joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100060dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + eax + 0x78]
mov edx, dword [ecx + eax + 0x20]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [ecx + eax + 0x1c]
mov dword [esp + 0x14], edx
mov eax, dword [ecx + eax + 0x24]
mov dword [esp + 0x18], eax
xor eax, eax
jmp 0x10006114
mov ebx, eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + ebx*4]
add edi, dword [esp + 4]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je fcn.1000610b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
imul ecx, edx
movsx esi, byte [edi]
movzx esi, si
add ecx, esi
inc edi
dec eax
jne 0x1000613b
jmp fcn.1000610b

Function at 0x1000610b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [ebx + 1]
cmp ecx, dword [esp + 8]
je 0x1000614c
mov ecx, dword [esp + 4]
add dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x18]
add eax, ecx
mov edx, dword [esp + 0x14]
and al, 0x14
add edx, ecx
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x10c]
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x3c]
mov eax, dword [ecx + eax + 0x78]
mov edx, dword [ecx + eax + 0x20]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [ecx + eax + 0x1c]
add dword [ecx + ecx*4], ebx
push esp
and al, 0x14
mov eax, dword [ecx + eax + 0x24]
mov dword [esp + 0x18], eax
xor eax, eax
jmp 0x100061b4
lea eax, [ebx + 1]
cmp ecx, dword [esp + 8]
je 0x100061ec
mov ebx, eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + ebx*4]
add edi, dword [esp + 4]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x100061ab
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
invalid
scasd eax, dword es:[edi]

Function at 0x1000618c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [ebx + 1]
cmp ecx, dword [esp + 8]
je 0x1000614c
mov ecx, dword [esp + 4]
add dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x18]
add eax, ecx
mov edx, dword [esp + 0x14]
and al, 0x14
add edx, ecx
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x10c]
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x3c]
mov eax, dword [ecx + eax + 0x78]
mov edx, dword [ecx + eax + 0x20]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [ecx + eax + 0x1c]
add dword [ecx + ecx*4], ebx
push esp
and al, 0x14
mov eax, dword [ecx + eax + 0x24]
mov dword [esp + 0x18], eax
xor eax, eax
jmp 0x100061b4
lea eax, [ebx + 1]
cmp ecx, dword [esp + 8]
je 0x100061ec
mov ebx, eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + ebx*4]
add edi, dword [esp + 4]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x100061ab
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
invalid
scasd eax, dword es:[edi]
Function at 0x10006520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x3c]
mov eax, dword [ecx + eax + 0x78]
mov eax, dword [ecx + eax + 0x20]
add eax, ecx
mov dword [esp + 0x10], eax
xor ebx, ebx
jmp 0x10006552

Function at 0x10006586
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebx
cmp ecx, dword [esp + 8]
je 0x1000658c
mov eax, dword [esp + 0x10]
mov edi, dword [eax + ebx*4]
add edi, dword [esp + 4]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x1000654b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
nop
nop
nop
nop
imul ecx, edx
movsx esi, byte [edi]
movzx esi, si
add ecx, esi
inc edi
dec eax
jne 0x1000657b
jmp 0x1000654b
mov eax, dword [esp + 0x24]
add eax, dword [esp + 4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x5c]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x3c]
