joyce8/EMBER2024-capa huggingface dataset:
Function at 0x978f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x978ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x979035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00978e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x978fc5
mov edi, 0x9938b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x979035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00978e00
add edi, 4
add esp, 0xc
cmp edi, 0x9938c0
jb 0x979000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x979070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.0097f082
mov esi, eax
add esp, 8
test esi, esi
je 0x979107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x979102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.0097e946
add esp, 8
test eax, eax
je 0x9790e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x9790e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.0097e946
add esp, 8
test eax, eax
jne 0x9790c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x979102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x979f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x98e9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x97a002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.0097ddff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x97a002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.009756e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0097e20b
push 0x10
call fcn.0097e1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x979fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0096a1c0
jmp 0x979fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00979b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x979ff0
mov ecx, edi
call fcn.0096a2c0
push edi
call fcn.0097e1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x97a021
inc ebx
cmp ebx, 0x20
jb 0x979f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x97b250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x98f808
push 0x97f288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x97b329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x97b329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0097e1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x97b329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x97b329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x97b32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0097b351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x97bd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x97bd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x97bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x97bd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x97bd94
push eax
push esi
call fcn.0097e20b
add esp, 8
pop esi
ret 0x10

Function at 0x97bda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x97be22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x97be15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x994320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0097ddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x97bdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x97be30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x97bec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x97beb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x994320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0097ddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x97beab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x97be6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x97c000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x97c131
push esi
call fcn.0097f145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0096e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x97c131
push 0
push ebp
call fcn.0096e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0096e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x97c08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0096e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x97c121
push 0x994918
push edi
call fcn.0097d3f0
push eax
push ebx
push esi
call fcn.0097bf60
push 0x9948f8
push edi
call fcn.0097d3f0
push eax
push ebx
push esi
call fcn.0097bf60
push 0x9948d8
push edi
call fcn.0097d3f0
push eax
push ebx
push esi
call fcn.0097bf60
push 0x9948c0
push edi
call fcn.0097d3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0097bf60
push 0x9948a0
push edi
call fcn.0097d3f0
push eax
push ebx
push esi
call fcn.0097bf60
push 0x994888
push edi
call fcn.0097d3f0
push eax
push ebx
push esi
call fcn.0097bf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x97d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0097d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0097d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0097d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0097d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x97dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x97dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x98f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x97dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x97dc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10004a40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10005b30
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x1008c829]
push 1
push 3
call fcn.10002ab0
add esp, 8
test eax, eax
je 0x10004b4a
mov word [eax], 0xa0b
mov byte [eax + 2], 0x48
mov esi, eax
movzx eax, byte [0x1008c829]
push 8
push 0x18
call fcn.10002ab0
add esp, 8
test eax, eax
je 0x10004b53
mov edi, eax
movzx eax, byte [0x1008c829]
push 1
push 2
call fcn.10002ab0
add esp, 8
test eax, eax
je 0x10004b6b
mov ecx, eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [edi + 8], 2
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], 2
mov word [ecx], 0xa0b
mov dword [edi + 4], 0x40240000
mov dword [edi], 0
mov byte [edi + 0x14], 0
mov byte [eax + 0x40], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xee6b280
mov dword [eax + 0x34], 3
mov dword [eax + 0x38], esi
mov dword [eax + 0x3c], 3
mov dword [eax + 0x20], 0x3b9aca00
mov dword [eax + 0x28], 1
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], 1
mov dword fs:[0], edx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push 3
push 1
call fcn.1005eeb0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
push 0x18
push 8
call fcn.1005eeb0
add esp, 8
jmp 0x10004b84
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 1
push 2
push 1
call fcn.1005eeb0
add esp, 8
ud2
Function at 0x1000e600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp], ecx
mov ecx, dword [edx + 0x14]
mov esi, dword [edx + 0x10]
mov bl, 1
lea eax, [ecx + 1]
cmp eax, esi
mov dword [edx + 0x14], eax
jae 0x1000e639
mov edi, dword [edx + 0xc]
mov bl, 1
movzx edi, byte [edi + eax]
cmp edi, 0x2b
je 0x1000e631
cmp edi, 0x2d
jne 0x1000e639
xor ebx, ebx
add ecx, 2
mov eax, ecx
mov dword [edx + 0x14], ecx
cmp eax, esi
jae 0x1000e7de
mov ebp, dword [edx + 0xc]
mov dword [esp + 4], ebx
lea ecx, [eax + 1]
movzx ebx, byte [ebp + eax]
mov dword [edx + 0x14], ecx
add bl, 0xd0
cmp bl, 0xa
jae 0x1000e7e8
mov edi, dword [esp + 0x30]
mov bh, byte [esp + 0x2c]
cmp ecx, esi
mov dword [esp + 0x14], edi
movzx edi, bl
jae 0x1000e6e0
neg esi
add eax, 2
jmp 0x1000e693
movzx ecx, cl
lea edi, [edi + edi*4]
lea edi, [ecx + edi*2]
lea ecx, [esi + eax + 1]
inc eax
cmp ecx, 1
je 0x1000e6e0
movzx ecx, byte [ebp + eax - 1]
add cl, 0xd0
cmp cl, 0xa
jae 0x1000e6e0
cmp edi, 0xccccccb
mov dword [edx + 0x14], eax
jle 0x1000e680
cmp edi, 0xccccccc
jne 0x1000e6b8
cmp cl, 7
jbe 0x1000e680
mov ecx, dword [esp + 0x14]
xor eax, eax
movzx esi, byte [esp + 4]
movzx edi, bh
or ecx, dword [esp + 0x34]
mov ecx, dword [esp]
sete al
push esi
push eax
push edi
call fcn.1005d8e0
add esp, 0x24
jmp 0x1000e7cf
mov esi, dword [esp + 0x38]
cmp byte [esp + 4], 0
je 0x1000e6fa
lea eax, [esi + edi]
sar eax, 0x1f
add eax, 0x80000000
add esi, edi
jmp 0x1000e708
xor eax, eax
cmp esi, edi
setns al
add eax, 0x7fffffff
sub esi, edi
cmovo esi, eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
movd xmm0, eax
movd xmm1, ecx
mov eax, esi
punpckldq xmm1, xmm0
neg eax
punpckldq xmm1, xmmword [0x100610f0]
cmovs eax, esi
cmp eax, 0x135
subpd xmm1, xmmword [0x10061100]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
jb 0x1000e788
movsd xmm2, qword [0x10061c88]
xorpd xmm1, xmm1
nop word cs:[eax + eax]
nop
ucomisd xmm0, xmm1
jne 0x1000e768
jnp 0x1000e7b1
test esi, esi
jns 0x1000e80d
divsd xmm0, xmm2
add esi, 0x134
mov eax, esi
neg eax
cmovs eax, esi
cmp eax, 0x134
ja 0x1000e760
mov ecx, dword [0x1007909c]
test esi, esi
movsd xmm1, qword [ecx + eax*8]
js 0x1000e7d4
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x10061c90]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x10061ca0]
jae 0x1000e80d
test bh, bh
jne 0x1000e7bd
xorpd xmm0, xmmword [0x10061cb0]
mov eax, dword [esp]
movsd qword [eax + 8], xmm0
xor eax, eax
mov ecx, dword [esp]
mov dword [ecx], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
divsd xmm0, xmm1
test bh, bh
je 0x1000e7b5
jmp 0x1000e7bd
mov dword [esp + 8], 5
jmp 0x1000e7f0
mov dword [esp + 8], 0xd
lea eax, [esp + 8]
push eax
push edx
mov esi, dword [esp + 8]
call fcn.1005d970
add esp, 8
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x1000e7cc
lea eax, [esp + 8]
mov dword [esp + 8], 0xe
push eax
push edx
call fcn.1005d970
mov ecx, dword [esp + 8]
add esp, 8
mov dword [ecx + 4], eax
mov eax, 1
jmp 0x1000e7c7
Function at 0x10024ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
movzx ebx, byte [esp + 0x4c]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
test bl, bl
je 0x10024f09
movzx eax, bl
xor ebp, ebp
lea ecx, [eax + 0x2f6]
add eax, 0x19c
and eax, ecx
inc ah
cmp ah, 1
ja 0x10024f3c
test ah, ah
je 0x10024fe6
lea eax, [esp + 8]
push 1
push str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
push edi
push eax
call fcn.1003ba50
add esp, 0x10
