joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x7a
mov dword [ebp - 4], 0
jmp 0x10002822
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x19
jge 0x10002861
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x7d9831a5]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000285c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10002819
mov eax, 1
imul ecx, eax, 0x19
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10002880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x81
mov dword [ebp - 4], 0
jmp 0x100028a2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x100028e1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x7f63df12]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100028dc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10002899
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10002900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x83
mov dword [ebp - 4], 0
jmp 0x10002922
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x10002961
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x91c5a21]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000295c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10002919
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10002980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x99
mov dword [ebp - 4], 0
jmp 0x100029a2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x100029e1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x848576d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100029dc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10002999
mov eax, 1
shl eax, 3
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10002a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x9a
mov dword [ebp - 4], 0
jmp 0x10002a22
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x17
jge 0x10002a61
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0xd8c3c9d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10002a5c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10002a19
mov eax, 1
imul ecx, eax, 0x17
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10002a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa4
mov dword [ebp - 4], 0
jmp 0x10002aa2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x17
jge 0x10002ae1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x1e2cb7ff]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10002adc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10002a99
mov eax, 1
imul ecx, eax, 0x17
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10002b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xbe
mov dword [ebp - 4], 0
jmp 0x10002b22
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x10002b61
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x666dae97]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10002b5c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10002b19
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10002b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xe0
mov dword [ebp - 4], 0
jmp 0x10002ba2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x10002be1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x604e8c40]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10002bdc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10002b99
mov eax, 1
shl eax, 3
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10003450
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1005bae8
push 0x1002b170
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe8
push ebx
push esi
push edi
mov eax, dword [0x1005f904]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x28
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10060a28]
test eax, eax
jge 0x100034b1
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x19]
jmp 0x1000353a
lea edx, [ebp - 0x28]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x100034e0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x1a], 0
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x1a]
jmp 0x1000353a
push 4
lea ecx, [ebp - 0x28]
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
call fcn.10004810
add esp, 0x10
movzx eax, al
test eax, eax
je 0x10003515
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x1b], 1
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x1b]
jmp 0x1000353a
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
jmp 0x10003538
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003bb0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x348
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x340], 0
lea ecx, [ebp - 0x334]
call fcn.10002e70
mov dword [ebp - 4], 0
mov eax, 1
imul ecx, eax, 0
mov dword [ebp - 0x34c], ecx
cmp dword [ebp - 0x34c], 0x104
jae 0x10003c13
jmp 0x10003c18
call fcn.10028ffb
mov edx, dword [ebp - 0x34c]
mov byte [ebp + edx - 0x114], 0
cmp dword [ebp + 0xc], 0
je 0x10003c52
mov eax, dword [ebp + 0xc]
push eax
call fcn.1002e2a0
add esp, 4
test eax, eax
je 0x10003c52
lea ecx, [ebp - 0x114]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x10003c8a
lea edx, [ebp - 0x334]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002d00
mov eax, dword [ebp - 0x340]
or eax, 1
mov dword [ebp - 0x340], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.100030b0
mov eax, dword [ebp + 8]
jmp 0x10003e0d
mov cx, word [0x1004a424]
mov word [ebp - 0x338], cx
mov dl, byte [0x1004a426]
mov byte [ebp - 0x336], dl
mov dword [ebp - 0x348], 0
lea eax, [ebp - 0x114]
mov dword [ebp - 0x33c], eax
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 0x33c]
mov cl, byte [eax]
mov byte [ebp + edx - 0x338], cl
push 0x104
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x10003d97
lea ecx, [ebp - 0x218]
push ecx
call fcn.1002e2a0
add esp, 4
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x104
jae 0x10003d97
mov edx, dword [ebp - 0x344]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1002e330
add esp, 0xc
test eax, eax
jne 0x10003d41
mov dword [ebp - 0x350], 1
jmp 0x10003d4b
mov dword [ebp - 0x350], 0
mov edx, dword [ebp - 0x350]
mov dword [ebp - 0x348], edx
cmp dword [ebp - 0x348], 0
je 0x10003d97
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x344]
push eax
lea ecx, [ebp - 0x338]
push ecx
push str._s_s
lea edx, [ebp - 0x31c]
push edx
call fcn.10002420
add esp, 0x10
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x334]
call fcn.10003160
mov ecx, dword [ebp - 0x33c]
movsx edx, byte [ecx]
mov dword [ebp - 0x354], edx
mov eax, dword [ebp - 0x33c]
add eax, 1
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x354], 0
je 0x10003dc0
jmp 0x10003d97
cmp dword [ebp - 0x348], 0
jne 0x10003dda
mov ecx, dword [ebp - 0x33c]
movsx edx, byte [ecx]
test edx, edx
jne 0x10003cba
lea eax, [ebp - 0x334]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002d00
mov ecx, dword [ebp - 0x340]
or ecx, 1
mov dword [ebp - 0x340], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.100030b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10003e30
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x28
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10003e51
xor al, al
jmp 0x10003e95
push 2
push 0x1004a430
mov ecx, dword [ebp - 4]
push ecx
call fcn.100032a0
add esp, 0xc
movzx edx, al
test edx, edx
je 0x10003e85
push 2
push 0x1004a444
mov eax, dword [ebp - 4]
push eax
call fcn.100032a0
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x10003e89
xor al, al
jmp 0x10003e95
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10003f80
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
test eax, eax
je 0x10003fd9
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002e00
mov eax, dword [ebp - 0x10c]
or eax, 1
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
jmp 0x1000404c
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.1002a950
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x1000402d
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002e00
mov edx, dword [ebp - 0x10c]
or edx, 1
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp + 8]
jmp 0x1000404c
push 0x1004a420
mov ecx, dword [ebp + 8]
call fcn.10002e00
mov eax, dword [ebp - 0x10c]
or eax, 1
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10004131
Capabilities:
Create thread

Disassembly:
jae 0x100040d7
jmp 0x100040d2
call fcn.100040d9
jae 0x100040d2
add esp, 4
jmp 0x100040de
dec dword [esp]
jno 0x100040e3
jns 0x100040ce
jp 0x100040e7
add esp, 4
popf
jmp 0x100040ee
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10004107
jne 0x10004107
call 0x1fc0745b
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.100044f0
clc
jae 0x10004122
mov esp, ebx
pushf
push 0xa
jae 0x1000412f
jmp 0x1000412a
call 0x10004131
jae 0x1000412a
add esp, 4
jmp 0x10004136
dec dword [esp]
jno 0x1000413b
jns 0x10004126
jp 0x1000413f
add esp, 4
popf
jmp 0x10004146
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000415f
jne 0x1000415f
fdivr qword [ebx + eax - 0x15]
add ebx, esp
jl 0x10004164
jmp 0x10004166
je 0x10004161
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10004180
jne 0x1000417f
call 0x93043207
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000418e
jne 0x1000418e
call 0x106a41fc
push 0
push 0
push 0
push 0x10003260
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100041b1
call fcn.10013200
xor eax, eax
test eax, eax
je 0x100041ba
jne 0x100041b9
call 0x93043241
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100041c8
jmp 0x100041ca
je 0x100041c5
clc
jae 0x100041cf
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x100041d4
jne 0x100041d4
pop eax
pushf
push 0xa
jae 0x100041e1
jmp 0x100041dc
call 0x100041e3
jae 0x100041dc
add esp, 4
jmp 0x100041e8
dec dword [esp]
jno 0x100041ed
jns 0x100041d8
jp 0x100041f1
add esp, 4
popf
jmp 0x100041f8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10004211
jne 0x10004211
call 0x1fc07565
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004360
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.100290f0
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10004340
movzx eax, al
test eax, eax
je 0x10004390
cmp dword [0x10060a24], 0
jne 0x10004467
lea ecx, [ebp - 0x1014]
push ecx
push 0x1000
lea edx, [ebp - 0x1004]
push edx
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x100043b1
call fcn.10013200
mov dword [ebp - 0x1008], 0
jmp 0x100043cc
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1014]
shr ecx, 2
cmp dword [ebp - 0x1008], ecx
jae 0x10004465
mov edx, dword [ebp - 0x1008]
cmp dword [ebp + edx*4 - 0x1004], 0
je 0x10004460
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x1008]
cmp dword [ebp + ecx*4 - 0x1004], eax
je 0x10004460
mov edx, dword [ebp - 0x1008]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0
jne 0x10004432
jmp 0x100043bd
mov ecx, dword [ebp - 0x1010]
push ecx
mov edx, dword [ebp - 0x1008]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
call fcn.10003550
add esp, 8
lea ecx, [ebp - 0x1010]
push ecx
mov ecx, 0x10060a54
call fcn.100055f0
jmp 0x100043bd
jmp 0x100044d0
mov dword [ebp - 0x100c], 0
lea edx, [ebp - 0x100c]
push edx
push 0
push 0
push 0x2000000
mov eax, dword [ebp - 0x100c]
push eax
call dword [0x10060a24]
test eax, eax
jne 0x100044d0
mov ecx, dword [ebp - 0x100c]
push ecx
call fcn.10004060
add esp, 4
mov dword [ebp - 0x1018], eax
mov edx, dword [ebp - 0x100c]
push edx
mov eax, dword [ebp - 0x1018]
push eax
call fcn.10003550
add esp, 8
lea ecx, [ebp - 0x100c]
push ecx
mov ecx, 0x10060a54
call fcn.100055f0
jmp 0x10004471
call fcn.10003390
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret

Function at 0x10006b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 6
mov dword [ebp - 4], 0
jmp 0x10006b92
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10006bd1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x64316fc3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10006bcc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10006b89
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10006bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x35
mov dword [ebp - 4], 0
jmp 0x10006c12
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xa
jge 0x10006c51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x7592cca3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10006c4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10006c09
mov eax, 1
imul ecx, eax, 0xa
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10006c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x3e
mov dword [ebp - 4], 0
jmp 0x10006c92
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jge 0x10006cd1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x54826d16]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10006ccc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10006c89
mov eax, 1
imul ecx, eax, 0x18
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10006cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x65
mov dword [ebp - 4], 0
jmp 0x10006d12
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x11
jge 0x10006d51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x6390647d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10006d4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10006d09
mov eax, 1
imul ecx, eax, 0x11
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10006d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x75
mov dword [ebp - 4], 0
jmp 0x10006d92
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1a
jge 0x10006dd1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x63c0828a]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10006dcc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10006d89
mov eax, 1
imul ecx, eax, 0x1a
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10006df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xc0
mov dword [ebp - 4], 0
jmp 0x10006e12
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xf
jge 0x10006e51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x341d3954]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10006e4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10006e09
mov eax, 1
imul ecx, eax, 0xf
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4