mov eax, dword [ecx + eax + 0x78]
mov edx, dword [ecx + eax + 0x20]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [ecx + eax + 0x1c]
mov dword [esp + 0x14], edx
mov eax, dword [ecx + eax + 0x24]
mov dword [esp + 0x54], eax
xor eax, eax
jmp 0x100065e4
lea eax, [ebx + 1]
cmp ecx, dword [esp + 8]
je 0x1000661c
mov ebx, eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + ebx*4]
add edi, dword [esp + 0x1c]
mov ecx, edi
stc
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x100065db
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
imul ecx, edx
movsx esi, byte [edi]
movzx esi, si
add ecx, esi
inc edi
dec eax
jne 0x1000660b
jmp 0x100065db
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
Function at 0x10006624
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, ecx
movzx eax, word [eax + ebx*2]
mov edx, dword [esp + 0x14]
add edx, ecx
mov eax, dword [edx + eax*4]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 4]
add ecx, esi
push 0x80
push 0x40
mov dword [esp + 0x20], ecx
call ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0xc0]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x3c]
mov eax, dword [esi + eax + 0x78]
mov ecx, dword [esi + eax + 0x20]
add ecx, esi
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + eax + 0x1c]
mov dword [esp + 0x68], ecx
mov eax, dword [esi + eax + 0x24]
mov dword [esp + 0x64], eax
xor eax, eax
jmp 0x10006694
lea eax, [esi + 1]
cmp ecx, dword [esp + 8]
je 0x100066cc
mov esi, eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + esi*4]
add edi, dword [esp + 4]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x1000668b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
imul ecx, edx
movsx ebx, byte [edi]
movzx ebx, bx
add ecx, ebx
inc edi
dec eax
jne 0x100066bb
jmp 0x1000668b
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x64]
add eax, ecx
movzx eax, word [eax + esi*2]
mov edx, dword [esp + 0x68]
add edx, ecx
mov eax, dword [edx + eax*4]
add eax, ecx
mov edx, dword [esp + 0x14]
mov dword [edx + 0xc], eax
mov dword [edx + 4], ecx
mov eax, dword [esp + 0x44]
mov dword [edx + 0x68], eax
mov eax, dword [esp + 0x48]
mov dword [edx + 0x44], eax

Function at 0x100066ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, ecx
movzx eax, word [eax + ebx*2]
mov edx, dword [esp + 0x14]
add edx, ecx
mov eax, dword [edx + eax*4]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 4]
add ecx, esi
push 0x80
push 0x40
mov dword [esp + 0x20], ecx
call ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0xc0]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x3c]
mov eax, dword [esi + eax + 0x78]
mov ecx, dword [esi + eax + 0x20]
add ecx, esi
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + eax + 0x1c]
mov dword [esp + 0x68], ecx
mov eax, dword [esi + eax + 0x24]
mov dword [esp + 0x64], eax
xor eax, eax
jmp 0x10006694
lea eax, [esi + 1]
cmp ecx, dword [esp + 8]
je 0x100066cc
mov esi, eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + esi*4]
add edi, dword [esp + 4]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x1000668b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
imul ecx, edx
movsx ebx, byte [edi]
movzx ebx, bx
add ecx, ebx
inc edi
dec eax
jne 0x100066bb
jmp 0x1000668b
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x64]
add eax, ecx
movzx eax, word [eax + esi*2]
mov edx, dword [esp + 0x68]
add edx, ecx
mov eax, dword [edx + eax*4]
add eax, ecx
mov edx, dword [esp + 0x14]
mov dword [edx + 0xc], eax
mov dword [edx + 4], ecx
mov eax, dword [esp + 0x44]
mov dword [edx + 0x68], eax
mov eax, dword [esp + 0x48]
mov dword [edx + 0x44], eax
Function at 0x100066fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x60]
mov dword [edx + 0x34], eax
mov esi, dword [esp + 0x1c]
mov dword [edx + 0x78], esi
mov eax, dword [esp + 0x40]
mov dword [edx + 0x50], eax
mov eax, dword [esp + 0x54]
add eax, esi
mov dword [edx + 0x3c], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 0x64], eax

Function at 0x10006722
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x20]
mov dword [edx + 0x4c], eax
mov edi, dword [esp + 0x58]
add edi, ecx
mov eax, dword [esp + 0x50]
mov dword [edx + 0x30], eax
mov eax, dword [esp + 0x24]
mov dword [edx + 0x6c], eax
mov dword [edx + 0x54], edi
mov eax, dword [esp + 0x4c]
mov dword [edx + 0x70], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + 0x24], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0xd8]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x3c]
mov eax, dword [esi + eax + 0x78]
mov ecx, dword [esi + eax + 0x20]
add ecx, esi
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + eax + 0x1c]
mov dword [esp + 0x20], ecx
mov eax, dword [esi + eax + 0x24]
mov dword [esp + 0x24], eax
xor eax, eax
jmp 0x10006794
lea eax, [ebx + 1]
cmp ecx, dword [esp + 8]
je 0x100067cc
mov ebx, eax
mov eax, dword [esp + 0x10]
mov edi, dword [eax + ebx*4]
add edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x1000678b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
imul ecx, edx
movsx esi, byte [edi]
movzx esi, si
add ecx, esi
inc edi
dec eax
jne 0x100067bb
jmp 0x1000678b
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
add eax, edx
Function at 0x10006ba7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
inc bh
inc esp
and al, 0x2c
invalid
invalid
invalid
call dword [ebx + 0x6a]
add bh, bh
salc
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
pop es
add byte [eax], al
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi

Function at 0x10006bdc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
inc bh
inc esp
and al, 0x2c
invalid
invalid
invalid
call dword [ebx + 0x6a]
add bh, bh
salc
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
pop es
add byte [eax], al
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi

Function at 0x10006c1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
inc bh
inc esp
and al, 0x2c
invalid
invalid
invalid
call dword [ebx + 0x6a]
add bh, bh
salc
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
pop es
add byte [eax], al
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
mov dword [esp + 0x2c], 0xffffffff
push ebx
push 0
call esi
Function at 0x10006c56
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
cmp al, 0x36
inc bh
inc esp
and al, 0x2c
invalid
invalid
invalid
call dword [ebx + 0x6a]
add bh, bh
salc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x4c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x3c]
mov eax, dword [ecx + eax + 0x78]
mov edx, dword [ecx + eax + 0x20]
add edx, ecx
mov dword [esp + 8], edx
mov edx, dword [ecx + eax + 0x1c]
mov dword [esp + 0x20], edx
mov eax, dword [ecx + eax + 0x24]
inc esp
add dword [ecx + ecx*4], esp
inc esp
and al, 0x24
xor eax, eax
jmp 0x10006cc4
lea eax, [ebx + 1]
cmp ecx, dword [esp + 0x1c]
je 0x10006cfc
mov ebx, eax
mov eax, dword [esp + 8]
mov edi, dword [eax + ebx*4]
add edi, dword [esp + 4]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x10006cbb
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
imul ecx, edx
movsx esi, byte [edi]
movzx esi, si
add ecx, esi
inc edi
dec eax
jne 0x10006ceb
jmp 0x10006cbb
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x24]
add eax, ecx
mov edx, dword [esp + 0x20]
add edx, ecx
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
add eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x8c]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x10]
mov esi, dword [ecx + eax]
mov ebx, dword [ecx + eax + 4]
push esi
push 0x40
call dword [esp + 0x20]
and al, 0x20
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
lea edx, [eax + ecx + 8]
mov ecx, edi
push esi
call fcn.100073fb
add esp, 4
test esi, esi
je 0x10006d65
xor eax, eax
nop
nop
nop
xor dword [edi + eax], ebx
add eax, 4
cmp eax, esi
jb 0x10006d5b
push 0x20a
push 0x40
call dword [esp + 0x20]
mov esi, eax
movzx eax, byte [edi]
test al, al
je 0x10006d8c
xor ecx, ecx
movsx eax, al
mov word [esi + ecx*2], ax
movzx eax, byte [edi + ecx + 1]
inc ecx
test al, al
jne 0x10006d7b
push 0x20a
push 0x40
mov ebx, dword [esp + 0x1c]
call dword [ebx + 0x64]
mov edi, eax
push 0x105
add eax, 0x50000001
push 0
call dword [ebx + 0x54]
lea eax, [edi - 2]
nop
cmp word [eax + 2], 0
lea eax, [eax + 2]
jne 0x10006dab
nop
nop
nop
nop
nop
nop
mov word [eax], 0
cmp word [eax - 2], 0x5c
lea eax, [eax - 2]
jne 0x10006dbb
mov edx, edi
add edx, 0xfffffffe
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp word [edx + 2], 0
lea edx, [edx + 2]
jne 0x10006ddb
xor ecx, ecx
cmp word [edx - 2], 0x5c
je 0x10006df9
mov word [edx], 0x5c
mov ecx, 1
test esi, esi
je 0x10006e2c
movzx ebx, word [esi]
test bx, bx
mov dword [esp + 4], ecx
je 0x10006e31
lea ecx, [edx + ecx*2]
xor edx, edx
nop
nop
nop
nop
inc eax
mov edx, eax
jmp 0x10006e39
xor edx, edx
Function at 0x10006d37
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [edi + 0x4c]
mov ecx, ebx
mov edx, 8
call fcn.100073bb
mov dword [esp + 0x28], 0xfe363c80
cmp al, 0x36
inc bh
inc esp
and al, 0x2c
invalid
invalid
invalid
call dword [ebx + 0x6a]
add bh, bh
salc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x4c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x3c]
mov eax, dword [ecx + eax + 0x78]
mov edx, dword [ecx + eax + 0x20]
add edx, ecx
mov dword [esp + 8], edx
mov edx, dword [ecx + eax + 0x1c]
mov dword [esp + 0x20], edx
mov eax, dword [ecx + eax + 0x24]
inc esp
add dword [ecx + ecx*4], esp
inc esp
and al, 0x24
xor eax, eax
jmp 0x10006cc4
lea eax, [ebx + 1]
cmp ecx, dword [esp + 0x1c]
je 0x10006cfc
mov ebx, eax
mov eax, dword [esp + 8]
mov edi, dword [eax + ebx*4]
add edi, dword [esp + 4]
mov ecx, edi
call fcn.1000738b
test eax, eax
mov ecx, 0
je 0x10006cbb
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x1c]
xor ecx, ecx
nop
imul ecx, edx
movsx esi, byte [edi]
movzx esi, si
add ecx, esi
inc edi
dec eax
jne 0x10006ceb
jmp 0x10006cbb
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x24]
add eax, ecx
mov edx, dword [esp + 0x20]
add edx, ecx
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
add eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x8c]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x10]
mov esi, dword [ecx + eax]
mov ebx, dword [ecx + eax + 4]
push esi
push 0x40
call dword [esp + 0x20]
and al, 0x20
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
lea edx, [eax + ecx + 8]
mov ecx, edi
push esi
call fcn.100073fb
add esp, 4
test esi, esi
je 0x10006d65
xor eax, eax
nop
nop
nop
xor dword [edi + eax], ebx
add eax, 4
cmp eax, esi
jb 0x10006d5b
push 0x20a
push 0x40
call dword [esp + 0x20]
mov esi, eax
movzx eax, byte [edi]
test al, al
je 0x10006d8c
xor ecx, ecx
movsx eax, al
mov word [esi + ecx*2], ax
movzx eax, byte [edi + ecx + 1]
inc ecx
test al, al
jne 0x10006d7b
push 0x20a
push 0x40
mov ebx, dword [esp + 0x1c]
call dword [ebx + 0x64]
mov edi, eax
push 0x105
add eax, 0x50000001
push 0
call dword [ebx + 0x54]
lea eax, [edi - 2]
nop
cmp word [eax + 2], 0
lea eax, [eax + 2]
jne 0x10006dab
nop
nop
nop
nop
nop
nop
mov word [eax], 0
cmp word [eax - 2], 0x5c
lea eax, [eax - 2]
jne 0x10006dbb
mov edx, edi
add edx, 0xfffffffe
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp word [edx + 2], 0
lea edx, [edx + 2]
jne 0x10006ddb
xor ecx, ecx
cmp word [edx - 2], 0x5c
je 0x10006df9
mov word [edx], 0x5c
mov ecx, 1
test esi, esi
je 0x10006e2c
movzx ebx, word [esi]
test bx, bx
mov dword [esp + 4], ecx
je 0x10006e31
lea ecx, [edx + ecx*2]
xor edx, edx
nop
nop
nop
nop
inc eax
mov edx, eax
jmp 0x10006e39
xor edx, edx

Function at 0x1000701e
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
add esp, 4
add dword [esp + 0x3c], edi
jmp 0x10007072
Function at 0x10031c74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003b890]
jne 0x10031c7e
repz ret
jmp fcn.1003244e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404a28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov ebx, dword [ebp + 8]
mov ecx, 0x55087f58
mov eax, ecx
sub eax, ecx
mov ecx, eax
inc dword [0x42b474]
mov esi, ebx
and dword [0x409004], 0
mov eax, 0x1f89
mul ecx
mov dword [ebp - 4], eax
mov ecx, eax
and dword [0x419f18], 0
and dword [0x419f38], 0
and dword [0x409008], 0
mov dword [0x419dec], 4
add ecx, 0xcd5
mov dword [0x419944], 4
mov eax, esi
inc esi
mov al, byte [eax]
mov byte [0x419940], al
movzx eax, byte [0x419940]
or eax, eax
jl 0x404d28
cmp eax, 0xff
jg 0x404d28
jmp dword [eax*4 + 0x42b490]
inc dword [0x42b474]
test byte [0x419f18], 0x40
je 0x404e02
mov eax, esi
inc esi
mov al, byte [eax]
mov byte [0x42a170], al
mov eax, ecx
mul ecx
mov dword [ebp - 0x10], eax
mov ecx, eax
movzx eax, byte [0x42a170]
and eax, 0xc0
mov byte [ebp - 9], al
movzx eax, byte [0x42a170]
and eax, 7
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 9]
cmp eax, 0xc0
je 0x404e02
cmp byte [ebp - 9], 0x40
jne 0x404d85
inc dword [0x409008]
mov eax, 0x7f0e
mul ecx
mov dword [ebp - 0x14], eax
mov ecx, eax
movzx eax, byte [ebp - 9]
cmp eax, 0x80
jne 0x404da7
mov eax, dword [0x419944]
add dword [0x409008], eax
cmp dword [0x419944], 2
jne 0x404dc5
cmp byte [ebp - 9], 0
jne 0x404e02
cmp byte [ebp - 0xa], 6
jne 0x404e02
add dword [0x409008], 2
jmp 0x404e02
cmp byte [ebp - 0xa], 4
jne 0x404def
or byte [0x419f18], 0x80
mov eax, ecx
add eax, ecx
mov ecx, eax
mov eax, esi
inc esi
mov al, byte [eax]
mov byte [0x419de4], al
movzx eax, byte [0x419de4]
and eax, 7
mov byte [ebp - 0xa], al
cmp byte [ebp - 0xa], 5
jne 0x404e02
cmp byte [ebp - 9], 0
jne 0x404e02
add dword [0x409008], 4
and dword [0x40900c], 0
jmp 0x404e23
mov eax, esi
inc esi
mov edx, dword [0x40900c]
mov al, byte [eax]
mov byte [edx + 0x419938], al
inc dword [0x40900c]
mov eax, dword [0x409008]
