joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495ff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
pop ebp
ret

Function at 0x496020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
Function at 0x4979d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.00412c70
add esp, 8
cmp dword [ebp - 0xc], 0
je 0x497a13
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x497a13
test al, 0x10
je 0x497a13
mov bl, 1
jmp 0x497a15
xor bl, bl
lea ecx, [ebp - 0x1c]
call fcn.00401bf0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0049996c
mov esp, ebp
pop ebp
ret
Function at 0x497c40
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x497e12
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3f0
jne 0x497e12
push edi
mov ecx, esi
call fcn.00498850
mov edi, eax
cmp edi, 0xffffffff
je 0x497e09
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xffffffff
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x497df5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x497deb
test eax, eax
je 0x497deb
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x497cf6
call ebx
cmp eax, 0x7a
jne 0x497deb
push dword [ebp - 4]
call fcn.0049999d
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp - 4]
push ebx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x497de2
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x497de2
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x497de2
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x497d68
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x497deb
push dword [ebp - 4]
call fcn.0049999d
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x497dcf
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x497dcf
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x497dcf
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x18]
cmp eax, 1
sete bl
call fcn.004999a6
push dword [ebp - 8]
call fcn.004999a6
add esp, 8
test bl, bl
jne 0x497df5
jmp 0x497deb
push ebx
call fcn.004999a6
push dword [ebp - 8]
call fcn.004999a6
add esp, 8
jmp 0x497deb
push ebx
call fcn.004999a6
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [esi], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x497e09
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bf17
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x498307
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x498315
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x498315
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00498740
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049996c
mov esp, ebp
pop ebp
ret
Function at 0x498340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7b82
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x232]
xor ebx, ebx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], ebx
call fcn.00497c40
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x4d6d38], bl
jne 0x498401
xor eax, eax
mov dword [ebp - 0x230], ebx
push str.Support_GetWinSpecialFoldersFromReg
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
call fcn.00498740
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 1
mov ebx, 1
push eax
mov dword [ebp - 0x238], ebx
call fcn.0048b250
add esp, 4
mov byte [ebp - 0x231], 0
test al, al
je 0x498408
mov byte [ebp - 0x231], 1
mov dword [ebp - 4], 0
test bl, 1
je 0x498456
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x498456
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49844c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x49844c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0049995e
add esp, 8
cmp byte [ebp - 0x231], 0
lea eax, [ebp - 0x218]
je 0x49847e
push 0xa
push 0xffffffffffffffff
push 0
push 0x104
push eax
push dword [ebp + 0xc]
call fcn.00497e40
add esp, 0x18
jmp 0x49848c
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x218]
push eax
call fcn.00498740
cmp byte [ebp - 0x232], 0
je 0x4984c2
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049996c
mov esp, ebp
pop ebp
ret
Function at 0x498850
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x244], 0xffffffff
push eax
mov dword [ebp - 0x248], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x498a66
cmp dword [ebp - 0x248], 0xffffffff
je 0x498a66
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp eax, 0xffffffff
je 0x498a29
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x49899d
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov edi, edi
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call esi
add esp, 8
test eax, eax
jne 0x49897b
cmp edi, ebx
je 0x49895c
mov eax, dword [ebp - 0x234]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x258], edi
jmp 0x49897b
lea eax, [ebp - 0x234]
push eax
push edi
lea ecx, [ebp - 0x25c]
call fcn.00401e60
mov ebx, dword [ebp - 0x254]
mov edi, dword [ebp - 0x258]
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x498930
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 0x24c], esi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x498a29
lea ecx, [ecx]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0xffffffff
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x498a14
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x248]
jne 0x498a14
push dword [esi]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x498a14
lea ecx, [ebp - 0x244]
push ecx
push 0xf
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x250]
test eax, eax
jne 0x498a1d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, edi
jne 0x4989b0
jmp 0x498a23
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24c]
mov edi, dword [ebp - 0x244]
test esi, esi
je 0x498a62
sub ebx, esi
mov eax, esi
and ebx, 0xfffffffc
cmp ebx, 0x1000
jb 0x498a58
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x498a58
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebx
push esi
call fcn.0049995e
add esp, 8
mov eax, edi
jmp 0x498a6c
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049996c
mov esp, ebp
pop ebp
ret
Function at 0x498dc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push str.LdpLookupEx__r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
jmp fcn.00498de0
Function at 0x12d4550
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x12d4640
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x12d4640
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x12d459a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x12d45a1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x12d4580
jmp 0x12d45a3
mov esi, 0x1505
jmp 0x12d45a3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
mov edx, ebx
sub edx, 1
jb 0x12d4640
mov ecx, esi
not ecx
or edx, ecx
mov eax, ebx
and eax, 0xfffffffe
add eax, eax
mov ecx, ebx
xor ecx, 1
sub eax, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
lea ebp, [esi + edx]
inc ebp
jmp 0x12d45e4
inc ebp
dec ebx
je 0x12d463e
mov eax, ebp
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x12d463e
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x12d45e0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.012dc9c0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x12d45e0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.012dc9e0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x12d45e0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x12d4640
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12d5890
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x12d5a8a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x12d5a8a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x12d5a8a
cmp dword [ecx], 0
jne 0x12d5a8a
push esi
call fcn.012dc9c0
add esp, 4
test eax, eax
je 0x12d58fa
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x12d5901
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x12d58e0
jmp 0x12d5903
mov edi, 0x1505
jmp 0x12d5903
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
mov esi, edx
sub esi, 1
jae 0x12d59cd
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x12d595a
call fcn.012d5b60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x12d5a8a
push esi
call fcn.012dc9c0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.012d5aa0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.012dc9c0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [fcn.01319008]
add esp, 4
test eax, eax
je 0x12d5a85
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.012dc8b0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x12d5a8a
mov dword [esp], eax
mov eax, edx
mov edx, edi
not edx
or esi, edx
mov ebx, eax
and ebx, 0xfffffffe
add ebx, ebx
mov edx, eax
xor edx, 1
sub ebx, edx
mov dword [esp + 0xc], ebx
mov edx, eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea ebx, [edi + esi]
inc ebx
jmp 0x12d5a08
inc ebx
dec edx
je 0x12d5915
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x12d591a
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x12d5a00
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.012dc9c0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x12d5a00
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.012dc9e0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x12d5a00
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.012d4970
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x12d59c2
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12d6b50
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x12d6cf2
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x12d6ceb
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x12d6be0
add ebp, dword [esp + 8]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x12d6ceb
xor eax, eax
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 4], esi
jb 0x12d6c65
mov eax, edx
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
mov ebx, ecx
xor ebx, edi
and ecx, edi
movzx esi, byte [ebp + edx + 6]
add esi, edi
movzx edi, byte [ebp + edx + 7]
add edi, esi
add esi, ebx
lea ecx, [esi + ecx*2]
lea ebx, [edx + 8]
add ecx, edi
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x12d6c00
add ebp, ebx
mov esi, dword [esp + 4]
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], ebx
jbe 0x12d6ba8
mov ebx, edx
mov edx, eax
or edx, 1
test bl, 1
jne 0x12d6c90
mov ebx, ebp
cmp dword [esp], edx
je 0x12d6ba0
jmp 0x12d6cad
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
add edi, eax
mov eax, edi
and eax, ecx
xor ecx, edi
lea ecx, [ecx + eax*2]
mov eax, edx
cmp dword [esp], edx
je 0x12d6ba0
mov edx, dword [esp]
sub edx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + eax]
add esi, edi
mov edi, esi
and edi, ecx
xor ecx, esi
lea ecx, [ecx + edi*2]
movzx edi, byte [ebx + eax + 1]
add edi, esi
mov esi, edi
and esi, ecx
xor ecx, edi
lea ecx, [ecx + esi*2]
add eax, 2
cmp edx, eax
jne 0x12d6cc0
jmp 0x12d6ba0
shl ecx, 0x10
or ecx, edi
jmp 0x12d6cf7
mov ecx, 1
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12d6d10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x12d6d3e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x12d6ddc
not eax
test bl, 1
jne 0x12d6d45
mov edx, ebx
cmp ebx, 1
jne 0x12d6d76
jmp 0x12d6dda
xor eax, eax
jmp 0x12d6ddc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x1316c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x1316c50]
cmp ebx, 1
je 0x12d6dda
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x1316c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x1316c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x1316c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x1316c50]
add esi, 2
cmp edx, esi
jne 0x12d6d80
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x12de990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x12dec03
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x12de9cc
cmp edx, esi
jae 0x12dec03
test edi, edi
je 0x12dec03
movzx ebp, bl
test bl, bl
js 0x12dea10
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
xor esi, eax
not eax
and eax, ecx
add eax, eax
sub eax, esi
sar eax, 1
sub edi, eax
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x12de9c0
jmp 0x12dec03
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x12dea4b
cmp bl, 0xc2
jb 0x12de9f8
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x12deab4
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x12de9e2
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x12dea75
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x12deabe
cmp ebp, 0xe0
jne 0x12deac7
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x12de9f4
jmp 0x12deac7
mov ecx, ebp
not ecx
or ecx, 0xf8
add ecx, ebp
cmp ecx, 0xef
jne 0x12debde
cmp bl, 0xf4
ja 0x12de9f8
movzx ecx, byte [edx + 1]
je 0x12deb11
cmp ebp, 0xf0
jne 0x12deb1a
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x12de9f4
jmp 0x12deb1a
inc edx
mov esi, dword [esp + 0x24]
jmp 0x12de9fa
cmp cl, 0x9f
ja 0x12de9f4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x12debe5
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x12debeb
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
mov word [eax], si
lea ecx, [eax + 2]
add edx, 3
jmp 0x12de9e2
cmp cl, 0x8f
ja 0x12de9f4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x12debe5
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x12debeb
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x12debf7
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x12de9f4
mov ecx, dword [esp]
add ecx, ebp
add ecx, 0xffffff80
cmp ecx, 0x10000
jb 0x12de9f4
cmp edi, 2
jb 0x12debde
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
mov esi, 0x3ff
sub esi, ecx
not esi
or esi, ecx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x12de9e2
mov ecx, eax
jmp 0x12de9e2
inc edx
jmp 0x12de9f4
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x12de9fa
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x12de9fa
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x12df190
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x104], 0x3c
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x131f038]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x12df271
sar edx, 1
lea edi, [esi + 0x104]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x1319ab4]