joyce8/EMBER2024-capa huggingface dataset:
Function at 0xda0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00da01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xda007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda006a
add dl, dl
jne 0xda0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda00dc
xor eax, eax
add dl, dl
jne 0xda0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda017d
add dl, dl
jne 0xda00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xda00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xda0075
mov eax, 1
add dl, dl
jne 0xda00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda00e1
sub eax, ebx
mov ebx, 1
jne 0xda0128
mov ecx, 1
add dl, dl
jne 0xda010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xda013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda0136
cmp eax, 0x7d00
jae 0xda016d
cmp eax, 0x500
jb 0xda0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda0075
cmp eax, 0x7f
ja 0xda0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xda019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xda0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1a3a6c21
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x54bf4b55
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x82d69c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x82d6a6
pushal
call 0x82d6ac
pop ebp
sub ebp, 0x10
sub ebp, 0x42d69c
jmp 0x82d6c2
mov eax, 0x42d69c
add eax, ebp
add eax, 0x4c
mov ecx, 0x611
mov edx, 0x39bd75d9
xor byte [eax], dl
inc eax
dec ecx
jne 0x82d6d9
jmp 0x82d6ec
push edx
adc al, 0x52
push eax
in eax, 0xd9
fstpnce st(1), st(0)
pop eax
sbb byte [ecx], ah
fstpnce st(1), st(0)
fstpnce st(2), st(0)
adc al, 0x61
fstp st(1)
fstpnce st(1), st(0)
arpl cx, si
fstpnce st(1), st(0)
fldcw word [esi]
cmp ebx, edx
adc dword [edx + 0x58], edx
aad 0xd9
fstpnce st(1), st(0)
ficomp dword [esp + edx*2]
mov ebp, 0xdd5025fd
std
push esp
mov ebp, 0xdd5025fd
std
mov cl, 0xed
pop ebp
xlatb
fnstenv [ecx - 0x26127441]
fdiv st(5)
std
mov cl, 0x50
inc esp
invalid
Function at 0x4101b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x456548
push 0x439290
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x459178]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004025f6
mov edx, esi
mov ecx, edi
call fcn.00410300
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x410245
test bl, bl
jne 0x4102de
cmp edi, 0x1a
jne 0x4102de
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x410267
mov eax, dword [esi]
jmp 0x410269
mov eax, esi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x430], ax
push 0x40e
push eax
lea eax, [ebp - 0x42e]
push eax
call fcn.004374e0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [ebp - 0x430], 0
jne 0x4102b1
xor eax, eax
jmp 0x4102c0
lea eax, [ebp - 0x430]
push eax
call fcn.004370ab
add esp, 4
push eax
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.00402102
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00436362
mov esp, ebp
pop ebp
ret
Function at 0x42f926
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x42f936
mov dword [edi], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0x10], esi
test ecx, ecx
je 0x42f98e
mov eax, 0x8000
cmp ecx, eax
push esi
cmovb eax, ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 8]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test edi, edi
je 0x42f96b
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
test eax, eax
jne 0x42f98e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42f980
mov esi, 0x80004005
jmp 0x42f98e
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x4330c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x4330e5
xor eax, eax
jmp 0x433227
add dword [ebp + 8], 5
lea eax, [edx - 4]
push ebx
or ebx, 0xffffffff
add eax, ecx
mov dword [ebp - 4], eax
lea edx, [edi + ecx]
mov dword [ebp - 0xc], edx
cmp edx, eax
jae 0x433118
mov ecx, dword [ebp - 4]
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x43310f
inc edx
cmp edx, ecx
jb 0x433102
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov edi, edx
sub edi, ecx
cmp edx, eax
jae 0x43320b
mov ecx, edi
sub ecx, ebx
cmp ecx, 3
jbe 0x43319e
xor esi, esi
mov al, byte [edx + 4]
mov ebx, edi
mov dword [ebp - 0x18], ebx
test al, al
je 0x433143
cmp al, 0xff
jne 0x4331cb
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
mov edx, dword [ebp + 8]
shl ebx, 8
or ebx, eax
sub ebx, edi
sub ebx, edx
mov dword [ebp - 0x14], ebx
test esi, esi
je 0x4331df
movzx eax, byte [esi + 0x44d440]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x43318d
cmp al, 0xff
jne 0x4331df
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [ebp - 0x10]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [ebp - 0x14]
jmp 0x433164
dec ecx
shl esi, cl
and esi, 7
je 0x43312f
movzx eax, byte [esi + 0x44d440]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x44cfa4], 0
mov al, byte [ecx + 4]
je 0x4331c9
test al, al
je 0x4331c9
cmp al, 0xff
jne 0x43312f
mov ebx, edi
and esi, 3
add esi, esi
or esi, 1
inc edi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
jmp 0x4330f5
mov edx, dword [ebp - 0xc]
mov eax, ebx
shr eax, 0x18
and al, 1
dec al
not al
mov byte [edx + 1], bl
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x18]
shr eax, 8
add edi, 5
mov byte [edx + 2], al
jmp 0x4331d4
mov edx, edi
xor eax, eax
sub edx, ebx
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp edx, 3
cmova esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43397c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x4339b2
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x4339a5
cmp esi, ecx
jae 0x433a9e
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x433a30
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
and eax, 0xff
shr ecx, 8
and ecx, 0xff
movzx eax, byte [eax + str.cw]
movzx ecx, byte [ecx + str.cw]
or edx, eax
mov eax, dword [ebp - 8]
shl edx, 8
movzx eax, byte [eax + 0x44d570]
xor ecx, eax
or ecx, edx
jmp 0x433a84
cmp edi, 6
jbe 0x433a84
cmp edx, 4
jne 0x433a84
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4339c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43fa28
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x459178]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0043956a
mov dword [ebp - 0x14], eax
cmp dword [0x45d764], esi
jne 0x43fb1b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43faa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43fbfb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43fbfb
push 0x44d7b4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43fbfb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45d764], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45d768], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45d76c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45d774], eax
test eax, eax
je 0x43fb18
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45d770], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43fb40
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43fb33
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43fb55
push 4
pop eax
jmp 0x43fbfd
cmp dword [ebp - 0x14], esi
je 0x43fb55
push dword [0x45d764]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43fb3a
mov eax, dword [0x45d770]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x43fbb3
cmp dword [0x45d774], edi
je 0x43fbb3
push eax
call ebx
push dword [0x45d774]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43fbb3
test eax, eax
je 0x43fbb3
call ecx
test eax, eax
je 0x43fba8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43fba8
test byte [ebp - 8], 1
jne 0x43fbb3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x43fbe3
mov eax, dword [0x45d768]
cmp eax, edi
je 0x43fbe0
push eax
call ebx
test eax, eax
je 0x43fbe0
call eax
mov esi, eax
test esi, esi
je 0x43fbe0
mov eax, dword [0x45d76c]
cmp eax, edi
je 0x43fbe0
push eax
call ebx
test eax, eax
je 0x43fbe0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45d764]
call ebx
test eax, eax
je 0x43fbfb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43fbfd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00436362
mov esp, ebp
pop ebp
ret
Function at 0x1006935
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x100696c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x1006946
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x1006941
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x100699d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x100697f
pop edi
not eax
pop esi
ret 0xc
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x102c0e7c]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x102c0e8c], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x102c0e9c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100ddeee
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x102c0e9c], 0
call fcn.10001a30
mov ecx, dword [0x102c0e98]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100ddeee
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x102c0e98], 0
mov dword [0x102c0e8c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x102c0e90], 0
je 0x10002679
mov eax, dword [0x102c0e90]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.100de50f
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100ddeee
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x102c0e90], eax
mov dword [0x102c0e94], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x102c0e98]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x102c0e98], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10004785
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and ecx, 0xfffffffc
mov esp, ecx
mov ebp, dword [esp + 0x30]
mov ecx, 0xfffffff8
mov eax, 2
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
add ebx, 0xb10
mov esi, dword [edx - 4]
mov dword [edx - 4], 0xfffffffe
mov dword [ebx - 0xa44], 0xffffffff
jmp 0x100046bb

Function at 0x100089d0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x100089eb
bts eax, 7
shr ecx, 1
test cl, 1
je 0x100089f6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10008a01
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10008a0c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10008a17
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10008a22
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10008a2d
bts eax, 1
test cl, 2
je 0x10008a36
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10008ad2
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10008ac3
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x100089e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008b00
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x10136444
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10008b3a
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10008b68
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x10008bc0
push esi
nop
mov esi, ebx
test eax, eax
je 0x10008ba7
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10008b86
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10008b80
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000c690
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x1000c5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x1000c5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x1000c5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x1000c5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x1000c5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x1000c723
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]