mov eax, dword [ebp - 0x23]
and eax, 0xffffff00
or eax, 0xa
mov dword [ebp - 0x23], eax
mov byte [ebp - 0x24], 0xaa
mov byte [ebp - 0x118], 0x68
mov byte [ebp - 0x117], 0x34
mov byte [ebp - 0x116], 0
mov byte [ebp - 0x115], 0
mov byte [ebp - 0x114], 0
mov byte [ebp - 0x113], 0
mov byte [ebp - 0x112], 0
mov byte [ebp - 0x111], 0x68
mov byte [ebp - 0x110], 8
mov byte [ebp - 0x10f], 6
mov byte [ebp - 0x10e], 0x38
mov byte [ebp - 0x10d], 0x33
mov byte [ebp - 0x10c], 0x33
mov byte [ebp - 0x10b], 0x34
mov byte [ebp - 0x10a], 0x34
mov byte [ebp - 0x109], 0x33
mov byte [ebp - 0x108], 0x4b
mov byte [ebp - 0x107], 0x16
mov dword [ebp - 0x124], 0x12
lea eax, [ebp - 0x118]
mov dword [ebp - 0x130], eax
push 6
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x130]
add ecx, 1
push ecx
call fcn.004a08fb
add esp, 0xc
movzx eax, byte [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a3fe2
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a469a
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x130]
add edx, 0xa
push edx
call fcn.004a08fb
add esp, 0xc
mov eax, dword [ebp - 0x124]
sub eax, 2
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.004a2c2d
add esp, 8
mov edx, dword [ebp - 0x124]
mov byte [ebp + edx - 0x11a], al
mov eax, 4
imul ecx, eax, 0
lea edx, [ebp - 0x118]
mov dword [ebp + ecx - 0x8c], edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x124]
mov dword [ebp + ecx - 0xf4], edx
push 0
push 0
push 0
lea eax, [ebp - 0xfc]
push eax
call fcn.004a0630
add esp, 0x10
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4e7a1c]
call fcn.004a3191
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a33b2
add esp, 0x1f4
cmp ebp, esp
call fcn.004a14e0
mov esp, ebp
pop ebp
ret
Function at 0x5b0bf0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.0049f7f3
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5b0c2e
cmp dword [ebp + 8], 0
je 0x5b0c1c
lea eax, [ebp + 8]
push eax
call fcn.004a40a5
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x5b0c2e
mov eax, 4
jmp 0x5b0d5e
call fcn.004a1201
movzx edx, al
test edx, edx
jne 0x5b0c5c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5b0c4d
mov dword [ebp - 0xc], 4
jmp 0x5b0c54
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x5b0d5e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x5b0d05
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x5b10b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.004a2cb9
lea ecx, [ebp - 8]
call fcn.0049fc35
movzx edx, al
test edx, edx
jne 0x5b0cc7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.004a1341
mov eax, dword [ebp - 0x10]
jmp 0x5b0d5e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.004a3a3d
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x5b0cf2
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.004a1341
mov eax, dword [ebp - 0x14]
jmp 0x5b0d5e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.004a1341
mov eax, dword [ebp - 0x18]
jmp 0x5b0d5e
call fcn.0049f78a
movzx ecx, al
test ecx, ecx
jne 0x5b0d3e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.004a124c
add esp, 0x10
jmp 0x5b0d5e
call fcn.004a432a
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.004a452d
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x5b0dc0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.0049f7f3
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5b0dfe
cmp dword [ebp + 8], 0
je 0x5b0dec
lea eax, [ebp + 8]
push eax
call fcn.004a2570
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x5b0dfe
mov eax, 4
jmp 0x5b0f2e
call fcn.004a1201
movzx edx, al
test edx, edx
jne 0x5b0e2c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5b0e1d
mov dword [ebp - 0xc], 4
jmp 0x5b0e24
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x5b0f2e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x5b0ed5
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x5b1110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.004a2cb9
lea ecx, [ebp - 8]
call fcn.0049fc35
movzx edx, al
test edx, edx
jne 0x5b0e97
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.004a1341
mov eax, dword [ebp - 0x10]
jmp 0x5b0f2e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.004a3a3d
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x5b0ec2
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.004a1341
mov eax, dword [ebp - 0x14]
jmp 0x5b0f2e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.004a1341
