joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100109d3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x10010a47
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x100109ff
cmp dword [esi + 0x40], edi
jae 0x100109ff
push eax
call fcn.10012c29
pop ecx
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0x3c], ebx
jne 0x10010a14
lea eax, [edi + edi]
push eax
call fcn.10012c1b
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.10011940
add esp, 0xc
test edi, edi
jbe 0x10010a44
mov eax, dword [esi + 0x3c]
mov al, byte [ebx + eax]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.1001073d
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jb 0x10010a27
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10010a76
mov eax, dword [esi + 0x24]
lea ebx, [eax + edi]
cmp ebx, dword [esi + 0x28]
jb 0x10010a62
mov dword [esi + 0x14], 0x30000
jmp 0x10010a98
push edi
add eax, ecx
push edx
push eax
call fcn.10011940
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
jmp 0x10010a9a
mov eax, dword [esi + 4]
test eax, eax
je 0x10010a91
lea ecx, [ebp + 8]
push 0
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x10010a9a
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10010dcf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x10010e1f
mov eax, dword [esi + 0x80]
mov edi, dword [esi + 0x7c]
cmp eax, edi
jae 0x10010e61
sub edi, eax
cmp edi, dword [ebp + 0xc]
jbe 0x10010df4
mov edi, dword [ebp + 0xc]
add eax, ecx
push edi
push eax
push dword [ebp + 8]
call fcn.10011940
add dword [esi + 0x80], edi
add dword [esi + 0x68], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x6c]
call fcn.100105d4
mov dword [esi + 0x6c], eax
add esp, 0x18
mov eax, edi
jmp 0x10010e63
mov eax, dword [esi + 0x70]
test eax, eax
je 0x10010e5a
lea ecx, [ebp + 0xc]
push 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10010e61
mov eax, dword [ebp + 0xc]
add dword [esi + 0x68], eax
push eax
push dword [ebp + 8]
push dword [esi + 0x6c]
call fcn.100105d4
mov dword [esi + 0x6c], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
jmp 0x10010e63
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x40809c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40812c
add byte [eax], al
invalid
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40812c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4080df
test edx, 3
jne 0x4080ce
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4080d9
jmp 0x4080df
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4080df
cmp dword [ecx - 8], 1
je 0x4080e9
mov edx, ebx
or edx, 3
call fcn.00404d94
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4080fb
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404648

Function at 0x408138
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4081c8
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4081c8
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40817b
test edx, 3
jne 0x40816a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408175
jmp 0x40817b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40817b
cmp dword [ecx - 8], 1
je 0x408185
mov edx, ebx
or edx, 3
call fcn.00404d94
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408197
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404648
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x103ae148
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103ae152
pushal
call 0x103ae158
pop ebp
sub ebp, 0x10
sub ebp, 0x3ae148
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103ae17c
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103ae185
mov eax, 0x3ae148
add eax, ebp
add eax, 0x63
mov ecx, 0x5f3
mov edx, 0x7096620e
xor byte [eax], dl
inc eax
dec ecx
jne 0x103ae19c
jmp 0x103ae1af
test ebx, eax
test dword [edi + 0xe0e0e32], eax
invalid
Function at 0x10045766
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rcr dh, 7
pushfd
mov edx, dword [esi + 0x78]
mov byte [esp], 0x27
jmp 0x10068408
cmp edi, ebx
pushfd
pushfd
call fcn.1004bb55
add byte [eax], al
dec esi
je 0x10045740
jne 0x10045756
jb 0x1004576c
push ebx
jns 0x10045769
je 0x1004575d
insd dword es:[edi], dx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
jb 0x1004576c
popal
je 0x1004576b
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [esp + ebx*4 - 0x23aa79], bl
je 0x10045731
add al, 0xe9
mov ah, byte [eax + 2]
add bh, bh
and eax, sym.imp.KERNEL32.dll_LoadLibraryA_1
dec edi
dec esp
inc ebp
inc ecx
push ebp
push esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x367f861b], al
mov cl, 0x8b
dec ebp
or al, 0xe9
lodsd eax, dword [esi]
daa
add al, byte [eax]
add byte [eax], al
push esi
imul esi, dword [edx + 0x74], 0x516c6175
jne 0x100457a5
jb 0x100457bb
add byte [esi - 0x75], dl
je 0x1004576b
sub byte [ebp + 0x6b82b689], cl
mov byte [0x2c244c8b], al
xor bl, byte [edi + 0x33]
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [esi + 0xf], ah
btc si, 7
dec edx
mov esi, dword [eax + 0x3c]
inc byte [edi]
dec edx
mov esi, dword [eax + 0x3c]
shrd dx, ax, cl
shl dh, cl
add esi, eax
jmp 0x10045474
and al, 4
lea esp, [esp + 4]
jae 0x10047a66
movzx bx, cl
dec cl
mov ebx, eax
xchg di, cx
or edi, esp
mov edi, eax
xor cx, 0xbc48
add cx, 0xb1be
mov ecx, 0x104
stc
sub al, al
push edi
push dword [esp]
stc
test al, 0x77
repne scasb al, byte es:[edi]
mov byte [esp], dl
mov dword [esp], 0x55f7ed60
push edi
lea esp, [esp + 0xc]
jne 0x10047a54
pushal
mov ecx, edi
xor esi, esp
sar si, 1
pop esi
shrd si, dx, cl
sub ecx, ebx
cmc
btr esi, 0x1a
sbb esi, 0xad6701a9
lea esi, [esp + 0x1c]
cmp di, 0x32d6
pushfd
clc
pushal
sub edi, 4
mov byte [esp + 4], 0xe2
push dword [edi]
pop dword [esp + 0x3c]
jmp 0x100456e1
test edx, edx
push ecx
mov byte [esp + 8], 0xd0
mov byte [esp + 4], cl
jmp 0x10048a61

Function at 0x1004953f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
cmc
test eax, eax
pushal
lea esp, [esp + 0x20]
je 0x10047a54
shrd si, bx, cl
neg dx
mov esi, dword [eax + 0x3c]
rcl dl, 3
bsr dx, dx
btr edx, 6
bswap dx
add esi, eax
bswap edx
movzx edx, cl
rol dl, 5
mov edx, dword [esi + 0x78]
jmp 0x100691e9
add ah, ah
adc ah, dl
rcl ah, 1
pushal
mov dword [esp + 0x1c], ebp
and ebp, 0x12373a65
clc
shl bp, cl
lea esp, [esp + 0x1c]
jp 0x100672e1
mov ebp, esp
btr ax, 0xa
aam 0xdc
pushal
lahf
sub esp, 0xfffffff0
shrd ax, ax, 8
push esi
xor ah, 0x6d
sete ah
push edi
ror al, cl
mov ah, 0xab
btc ax, ax
push ebx
shrd ax, dx, 3
push edx
aad 0x6d
sbb ax, 0x7f75
mov eax, dword [ebp + 8]
cmp cl, dh
jmp 0x100452e9
xchg bp, ax
bsr bp, di
adc ax, bp
mov ebp, esp
ror eax, 6
sbb al, ah
aaa
sub esp, 0x10
aam 0x96
das
not ax
push esi
neg ah
lahf
sbb ah, 0xe0
rol ah, cl
push edi
test ah, 0x90
setae al
dec ax
push ebx
aam 0x34
push 0xd8eaca98
daa
bswap eax
mov dword [esp], edx
rcl ax, cl
mov eax, dword [ebp + 8]
pushal
call fcn.100456b2
Function at 0x40a6c5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x40a73d
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x40a71e
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x40a71b
cmp ecx, 0x5c
je 0x40a71b
cmp ecx, 0x2f
jne 0x40a728
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x40a708
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40a73f
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40aa40
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x40aa7c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x40b311
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x5c], eax
ret

Function at 0x40c870
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40d2e8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x418618]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x40d349
push esi
push dword [0x418614]
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x418618]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x418610]
jmp 0x40d339
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40d337
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x40d327
push edi
push 0x40d286
call fcn.00412082
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4
Function at 0x10002360
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
movd xmm6, dword [esp + 0x58]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ebp
mov eax, 1
cpuid
xor eax, eax
cmp dword [esp + 0x50], 5
jl 0x100025a0
cmp dword [esp + 0x54], 5
jl 0x100025a0
test edx, 0x4000000
je 0x100025a0
movss xmm5, dword [0x19a91400]
pshufd xmm6, xmm6, 0xe0
xorps xmm7, xmm7
cvtdq2ps xmm6, xmm6
shufps xmm5, xmm5, 0xe0
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
lea eax, [0x19a51450]
lea edi, [0x19a513b5]
test dword [esp + 0x3c], 1
cmovne eax, edi
lea edi, [ebp*8]
call eax
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
lea eax, [0x19a5162c]
lea edi, [0x19a514f4]
test dword [esp + 0x3c], 1
cmovne eax, edi
lea edi, [ebp*8]
add ebx, edi
add ecx, edi
add edx, edi
xor esi, esi
call eax
movdqu xmm0, xmmword [esp + 0x3c]
movdqu xmm1, xmmword [esp + 0x4c]
sub esp, 0x20
movdqu xmmword [esp], xmm0
movdqu xmmword [esp + 0x10], xmm1
call fcn.100025c0
add esp, 0x20
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
sub esi, 2
mov eax, dword [esp + 0x3c]
mov edi, ebx
test esi, 1
cmove ebx, edx
cmove edx, edi
xor eax, esi
test eax, 1
lea eax, [0x19a514f4]
lea edi, [0x19a5162c]
cmovne eax, edi
lea edi, [ebp*8]
imul esi, edi
add ebx, esi
add ecx, esi
add edx, esi
xor esi, esi
call eax
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
sub esi, 1
mov eax, dword [esp + 0x3c]
mov edi, ebx
test esi, 1
cmovne ebx, edx
cmovne edx, edi
xor eax, esi
test eax, 1
lea eax, [0x19a51450]
lea edi, [0x19a513b5]
cmovne eax, edi
lea edi, [ebp*8]
imul esi, edi
neg edi
add ebx, esi
add ecx, esi
add edx, esi
call eax
mov esi, dword [esp + 0x54]
sub esi, 4
mov dword [esp + 0x10], esi
mov dword [esp], 2
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov esi, dword [esp]
add dword [esp], 1
mov ebp, dword [esp + 0x50]
lea ebx, [eax + ebx*2]
lea ecx, [eax + ecx*2]
lea edx, [eax + edx*2]
mov eax, dword [esp + 0x3c]
mov edi, ebx
test esi, 1
cmove ebx, edx
cmove edx, edi
xor eax, esi
test eax, 1
lea eax, [0x19a514f4]
lea edi, [0x19a5162c]
cmovne eax, edi
lea edi, [ebp*8]
imul esi, edi
add ebx, esi
add ecx, esi
add edx, esi
lea esi, [ebp - 4]
neg esi
call eax
sub dword [esp + 0x10], 1
jne 0x10002531
mov eax, 1
emms
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
add esp, 0x38
ret
Function at 0x1000bff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push esi
xor esi, esi
xor ebx, ebx
call fcn.1000f740
call fcn.1000f7a0
cmp eax, 0x80008
jne 0x1000c0f2
call fcn.1000f7a0
test eax, eax
je 0x1000c0f2
push ebp
call fcn.1000f740
movzx ebp, ax
cmp ebp, 0xa
je 0x1000c032
cmp ebp, 0xc
jne 0x1000c0f1
mov eax, 0xffff
mov dword [esp + 0x10], ebx
mov ecx, ebp
shl ax, cl
not ax
push edi
mov dword [esp + 0x1c], eax
mov edi, 0x19b9afe0
lea ecx, [ecx]
mov dword [esp + 0x18], 8
cmp esi, ebp
jge 0x1000c0c8
push dword [0x19b9d554]
lea eax, [esp + 0x14]
mov word [esp + 0x14], 0xffff
push 2
push 1
push eax
call fcn.10034540
mov eax, 0x4949
add esp, 0x10
cmp word [0x19b9d54c], ax
jne 0x1000c094
movzx ecx, byte [esp + 0x11]
movzx eax, byte [esp + 0x10]
jmp 0x1000c09e
movzx ecx, byte [esp + 0x10]
movzx eax, byte [esp + 0x11]
shl cx, 8
or cx, ax
shl ebx, 0x10
mov eax, dword [esp + 0x14]
inc dword [esp + 0x14]
and eax, 1
movzx edx, cx
movzx ecx, word [eax*2 + 0x19a90ad8]
movzx eax, dx
xor ecx, eax
or ebx, ecx
add esi, 0x10
sub esi, ebp
mov eax, ebx
mov ecx, esi
shr eax, cl
and eax, dword [esp + 0x1c]
mov word [edi], ax
add edi, 2
dec dword [esp + 0x18]
jne 0x1000c058
cmp edi, 0x19b9b060
jl 0x1000c050
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x1000fdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20
mov eax, dword [0x19a91810]
xor eax, esp
mov dword [esp + 0x1c], eax
fldz
lea eax, [esp + 0x14]
push ebp
push dword [0x19b9d554]
mov ebp, 2
push ebp
push ebp
fst qword [esp + 0x1c]
push eax
fstp qword [esp + 0x18]
call fcn.10034540
mov eax, dword [esp + 0x38]
add esp, 0x10
sub eax, ebp
je 0x1000fea9
push ebx
push esi
push edi
jmp 0x1000fe08
fstp st(1)
fstp st(0)
push dword [0x19b9d554]
lea esi, [esp + 0x28]
dec eax
push 1
lea esi, [esi + ebp*2]
mov dword [esp + 0x3c], eax
push 2
push esi
call fcn.10034540
movzx esi, byte [esi]
mov ebx, ebp
movzx edx, byte [esp + ebp*2 + 0x35]
xor ebx, 2
mov eax, esi
add esp, 0x10
shl eax, 8
or edx, eax
movzx edi, byte [esp + ebx*2 + 0x24]
movzx ecx, byte [esp + ebx*2 + 0x25]
mov eax, edi
shl eax, 8
or ecx, eax
movzx eax, byte [esp + ebx*2 + 0x25]
sub ecx, edx
shl eax, 8
mov dword [esp + 0x10], ecx
or eax, edi
fild dword [esp + 0x10]
movzx ecx, byte [esp + ebp*2 + 0x25]
inc ebp
shl ecx, 8
and ebp, 3
or ecx, esi
sub eax, ecx
fmul st(0), st(0)
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
fadd qword [esp + 0x1c]
fst qword [esp + 0x1c]
fild dword [esp + 0x10]
fmul st(0), st(0)
fadd qword [esp + 0x14]
fst qword [esp + 0x14]
test eax, eax
jne 0x1000fe04
fcompp
fnstsw ax
pop edi
pop esi
pop ebx
test ah, 0x41
mov eax, 0x4d4d
je 0x1000feae
mov eax, 0x4949
mov ecx, dword [esp + 0x20]
pop ebp
xor ecx, esp
call fcn.10007d50
add esp, 0x20
ret
Function at 0x1002b2d0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0xc], 0
push esi
push edi
je 0x1002b36d
mov eax, dword [esp + 0x18]
xor ecx, ecx
imul eax, eax, 0x2e90edd
inc eax
mov dword [ecx + 0x19b007b8], eax
add ecx, 4
cmp ecx, 0x10
jb 0x1002b2e3
mov ecx, dword [0x19b007c0]
mov esi, 0x19b007bc
xor ecx, dword [0x19b007b8]
mov edi, 0x7b
mov eax, dword [0x19b007c4]
shr ecx, 0x1f
add eax, eax
or ecx, eax
mov dword [0x19b007c4], ecx
mov ecx, dword [esi + 8]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
mov eax, dword [esi - 8]
xor eax, dword [esi]
shr ecx, 0x1f
add eax, eax
or ecx, eax
mov dword [esi + 8], ecx
dec edi
jne 0x1002b320
xor ecx, ecx
mov dword [0x19b007b4], ecx
push dword [ecx*4 + 0x19b007b8]
call fcn.10035040
mov ecx, dword [0x19b007b4]
add esp, 4
mov dword [ecx*4 + 0x19b007b8], eax
inc ecx
mov dword [0x19b007b4], ecx
cmp ecx, 0x7f
jb 0x1002b343
jmp 0x1002b373
mov ecx, dword [0x19b007b4]
mov edi, dword [esp + 0x10]
test edi, edi
je 0x1002b3c1
push ebx
mov ebx, dword [esp + 0x10]
lea esi, [ecx - 1]
mov eax, ecx
dec edi
inc ecx
inc esi
test eax, eax
je 0x1002b3ba
lea edx, [esi - 0x3f]
mov eax, ecx
and edx, 0x7f
and eax, 0x7f
mov edx, dword [edx*4 + 0x19b007b8]
xor edx, dword [eax*4 + 0x19b007b8]
mov eax, esi
xor dword [ebx], edx
and eax, 0x7f
add ebx, 4
mov dword [eax*4 + 0x19b007b8], edx
test edi, edi
jne 0x1002b383
mov dword [0x19b007b4], ecx
pop ebx
pop edi
pop esi
ret
Function at 0x10031620
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x19b9d08c]
cmp ecx, 1
je 0x10031643
cmp dword [0x19a964dc], 0
jne 0x10031643
mov eax, dword [0x19a94900]
dec eax
cmp eax, 4
ja 0x10031643
xor eax, eax
jmp 0x10031648
mov eax, 1
or dword [0x19b9d140], eax
jne 0x1003169b
movzx eax, word [0x19b9d086]
push 0x19b5aea0
push 0xffff
push ecx
push eax
movzx eax, word [0x19b9d084]
push eax
push dword [0x19b9d06c]
push 0x19b7aea0
call fcn.10030cb0
add esp, 0x1c
cmp dword [0x19b9d08c], 4
jne 0x1003169a
cmp dword [0x19a94900], 0
je 0x1003169a
mov dword [0x19b9d08c], 3
ret
jmp fcn.1002d590
Function at 0x1002bc15
Capabilities:
Encode data using xor

Disassembly:
pushfd
cmp edi, ebx
mov byte [esp], 0xab
jmp 0x1002f81b
push ebx
push dword [esp + 0xc]
lea esp, [esp + 0x18]
ja 0x100206cd
sbb al, 8
sub ebx, edi
movzx di, al
setne al
stc
add ebx, esp
btc di, cx
call fcn.1002f2e4
add byte [eax], al
inc edi
je 0x1002f896
inc ebp
dec ebp
inc ebx
push eax
add byte [ebp - 0x3cfbdb9c], cl
lea esp, [esp + 4]
ret
jmp dword [sym.imp.KERNEL32.dll_LoadLibraryA_1]
invalid