cmp dword [0x40900c], eax
jb 0x404e0b
xor ecx, 0x3c7f
and dword [0x40900c], 0
jmp 0x404e57
mov eax, esi
inc esi
mov edx, dword [0x40900c]
mov al, byte [eax]
mov byte [edx + 0x42a3a8], al
inc dword [0x40900c]
mov eax, dword [0x419f38]
cmp dword [0x40900c], eax
jb 0x404e3f
inc dword [0x42b474]
mov eax, esi
sub eax, ebx
mov dword [0x409004], eax
xor eax, eax
inc eax
jmp 0x404e7e
pop esi
pop ebx
leave
ret
Function at 0x4062a3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov dword [ebp - 4], 0x7f83677c
sub dword [ebp - 4], 0x1715
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mul dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov word [ebp - 0x10], 0
jmp 0x4063c4
mov eax, ebx
add eax, esi
push eax
call fcn.00405a3c
pop ecx
mov edx, eax
mov byte [ebp - 5], dl
mov eax, dword [ebp - 4]
mov edx, eax
add edx, eax
mov dword [ebp - 4], edx
cmp byte [ebp - 5], 0
jne 0x406309
mov byte [ebp - 6], 0
jmp 0x406333
call 0x40b300
mov dword [ebp - 0x20], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 5]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x20]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 6], dl
mov al, byte [esi + ebx]
cmp al, 0x70
jb 0x40634e
cmp al, 0x7f
ja 0x40634e
mov eax, ebx
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
sub edx, ecx
mov byte [eax], dl
movzx eax, byte [esi + ebx]
cmp eax, 0xe2
jne 0x406369
mov eax, ebx
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 6]
sub edx, ecx
mov byte [eax], dl
mov eax, 0x3e96
mul dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
push 8
push 0x90
lea eax, [ebp - 0xe]
push eax
call 0x40b2dc
movzx eax, byte [ebp - 5]
push eax
mov eax, ebx
add eax, esi
push eax
lea eax, [ebp - 0xe]
movzx edx, byte [ebp - 6]
add eax, edx
push eax
call 0x40b2d0
push 6
lea eax, [ebp - 0xe]
push eax
mov eax, ebx
add eax, esi
push eax
call 0x40b2d0
add esp, 0x24
mov eax, dword [ebp - 4]
mov edx, eax
xor edx, eax
mov dword [ebp - 4], edx
add esi, 6
inc word [ebp - 0x10]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x4062e3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
xor ecx, 0x1508
push ebp
push esi
mov esi, dword [esp + 0x14]
add esi, 0xfffffe6a
lea ebp, [edx - 0x865]
lea eax, [esi - 0x817]
cmp ecx, eax
jg 0x4014dd
mov eax, esi
xor eax, 0x1a2a
cmp ecx, eax
jge 0x4014af
mov eax, dword [0x49c798]
mov esi, 0x12a7fd
push ebx
push edi
mov edi, dword [esp + 0x20]
push edi
cmp dword [edi + 0x3c], 0xeb6d
cmova eax, esi
mov esi, dword [esp + 0x2c]
mov dword [0x49c798], eax
lea ebx, [esi - 0x5a6]
lea eax, [ebx - 2]
push eax
lea eax, [ecx + 0x1196]
push eax
lea eax, [esi - 0x207]
push eax
mov eax, ebx
xor eax, 0x175b
push eax
push edx
call fcn.00408669
mov ecx, dword [0x493c3c]
add esp, 0x18
mov ebp, eax
push 0x40
push 0x3000
push dword [ecx + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x14]
add eax, 0x6000
mov dword [edi + 0xdc], eax
lea eax, [esi + 0x331]
push eax
push dword [0x493c3c]
lea eax, [ebp + 0x7e0]
push eax
lea eax, [ebx - 0x31e]
push eax
lea eax, [ecx - 0x1b2]
push eax
lea eax, [ecx - 0x85]
push eax
lea eax, [ebp + 0xe9e]
push eax
call fcn.00419eb7
add esp, 0x1c
pop edi
pop ebx
jmp 0x4014dd
mov eax, dword [0x493c3c]
mov eax, dword [eax + 0xac]
add eax, 0xb9b
xor eax, dword [0x49c768]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [0x493c3c]
mov eax, dword [ecx + 0xe4]
or eax, esi
sub dword [ecx + 0x7c], eax
pop esi
mov eax, ebp
pop ebp
ret