joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100126a6
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 4]
push eax
push 0x1002210c
push 1
push esi
push 0x100221dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1001272e
push edi
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
lea edi, [ebp - 8]
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push ecx
call dword [edx + 0xc]
pop edi
test eax, eax
js 0x1001272e
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x1001272e
push 8
call fcn.1000ac58
pop ecx
cmp eax, esi
jne 0x1001274c
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x1001273b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x10012748
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x10012757
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
pop esi
leave
ret

Function at 0x10012e37
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
mov eax, dword [0x10039758]
xor esi, esi
push 2
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
call dword [eax + 4]
test eax, eax
je 0x10012e78
or eax, 0xffffffff
jmp 0x10012f28
mov dword [ebp - 4], esi
cmp dword [ebp - 0xc], esi
jbe 0x10012f1b
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
push dword [eax + ecx*4]
push esi
call edi
mov eax, dword [ebp - 0x10]
inc eax
push eax
call fcn.1000ac58
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x10012f0a
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push ebx
mov dword [ebp - 0x14], 0x200
push dword [eax + ecx*4]
push esi
call edi
test eax, eax
je 0x10012f0a
push dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ebx
push dword [eax + ecx*4]
call fcn.10008a0e
mov eax, dword [0x10039740]
add esp, 0xc
push 0xa
call dword [eax + 0xb4]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x10012e8c
pop edi
pop ebx
push dword [ebp - 8]
mov eax, dword [0x10039758]
call dword [eax + 0xc]
xor eax, eax
pop esi
leave
ret
Function at 0x10012fe1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push str.advapi32.dll
call fcn.1000acd6
pop ecx
push 0xf
pop ecx
cmp eax, ecx
ja 0x10012ffb
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x10013009
lea edx, [eax + 0x41]
inc eax
cmp eax, ecx
jb 0x10013001
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
jle 0x100130a8
push ebx
push esi
push edi
movzx ecx, cl
movzx edi, dl
inc ecx
and ecx, 0x800000ff
jns 0x10013040
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 1], cl
movzx ecx, cl
mov dl, byte [ecx + eax]
movzx ebx, dl
add ebx, edi
and ebx, 0x800000ff
jns 0x1001305e
dec ebx
or ebx, 0xffffff00
inc ebx
mov esi, dword [ebp + 8]
add esi, dword [ebp - 8]
movzx edi, bl
mov byte [ebp + 0x13], bl
mov bl, byte [edi + eax]
mov byte [ecx + eax], bl
mov byte [edi + eax], dl
movzx ebx, byte [ecx + eax]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x1001308c
dec edx
or edx, 0xffffff00
inc edx
movzx edx, dl
mov dl, byte [edx + eax]
xor byte [esi], dl
inc dword [ebp - 8]
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jl 0x1001302f
mov dl, byte [ebp + 0x13]
mov cl, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
leave
ret

Function at 0x100135ed
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
push esi
push edi
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0xc], eax
mov esi, ecx
cmp eax, edi
je 0x10013690
dec dword [esp + 0xc]
cmp dword [esp + 0x74], edi
jne 0x100136a1
mov ecx, dword [esp + 0x6c]
mov al, byte [esi]
mov byte [esp + ecx + 0x2c], al
inc dword [esp + 0x6c]
add dword [esp + 0x24], 8
jne 0x1001366d
inc dword [esp + 0x28]
jne 0x1001366d
mov dword [esp + 0x74], 1
cmp dword [esp + 0x6c], 0x40
jne 0x1001367d
lea eax, [esp + 0x10]
call fcn.100136d8
inc esi
cmp dword [esp + 0xc], edi
jne 0x10013640
cmp dword [esp + 0x74], edi
jne 0x100136a1
cmp dword [esp + 0x70], edi
jne 0x100136a1
lea eax, [esp + 0x10]
call fcn.10013569
mov dword [esp + 0x70], 1
lea ecx, [esp + 0x11]
lea esi, [esp + 0x10]
sub ecx, ebx
lea eax, [ebx + 2]
sub esi, ebx
mov dl, byte [ecx + eax]
mov byte [eax - 2], dl
mov dl, byte [esi + eax]
mov byte [eax - 1], dl
mov dl, byte [esp + edi*4 + 0x11]
mov byte [eax], dl
mov dl, byte [esp + edi*4 + 0x10]
mov byte [eax + 1], dl
inc edi
add eax, 4
cmp edi, 5
jb 0x100136b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100136d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
xor edx, edx
lea ecx, [eax + 0x1d]
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x150], esi
inc edx
add ecx, 4
cmp edx, 0x10
jl 0x100136e9
push 0x40
lea ecx, [ebp - 0x148]
pop edx
mov esi, dword [ecx + 0x2c]
xor esi, dword [ecx + 0x18]
xor esi, dword [ecx - 8]
xor esi, dword [ecx]
add ecx, 4
dec edx
rol esi, 1
mov dword [ecx + 0x34], esi
jne 0x10013720
mov esi, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 8]
and dword [ebp - 4], 0
mov dword [ebp - 8], esi
mov esi, dword [eax + 0x10]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0xc]
mov edi, ecx
not edi
and edi, dword [ebp - 8]
mov ebx, edx
and ebx, ecx
or edi, ebx
rol esi, 5
add esi, edi
mov edi, dword [ebp - 4]
add esi, dword [ebp + edi*4 - 0x150]
mov edi, dword [ebp - 0x10]
inc dword [ebp - 4]
lea esi, [esi + edi + 0x5a827999]
mov edi, dword [ebp - 8]
ror ecx, 2
cmp dword [ebp - 4], 0x14
mov dword [ebp - 8], edx
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
jl 0x10013751
mov dword [ebp - 4], 0x14
mov ebx, dword [ebp - 8]
xor ebx, edx
xor ebx, ecx
rol esi, 5
add esi, ebx
mov ebx, dword [ebp - 4]
add esi, dword [ebp + ebx*4 - 0x150]
inc dword [ebp - 4]
lea esi, [esi + edi + 0x6ed9eba1]
mov edi, dword [ebp - 8]
ror ecx, 2
cmp dword [ebp - 4], 0x28
mov dword [ebp - 8], edx
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], esi
jl 0x1001379e
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0x28
mov edi, edx
or edi, ecx
and edi, dword [ebp - 8]
mov ebx, edx
and ebx, ecx
or edi, ebx
mov ebx, dword [ebp - 4]
add edi, dword [ebp + ebx*4 - 0x150]
rol esi, 5
add esi, dword [ebp - 0x10]
inc dword [ebp - 4]
lea esi, [edi + esi - 0x70e44324]
mov edi, dword [ebp - 8]
ror ecx, 2
push 0x3c
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edx
pop edi
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], esi
cmp dword [ebp - 4], edi
jl 0x100137df
mov dword [ebp - 4], edi
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
xor edi, edx
xor edi, ecx
add edi, dword [ebp + ebx*4 - 0x150]
mov ebx, dword [ebp - 8]
rol esi, 5
add esi, dword [ebp - 0x10]
inc dword [ebp - 4]
ror ecx, 2
cmp dword [ebp - 4], 0x50
mov dword [ebp - 8], edx
lea esi, [edi + esi - 0x359d3e2a]
mov edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
jl 0x10013825
mov edi, dword [eax]
add edi, esi
mov esi, dword [eax + 4]
add esi, ecx
mov ecx, dword [eax + 8]
add ecx, edx
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp - 8]
mov dword [eax], edi
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x10]
pop edi
add ecx, ebx
and dword [eax + 0x5c], 0
mov dword [eax + 4], esi
pop esi
mov dword [eax + 0x10], ecx
pop ebx
leave
ret
Function at 0x10014e1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 0x14], 0xffffffff
push ebx
push esi
xor esi, esi
push edi
mov ebx, 0x126
push ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.1000ac58
pop ecx
cmp eax, esi
jne 0x10014e51
xor eax, eax
jmp 0x10014e77
mov edx, 0x10038080
xor edi, edi
sub edx, eax
mov ebx, edi
and ebx, 0xf
mov bl, byte [ebx + str._Dej_bu._P3J_b]
lea ecx, [edi + eax]
xor bl, byte [edx + ecx]
inc edi
mov byte [ecx], bl
mov ebx, 0x126
cmp edi, ebx
jb 0x10014e5a
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x10014e86
push 0xfffffffffffffffe
pop eax
jmp 0x10014fc3
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0x8000
push ebx
push eax
mov eax, dword [0x10039750]
push 8
push 1
call dword [eax]
test eax, eax
je 0x10014f22
push 0xf0000000
push 1
push esi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1003974c]
call dword [eax + 0x48]
test eax, eax
jne 0x10014ed7
push 0xf0000008
push 1
push esi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1003974c]
call dword [eax + 0x48]
test eax, eax
je 0x10014f22
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
mov eax, dword [0x10039750]
push 0x10001
push dword [ebp - 4]
call dword [eax + 4]
test eax, eax
je 0x10014f22
lea eax, [ebp - 8]
push eax
mov eax, dword [0x1003974c]
push esi
push esi
push 0x8004
push dword [ebp - 4]
call dword [eax + 0x4c]
test eax, eax
je 0x10014f22
mov eax, dword [0x1003974c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [eax + 0x50]
test eax, eax
jne 0x10014f2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10014f6f
mov eax, dword [ebp + 8]
xor edi, edi
add eax, 0xff
mov ecx, dword [ebp + 8]
mov bl, byte [eax]
lea edx, [edi + ecx]
mov cl, byte [edx]
mov byte [edx], bl
inc edi
mov byte [eax], cl
dec eax
cmp edi, 0x80
jb 0x10014f34
mov eax, dword [0x1003974c]
push esi
push esi
push dword [ebp - 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push dword [ebp - 8]
call dword [eax + 0x54]
test eax, eax
je 0x10014f6f
mov dword [ebp - 0x14], 1
cmp dword [ebp - 8], esi
je 0x10014f7f
push dword [ebp - 8]
mov eax, dword [0x1003974c]
call dword [eax + 0x60]
cmp dword [ebp - 0xc], esi
je 0x10014f8f
push dword [ebp - 0xc]
mov eax, dword [0x1003974c]
call dword [eax + 0x5c]
cmp dword [ebp - 4], esi
je 0x10014fa0
mov eax, dword [0x1003974c]
push esi
push dword [ebp - 4]
call dword [eax + 0x58]
cmp dword [ebp - 0x10], esi
je 0x10014fb0
push dword [ebp - 0x10]
mov eax, dword [0x10039740]
call dword [eax + 0x34]
lea eax, [ebp - 0x1c]
push 0x126
push eax
call fcn.1000ab81
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10018460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
jmp 0x10018488
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x100184af
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor edx, ecx
movzx eax, byte [ebp - 1]
or eax, edx
mov byte [ebp - 1], al
jmp 0x1001847f
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x1001d7e4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x9c0], 0x270
jl 0x1001d896
push ebx
push esi
push edi
xor esi, esi
mov edi, SysReAllocString
mov eax, dword [ecx + esi*4 + 4]
lea edx, [ecx + esi*4]
xor eax, dword [edx]
and eax, edi
xor eax, dword [edx]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x10038008]
xor eax, dword [ecx + esi*4 + 0x634]
inc esi
mov dword [edx], eax
cmp esi, 0xe3
jl 0x1001d804
jmp 0x1001d858
mov eax, dword [ecx + esi*4 + 4]
lea edx, [ecx + esi*4]
xor eax, dword [edx]
and eax, edi
xor eax, dword [edx]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x10038008]
xor eax, dword [ecx + esi*4 - 0x38c]
inc esi
mov dword [edx], eax
cmp esi, 0x26f
jl 0x1001d833
mov eax, dword [ecx + 0x9bc]
xor eax, dword [ecx]
and eax, edi
