joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405134
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405364
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4051b7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405364
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4051b7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405380
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405240
xor eax, eax
push ebp
push 0x405239
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404f7c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40521e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4053a0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40521e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405240
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40535a
cmp byte [ebp - 0xd], 0
jne 0x405287
cmp byte [ebp - 0x12], 0
je 0x40535a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4052a0
dec ebx
cmp byte [ebx], 0x2e
je 0x4052af
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40529f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40535a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4052ec
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40535a
cmp byte [ebp - 0xd], 0
je 0x40535a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40535a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4059f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a56
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042c8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d34
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a40
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a5d
lea eax, [ebp - 0x10]
call fcn.00404058
ret

Function at 0x4073e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004044e4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x407401
test al, 0x10
jne 0x407405
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409bc4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409bfd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404148
jmp 0x409c06
mov eax, ebx
mov edx, esi
call fcn.004040ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409c10
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409c31
mov al, byte [esp]
jmp 0x409c33
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a2b8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a130
mov eax, dword [0x414504]
cmp byte [eax], 0
je 0x40a334
mov eax, dword [0x414420]
call fcn.00402b5c
call fcn.0040275c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407578
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a37c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a36a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4143fc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415660]
call fcn.00404f40
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b018
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b07c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004042c8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004070e0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b083
lea eax, [ebp - 0xc]
call fcn.00404058
ret
Function at 0x412d10
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0
push 0
mov eax, esi
call fcn.004044e4
push eax
mov eax, ebx
call fcn.004044e4
push eax
push 0x412d3c
push 0
call sub.shell32.dll_ShellExecuteA
pop esi
pop ebx
ret

Function at 0x413080
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
mov eax, dword [0x414420]
mov edx, 0x41326c
call fcn.00404628
call fcn.00402f28
call fcn.0040275c
push 0
push 0
push 0
push 0
push 0x413284
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413246
xor eax, eax
push ebp
push 0x41323f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 0
push 0x50
push 0x41328c
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x413228
xor eax, eax
push ebp
push 0x413221
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
push 0x41328c
push 0x4132b8
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41320a
xor eax, eax
push ebp
push 0x413203
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x4131ec
xor ecx, ecx
mov dl, 1
mov eax, dword [0x40fa54]
