joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x42
mov dword [ebp - 4], 0
jmp 0x10012bc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jge 0x10012c01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x41d9b550]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10012bfc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10012bb9
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10012c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa6
mov dword [ebp - 4], 0
jmp 0x10012c42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x10012c81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x676b3cb6]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10012c7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10012c39
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10013260
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100135d0
add esp, 8
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov byte [edx], 0xe8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 1], ecx
mov dword [ebp - 4], 5
jmp 0x100132b5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x100132c8
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x90
jmp 0x100132ac
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x100133d0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0x288
push 0x12
call fcn.10032afe
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
jne 0x1001340b
push str.Error_allocating_memory_needed_for_MAC_address_n
call fcn.10017480
add esp, 4
xor eax, eax
jmp 0x100135bd
push 0x288
call fcn.10032afe
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10013441
push str.Error_allocating_memory_needed_for_adapter_info_n
call fcn.10017480
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.10032ae1
add esp, 4
xor eax, eax
jmp 0x100135bd
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x10013494
mov eax, dword [ebp - 8]
push eax
call fcn.10032ae1
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10032afe
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10013494
push str.Error_reallocating_memory_needed_for_adapter_info_n
call fcn.10017480
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.10032ae1
add esp, 4
xor eax, eax
jmp 0x100135bd
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x10013595
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10013593
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 6
jne 0x10013586
mov ecx, 1
imul edx, ecx, 5
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 2
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + ecx + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1000d100
add esp, 0x20
mov edx, dword [ebp - 0xc]
push edx
call fcn.10014c20
add esp, 4
test eax, eax
jne 0x10013586
push 0x12
call fcn.10032afe
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10013584
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10034a70
add esp, 8
jmp 0x10013593
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x100134af
jmp 0x100135a2
push str.Error_getting_adapter_information_n
call fcn.10017480
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.10032ae1
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.10032ae1
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10014ae0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10063274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x64
call fcn.10032afe
add esp, 4
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x10014b1a
push str.Error_allocating_memory_for_serial_number_n
call fcn.10017480
add esp, 4
xor eax, eax
jmp 0x10014bc0
mov al, byte [0x1004ce31]
mov byte [ebp - 0x74], al
push 0x63
push 0
lea ecx, [ebp - 0x73]
push ecx
call fcn.1002d220
add esp, 0xc
mov dl, byte [0x1004ce32]
mov byte [ebp - 0x10], dl
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
push 0xa
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x7c]
push ecx
push 0x64
lea edx, [ebp - 0x74]
push edx
push 0x1004d4e4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0x10014ba0
mov eax, dword [ebp - 0x7c]
push eax
push 0x1004d4e8
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.1000d100
add esp, 0xc
jmp 0x10014bb1
push str.Error_getting_serial_number
mov edx, dword [ebp - 0x78]
push edx
call fcn.10034a70
add esp, 8
mov eax, dword [ebp - 0x78]
push eax
call fcn.10032ae1
add esp, 4
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002b564
mov esp, ebp
pop ebp
ret

Function at 0x10014bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0x10], 1
jle 0x10014bf8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x10014c00
mov edx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [edx], al
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10016880
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
push 0x40
push 4
mov edx, 1
imul eax, edx, 0
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov dx, word [ebp + 0xc]
mov word [ecx], dx
mov esp, ebp
pop ebp
ret

Function at 0x10017190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0x400
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
shl ecx, 2
push ecx
call fcn.10032afe
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100171c2
xor eax, eax
jmp 0x10017282
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10017280
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x10017251
mov eax, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10032b09
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
jmp 0x10017205
cmp dword [ebp - 0xc], 0
je 0x10017265
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10017282
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10017282
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100173a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10017400
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10017470
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1001745f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10017472
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10017472
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10017500
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x10063274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x135], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x10017646
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.KERNEL32.dll_Process32First
mov edx, dword [ebp - 0x12c]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1001762b
mov dword [ebp - 0x13c], 0
jmp 0x10017595
mov eax, dword [ebp - 0x13c]
add eax, 1
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xa7
jae 0x1001761e
lea ecx, [ebp - 0x148]
push ecx
push 7
lea edx, [ebp - 0xc]
push edx
imul eax, dword [ebp - 0x13c], 0xc
mov ecx, dword [eax + 0x10062268]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10017619
cmp dword [ebp - 0x148], 7
jne 0x10017619
push 7
imul eax, dword [ebp - 0x13c], 0xc
add eax, 0x1006226c
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.1002dc7d
add esp, 0xc
test eax, eax
jne 0x10017619
push 0
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100179f0
call fcn.1001b470
jmp 0x10017586
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10017553
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x135]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002b564
mov esp, ebp
pop ebp
ret
Function at 0x10017670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
jmp 0x10017692
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x100176d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x472aed4d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100176cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10017689
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100179f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x10017a0a
jne 0x10017a09
call 0x93056a91
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10017a18
jmp 0x10017a1a
je 0x10017a15
clc
jae 0x10017a1f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10017a24
jne 0x10017a24
pop eax
pushf
push 0xa
jae 0x10017a31
jmp 0x10017a2c
call 0x10017a33
jae 0x10017a2c
add esp, 4
jmp 0x10017a38
dec dword [esp]
jno 0x10017a3d
jns 0x10017a28
jp 0x10017a41
add esp, 4
popf
jmp 0x10017a48
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10017a61
jne 0x10017a61
call 0x1fc1adb5
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.100359ab
clc
jae 0x10017a7e
shl byte [ecx], 1
pushf
push 0xa
jae 0x10017a8b
jmp 0x10017a86
call 0x10017a8d
jae 0x10017a86
add esp, 4
jmp 0x10017a92
dec dword [esp]
jno 0x10017a97
jns 0x10017a82
jp 0x10017a9b
add esp, 4
popf
jmp 0x10017aa2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10017abb
jne 0x10017abb
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x10017ac0
jmp 0x10017ac2
je 0x10017abd
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10017adc
jne 0x10017adb
call 0x93056b63
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10017aea
jne 0x10017aea
call fcn.10017baa
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x10017af8
add esi, dword [ebp]
jne 0x10017af7
call 0x93056b7f
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10017b06
jmp 0x10017b08
je 0x10017b03
clc
jae 0x10017b0d
jp 0x10017af4
je 0x10017b12
jne 0x10017b12
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x10017b1f
jmp 0x10017b1a
call 0x10017b21
jae 0x10017b1a
add esp, 4
jmp 0x10017b26
dec dword [esp]
jno 0x10017b2b
jns 0x10017b16
jp 0x10017b2f
add esp, 4
popf
jmp 0x10017b36
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10017b4f
jne 0x10017b4f
call 0x1fc1aea3
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10017a33
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x10017a0a
jne 0x10017a09
call 0x93056a91
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10017a18
jmp 0x10017a1a
je 0x10017a15
clc
jae 0x10017a1f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10017a24
jne 0x10017a24
pop eax
pushf
push 0xa
jae 0x10017a31
jmp 0x10017a2c
call 0x10017a33
jae 0x10017a2c
add esp, 4
jmp 0x10017a38
dec dword [esp]
jno 0x10017a3d
jns 0x10017a28
jp 0x10017a41
add esp, 4
popf
jmp 0x10017a48
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10017a61
jne 0x10017a61
call 0x1fc1adb5
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.100359ab
clc
jae 0x10017a7e
shl byte [ecx], 1
pushf
push 0xa
jae 0x10017a8b
jmp 0x10017a86
call 0x10017a8d
jae 0x10017a86
add esp, 4
jmp 0x10017a92
dec dword [esp]
jno 0x10017a97
jns 0x10017a82
jp 0x10017a9b
add esp, 4
popf
jmp 0x10017aa2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10017abb
jne 0x10017abb
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x10017ac0
jmp 0x10017ac2
je 0x10017abd
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10017adc
jne 0x10017adb
call 0x93056b63
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10017aea
jne 0x10017aea
call fcn.10017baa
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x10017af8
add esi, dword [ebp]
jne 0x10017af7
call 0x93056b7f
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10017b06
jmp 0x10017b08
je 0x10017b03
clc
jae 0x10017b0d
jp 0x10017af4
je 0x10017b12
jne 0x10017b12
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x10017b1f
jmp 0x10017b1a
call 0x10017b21
jae 0x10017b1a
add esp, 4
jmp 0x10017b26
dec dword [esp]
jno 0x10017b2b
jns 0x10017b16
jp 0x10017b2f
add esp, 4
popf
jmp 0x10017b36
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10017b4f
jne 0x10017b4f
call 0x1fc1aea3
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10017b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret
Function at 0x10017e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x26
mov dword [ebp - 4], 0
jmp 0x10017e62
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10017ea1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x5e8de71]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10017e9c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10017e59
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10017ec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
add edx, 0xc
cmp dword [ebp - 8], edx
je 0x10017f93
cmp dword [ebp - 8], 0
je 0x10017f93
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0x18]
jne 0x10017f86
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2c]
mov word [eax + 0x14], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2e]
mov word [eax + 0x16], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x24]
mov word [eax + 0xc], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x26]
mov word [eax + 0xe], dx
mov al, 1
jmp 0x10017f95
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
jmp 0x10017ee2
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10018250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x31
mov dword [ebp - 4], 0
jmp 0x10018272
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x14
jge 0x100182b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0xe0e17dc]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100182ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10018269
mov eax, 1
imul ecx, eax, 0x14
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100182d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x9b
mov dword [ebp - 4], 0
jmp 0x100182f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x10018331
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x654a77ba]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001832c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100182e9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xf4
mov dword [ebp - 4], 0
jmp 0x10018372
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x100183b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2692055e]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100183ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10018369
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4