xor eax, dword [ecx + 0x9bc]
pop edi
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x10038008]
xor edx, dword [ecx + 0x630]
shr eax, 1
xor edx, eax
and dword [ecx + 0x9c0], 0
pop esi
mov dword [ecx + 0x9bc], edx
pop ebx
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop ebp
ret

Function at 0x1001d8ce
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
mov dword [eax], ecx
mov dword [eax + 0x9c0], 1
push edi
mov edx, dword [eax + 0x9c0]
lea ecx, [eax + edx*4]
mov esi, dword [ecx - 4]
mov edi, esi
shr edi, 0x1e
xor edi, esi
imul edi, edi, 0x6c078965
add edi, edx
mov dword [ecx], edi
inc dword [eax + 0x9c0]
cmp dword [eax + 0x9c0], 0x270
jl 0x1001d8e5
pop edi
pop esi
pop ebp
ret
Function at 0x1001f66b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push ebx
lea ebx, [edx + eax - 0x21524111]
push esi
mov eax, ebx
push edi
mov esi, ebx
mov dword [ebp - 4], eax
cmp edx, 0xc
jbe switch.0x1001f75d
lea eax, [edx - 0xd]
push 0xc
xor edx, edx
pop edi
div edi
inc eax
mov dword [ebp - 8], eax
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
movzx edi, byte [ecx + 4]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
add edi, esi
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 0xa]
shl eax, 8
add edi, eax
movzx eax, byte [ecx + 0xb]
movzx esi, byte [ecx + 3]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, ebx
movzx ebx, byte [ecx + 2]
shl esi, 8
add esi, ebx
movzx ebx, byte [ecx + 1]
shl esi, 8
add esi, ebx
movzx ebx, byte [ecx]
shl esi, 8
add esi, ebx
shl eax, 8
add eax, edx
sub esi, eax
add esi, dword [ebp - 4]
mov edx, eax
rol edx, 4
xor edx, esi
add eax, edi
sub edi, edx
mov esi, edx
rol esi, 6
xor esi, edi
add edx, eax
sub eax, esi
mov edi, esi
add esi, edx
rol edi, 8
xor edi, eax
sub edx, edi
mov eax, edi
rol eax, 0x10
xor eax, edx
add edi, esi
sub esi, eax
mov edx, eax
ror edx, 0xd
xor esi, edx
mov edx, dword [ebp + 8]
add eax, edi
mov ebx, esi
sub edi, esi
rol ebx, 4
sub edx, 0xc
xor ebx, edi
add esi, eax
add ecx, 0xc
dec dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edx
jne 0x1001f69b
cmp edx, 0xc
ja 0x1001f7c6
jmp dword [edx*4 + 0x1001f817]
movzx edx, byte [ecx + 0xb]
shl edx, 0x18
add ebx, edx
movzx edx, byte [ecx + 0xa]
shl edx, 0x10
add ebx, edx
movzx edx, byte [ecx + 9]
shl edx, 8
add ebx, edx
movzx edx, byte [ecx + 8]
add ebx, edx
movzx edx, byte [ecx + 7]
shl edx, 0x18
add esi, edx
movzx edx, byte [ecx + 6]
shl edx, 0x10
add esi, edx
movzx edx, byte [ecx + 5]
shl edx, 8
add esi, edx
movzx edx, byte [ecx + 4]
add esi, edx
movzx edx, byte [ecx + 3]
shl edx, 0x18
add eax, edx
movzx edx, byte [ecx + 2]
shl edx, 0x10
add eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
add eax, edx
movzx ecx, byte [ecx]
add eax, ecx
xor ebx, esi
mov ecx, esi
rol ecx, 0xe
sub ebx, ecx
mov edx, ebx
rol edx, 0xb
mov ecx, ebx
xor ecx, eax
sub ecx, edx
xor esi, ecx
mov eax, ecx
ror eax, 7
sub esi, eax
xor ebx, esi
mov eax, esi
rol eax, 0x10
sub ebx, eax
mov eax, ebx
mov edi, eax
mov edx, eax
xor edx, ecx
rol edi, 4
sub edx, edi
mov ecx, edx
rol ecx, 0xe
xor esi, edx
sub esi, ecx
mov ecx, esi
ror ecx, 8
xor eax, esi
sub eax, ecx
pop edi
pop esi
pop ebx
leave
ret
mov eax, ebx
jmp 0x1001f80b
Function at 0x10020530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x10020555
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x1002056d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x1002059c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x100205de
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x100206b2
sub edx, 0x10000
js 0x100206b2