call fcn.00411c1c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4131e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x10], 0
jbe 0x4131a5
lea edx, [ebp - 0x414]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 0x10], 0
jne 0x413175
mov eax, dword [0x414420]
mov edx, 0x4132c4
call fcn.00404628
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 4]
call fcn.00404628
call fcn.00402f28
call fcn.0040275c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4131ec
mov eax, dword [ebp - 0x14]
call fcn.00403408
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41320a
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413228
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413246
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov eax, dword [0x414420]
mov edx, 0x4132dc
call fcn.00404628
call fcn.00402f28
call fcn.0040275c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021670
Capabilities:
Check for trap flag exception

Disassembly:
lea esp, [esp - 4]
pushfd
push eax
aad 0xa
push edx
mov edx, 0x4768
rol dl, 1
daa
push ebx
xor bx, ax
sahf
cmp edx, ebx
xor dx, dx
mov ax, 0x4889
push ecx
mov cx, 0xc990
div cx
aaa
shl dh, 3
xor dx, dx
mov ax, 0x9192
mov cx, 0x6951
div cx
mov eax, dword [esp + 0xc]
bswap ebx
not bl
bsf edx, ecx
neg dh
cmp ax, ax
shl dl, 2
push edx
pop ecx
push ecx
nop
bsf ecx, edx
mov ebx, dword [esp + 0x14]
push ebx
popfd
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
bswap ebx
mov ebx, dword [esp + 8]
lea esp, [esp + 0x18]
mov dword [esp], ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
jmp 0x1002171f
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x100216ed
pop edi
pop ebx
ret
and ebx, 0x7f
xor edi, ebx
jmp 0x1002170b

Function at 0x10021730
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 4]
pushfd
push ebx
shr bx, 4
push ecx
not ecx
push eax
das
push edx
shl cl, 4
bswap ebx
xadd eax, ecx
ror bx, 3
aam 0xa
bswap ecx
pop eax
push edx
shl dl, 0
bsf eax, edx
bt ebx, 1
aas
stc
bsf eax, edx
das
aam 0xa
neg cx
mov ecx, dword [esp + 8]
nop
neg dh
xchg edx, eax
xor edx, eax
mov eax, dword [esp + 4]
xor edx, ebx
mov ebx, dword [esp + 0x10]
push ebx
popfd
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
lea esp, [esp + 0x14]
mov dword [esp], ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
jmp 0x1002179d
push edi
or ecx, edx
add esi, esi
mov edi, edx
and edi, esi
add edi, edx
mov ebx, ecx
shr ebx, 8
add ebx, edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
shr edi, 4
sar ebx, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add ecx, ecx
mov edi, ecx
xor edi, esi
not edi
and edx, edi
cmp ecx, 0x10000
jb 0x100217a0
pop edi
pop esi
mov ebx, dword [esp]
pushfd
push ecx
xor ecx, 0xb0
push ebx
or ecx, ebx
push eax
bswap eax
xchg bx, cx
daa
neg ebx
bswap ebx
das
bswap ebx
push edx
xor edx, edx
mov eax, 0xb041
mov ecx, 0x5613
div ecx
mov edx, dword [esp]
pop eax
das
sub bx, bx
neg cx
mov ecx, dword [esp + 8]
not bx
mov ebx, dword [esp + 4]
aas
inc eax
aas
mov eax, dword [esp + 0xc]
push eax
popfd
mov eax, dword [esp]
lea esp, [esp + 0x10]
lea esp, [esp + 4]
pop ebp
ret
Function at 0x10021bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
jmp 0x10021ca0
je 0x10021c32
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
shr ebx, 4
and eax, 0x7f
xor ebx, eax
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp + 8]
mov eax, ecx
cmp eax, 1
jne 0x10021c05
add edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jb 0x10021c55
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], eax
or eax, 0x100
xor edi, edi
cmp eax, 1
jmp 0x10021bff
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x10021dd5
add edi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
jmp 0x10021c81
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, 0x10
jb 0x10021db4
cmp edx, dword [ebp + 0x10]
jae 0x10021c4c
lea eax, [edx - 0x10]
jmp 0x10021c52
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [ebp - 0xc], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
mov dword [ebp - 0x10], edx
lea esp, [esp - 4]
pushfd
push eax
not ax
push ebx
bswap ebx
aam 0xa
push edx
xchg dx, ax
daa
push ecx
rol ecx, 0
stc
cbw
bswap edx
bswap edx
shl ebx, 1
cdq
bt dx, 1
bsf ebx, eax
dec ecx
neg ch
mov ch, dh
sahf
sub ecx, edx
mov ecx, dword [esp]
mov edx, dword [esp + 4]
inc ah
clc
push ebx
test dx, 0x10
bswap ebx
mov ebx, dword [esp + 0xc]
inc al
mov eax, dword [esp + 0x14]
push eax
popfd
mov eax, dword [esp + 0x10]
lea esp, [esp + 0x18]
mov dword [esp], edi
mov dword [ebp - 0x14], ecx
xor edx, edx
jmp 0x10021d41
cmp edx, dword [ebp + 0x10]
jae 0x10021c4c
mov eax, edx
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x10021d92
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 4]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x10021d5d
add edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x10021d41
cmp edx, 0x10
jae 0x10021c8f
lea eax, [edx - 8]
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jae 0x10021c4c
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x10021c70
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 0x104]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
jmp 0x10021c64
Function at 0x10024690
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 4]
pushfd
push edx
neg dh
push eax
mov al, dh
push ecx
xchg dx, cx
lahf
stc
push ebx
bsf eax, ebx
aas
ror cx, 3
bsf edx, eax
not bx
mov ebx, dword [esp]
bsf ax, cx
neg edx
cdq
push edx
nop
neg ch
aad 0xa
lahf
and cx, 0x18
mov eax, 0xcd69
mov ecx, 0xa333
mul ecx
mov ecx, dword [esp + 8]
dec dx
mov eax, dword [esp + 0x14]
push eax
popfd
mov edx, dword [esp + 0x10]
bswap eax
mov eax, dword [esp + 0xc]
lea esp, [esp + 0x18]
mov dword [esp], ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [edi + 0x323c8]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
lea ebx, [ebx]
xor edx, edx
lea ecx, [edx + 1]
mov dword [ebp - 4], 4
lea esp, [esp]
movzx ebx, word [edi + ecx*2 + 0x32a4c]
mov eax, esi
and eax, 1
mov edi, eax
neg edi
sar edi, 4
and edi, 0x7f
shr ebx, 4
xor ebx, edi
mov edi, dword [ebp + 8]
add edx, dword [edi + ebx*4 + 0x30d34]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [ebp - 4]
jne 0x1002471d
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp esi, 0x10
jb 0x1002470d
jmp 0x10024776
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x84], 0
pop edi
pop esi
pop ebx
jmp 0x10024772
Function at 0x10029510
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov dword [eax + 0x34], edx
mov byte [eax + 0x1f], dl
mov dword [eax + 0x24], edx
mov dword [eax + 0x30], 0x20
mov dword [eax + 0x48], 4
mov word [eax + 0x1d], 1
lea esi, [eax + 0x60]
jmp 0x10029566
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
jmp 0x100295e2
lea esp, [esp]
mov eax, edx
and eax, 1
dec eax
not eax
jmp 0x100295cb
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
jmp 0x100295c2
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
jmp 0x1002953e
and eax, 1
dec eax
jmp 0x1002958d
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
jmp 0x1002957a
ret
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x1002956d
mov esi, dword [esp]
pushfd
push eax
aam 0xa
push edx
cwd
push ecx
bswap ecx
mov ecx, dword [esp]
nop
push ebx
shl ebx, 1
aam 0xa
neg dx
inc al
not bl
bswap eax
clc
clc
das
cmc
inc eax
lea edx, [edx + 0x6fbc]
push ecx
aam 0xa
clc
inc eax
mov eax, dword [esp + 0x10]
xadd ebx, ebx
mov ebx, dword [esp + 4]
inc edx
mov edx, dword [esp + 0x14]
push edx
popfd
mov edx, dword [esp + 0xc]
lea esp, [esp + 0x18]
lea esp, [esp + 4]
pop ebp
jmp 0x100295e1
Function at 0x10034ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
pushfd
push eax
das
push ecx
add ecx, ecx
lahf
push ebx
not ebx
aam 0xa
not al
push edx
bswap edx
nop
nop
shl dx, 0
aad 0xa
bts eax, 6
bsf ebx, edx
aad 0xa
cdq
and bh, 0xf0
rol eax, 3
inc dl
cbw
mov eax, 0x8993
mov ecx, 0x5d45
mul ecx
bsf ax, cx
bswap ebx
mov ebx, dword [esp + 4]
shr dh, 4
mov ax, 0x18
mov cx, 0x28
mul cx
mov eax, dword [esp + 0x10]
push eax
popfd
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp]
lea esp, [esp + 0x14]
mov dword [esp], 0xffffffff
push 0x3f57b98
mov eax, dword fs:[0]
lea esp, [esp - 4]
lea esp, [esp - 0x24]
push ecx
bswap ecx
pushfd
push ebx
neg bh
push edx
push eax
xor ax, 0xd9f1
nop
clc
mov eax, dword [esp]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
pop edx
cmc
or ecx, 0x67
cbw
not bx
aad 0xa
cdq
