joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026780
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x100267a0
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
pop ebp
ret 4

Function at 0x100286c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x100286f1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100286e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x10029c80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x10029cde
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x10029ca0
mov eax, dword [edi]
jmp 0x10029dc9
cmp eax, 0x4e0
jb 0x10029dc9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10029d00
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10029d50
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100319d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1004002c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov dword [ebp - 0x220], eax
push esi
push edi
test eax, eax
je 0x10031b96
xor eax, eax
mov dword [ebp - 0x218], 0
xor edx, edx
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x21c], eax
pushal
mov eax, dword fs:[0x30]
mov dword [ebp - 0x218], eax
popal
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax + 0xc]
xor eax, eax
mov dword [ebp - 0x224], ecx
sub eax, 0
je 0x10031a8c
sub eax, 1
je 0x10031a70
sub eax, 1
jne 0x10031aa5
lea ebx, [ecx + 0x1c]
mov ecx, 0x10
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ecx
jmp 0x10031ab1
lea ebx, [ecx + 0x14]
mov ecx, 8
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ecx
jmp 0x10031ab1
lea ebx, [ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ecx
jmp 0x10031ab1
mov ebx, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x20c]
mov edi, dword [ebx]
mov ebx, dword [ebp - 0x210]
cmp edi, ebx
je 0x10031b5e
mov esi, edi
mov dword [ebp - 0x208], edi
sub esi, ecx
xor eax, eax
movzx ecx, word [esi + 0x24]
test ecx, 0xfffffffe
jbe 0x10031aff
nop dword [eax]
cmp eax, 0x200
jge 0x10031b04
mov ecx, dword [esi + 0x28]
mov cl, byte [ecx + eax*2]
mov byte [ebp + eax - 0x204], cl
inc eax
movzx ecx, word [esi + 0x24]
shr ecx, 1
cmp eax, ecx
jl 0x10031ae0
cmp eax, 0x200
jae 0x10031ba7
push dword [ebp - 0x220]
mov byte [ebp + eax - 0x204], 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
je 0x10031b4c
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x214]
test eax, eax
cmovne esi, eax
mov dword [ebp - 0x214], esi
mov eax, dword [edi]
mov edi, eax
mov ecx, dword [ebp - 0x20c]
cmp eax, ebx
jne 0x10031ac1
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp eax, 3
jge 0x10031b7b
mov ecx, dword [ebp - 0x224]
jmp 0x10031a45
mov edx, dword [ebp - 0x214]
test edx, edx
je 0x10031b96
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [edx + 0x3c]
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033e43
mov esp, ebp
pop ebp
ret
call fcn.1003461b
int3
Function at 0x10031bb0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1004002c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x10031d45
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10031d45
movzx eax, word [eax + ecx + 0x14]
test ax, ax
je 0x10031d45
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], 0
push ebx
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0xc], ecx
cmp ecx, esi
je 0x10031c64
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10031c64
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x10031c5d
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x10031c40
cmp esi, 0x820621f3
je 0x10031c68
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x10031c27
mov eax, dword [eax]
jmp 0x10031c02
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
mov esi, dword [ebp - 0x18]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + edx]
movzx ebx, cx
add eax, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], ebx
push ecx
push 0x40
push ebx
push esi
call eax
push ebx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword fs:[0x30]
add esp, 0xc
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x10], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x14], ecx
cmp ecx, edx
je 0x10031d14
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x10031d14
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x10031d0d
nop dword [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x10031cf0
cmp esi, 0x820621f3
je 0x10031d18
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x10031cd6
mov eax, dword [eax]
jmp 0x10031cb1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
add eax, edx
push dword [ebp - 0xc]
push dword [ebp - 0x18]
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10033e43
mov esp, ebp
pop ebp
ret
Function at 0x10031fb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1004002c]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x14], eax
lea edx, [ecx + 1]
mov dword [esp + 0x18], ecx
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10031fe0
sub ecx, edx
lea eax, [ecx*2 + 0x400]
push eax
call fcn.100344cd
add esp, 4
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x20]
push 0xffffffffffffffff
push esi
call fcn.10001150
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov eax, esi
add esp, 0x1c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10032025
mov edi, dword [ebx]
sub eax, edx
cmp byte [ebp + 0x14], cl
jne 0x1003206f
test edi, edi
je 0x100320b7
mov edx, dword [esp + 0x14]
lea ecx, [edx + 1]
mov dword [esp + 0x10], ecx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10032044
sub edx, dword [esp + 0x10]
je 0x100320b7
test eax, eax
jne 0x10032069
mov eax, esi
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10032060
sub eax, edx
push eax
push esi
push 1
jmp 0x100320a3
test edi, edi
je 0x100320b7
mov edx, dword [esp + 0x14]
lea ecx, [edx + 1]
mov dword [esp + 0x10], ecx
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10032080
sub edx, dword [esp + 0x10]
je 0x100320b7
test eax, eax
jne 0x1003209f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10032096
sub eax, edx
push eax
push esi
push 7
push 0
push dword [esp + 0x24]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
jmp 0x100320b9
xor al, al
mov ecx, 8
push esi
mov byte [ecx + ebx], al
call fcn.10033e51
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10033e43
mov esp, ebp
pop ebp
ret

Function at 0x100321ea
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100321c6
pop esi
leave
ret 8
Function at 0x100352e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push esi
imul esi, dword [esp + 0xc], 0x2c
push edi
add esi, dword [0x10040fa0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10035322
pop edi
pop esi
mov eax, 0xa
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x10035348
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10035369
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10035369
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10035363
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10035369
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, byte [esi + 0x14]
and bl, 1
mov al, bl
and cl, 0xfd
add al, al
shl bl, 2
or cl, al
xor eax, eax
and cl, 0xfb
or cl, bl
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
pop ebp
ret
Function at 0x10035400
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x20
mov eax, dword [0x1004002c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push ebx
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10035516
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x1c
push eax
push ebp
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1003550f
mov ebx, 1
push edi
nop dword [eax + eax]
cmp dword [esp + 0x10], 0x10
jb 0x100354d0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x1c], eax
jne 0x100354d0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x18], eax
je 0x100354d0
mov edx, dword [esi]
test edx, edx
jne 0x1003549b
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x10040f04]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100354f6
lea edi, [esi + 8]
jmp 0x100354c5
mov eax, dword [esi + 4]
lea edi, [esi + 8]
cmp dword [edi], eax
jb 0x100354c5
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x10040f04]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100354f6
mov dword [esi], edx
mov ecx, dword [edi]
mov eax, dword [esp + 0x18]
mov dword [edx + ecx*4], eax
inc dword [edi]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push ebp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10035450
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1003550e
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x1003550e
push eax
push ebx
push dword [0x10040f04]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10033e43
add esp, 0x20
ret

Function at 0x100355f0
Capabilities:
Suspend thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10035400
add esp, 4
test eax, eax
jne 0x1003561d
mov eax, 9
pop esi
ret
cmp dword [esi], 0
je 0x1003566e
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10035669
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10035661
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebp
push dword [esp + 0x1c]
push ebx
call fcn.10035950
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10035630
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10035a50
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi], 0
je 0x10035aa8
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10035a97
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop word [eax + eax]
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10035a8f
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10035a70
pop ebp
pop ebx
push dword [edi]
push 0
push dword [0x10040f04]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
ret

Function at 0x10035b40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x10040f94]
test eax, eax
je 0x10035b5c
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x10035baf
mov eax, dword [eax]
test eax, eax
jne 0x10035b50
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x10035bad
push esi
push edi
xor edi, edi
mov dword [edx + 8], 0
lea ecx, [edx + 0x20]
lea esi, [edi + 0x20]
mov dword [ecx], edi
mov eax, ecx
mov dword [edx + 4], ecx
add esi, 0x20
add ecx, 0x20
mov edi, eax
cmp esi, 0xfe0
jbe 0x10035b87
mov eax, dword [0x10040f94]
pop edi
mov dword [edx], eax
pop esi
mov dword [0x10040f94], edx
mov eax, edx
ret