mov eax, dword [ebp - 0x18]
jmp 0x5b0f2e
call fcn.0049f78a
movzx ecx, al
test ecx, ecx
jne 0x5b0f0e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.004a15e4
add esp, 0x10
jmp 0x5b0f2e
call fcn.004a432a
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.004a1b39
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1000e2ee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10022f17
call fcn.100214ba
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x1000e39c
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.10014500
add esp, 0xc
test eax, eax
js 0x1000e39c
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x1000e382
push edi
call fcn.100033e4
pop ecx
test al, al
je 0x1000e382
mov eax, edi
call fcn.100216b0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000e38e
push edi
lea ecx, [ebp - 0x428]
call fcn.10014500
push 3
push edi
push esi
push eax
call fcn.10014500
cmp eax, ebx
jne 0x1000e3d9
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000e3b5
lea ecx, [ebp - 0x418]
call fcn.1000cdea
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10002dcb
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.10021516
ret 0x10
push 2
push ebx
push eax
call fcn.1000cff7
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x1000e3fa
call fcn.10003ef0
mov esi, eax
jmp 0x1000e4c4
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x1000e41d
call fcn.10003ef0
jmp 0x1000e4b6
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x1000e413
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x1000e44d
mov esi, 0x8007000e
jmp 0x1000e4b8
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10014500
mov dword [ebp - 4], 1
jmp 0x1000e47b
cmp dword [ebp - 0x418], ebx
je 0x1000e446
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.10014500
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.10014500
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000e3ba
lea ecx, [ebp - 0x418]
call fcn.1000cdea
jmp 0x1000e3ba
Function at 0x10014500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1001450f
pop dword [ebp - 0x20]
mov eax, 0x43de3494
sub eax, 0x33dcef85
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x343bf
push 0
mov eax, 0x18cc1750
sub eax, 0x8c9d5e4
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x1ccd2936
add ecx, 0xe33307ba
xor esi, esi
add esi, eax
mov edx, 0x10038c00
add edx, dword [ebp - 0x20]
mov ebx, 0xa1d75311
xor dword [ebp - 0xc], 0x4ce0d69
mov edi, dword [edx]
mov dword [ebp - 0x18], 0xcea42243
sub edi, ebx
add dword [ebp - 0x18], 0xe7b0b9ad
mov dword [esi], edi
add esi, 4
add edx, 0xc61cb5f5
sub edx, 0xc61cb5f1
loop 0x10014564
add eax, 0x187c24eb
sub eax, 0x187b6e58
xor ebx, ebx
add ebx, eax
add eax, 0xf5b9c106
add eax, 0xa463eff
mov ecx, 0xe80d93ab
add ecx, 0x27f26c55
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x10014920
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor ecx, ecx
xor edx, edx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov cl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
test ebp, ebp
je 0x1001496f
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x10014944
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x10014981
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov eax, 0x3020100
push esi
mov ecx, 0x40
mov esi, dword [esp + 0xc]
push edi
mov edx, esi
push ebp
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
dec ecx
jne 0x10014995
xor ecx, ecx
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dl, byte [edi + esi]
mov al, byte [ebp + ecx]
add bl, al
inc ecx
add bl, dl
inc edi
mov al, byte [ebx + esi]
mov byte [edi + esi - 1], al
cmp dword [esp + 0x18], ecx
mov byte [ebx + esi], dl
jne 0x100149db
xor ecx, ecx
cmp edi, 0x100
jb 0x100149b8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x10015290
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x100152dc
jle 0x100152d7
cmp eax, 3
jg 0x100152d7
push esi
mov esi, dword [ecx]
test esi, esi
je 0x100152ce
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x100152bc
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.10014500
mov eax, 1
ret 0x10
Function at 0x10015850
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x1001589c
jle 0x10015897
cmp eax, 3
jg 0x10015897
push esi
mov esi, dword [ecx]
test esi, esi
je 0x1001588e
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x1001587c
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.10016740
mov eax, 1
ret 0x10