joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10097610
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10097450
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100976db
mov dword [ebp - 4], 0
jmp 0x1009766c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100976db
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1009a284
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100976d9
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1009a284
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10097270
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1009a284
jmp 0x10097663
pop esi
add esp, 8
cmp ebp, esp
call fcn.1009a284
mov esp, ebp
pop ebp
ret

Function at 0x100976f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1009779b
mov dword [ebp - 4], 0
jmp 0x10097723
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x1009777e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1009a284
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009777c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1009a284
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1009a284
jmp 0x1009771a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x100c95a4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1009a284
pop esi
add esp, 8
cmp ebp, esp
call fcn.1009a284
mov esp, ebp
pop ebp
ret
Function at 0x100977b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x101a5420]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10097813
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1009a284
test eax, eax
jne 0x1009783e
mov eax, 0xa
jmp 0x10097940
cmp dword [ebp + 0xc], 0
je 0x1009788a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x10097888
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x100978c6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100978b1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x100978c6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1009a284
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1009a284
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1009a284
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10097964]
call fcn.1009a230
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.1009a284
mov esp, ebp
pop ebp
ret
Function at 0x10098040
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x101a541c]
mov dword [ebp - 4], eax
jmp 0x10098067
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10098080
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1009807e
mov eax, dword [ebp - 4]
jmp 0x10098104
jmp 0x1009805f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1009a284
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10098101
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100980c3
mov edx, dword [ebp - 4]
mov eax, dword [0x101a541c]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x101a541c], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1009a284
mov esp, ebp
pop ebp
ret

Function at 0x100985f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10098640
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10098640
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10098640
xor eax, eax
jmp 0x10098681
mov dword [ebp - 4], 1
jmp 0x10098652
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1009867c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x1009867a
xor eax, eax
jmp 0x10098681
jmp 0x10098649
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0xc4187f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 5
pop ecx
mov esi, 0xc6f240
mov edx, dword [0xc77090]
lea edi, [ebp - 0x18]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
or edx, 0x31efea37
mov eax, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov cl, byte [esi]
cmp cl, byte [ebp - 0x18]
jne 0xc418ee
test cl, cl
je 0xc418c6
cmp byte [ebp + eax - 0x18], bl
je 0xc418c6
inc eax
mov cl, byte [esi + eax]
cmp cl, byte [ebp + eax - 0x18]
je 0xc418b2
mov ecx, dword [ebp + 8]
cmp ecx, eax
jae 0xc418ee
mov esi, dword [0xc77090]
cmp ecx, 0x1171
jne 0xc418e3
mov edx, esi
and edx, 0xf0186a5b
and edx, 0x131c278a
inc ecx
cmp ecx, eax
jb 0xc418d3
mov ecx, dword [0xc77090]
and ecx, 0x1b625322
imul eax, dword [0xc77090], 0xf5b2e830
mov dword [0xc77084], eax
xor ecx, 0xaac686d9
inc ebx
cmp byte [ebx + 0xc6fe24], 0
jne 0xc41909
pop edi
pop esi
cmp ebx, 0x410
mov dword [0xc77014], ecx
pop ebx
je 0xc41934
xor eax, 0x2579919f
mov dword [0xc77084], eax
leave
ret
Function at 0xc420cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov ecx, dword [0xc770c4]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov al, byte [esi]
mov byte [ebp + 0xf], al
test al, al
je 0xc420f4
mov eax, esi
and ecx, 0xfd0ea509
inc eax
cmp byte [eax], 0
jne 0xc420e8
xor ebx, ebx
lea eax, [ecx + 0x1b87d3c9]
mov edx, ebx
inc edx
cmp byte [edx + 0xc6f9b0], bl
jne 0xc420fe
cmp edx, 0x487
jae 0xc42116
or eax, 0x909170ee
jmp 0xc4211c
imul ecx, ecx, 0xd2707129
mov edx, ebx
cmp byte [ebp + 0xf], dl
je 0xc4213d
and eax, 0xc7d4ed5c
inc edx
cmp byte [edx + esi], bl
jne 0xc42123
cmp edx, 0x2434
jbe 0xc4213d
xor eax, 0xb66724ab
jmp 0xc42142
or eax, 0x2cc93626
mov esi, dword [ebp + 8]
mov edx, ebx
push 0
mov bl, byte [esi]
mov byte [ebp + 0xf], bl
test bl, bl
pop ebx
je 0xc4216e
or ecx, 0xd2b2b6c9
inc edx
cmp byte [edx + esi], 0
jne 0xc42153
cmp edx, 0xc7
lea edx, [eax + 0x3f375870]
je 0xc42174
lea edx, [ecx - 0x1effa12e]
add edx, 0x3b36f9a
mov eax, ebx
cmp byte [ebp + 0xf], 0
je 0xc4219c
mov ecx, edx
or ecx, 0xea0da4cf
inc eax
cmp byte [eax + esi], 0
jne 0xc4218a
cmp dword [ebp + 0xc], eax
jae 0xc4219c
lea edx, [ecx - 0x5d11c4a]
mov ecx, edx
mov eax, ebx
xor ecx, 0x420e839d
inc eax
cmp byte [eax + 0xc6fae4], 0
jne 0xc421a6
mov esi, dword [ebp + 0xc]
jmp 0xc421ca
cmp esi, 0x4a5
jne 0xc421c3
and edx, 0xcd7ba6f1
and ecx, 0x2d38c125
inc esi
cmp esi, eax
jb 0xc421b5
push edi
mov esi, 0xc6f528
lea edi, [ebp - 0x10]
add ecx, 0x3ae93745
mov eax, ebx
mov dword [ebp + 8], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x77
jne 0xc4221b
mov byte [ebp + 0xf], 0x77
xor ebx, ebx
mov cl, byte [ebp + 0xf]
test cl, cl
je 0xc4220b
cmp byte [ebp + eax - 0x10], bl
je 0xc4220b
mov cl, byte [eax + 0xc6f945]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0xc421f4
mov ecx, dword [ebp + 8]
cmp dword [ebp + 0xc], eax
jae 0xc4221b
mov edx, ecx
and edx, 0x6e5d0f7e
imul eax, edx, 0x7c21a602
mov ecx, ebx
xor edx, 0x1f0fc6a8
inc ecx
cmp byte [ecx + 0xc6f9b0], 0
jne 0xc42223
cmp ecx, 0x23d1
jne 0xc42243
imul eax, edx, 0x4fe106e5
jmp 0xc42248
or eax, 0x73811f82
push 7
pop ecx
mov esi, 0xc6f534
mov dword [ebp + 0xc], eax
lea edi, [ebp - 0x2c]
and edx, 0xb918ae1b
rep movsd dword es:[edi], dword [esi]
push 0x46
pop ecx
mov eax, ebx
mov dword [ebp - 4], edx
pop edi
cmp cx, word [ebp - 0x2c]
jne 0xc42296
mov edx, ebx
test cx, cx
je 0xc4228d
cmp word [ebp + eax - 0x2c], bx
je 0xc4228d
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + 0xc6fa00]
cmp cx, word [ebp + eax - 0x2c]
je 0xc4226f
mov dword [ebp + 8], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax*2 + 0xc6fa00]
movzx eax, byte [ebp + eax*2 - 0x2c]
sub ecx, eax
mov eax, dword [ebp + 0xc]
cmp ecx, 0x14e5
jne 0xc422b8
and edx, 0x5ca08dcc
jmp 0xc422be
lea edx, [eax + 0x4e364ef7]
xor eax, 0x9d5a7bf9
inc ebx
cmp byte [ebx + 0xc6fe24], 0
jne 0xc422be
mov dword [0xc770c4], eax
mov eax, dword [ebp + 0xc]
jmp 0xc422eb
cmp eax, 0x1673
jne 0xc422e4
sub edx, 0x43e2f587
and edx, 0x3b78efd1
inc eax
cmp eax, ebx
jb 0xc422d7
add edx, 0x71089147
pop esi
mov dword [0xc77070], edx
pop ebx
leave
ret
Function at 0xc4239d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0xc77024]
push ebx
and eax, 0xaf0f1c6d
imul edx, eax, 0x85a2e66c
push esi
push edi
mov edi, dword [0xc770a4]
or edi, 0x6d98d93d
xor eax, eax
mov dword [ebp - 8], edi
mov esi, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
lea ebx, [edx + 0x4b97c5ce]
inc esi
cmp byte [esi + 0xc6fdf0], al
jne 0xc423d5
mov ecx, dword [ebp - 0x10]
cmp ecx, esi
jae 0xc42401
cmp ecx, 0x778
jne 0xc423f3
add ebx, 0x135670bd
add edi, 0x57f7c389
inc ecx
cmp ecx, esi
jb 0xc423e5
mov dword [ebp - 8], edi
push 5
pop ecx
mov esi, 0xc6f59c
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x28], 0x66
jne 0xc42445
mov byte [ebp - 1], 0x66
mov ecx, eax
mov dl, byte [ebp - 1]
test dl, dl
je 0xc42435
cmp byte [ebp + ecx - 0x28], al
je 0xc42435
mov dl, byte [ecx + 0xc6fce9]
inc ecx
cmp dl, byte [ebp + ecx - 0x28]
je 0xc4241e
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jae 0xc42445
mov edx, ebx
or edx, 0xd2c22c6a
mov esi, 0xc6f5b4
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x24], 0x70
jne 0xc42473
mov cl, 0x70
test cl, cl
je 0xc42473
cmp byte [ebp + eax - 0x24], 0
je 0xc42473
mov cl, byte [eax + 0xc6f901]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0xc4245b
movzx ecx, byte [eax + 0xc6f900]
movzx eax, byte [ebp + eax - 0x24]
sub ecx, eax
cmp ecx, 0x1b2d
jae 0xc42493
mov ebx, edx
and ebx, 0x52883fb1
jmp 0xc4249c
mov edx, dword [ebp - 8]
and edx, 0xa531b9b8
xor edx, 0xe4040140
mov eax, 0xc6fdf0
mov dword [0xc770a4], edx
and ebx, 0x55fe509d
inc eax
cmp byte [eax], 0
jne 0xc424ad
push 0x13
pop ecx
mov esi, str.Processed_ContentSnippet_for__s__Indexing_Content:__d__has_file_IFilter:__d
mov dword [0xc77024], ebx
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x74], 0x70
jne 0xc424f2
push 0x70
xor eax, eax
pop ecx
test cl, cl
je 0xc424ef
cmp byte [ebp + eax - 0x74], 0
je 0xc424ef
mov cl, byte [eax + 0xc6f901]
inc eax
cmp cl, byte [ebp + eax - 0x74]
je 0xc424d7
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0xc6f900]
movzx eax, byte [ebp + eax - 0x74]
sub ecx, eax
cmp ecx, 0x6df
jae 0xc42517
or edx, 0x8ce1ccfa
mov dword [0xc770a4], edx
pop edi
lea ecx, [edx + 0x75583cc1]
mov eax, ebx
pop esi
mov dword [0xc7702c], ecx
pop ebx
leave
ret
Function at 0xc45ba8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx edx, word [ecx]
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], edx
push ebx
movzx ebx, dx
mov dword [ebp - 4], ebx
push esi
mov esi, dword [0xc77134]
push edi
mov edi, dword [0xc770ec]
test dx, dx
je 0xc45bf3
imul edx, edi, 0x6cc371bd
xor ebx, ebx
inc eax
cmp word [ecx + eax*2], bx
jne 0xc45bdb
cmp eax, 0x190
jbe 0xc45bf3
mov ebx, esi
xor ebx, 0x5e9e80c
jmp 0xc45c01
mov ebx, dword [0xc77118]
mov edx, ebx
xor edx, 0xa39af9da
xor eax, eax
xor edx, 0x69364dee
inc eax
cmp byte [eax + 0xc70dfc], 0
jne 0xc45c03
mov dword [ebp - 0x10], edx
cmp eax, 0xe2e
jae 0xc45c27
mov ebx, esi
xor ebx, 0xaab38848
jmp 0xc45c2d
xor edi, 0x3025fb8e
xor eax, eax
mov esi, edx
or esi, 0xa032d15a
mov ecx, eax
mov dword [0xc77134], esi
inc ecx
cmp word [ecx*2 + 0xc70b40], ax
jne 0xc45c3f
mov eax, dword [ebp - 0x14]
cmp eax, ecx
jae 0xc45c6e
lea edx, [esi + 0x17fa64a7]
mov dword [ebp - 0x10], edx
cmp eax, 0x2034
jne 0xc45c69
mov ebx, edi
and ebx, 0xe1e378d5
inc eax
cmp eax, ecx
jb 0xc45c5a
push 6
pop ecx
mov esi, 0xc702a0
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x14]
xor eax, eax
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 4]
cmp cx, word [ebp - 0x30]
jne 0xc45cbc
mov esi, dword [ebp - 8]
mov edx, eax
movzx ecx, di
xor edi, edi
test cx, cx
je 0xc45cb0
cmp word [ebp + eax - 0x30], di
je 0xc45cb0
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x30]
je 0xc45c95
mov edi, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
movzx ecx, byte [esi + eax*2]
movzx eax, byte [ebp + eax*2 - 0x30]
sub ecx, eax
cmp ecx, 0x11c1
je 0xc45cdd
imul eax, edx, 0xcc1b4e17
mov dword [0xc77134], eax
xor ecx, ecx
mov eax, ecx
test di, di
je 0xc45d1e
xor edx, 0x15c699b3
inc eax
cmp word [esi + eax*2], cx
jne 0xc45ce6
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jae 0xc45d1e
mov esi, edx
mov edi, edx
mov edx, esi
cmp ecx, 0x1b
jne 0xc45d0b
imul edx, edi, 0x188b8608
xor edx, 0x5bbfabc4
inc ecx
mov esi, edx
cmp ecx, eax
jb 0xc45cfc
mov dword [0xc77108], edx
push 9
pop ecx
mov esi, 0xc702bc
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
xor eax, eax
mov esi, dword [ebp - 8]
cmp cx, word [ebp - 0x38]
jne 0xc45d5b
xor edi, edi
movzx edx, cx
mov ecx, edi
test dx, dx
je 0xc45d5b
cmp word [ebp + ecx - 0x38], di
je 0xc45d5b
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + esi]
cmp dx, word [ebp + ecx - 0x38]
je 0xc45d40
movzx ecx, byte [esi + eax*2]
movzx eax, byte [ebp + eax*2 - 0x38]
sub ecx, eax
cmp ecx, 0xcb3
jne 0xc45d7a
imul ecx, dword [0xc77134], 0x2c2727f2
jmp 0xc45d80
lea ecx, [ebx - 0x15357080]
pop edi
lea eax, [ecx - 0x48c38d9c]
mov dword [0xc77108], ecx
or ecx, 0x5c27dd44
mov dword [0xc770ec], eax
pop esi
mov dword [0xc77118], ecx
pop ebx
leave
ret
Function at 0xc46549
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
or dword [0xc77110], 0x712fc19f
push ebx
push esi
push edi
push 0xa
pop ecx
mov esi, str.ext_ms_win_advapi32_eventlog_l1_1_0.dll
mov dword [ebp - 0x18], 0x4f5469fd
lea edi, [ebp - 0x40]
mov dword [ebp - 0x14], 0xe286d8a3
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0x10], 0x7903756e
mov dword [ebp - 0xc], 0xa4931bf9
xor eax, eax
mov dword [ebp - 8], 0xdce62afc
mov dword [ebp - 4], 0xfe959915
mov byte [ebp + eax - 0x140], al
inc eax
cmp eax, 0x100
jb 0xc4659a
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x140]
push 0x27
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x40]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x140]
mov byte [ebp + esi - 0x140], al
inc esi
mov byte [ebp + edi - 0x140], bl
cmp esi, 0x100
jb 0xc465ab
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x140]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x140]
mov byte [ebp + edi - 0x140], al
mov byte [ebp + ebx - 0x140], cl
movzx eax, byte [ebp + edi - 0x140]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x140]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x34], al
inc esi
cmp esi, 0x18
jb 0xc465ee
mov ecx, dword fs:[0x30]
lea edx, [ebp - 0x34]
mov esi, dword [ebp + 8]
mov byte [ebp - 0x1c], 0
mov eax, dword [ecx + 0xa4]
mov dword [esi], eax
mov eax, dword [ecx + 0xa8]
mov dword [esi + 4], eax
movzx ecx, word [ecx + 0xac]
mov dword [esi + 8], ecx
lea ecx, [esi + 0xc]
push ecx
xor ecx, ecx
push 0xffffffffffffffff
inc ecx
call fcn.00c4ba1b
call eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xc47a1c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3bc
push ebx
push esi
push edi
mov esi, 0xc6f4ec
mov dword [ebp - 0x34], ecx
lea edi, [ebp - 0x40]
mov dword [ebp - 0x2c], 0xd791ccbd
mov dword [ebp - 0x28], 0x41ee35cf
mov dword [ebp - 0x24], 0xf4806bf4
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], 0x1505d8c0
mov dword [ebp - 0x1c], 0x88bb3050
mov dword [ebp - 0x18], 0x4c460dc7
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0x49995fc8
mov dword [ebp - 0x10], 0x5269ebe0
mov dword [ebp - 0xc], 0xe8ee5202
movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 8], 0xca97d68d
mov dword [ebp - 4], 0xa94b1d89
xor eax, eax
mov byte [ebp + eax - 0x170], al
inc eax
cmp eax, 0x100
jb 0xc47a87
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x170]
push 0xb
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x40]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x170]
mov byte [ebp + esi - 0x170], al
inc esi
mov byte [ebp + edi - 0x170], bl
cmp esi, 0x100
jb 0xc47a98
and dword [ebp - 0x30], 0
xor ebx, ebx
mov esi, dword [0xc7710c]
xor edi, edi
lea eax, [ebx + 1]
and esi, 0xee34bedc
movzx ebx, al
mov eax, dword [ebp - 0x30]
mov dword [0xc771b4], esi
add esi, 0xdab7bcf2
mov cl, byte [ebp + ebx - 0x170]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x30], eax
mov al, byte [ebp + eax - 0x170]
mov byte [ebp + ebx - 0x170], al
mov eax, dword [ebp - 0x30]
mov byte [ebp + eax - 0x170], cl
movzx eax, byte [ebp + ebx - 0x170]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x170]
xor al, byte [ebp + edi - 0x2c]
mov byte [ebp + edi - 0x70], al
inc edi
cmp edi, 0x2c
jb 0xc47ae3
push 1
xor edx, edx
mov dword [0xc7710c], esi
lea eax, [ebp - 0x3b8]
mov byte [ebp - 0x44], dl
push eax
push edx
push edx
push 2
lea edx, [ebp - 0x70]
mov dword [ebp - 0x3b8], 0x348
pop ecx
call fcn.00c4ba1b
call eax
mov ecx, dword [ebp - 0x34]
lea edx, [ebp - 0x374]
call fcn.00c4d34c
pop edi
pop esi
pop ebx
leave
ret
Function at 0xc47b8a
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push ebx
push esi
push edi
push 5
pop ecx
mov esi, 0xc70550
mov dword [ebp - 0x2c], 0x5cfa8518
lea edi, [ebp - 0x58]
mov dword [ebp - 0x28], 0x42d5e15d
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x24], 0x6b82e1c0
mov dword [ebp - 0x20], 0xf37c1bfc
mov edi, eax
mov dword [ebp - 0x1c], 0xc1cb435d
mov ecx, eax
mov dword [ebp - 0x18], 0x5201692e
mov dword [ebp - 0x14], 0xaf41079a
mov dword [ebp - 0x10], 0x4e6e06b9
mov dword [ebp - 0xc], 0x4f496c5c
mov dword [ebp - 8], 0x2a449b65
mov dword [ebp - 4], 0x92ad7031
mov byte [ebp + ecx - 0x188], cl
inc ecx
cmp ecx, 0x100
jb 0xc47bf6
mov esi, eax
xor edx, edx
mov bl, byte [ebp + esi - 0x188]
push 0x13
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x58]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x188]
mov byte [ebp + esi - 0x188], al
inc esi
mov byte [ebp + edi - 0x188], bl
cmp esi, 0x100
jb 0xc47c08
xor ebx, ebx
mov edi, ebx
mov esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x188]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x188]
mov byte [ebp + edi - 0x188], al
mov byte [ebp + ebx - 0x188], cl
movzx eax, byte [ebp + edi - 0x188]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x188]
xor al, byte [ebp + esi - 0x2c]
mov byte [ebp + esi - 0x88], al
inc esi
cmp esi, 0x2c
jb 0xc47c4b
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x40
xor ecx, ecx
lea edx, [ebp - 0x88]
xor ebx, ebx
inc ecx
push eax
mov byte [ebp - 0x5c], bl
call fcn.00c4ba1b
call eax
test eax, eax
jne 0xc47d5d
mov edx, dword [0xc7713c]
mov ecx, 0xc70b28
push edx
call fcn.00c4574b
mov esi, 0xc705d8
lea edi, [ebp - 0x54]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x54], 0x52
jne 0xc47d07
push 0x52
pop eax
test al, al
je 0xc47d07
cmp byte [ebp + ebx - 0x54], 0
je 0xc47d07
call fcn.00c4641e
mov al, byte [ebx + 0xc70b29]
inc ebx
cmp al, byte [ebp + ebx - 0x54]
je 0xc47cea
movzx eax, byte [ebp + ebx - 0x54]
movzx ecx, byte [ebx + 0xc70b28]
sub ecx, eax
cmp ecx, 0xdfd
jne 0xc47d3b
mov eax, dword [0xc7713c]
mov ecx, 0xc709f0
and eax, 0x1d1174a8
mov edx, ecx
push eax
mov dword [0xc7713c], eax
call fcn.00c45a44
jmp 0xc47d58
mov edx, dword [0xc7713c]
mov ecx, 0xc70a50
and edx, 0x503831fb
push edx
mov dword [0xc7713c], edx
call fcn.00c4574b
pop ecx
xor eax, eax
jmp 0xc47d67
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shrd eax, ecx, 0x14
pop edi
pop esi
pop ebx
leave
ret