Function at 0x10035ee0
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 4]
push esi
mov cl, byte [edx]
test cl, cl
je 0x10035ef5
cmp cl, 0x90
je 0x10035ef5
cmp cl, 0xcc
jne 0x10035f13
mov esi, dword [esp + 0xc]
mov eax, 1
cmp esi, eax
jbe 0x10035f0c
cmp byte [eax + edx], cl
jne 0x10035f13
inc eax
cmp eax, esi
jb 0x10035f02
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
jmp loc.0040a000

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x401010
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [edx]
push ebx
push esi
mov esi, ecx
mov ebx, 4
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
movzx eax, byte [edx + 6]
mov byte [esi + 6], al
movzx eax, byte [edx + 7]
mov byte [esi + 7], al
movzx eax, byte [edx + 8]
mov byte [esi + 8], al
movzx eax, byte [edx + 9]
mov byte [esi + 9], al
movzx eax, byte [edx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [esi + 0xc], al
movzx eax, byte [edx + 0xd]
mov byte [esi + 0xd], al
lea eax, [esi + 0xe]
mov cl, byte [edx + 0xe]
mov byte [eax], cl
mov cl, byte [edx + 0xf]
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ch, byte [eax - 2]
mov cl, byte [eax - 1]
mov dl, byte [eax]
mov dh, byte [eax + 1]
mov byte [ebp - 4], ch
mov byte [ebp - 3], cl
mov byte [ebp - 1], dl
mov byte [ebp - 2], dh
test bl, 3
jne 0x4010ed
movzx edx, cl
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 3], cl
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 1], cl
movzx ecx, byte [ebp - 4]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 2], cl
mov ecx, ebx
shr ecx, 2
mov ch, byte [ecx + 0x41eb90]
xor ch, byte [edx + str.cw]
mov dl, byte [ebp - 1]
mov dh, byte [ebp - 2]
mov cl, byte [eax - 0xe]
inc ebx
xor cl, ch
mov byte [eax + 2], cl
mov cl, byte [eax - 0xd]
xor cl, byte [ebp - 3]
mov byte [eax + 3], cl
mov cl, byte [eax - 0xc]
xor cl, dl
mov byte [eax + 4], cl
mov cl, byte [eax - 0xb]
xor cl, dh
mov byte [eax + 5], cl
add eax, 4
cmp ebx, 0x2c
jb 0x401090
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov ebx, 4
push esi
push edi
mov dword [ebp - 8], eax
mov esi, ecx
lea edi, [eax + 0xa0]
nop dword [eax + eax]
mov edx, 4
mov al, byte [edi]
inc edi
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x4015d5
sub ebx, 1
jne 0x4015d0
mov eax, dword [ebp - 8]
add eax, 0x90
mov byte [ebp - 1], 9
mov dword [ebp - 0xc], eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x41ea90]
mov byte [ecx - 4], al
sub edx, 1
jne 0x401660
inc edi
sub ebx, 1
jne 0x401650
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x401690
sub ebx, 1
jne 0x401684
mov ecx, esi
call fcn.00401160
mov dl, byte [ebp - 1]
sub dword [ebp - 0xc], 0x10
dec dl
mov byte [ebp - 1], dl
test dl, dl
jne 0x4015f4
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
nop dword [eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x41ea90]
mov byte [ecx - 4], al
sub edx, 1
jne 0x401720
inc edi
sub ebx, 1
jne 0x401712
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
mov ecx, 4
nop dword [eax]
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x401750
sub dword [ebp - 0xc], 1
jne 0x401744
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret