joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180b328a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push eax
push 0x180b334f
mov edi, ecx
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.180040b1
push eax
lea ecx, [esp + 0x18]
call fcn.1800717c
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
push dword [ebp + 8]
push str._s_s.dmp
push eax
call fcn.1800f2dc
lea ecx, [esp + 0x24]
call fcn.1800f0bb
mov bl, byte [esp + 0x23]
lea eax, [esp + 0x24]
mov dl, byte [edi]
add esp, 0xc
mov cl, bl
push eax
call fcn.180bf3f8
cmp byte [edi + 1], 0
pop ecx
pop ecx
je 0x180b333a
push dword [ebp + 0xc]
lea eax, [esp + 0x18]
push dword [ebp + 8]
push str._s_s_full.dmp
push eax
call fcn.1800f2dc
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.1800f0bb
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.18005162
test al, al
je 0x180b333e
mov dl, byte [edi]
lea eax, [esp + 0x14]
push ecx
push eax
mov cl, bl
call fcn.180bf3f8
pop ecx
pop ecx
jmp 0x180b333e
mov esi, dword [esp + 0x14]
lea ecx, [esi - 0x10]
call fcn.18004715
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x180b704b
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push 4
mov edx, str.AutoUpdateJitterMs
mov ecx, str.HKLMSoftwareGoogleUpdateDev_
call fcn.180128c2
add esp, 0xc
test eax, eax
js 0x180b7083
mov eax, dword [ebp - 4]
cmp eax, 0xea60
jb 0x180b70a8
mov eax, 0xea5f
leave
ret
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
movzx eax, al
mov ecx, 0xea60
neg eax
sbb eax, eax
xor edx, edx
and eax, dword [ebp - 8]
div ecx
mov eax, edx
leave
ret

Function at 0x180b72c4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x181cf008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.18148b00
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor ebx, ebx
inc ebx
test eax, eax
je 0x180b732b
push ebx
mov edx, str..google.com
lea ecx, [ebp - 0x204]
call fcn.1800cb89
pop ecx
test al, al
jne 0x180b7370
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x208]
push esi
push eax
push 0x64
push 0
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov esi, dword [ebp - 0x208]
test eax, eax
jne 0x180b7366
cmp dword [esi + 8], eax
je 0x180b7366
push str.google
push dword [esi + 8]
call fcn.18152d83
pop ecx
pop ecx
test eax, eax
je 0x180b7368
xor bl, bl
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.18145fe4
leave
ret
Function at 0x180bbefb
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x180bbf0b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x180bbf11
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x180bbf39
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x1819f8c0]
test ax, ax
jne 0x180bbf20
mov esi, ecx
jmp 0x180bbf3c
movzx esi, si
pop edi
cmp cx, si
je 0x180bbf59
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x1819f8c0]
test cx, cx
jne 0x180bbf3d
mov eax, 0x18181a7c
jmp 0x180bbf61
imul eax, edx, 0x1a
add eax, 0x1819f8c2
push eax
mov ecx, ebx
call fcn.18006e44
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x180bf2a5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
mov ebx, ecx
movzx ecx, byte [0x181d7aa2]
neg ecx
mov dword [ebp - 0xc], ebx
push esi
sbb ecx, ecx
push edi
and ecx, 0x181d6c50
je 0x180bf2f4
or dword [ebp - 0x1c], 0xffffffff
push 7
pop eax
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
call fcn.18005e59
push dword [ebx]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push str._StartProcessWithNoExceptionHandler___s_
push eax
call fcn.18004253
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.1800f1bf
push 0x181adc00
lea ecx, [ebp - 8]
call fcn.18006e44
push str.GOOGLE_UPDATE_NO_CRASH_HANDLER
lea ecx, [ebp - 4]
call fcn.18006e44
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
call fcn.180a6211
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004715
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18004715
xor esi, esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.180a6478
mov ebx, dword [ebp - 0x20]
test al, al
je 0x180bf3b8
cmp ebx, dword [ebp - 0x1c]
je 0x180bf3b8
push 0x40
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x44
push esi
push eax
call fcn.18148b00
mov ecx, dword [ebp - 0xc]
lea edi, [ebp - 0x34]