mov edx, dword [esp + 0x2c]
inc ebx
xchg cx, ax
shl cl, 1
daa
shl cl, 5
mov ecx, dword [esp + 0xc]
not eax
bswap eax
shr bx, 4
mov ebx, dword [esp + 4]
aad 0xa
mov eax, dword [esp + 8]
push eax
popfd
mov eax, dword [esp + 0x30]
lea esp, [esp + 0x34]
mov dword [esp], eax
sub esp, 0x14
push ebx
push esi
push edi
jmp 0x10034ecd
jb 0x10034dd1
mov eax, dword [eax]
cmp dword [esi + 0x14], ecx
jno 0x10034e59
push ebx
mov bx, 0xc4
pushfd
cmc
push eax
mov ax, 0x63
push ecx
mov cx, 0x53
push edx
mul cx
aad 0xa
inc al
bts ax, 3
xor dx, dx
mov ax, 0x6c58
mov cx, 0xbc8a
div cx
inc bx
neg ebx
not edx
neg ecx
aad 0xa
xadd ebx, ecx
shr cl, 3
bt bx, 5
aaa
clc
shl cl, 6
nop
push eax
and bx, dx
cmc
aas
push edx
not bl
mov ebx, dword [esp + 0x18]
test eax, ebx
dec dx
cmp ecx, 1
neg cx
mov ecx, dword [esp + 0xc]
aaa
shl ax, 1
mov eax, dword [esp + 0x14]
push eax
popfd
mov eax, dword [esp + 0x10]
pop edx
mov edx, dword [esp + 4]
lea esp, [esp + 0x18]
jo 0x10034e59
jb 0x10034e61
mov esi, dword [esi]
push eax
push esi
call dword [0x3f5d078]
test eax, eax
jne 0x10034e79
call dword [0x3f5d108]
mov ebx, eax
mov esi, dword [ebp - 0x20]
cmp esi, edi
je 0x10034eae
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
jmp 0x10034e9b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push esi
call fcn.10015320
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.100639c0
add esp, 0x14
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
jmp 0x10034e94
mov ecx, 8
cmp dword [eax + 0x14], ecx
jmp 0x10034dc9
mov eax, dword [0x3f67864]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
dec eax
push eax
inc ecx
push ecx
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 4], edi
call fcn.10060980
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0xc
cmp eax, 2
jb 0x10034e7c
lea eax, [esi + 0x1c]
jmp 0x10034ec0
Function at 0x1003d7a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
jmp 0x1003d7bf
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x10051b60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea esp, [esp - 4]
push eax
nop
mov ax, 0xe7
push ecx
mov cx, 0x97
pushfd
push edx
mul cx
cwd
push ebx
sub cx, bx
rol dl, 2
aam 0xa
daa
and cx, bx
cwd
lea ebx, [eax + ecx - 0x6c16]
mov ebx, dword [esp]
not ax
cmc
stc
aas
mov dx, cx
stc
clc
and dl, cl
cmp eax, ecx
sub al, 0x88
xor edx, edx
mov eax, 0x346d
mov ecx, 0xebd3
div ecx
mov eax, dword [esp + 8]
push eax
popfd
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
lea esp, [esp + 0x14]
mov dword [esp], ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
push edi
xor eax, eax
lea ecx, [ecx]
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x10051bd6
mov edi, dword [ebp + 0x10]
mov word [esi + 0x100], cx
xor bl, bl
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 0xc]
inc ecx
movzx edx, byte [edx + eax]
add dl, byte [ecx + esi - 1]
add bl, dl
movzx edx, byte [ecx + esi - 1]
movzx eax, bl
mov byte [ebp + 0xb], dl
movzx edx, byte [eax + esi]
mov byte [ecx + esi - 1], dl
movzx edx, byte [ebp + 0xb]
mov byte [eax + esi], dl
cmp ecx, 0x100
jl 0x10051bf1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10051c30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
test edx, edx
jle 0x10051cc9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
sub ecx, edi
mov dword [ebp - 4], ecx
mov dword [ebp + 0x14], edx
mov ecx, 1
jmp 0x10051c63
add byte [eax + 0x100], cl
movzx esi, byte [eax + 0x100]
movzx edx, byte [esi + eax]
add byte [eax + 0x101], dl
movzx ecx, byte [eax + 0x101]
mov bl, byte [ecx + eax]
mov dl, byte [esi + eax]
mov byte [esi + eax], bl
mov byte [ecx + eax], dl
movzx ecx, byte [eax + 0x101]
movzx ecx, byte [ecx + eax]
movzx edx, byte [eax + 0x100]
add cl, byte [edx + eax]
movzx edx, cl
movzx ecx, byte [edx + eax]
mov edx, dword [ebp - 4]
xor cl, byte [edx + edi]
mov byte [edi], cl
mov ecx, 1
add edi, ecx
sub dword [ebp + 0x14], ecx
jne 0x10051c63
pop edi
pop esi
jmp 0x10051cc8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10051df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not eax
test ecx, ecx
je 0x10051e25
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x3f67228]
inc edx
dec ecx
jne 0x10051e07
pop esi
not eax
pop ebp
ret