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x100205c4
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x100205c4
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x10020635
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x10020632
add edx, 8
jne 0x10020619
jmp 0x100206a3
add edx, 4
test eax, 0xffff
jne 0x10020642
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x100206a3
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x10020676
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x100205c4
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x100206b2
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x100205c4
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x100206c3
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x430a1f
pop dword [ebp - 0x44]
mov eax, 0x2a4ae81c
sub eax, 0x2a07ddfd
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3cdc3
push 0
mov eax, 0x5cf2d71e
add eax, 0xa350a912
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xbd382f97
sub ecx, 0xbd37def0
xor edx, edx
add edx, eax
mov ebx, 0x44c600
add ebx, dword [ebp - 0x44]
mov edi, 0x23e7733b
sub edi, 0xd85a19ba
sub dword [ebp - 0xc], 0xae5dd88e
mov esi, dword [ebx]
sub esi, edi
xor dword [ebp - 0x1c], 0xfcdb2ad5
mov dword [edx], esi
xor dword [ebp - 0x34], 0x57d25812
add edx, 0xa920f857
add edx, 0x56df07ad
add ebx, 0xf538178f
add ebx, 0xac7e875
loop 0x430a7a
add eax, 0x1356f
mov ebx, eax
add eax, 0xde8bf970
sub eax, 0xde8bf96b
mov ecx, 0xc019b05d
sub ecx, 0xbfd9b05d
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4
Function at 0x40c391
Capabilities:
Create thread

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4a8068]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov ebx, dword [esp + 0x134]
push ebp
push esi
mov esi, dword [sym.imp.kernel32.dll_CreateEventA]
xor ebp, ebp
push edi
xor edi, edi
mov dword [ebx + 0xc], 0xbc2
mov eax, dword [0x4ab368]
inc ebp
push edi
push edi
push ebp
push edi
mov dword [ebx + 0x18], eax
call esi
push edi
push edi
push ebp
push edi
mov dword [ebx + 0x20], eax
call esi
push edi
push edi
push ebp
push edi
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x38], eax
call fcn.0046dfb5
mov dword [ebx + 0x3c], eax
lea edi, [esp + 0x20]
xor eax, eax
stosd dword es:[edi], eax
push ebp
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor edi, edi
lea eax, [esp + 0x20]
push edi
push edi
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.SunJavaUpdateRecheckUpdateEvent
lea eax, [esp + 0x24]
mov dword [esp + 0x14], 0xc
push edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push edi
push eax
call esi
push dword [ebx + 0x20]
mov esi, dword [sym.imp.kernel32.dll_ResetEvent]
mov dword [ebx + 0x40], eax
call esi
push dword [ebx + 0x24]
call esi
push dword [ebx + 0x38]
call esi
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push 0x40c9dd
push edi
push edi
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x40c472
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebx + 0x20]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x20]
call esi
mov esi, dword [sym.imp.user32.dll_LoadStringA]
lea eax, [ebx + 0x54]
mov edi, 0x104
push edi
push eax
push 0x7b
push dword [ebx + 0x18]
call esi
push edi
lea eax, [esp + 0x38]
push eax
push 0x7c
push dword [ebx + 0x18]
call esi
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x40c4c7
lea eax, [esp + 0x34]
push eax
lea eax, [ebx + 0x158]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
mov ecx, dword [esp + 0x138]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004484c4
add esp, 0x12c
ret 4