xor eax, eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1800e29a
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push esi
push ebx
push 0x400
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180bf3b8
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
xor esi, esi
jmp 0x180bf3bf
call fcn.18013e1e
mov esi, eax
test ebx, ebx
je 0x180bf3d4
mov ecx, dword [ebp - 0x18]
sub ecx, ebx
and ecx, 0xfffffffe
push ecx
push ebx
call fcn.1800a736
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
lea eax, [ebp - 0x14]
push eax
mov ecx, eax
call fcn.1800f25d
push 0x18
push dword [ebp - 0x14]
call fcn.1800a736
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x180c4e96
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x20
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180c4ecf
cmp dword [ebp - 8], 3
jne 0x180c4ecf
test eax, eax
jne 0x180c4ecf
cmp dword [ebp - 4], esi
jne 0x180c4ecf
mov al, 1
jmp 0x180c4edf
push esi
push 0
push dword [ebp + 8]
call fcn.18148b00
add esp, 0xc
xor al, al
pop esi
leave
ret

Function at 0x180c8a1d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jg 0x180c8a93
movzx ecx, byte [0x181d7aa2]
neg ecx
sbb ecx, ecx
and ecx, 0x181d6c50
je 0x180c8a6e
push 7
pop edx
xor eax, eax
mov dword [ebp - 0x10], ecx
inc eax
mov dword [ebp - 0xc], edx
push eax
push edx
mov dword [ebp - 8], eax
call fcn.18005e59
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push str._Google_Update_core_is_shutting_down..._
push eax
call fcn.18004253
pop ecx
pop ecx
push 0
push 0
push 0x12
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x180c8a93
push 0x80004004
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
pop esi
leave
ret
push esi
mov esi, ecx
call fcn.180c8703
mov ecx, esi
pop esi
test al, al
je 0x180c8a1d
jmp fcn.180c8bef
Function at 0x1810050b
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
mov dword [ebp - 4], esi
mov edi, ecx
lea eax, [esi + 4]
push eax
call fcn.180dd53e
imul esi, dword [esi], 0x1000193
mov ebx, eax
xor ebx, esi
mov esi, dword [edi + 0xc]
and ebx, dword [edi + 0x18]
mov esi, dword [esi + ebx*8]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
cmp dword [eax + ebx*8], ecx
jne 0x18100544
mov eax, ecx
jmp 0x1810054a
mov eax, dword [eax + ebx*8 + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x1810057c
mov edx, dword [ebp - 4]
lea ecx, [esi + 8]
call fcn.18104a08
test al, al
jne 0x18100561
mov esi, dword [esi]
jmp 0x18100535
mov ecx, dword [ebp - 4]
lea edx, [esi + 8]
call fcn.18104a08
test al, al
jne 0x18100577
mov esi, dword [edi + 4]
mov ecx, esi
jmp 0x1810057e
mov ecx, dword [edi + 4]
jmp 0x1810057e
mov esi, ecx
cmp esi, ecx
jne 0x18100586
xor eax, eax
jmp 0x18100589
mov eax, dword [esi + 0x14]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18104930
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
lea eax, [ebx + 4]
push eax
call fcn.180dd53e
imul edx, dword [ebx], 0x1000193
mov esi, dword [edi + 0xc]
xor eax, edx
and eax, dword [edi + 0x18]
mov dword [ebp + 0xc], eax
push eax
mov esi, dword [esi + eax*8]
jmp 0x1810496f
lea ecx, [esi + 8]
mov edx, ebx
call fcn.18104a08
test al, al
jne 0x1810499f
mov esi, dword [esi]
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.180decab
cmp esi, dword [eax]
jne 0x1810495c
mov esi, dword [edi + 4]
mov eax, esi
cmp esi, eax
jne 0x181049b2
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push ecx
push dword [ebp + 8]
mov ecx, edi
call fcn.181064f6
mov eax, dword [ebp + 8]
jmp 0x181049bb
lea edx, [esi + 8]
mov ecx, ebx
call fcn.18104a08
test al, al
je 0x1810497e
mov eax, dword [edi + 4]
jmp 0x18104983
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x18132e15
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub esp, 0xc
lea edx, [ebx + 0x1c]
lea ecx, [ebx + 0x40]
mov esi, eax
lea eax, [ebx + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x3c]
push ecx
push eax
push edi
push esi
push ecx
lea ecx, [ebp - 0x88]
call fcn.18132cd6
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push 0x2c
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push eax
push 0x2c
lea eax, [ebp - 0x88]
mov dword [ebp - 0x2c], esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x18132f08
cmp dword [ebp - 0x30], 2
jne 0x18132f08
cmp dword [ebp - 0x2c], esi
je 0x18132f08
cmp dword [ebp - 0x10], esi
je 0x18132f08
cmp dword [ebp - 0xc], esi
je 0x18132f08
cmp dword [ebp - 8], esi
je 0x18132f08
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
lea edi, [ebp - 0x48]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x2c
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x3c], esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x5c], 3
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18132f08
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x34], eax
mov al, 1
jmp 0x18132f0a
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1813d67d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 4
pop edx
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x181a6de0]
sub edx, 1
jne 0x1813d680
mov eax, ecx
ret
Function at 0x18142e95
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov byte [ebp - 4], dl
push 1
lea edx, [ebp - 4]
mov ecx, dword [esi]
not ecx
call fcn.1813d695
mov ecx, dword [esi + 8]
lea edx, [ebp - 4]
not eax
not ecx
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
call fcn.1813d695
pop ecx
not eax
pop ecx
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x18142ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov dword [ebp - 4], ecx
xor edx, edx
mov dword [ebp - 0xc], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edx
jb 0x18142f74
ja 0x18142f04
cmp dword [ebp + 0xc], edx
jbe 0x18142f74
test eax, eax
je 0x18142f52
mov eax, dword [ebp + 8]
mov bl, byte [edi + eax]
mov ax, word [ecx + 8]
mov dl, bl
or ax, 2
movzx esi, ax
call fcn.18142e95
mov eax, esi
mov ecx, esi
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 0xc]
shr ecx, 8
xor cl, bl
mov byte [edi + eax], cl
add edi, 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x18142f08
ja 0x18142f74
cmp edi, dword [ebp + 0xc]
jb 0x18142f08
jmp 0x18142f74
mov ebx, dword [ebp + 8]
mov esi, edx
mov dl, byte [esi + ebx]
call fcn.18142e95
mov ecx, dword [ebp - 4]
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x18142f57
ja 0x18142f74
cmp esi, dword [ebp + 0xc]
jb 0x18142f57
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18142fdc
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xf0000040
push 0x18
push 0
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1814301f
push esi
push 0xb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1814301f
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x1814301f
mov al, 1
jmp 0x18143021
xor al, al
pop esi
leave
ret
Function at 0x1814479e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x18144807
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1814437c
push eax
push esi
push dword [ebp + 8]
call fcn.18144331
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1814436c
mov edi, 0x9d88d506
jl 0x181447f1
invalid
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1814436c
in al, dx
adc byte [ebx], dh
push ss
lea eax, [ebp - 0x84]
push eax
call fcn.1814437c
push eax
push esi
push dword [ebp + 8]
call fcn.18144331
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x18144b65
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.181442dd
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x181448dc
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.181442dd
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x181448a9
call fcn.1814436c
out dx, al
invalid
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1815f124
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1817b500
push 0x1817b4f8
push str.FlsAlloc
push 0x1e
call fcn.1815ef91
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1815f158
push dword [ebp + 8]
mov ecx, esi
call dword [0x18175914]
call esi
jmp 0x1815f15e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1815f1a2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1817b510
push 0x1817b508
push str.FlsGetValue
push 0x20
call fcn.1815ef91
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1815f1d9
push dword [ebp + 8]
mov ecx, esi
call dword [0x18175914]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1816b266
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x181cf008]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
push edi
test esi, esi
jne 0x1816b296
mov esi, 0x181d5c58
xor edx, edx
xor edi, edi
inc edx
test ecx, ecx
jne 0x1816b2d6
mov ecx, 0x181a9f34
mov dword [ebp - 0x28], edi
mov eax, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0x10], eax
xor eax, eax
cmp word [esi + 6], ax
jne 0x1816b32f
mov bl, byte [ecx]
inc ecx
mov dword [ebp - 0x18], ecx
test bl, bl
js 0x1816b2f2
test edi, edi
je 0x1816b2ca
movzx eax, bl
mov dword [edi], eax
xor eax, eax
test bl, bl
setne al
jmp 0x1816b415
mov edi, ecx
mov dword [ebp - 0x18], ecx
neg edi
sbb edi, edi
and edi, ebx
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x28], edi
jne 0x1816b2af
push 0xfffffffffffffffe
pop eax
jmp 0x1816b415
mov al, bl
and al, 0xe0
cmp al, 0xc0
jne 0x1816b2fe
mov bh, 2
jmp 0x1816b318
mov al, bl
and al, 0xf0
cmp al, 0xe0
jne 0x1816b30a
mov bh, 3
jmp 0x1816b318
mov al, bl
and al, 0xf8
cmp al, 0xf0
jne 0x1816b40a
mov bh, 4
push 7
movzx eax, bh
pop ecx
sub ecx, eax
mov byte [ebp - 0x11], bh
shl edx, cl
mov cl, bh
dec edx
movzx eax, bl
and edx, eax
jmp 0x1816b354
mov bh, byte [esi + 4]
mov edx, dword [esi]
mov al, bh
mov cl, byte [esi + 6]
sub al, 2
cmp al, 2
ja 0x1816b40a
cmp cl, 1
jb 0x1816b40a
cmp cl, bh
jae 0x1816b40a
movzx eax, cl
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x24], eax
jae 0x1816b368
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x10], eax
mov edi, dword [ebp - 0x18]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 0x20], edi
cmp edi, eax
mov edi, dword [ebp - 0x28]
jae 0x1816b39f
mov eax, dword [ebp - 0x18]
mov bl, byte [eax]
inc eax
inc dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov al, bl
and al, 0xc0
cmp al, 0x80
jne 0x1816b40a
movzx eax, bl
and eax, 0x3f
shl edx, 6
or edx, eax
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x20], eax
jb 0x1816b378
cmp eax, dword [ebp - 0x24]
jae 0x1816b3be
movzx eax, bh
mov word [esi + 4], ax
mov eax, dword [ebp + 0x10]
sub cl, al
movzx eax, cl
mov dword [esi], edx
mov word [esi + 6], ax
jmp 0x1816b2ea
cmp edx, 0xd800
jb 0x1816b3ce
cmp edx, 0xdfff
jbe 0x1816b40a
cmp edx, 0x10ffff
ja 0x1816b40a
movzx eax, bh
mov dword [ebp - 0x10], 0x80
mov dword [ebp - 0xc], 0x800
mov dword [ebp - 8], 0x10000
cmp edx, dword [ebp + eax*4 - 0x18]
jb 0x1816b40a
test edi, edi
je 0x1816b3fa
mov dword [edi], edx
neg edx
push esi
sbb edx, edx
and edx, dword [ebp - 0x24]
push edx
call fcn.1816b230
jmp 0x1816b413
push dword [ebp - 0x1c]
push esi
call fcn.1816b244
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18145fe4
leave
ret
Function at 0x7f6160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7f62b0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7f6186
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f6172
add dl, dl
jne 0x7f6191
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f61e4
xor eax, eax
add dl, dl
jne 0x7f619e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f6285
add dl, dl
jne 0x7f61ad
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f61b8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f61c3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f61ce
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7f61da
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7f617d
mov eax, 1
add dl, dl
jne 0x7f61f2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f61fd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f61e9
sub eax, ebx
mov ebx, 1
jne 0x7f6230
mov ecx, 1
add dl, dl
jne 0x7f6216
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7f6221
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f620d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f617d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7f6247
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7f6252
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f623e
cmp eax, 0x7d00
jae 0x7f6275
cmp eax, 0x500
jb 0x7f6270
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f617d
cmp eax, 0x7f
ja 0x7f6278
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f617d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7f62a6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7f617d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10