cmp byte [esp + 8], 4
jne 0x10024f2c
mov ebp, 1
jmp 0x10024f3c
mov eax, dword [esp + 8]
mov ebp, dword [esp + 0xc]
cmp al, 4
jne 0x10024fe2
cmp bl, 0x64
jb 0x10024f68
movzx eax, bl
xor esi, esi
lea ecx, [eax + eax*4]
lea eax, [eax + ecx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
mov ebx, eax
movzx ecx, word [ecx + ecx + 0x1006340e]
mov word [esp + 9], cx
jmp 0x10024f72
mov esi, 2
cmp bl, 0xa
jae 0x10024f7b
or bl, 0x30
mov byte [esp + esi + 8], bl
jmp 0x10024f90
movzx eax, bl
mov esi, 1
movzx eax, word [eax + eax + 0x1006340e]
mov word [esp + 9], ax
lea eax, [esp + esi + 8]
xor esi, 3
mov ecx, esp
push esi
push eax
push edi
push ecx
call fcn.1003ba50
add esp, 0x10
cmp byte [esp], 4
je 0x10024fb6
mov eax, dword [esp]
mov esi, dword [esp + 4]
cmp al, 4
jne 0x10024fc6
mov eax, dword [esp + 0x44]
add esi, ebp
mov dword [eax + 4], esi
mov esi, eax
mov byte [eax], 4
jmp 0x1002502b
mov edx, dword [esp + 0x44]
mov ecx, eax
shr ecx, 8
mov byte [edx], al
shr eax, 0x18
mov word [edx + 1], cx
mov byte [edx + 3], al
mov dword [edx + 4], esi
mov esi, edx
jmp 0x1002502b
mov ecx, eax
jmp 0x10025018
mov ebx, esi
lea esi, [esp + 8]
nop dword [eax]
push 1
push str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
push edi
push esi
call fcn.1003ba50
add esp, 0x10
cmp byte [esp + 8], 4
je 0x10024ff0
mov eax, dword [esp + 8]
cmp al, 4
je 0x10024ff0
mov ebp, dword [esp + 0xc]
mov ecx, eax
mov esi, ebx
shrd ecx, ebp, 8
mov byte [esi], al
mov word [esi + 1], cx
shr ecx, 0x10
mov byte [esi + 3], cl
mov dword [esi + 4], ebp
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100264c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
movzx ebx, byte [esp + 0x4c]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
test bl, bl
je 0x100264f9
movzx eax, bl
xor ebp, ebp
lea ecx, [eax + 0x2f6]
add eax, 0x19c
and eax, ecx
inc ah
cmp ah, 1
ja 0x1002652c
test ah, ah
je 0x100265d6
lea eax, [esp + 8]
push 1
push str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
push edi
push eax
call fcn.1003b530
add esp, 0x10
cmp byte [esp + 8], 4
jne 0x1002651c
mov ebp, 1
jmp 0x1002652c
mov eax, dword [esp + 8]
mov ebp, dword [esp + 0xc]
cmp al, 4
jne 0x100265d2
cmp bl, 0x64
jb 0x10026558
movzx eax, bl
xor esi, esi
lea ecx, [eax + eax*4]
lea eax, [eax + ecx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
mov ebx, eax
movzx ecx, word [ecx + ecx + 0x1006340e]
mov word [esp + 9], cx
jmp 0x10026562
mov esi, 2
cmp bl, 0xa
jae 0x1002656b
or bl, 0x30
mov byte [esp + esi + 8], bl
jmp 0x10026580
movzx eax, bl
mov esi, 1
movzx eax, word [eax + eax + 0x1006340e]
mov word [esp + 9], ax
lea eax, [esp + esi + 8]
xor esi, 3
mov ecx, esp
push esi
push eax
push edi
push ecx
call fcn.1003b530
add esp, 0x10
cmp byte [esp], 4
je 0x100265a6
mov eax, dword [esp]
mov esi, dword [esp + 4]
cmp al, 4
jne 0x100265b6
mov eax, dword [esp + 0x44]
add esi, ebp
mov dword [eax + 4], esi
mov esi, eax
mov byte [eax], 4
jmp 0x1002661b
mov edx, dword [esp + 0x44]
mov ecx, eax
shr ecx, 8
mov byte [edx], al
shr eax, 0x18
mov word [edx + 1], cx
mov byte [edx + 3], al
mov dword [edx + 4], esi
mov esi, edx
jmp 0x1002661b
mov ecx, eax
jmp 0x10026608
mov ebx, esi
lea esi, [esp + 8]
nop dword [eax]
push 1
push str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember
push edi
push esi
call fcn.1003b530
add esp, 0x10
cmp byte [esp + 8], 4
je 0x100265e0
mov eax, dword [esp + 8]
cmp al, 4
je 0x100265e0
mov ebp, dword [esp + 0xc]
mov ecx, eax
mov esi, ebx
shrd ecx, ebp, 8
mov byte [esi], al
mov word [esi + 1], cx
shr ecx, 0x10
mov byte [esi + 3], cl
mov dword [esi + 4], ebp
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002c3c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
call fcn.1003fd20
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], ecx
mov ecx, dword [ebp + 0x10]
cmp ebx, 0x3b9aca00
mov eax, 0xffffffff
mov edx, 0x3b9ac9ff
cmovne edx, ebx
mov dword [esp + 8], edx
cmove ecx, eax
cmovne eax, dword [ebp + 0xc]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 4]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
push eax
push 0x1002c510
call dword [sym.imp.user32.dll_EnumWindows]
test eax, eax
jne 0x1002c47f
call fcn.1002f3c0
test edx, edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], 1
je 0x1002c47f
lea eax, [esp + 0x3c]
push eax
call fcn.1002f390
add esp, 4
mov edx, dword [esp + 0x2c]
cmp dword [esp + 0x28], 0
jne 0x1002c4f8
mov dword [esp + 4], edx
push 0x5f5e100
push 0
push 0
call fcn.10038ad0
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.10040110
add esp, 4
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov edi, edx
xor edx, esi
xor ebx, ebx
xor eax, ecx
or eax, edx
mov edx, dword [esp + 0x1c]
setne bl
cmp dword [esp + 0x18], ecx
mov ecx, 0xff
sbb edi, esi
cmovb ebx, ecx
xor eax, eax
cmp edx, dword [esp + 8]
setne al
cmovb eax, ecx
test bl, bl
cmovne eax, ebx
cmp al, 1
jne 0x1002c420
mov edx, dword [esp + 4]
xor eax, eax
jmp 0x1002c4fd
mov eax, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret