joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10106180
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
mov eax, edx
mov ecx, dword [ebp + 0xc]
push esi
shr eax, 5
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], eax
imul eax, eax, 0xffffffe0
movzx esi, di
shr edi, 0x10
add edx, eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], edx
test eax, eax
je 0x101062bf
xorps xmm7, xmm7
mov edx, 0xad
mov dword [ebp - 4], 0
movd xmm0, dword [ebp - 4]
cmp eax, edx
movd xmm5, edi
xorps xmm6, xmm6
cmovb edx, eax
sub eax, edx
mov dword [ebp + 8], eax
mov eax, edx
imul eax, esi
movd xmm4, eax
xor eax, eax
punpckldq xmm4, xmm0
xorps xmm0, xmm0
punpckldq xmm4, xmm0
movd xmm0, eax
punpckldq xmm5, xmm0
xorps xmm0, xmm0
punpckldq xmm5, xmm0
nop word [eax + eax]
movups xmm3, xmmword [ecx]
movups xmm2, xmmword [ecx + 0x10]
add ecx, 0x20
movaps xmm0, xmm6
movaps xmm1, xmm3
pmaddubsw xmm3, xmmword [0x102aafa0]
paddd xmm4, xmm0
psadbw xmm1, xmm7
movaps xmm0, xmm2
pmaddubsw xmm2, xmmword [0x102aaf90]
psadbw xmm0, xmm7
pmaddwd xmm3, xmmword [0x102aaf80]
paddd xmm6, xmm1
pmaddwd xmm2, xmmword [0x102aaf80]
paddd xmm6, xmm0
paddd xmm5, xmm3
paddd xmm5, xmm2
sub edx, 1
jne 0x10106200
pshufd xmm1, xmm6, 0xb1
paddd xmm1, xmm6
pslld xmm4, 5
pshufd xmm0, xmm1, 0x4e
paddd xmm0, xmm1
paddd xmm4, xmm5
movd eax, xmm0
pshufd xmm1, xmm4, 0xb1
paddd xmm1, xmm4
add esi, eax
pshufd xmm0, xmm1, 0x4e
mov eax, 0x80078071
paddd xmm0, xmm1
mul esi
movd edi, xmm0
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x101061b3
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10106392
cmp edx, 0x10
jb 0x10106355
movzx eax, byte [ecx]
add esi, eax
movzx eax, byte [ecx + 1]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 2]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 3]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 4]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 5]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 6]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 7]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 8]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 9]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 0xa]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 0xb]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 0xc]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 0xd]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 0xe]
add edi, esi
add esi, eax
movzx eax, byte [ecx + 0xf]
add edi, esi
add ecx, 0x10
add esi, eax
add edi, esi
sub edx, 0x10
test edx, edx
je 0x1010636f
nop dword [eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
add esi, eax
add edi, esi
sub edx, 1
jne 0x10106360
mov eax, 0x80078071
lea ecx, [esi - 0xfff1]
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
cmp esi, 0xfff1
cmovb ecx, esi
mov esi, ecx
shl edi, 0x10
or edi, esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10106950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movd xmm0, dword [ebp + 0x10]
sub ecx, 0x40
movaps xmm3, xmmword [0x102ab120]
movups xmm2, xmmword [eax]
movups xmm5, xmmword [eax + 0x10]
movups xmm6, xmmword [eax + 0x20]
movups xmm7, xmmword [eax + 0x30]
add eax, 0x40
pxor xmm2, xmm0
cmp ecx, 0x40
jb 0x10106a06
mov edx, ecx
shr edx, 6
nop dword [eax]
movups xmm0, xmmword [eax]
sub ecx, 0x40
movaps xmm1, xmm2
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm2, xmm3, 0
pxor xmm2, xmm1
movaps xmm1, xmm5
pclmulqdq xmm1, xmm3, 0x11
pxor xmm2, xmm0
movups xmm0, xmmword [eax + 0x10]
pclmulqdq xmm5, xmm3, 0
pxor xmm5, xmm1
movaps xmm1, xmm6
pxor xmm5, xmm0
movups xmm0, xmmword [eax + 0x20]
pclmulqdq xmm1, xmm3, 0x11
pclmulqdq xmm6, xmm3, 0
pxor xmm6, xmm1
movaps xmm1, xmm7
pxor xmm6, xmm0
movups xmm0, xmmword [eax + 0x30]
add eax, 0x40
pclmulqdq xmm7, xmm3, 0
pclmulqdq xmm1, xmm3, 0x11
pxor xmm7, xmm1
pxor xmm7, xmm0
sub edx, 1
jne 0x10106990
movaps xmm4, xmmword [0x102ab130]
movaps xmm0, xmm2
pclmulqdq xmm0, xmm4, 0x11
pxor xmm0, xmm5
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
movaps xmm1, xmm0
pclmulqdq xmm1, xmm4, 0x11
pxor xmm1, xmm6
pclmulqdq xmm0, xmm4, 0
pxor xmm1, xmm0
movaps xmm2, xmm1
pclmulqdq xmm2, xmm4, 0x11
pxor xmm2, xmm7
pclmulqdq xmm1, xmm4, 0
pxor xmm2, xmm1
cmp ecx, 0x10
jb 0x10106a83
shr ecx, 4
nop word [eax + eax]
lea eax, [eax + 0x10]
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x10]
pclmulqdq xmm1, xmm4, 0x11
pxor xmm1, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
sub ecx, 1
jne 0x10106a60
movaps xmm3, xmmword [0x102ab160]
movaps xmm1, xmm2
movq xmm0, qword [0x102ab140]
pclmulqdq xmm1, xmm4, 0x10
psrldq xmm2, 8
pxor xmm1, xmm2
movaps xmm2, xmm3
pand xmm2, xmm1
psrldq xmm1, 4
pclmulqdq xmm2, xmm0, 0
pxor xmm2, xmm1
movaps xmm1, xmm3
pand xmm1, xmm2
pclmulqdq xmm1, xmmword [0x102ab150], 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmmword [0x102ab150], 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
pop ebp
ret
Function at 0x1010f07a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x100
mov edx, dword [edi + 0x58]
cmp edx, 1
mov ebx, dword [edi + 0x1cc]
sete al
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], edx
mov dword [ebx + 0x1c], eax
mov eax, 0x2fe
push dword [edi + 0x78]
mov ecx, dword [edi + 4]
cmovne eax, esi
push eax
push 1
push edi
call dword [ecx + 8]
xor esi, esi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [ebp - 0x10], esi
cmp dword [edi + 0x78], esi
jle 0x1010f19e
mov ecx, dword [ebx + esi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 8], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jne 0x1010f0ee
mov eax, dword [ebx + 0x18]
add dword [eax + esi*4], 0xff
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax + esi*4]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
lea ebx, [esi*2 - 2]
lea eax, [esi + 0xfe]
mov dword [ebp - 0x18], ebx
cdq
idiv ebx
xor ebx, ebx
mov edx, eax
cmp ebx, edx
jle 0x1010f13e
imul eax, ecx, 0x1fe
lea edi, [esi + 0xfe]
add edi, eax
add edi, 0x1fe
inc ecx
mov eax, edi
cdq
idiv dword [ebp - 0x18]
mov edx, eax
cmp ebx, edx
jg 0x1010f128
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x14]
movzx eax, al
movzx ecx, cl
imul ecx, eax
mov eax, dword [ebp - 0xc]
mov byte [ebx + eax], cl
inc ebx
mov ecx, dword [ebp - 4]
cmp ebx, 0xff
jle 0x1010f116
cmp dword [ebp - 8], 1
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
jne 0x1010f18b
mov ebx, eax
xor ecx, ecx
inc ecx
lea edx, [ebx - 1]
mov al, byte [ebx]
mov byte [edx], al
mov al, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
dec edx
cmp ecx, 0xff
jle 0x1010f170
mov ebx, dword [ebp - 0x1c]
inc esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
cmp esi, dword [edi + 0x78]
jl 0x1010f0d1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10157794
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10157613

Function at 0x101602ae
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1015ff6e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000d0c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000d0d2
pop dword [ebp - 0x44]
mov eax, 0x1000d0d2
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x65eb904c
sub dword [ebp - 0x54], 0x17994b01
mov dword [ebp - 0x50], 0x1ef52fe5
add dword [ebp - 0x50], 0x133e1c60
mov dword [ebp - 0x4c], 0x8daf9b81
add dword [ebp - 0x4c], 0xbe9ca8ad
mov dword [ebp - 0x48], 0x7a52e83b
sub dword [ebp - 0x48], 0x7a52e83b
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x73f6e30b
sub dword [ebp - 0x54], 0xff8479b5
mov dword [ebp - 0x50], 0x239204ff
sub dword [ebp - 0x50], 0xe225a38a
mov dword [ebp - 0x4c], 0xc80c9ba
add dword [ebp - 0x4c], 0x56eea2b2
mov dword [ebp - 0x48], 0x9f6a26c1
sub dword [ebp - 0x48], 0x9f6a26c1
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xad0e8415
add eax, 0x62f34c2f
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3e15d
push 0
call eax
mov ecx, 0xfeb29fea
sub ecx, 0xfeb24907
xor edx, edx
add edx, eax
mov esi, 0xe111300d
sub esi, 0xd10de00d
add esi, dword [ebp - 0x44]
mov ebx, 0xb4c24fd7
add ebx, 0xa69320e2
sub dword [ebp - 0x18], 0x11e79ab9
mov edi, dword [esi]
add dword [ebp - 0x40], 0x449bf070
xor edi, ebx
sub dword [ebp - 0x28], edx
mov dword [edx], edi
mov dword [ebp - 0xc], 0x8ab14fd9
add edx, 0x93f07310
add edx, 0x6c0f8cf4
add esi, 0x22dcb0bb
sub esi, 0x22dcb0b7
loop 0x1000d1ec
add eax, 0xda89816e
add eax, 0x2577ccf1
xor ebx, ebx
add ebx, eax
add eax, 0xcccc45a4
add eax, 0x3333ba61
mov ecx, 0xccf3f9ac
sub ecx, 0xbcf3f9ac
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x1000d45b
Capabilities:
Hash data using djb2

Disassembly:
movzx eax, word [ecx]
mov edx, 0x1505
push esi
xor esi, esi
jmp 0x1000d475
imul edx, edx, 0x21
movzx eax, ax
xor edx, eax
inc esi
movzx eax, word [ecx + esi*2]
test ax, ax
jne 0x1000d468
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret
Function at 0x100015be
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, esp
mov dword [eax + 4], 0x2eb
mov dword [eax], 0x2542a4
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
xor ecx, ecx
lea edx, [esp + 0x60]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], ecx
jmp 0x1000169e
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
call eax
xor ecx, ecx
mov edx, 0x18
mov esi, dword [esp + 0x58]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x18
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], edx
call fcn.10005800
mov eax, esp
lea ecx, [esp + 0x60]
mov dword [eax], ecx
mov dword [eax + 4], 0xfe6
mov eax, dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
call eax
sub esp, 8
mov dword [esp + 0x44], eax
jmp 0x10001684
mov eax, dword [esp + 0x40]
add eax, 1
mov ecx, esp
mov dword [ecx], 0x9af
mov ecx, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x3c], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0x3c]
cmp ecx, 0xa
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], ecx
jne 0x10001650
mov eax, dword [esp + 0x34]
add eax, 1
cmp eax, 0xfa
mov dword [esp + 0x54], eax
jne 0x1000169e
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov edx, esp
mov dword [edx], 0x63f80a
mov edx, dword [sym.imp.USER32.dll_SetFocus]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
call edx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xdb1045
mov ecx, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov dword [esp + 0x2c], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 8], 0x634
mov dword [ecx + 4], 0xb67f0d
mov dword [ecx], 0x896e5a
mov ecx, dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov dword [esp + 0x28], eax
call ecx
sub esp, 0xc
xor ecx, ecx
mov edx, dword [esp + 0x34]
sub edx, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
je 0x100015fb
jmp 0x10001718
mov eax, dword [esp + 0x34]
sub eax, 0x2e
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov dword [esp + 0x40], ecx
jne 0x10001650
jmp 0x10001733
mov eax, esp
mov dword [eax], 0x178594
mov eax, dword [sym.imp.GDI32.dll_BeginPath]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x52df89
mov ecx, dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov dword [esp + 0x14], eax
call ecx
sub esp, 4
mov eax, esp
mov dword [eax], 0x4cf98d
mov eax, dword [sym.imp.GDI32.dll_GetBkColor]
call eax
sub esp, 4
mov dword [esp + 0x10], eax
jmp 0x100015fb

Function at 0x10005c0c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10230620]
jne 0x10005c16
repz ret
jmp fcn.10005ebd
Function at 0x10006675
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 0x20f3
xor edi, edi
mov dword [0x10230600], 0x20f3
mov dword [0x1023060c], 0
mov byte [0x10230610], 0
mov dword [0x10230604], 0x1f84
mov dword [0x10230608], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffffed74
mov edx, eax
mov bl, dl
mov dword [0x10230604], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov eax, dword [0x10230604]
mov edx, eax
add edx, 0x22fb
mov dword [0x10230600], edx
mov esi, dword [0x10230608]
add esi, 1
mov dword [0x10230608], esi
cmp esi, 0x100
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
jl 0x100066cc
jmp 0x100067e6
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x23e
mov esi, 0x100
mov dword [ebp - 0x30], eax
xor edi, edi
mov dword [ebp - 0x34], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov dword [0x10230614], 0
mov dword [0x10230604], ecx
mov ecx, dword [0x1023060c]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x30]
movzx edi, byte [ebx + edi]
add edi, ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
add edi, edx
mov dword [0x10230614], edi
mov eax, edi
cdq
idiv esi
mov dword [0x1023060c], edx
mov dword [0x10230600], 0x133c
mov esi, dword [ebp - 0x30]
mov cl, byte [ebx + esi]
mov byte [0x10230610], cl
mov dword [0x10230604], 0x2285
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10230610]
mov edx, dword [0x1023060c]
mov byte [ebx + edx], cl
mov dword [0x10230600], 0xce3
mov edx, dword [0x10230608]
add edx, 1
mov dword [0x10230608], edx
cmp edx, 0x100
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edx
jl 0x10006723
jmp 0x10006806
xor eax, eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x1856
mov dword [0x10230608], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jmp 0x10006723
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10006890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x10230604], 0x1669
mov dword [0x10230600], 0x5a0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x1000690a
lea eax, [ebp - 0x20]
mov dword [0x10230600], 0x26eb
mov dword [0x10230604], 0x7fc
mov dword [ebp - 0x30], eax
call fcn.100071b9
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.1000629f
xor ecx, ecx
mov dword [0x10230600], 0x79
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x100069cd
jmp 0x10006936
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1022c57f]
mov dh, byte [eax + 0x1022c550]
sub dh, dl
mov byte [ebp + eax - 0x20], dh
cmp ecx, 0xe
mov dword [ebp - 0x2c], ecx
je 0x100068bd
jmp 0x1000690a
mov dword [0x10230600], 0xb1f
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10230600], 0xc6
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.100064a3
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x10230600], 0xf02
mov edx, dword [ebp - 0x28]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x30], ecx
mov dword [0x10230604], 0x123a
cmp ecx, 0
mov dword [ebp - 0x38], eax
jne 0x100069d5
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret
mov eax, dword [ebp - 0x3c]
add eax, 0x18de
mov dword [0x10230604], 0x1815
mov dword [ebp - 0x38], eax
jmp 0x100069cd
Function at 0x10006aa3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov ecx, dword [0x10230604]
add ecx, 0xfffff6df
mov dword [0x10230600], ecx
mov dword [0x10230604], 0x1131
mov dword [ebp - 0x10], eax
call fcn.1000759a
xor ecx, ecx
mov edx, eax
mov dword [0x10230604], 0x1283
mov dword [0x10230600], 0x15c6
mov esi, dword [eax + 0x3c]
mov dword [0x10230604], 0x8cd
mov esi, dword [eax + esi + 0x78]
mov dword [0x10230604], 0x3582
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x10230600], 0xffffecce
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x10006c28
jmp 0x10006bac
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + ecx*4]
mov dword [0x10230600], 0x2c61
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
jmp 0x10006bc3
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x10006bc3
jmp 0x10006bf0
xor eax, eax
mov ecx, dword [ebp - 0x30]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], eax
jb 0x10006b36
jmp 0x10006c28
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
jmp 0x10006b36
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
jne 0x10006b5c
mov al, byte [ebp - 0x42]
test al, 1
jne 0x10006bf9
jmp 0x10006b86
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x10230604], 0x553
mov ecx, dword [edx + ecx*4]
mov dword [0x10230600], 0x15a4
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100072fc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x10230600], 0x1557
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x10230604], 0x43b
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x100073d0
mov dword [0x10230600], 0x2244
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10007433
jmp 0x10007450
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x100073ec
jmp 0x10007450
mov dword [0x10230604], 0xfffff81a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000733f
jmp 0x10007450
mov dword [0x10230600], 0x96f
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
jl 0x100073d0
jmp 0x10007361
mov eax, 1
mov dword [0x10230600], 0x720
mov dword [ebp - 0x20], eax
jmp 0x1000745f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
je 0x10007361
jmp 0x10007396
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10007450
mov dword [0x10230600], 0xffffeee6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10007450
mov dword [0x10230604], 0xffffd45e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10007378
jmp 0x10007450
mov dword [0x10230604], 0x220f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
je 0x100073b9
xor eax, eax
mov dword [0x10230604], 0xe66
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x1000772c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10230608], 0
mov dword [0x1023060c], 0
mov dword [0x10230618], 0
mov ebx, dword [0x10230600]
add ebx, 0xffffe9e9
mov dword [0x10230604], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x100078b6
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add ecx, 1
add edx, 0xffffe742
mov ebx, eax
add ebx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10230608], edx
mov dword [0x10230600], 0x1896
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ecx + edx]
add ecx, esi
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x1023060c], edx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10230610], cl
mov edi, dword [ebp - 0x34]
mov dword [0x10230600], edi
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10230610]
mov edx, dword [0x1023060c]
mov byte [edi + edx], cl
mov edx, dword [0x10230600]
add edx, 0xffffee17
mov dword [0x10230604], edx
mov edx, dword [0x10230608]
movzx edx, byte [edi + edx]
mov ecx, dword [0x1023060c]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x10230618], ecx
mov dword [0x10230600], 0x1309
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x10230604], 0x904
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov dword [0x10230600], 0x1ce0
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x3c], ebx
je 0x100078b6
mov eax, dword [0x1023060c]
mov ecx, dword [0x10230604]
mov edx, dword [0x10230608]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], esi
jmp 0x1000779a
mov dword [0x10230600], 0x129a
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret