joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f6a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10432764]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.10008290
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.1000ee50
add esp, 8
movzx edx, al
test edx, edx
je 0x1000f6e4
lea eax, [ebp + 8]
push eax
call fcn.1000f550
add esp, 4
jmp 0x1000f875
mov ecx, dword [ebp - 0x38]
call fcn.1000fa50
test eax, eax
je 0x1000f72a
mov ecx, dword [ebp - 0x38]
call fcn.1000fa50
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.1000ee30
cmp esi, eax
jae 0x1000f72a
lea ecx, [ebp + 8]
push ecx
call fcn.10010230
add esp, 4
mov byte [ebp - 0x39], al
mov ecx, dword [ebp - 0x38]
call fcn.1000d990
mov dl, byte [ebp - 0x39]
mov byte [eax], dl
mov eax, dword [ebp + 8]
jmp 0x1000f875
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x1000f73d
call fcn.10008290
jmp 0x1000f875
mov ecx, dword [ebp - 0x38]
call fcn.1000da90
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x1000f796
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp + 8]
push ecx
call fcn.10010230
add esp, 4
mov byte [ebp - 0x3a], al
mov edx, dword [ebp - 0x54]
push edx
movzx eax, byte [ebp - 0x3a]
push eax
call fcn.10008d30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1000f786
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48], edx
jmp 0x1000f78e
call fcn.10008290
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x1000f875
mov dword [ebp - 0x5c], 0x20
lea eax, [ebp + 8]
push eax
call fcn.10010230
add esp, 4
mov byte [ebp - 0x2a], al
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x29]
push ecx
lea edx, [ebp - 0x2a]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x58]
call fcn.1000f660
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x1000f7f3
cmp dword [ebp - 0x40], 1
je 0x1000f7f3
cmp dword [ebp - 0x40], 3
je 0x1000f840
jmp 0x1000f870
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x44], ecx
je 0x1000f825
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.10042025
add esp, 0x10
cmp dword [ebp - 0x44], eax
je 0x1000f825
call fcn.10008290
jmp 0x1000f875
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x1000f839
mov eax, dword [ebp + 8]
jmp 0x1000f875
call fcn.10008290
jmp 0x1000f875
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.10008d30
add esp, 8
movzx eax, al
test eax, eax
je 0x1000f863
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], ecx
jmp 0x1000f86b
call fcn.10008290
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x1000f875
call fcn.10008290
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a016
mov esp, ebp
pop ebp
ret 4
Function at 0x100107c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10432764]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x100107ea
jl 0x100107e1
cmp dword [ebp + 0xc], 0
ja 0x100107ea
xor eax, eax
xor edx, edx
jmp 0x1001092b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x1001080c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10010940
jmp 0x1001092b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.1000ccd0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x1001087b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.100046f0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.1000f240
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10008090
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.1000f150
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x1001091c
mov ecx, dword [ebp - 0x10]
call fcn.1000da90
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x100108eb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1004199e
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x100108e9
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1001092b
jmp 0x10010897
cmp dword [ebp - 8], 0
jbe 0x1001091c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1004199e
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a016
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x42
mov dword [ebp - 4], 0
jmp 0x10010e52
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xf
jge 0x10010e91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x72a9db26]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10010e8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010e49
mov eax, 1
imul ecx, eax, 0xf
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10010eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x5b
mov dword [ebp - 4], 0
jmp 0x10010ed2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jge 0x10010f11
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x5b17cf41]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10010f0c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010ec9
mov eax, 1
imul ecx, eax, 0x18
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10010f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x73
mov dword [ebp - 4], 0
jmp 0x10010f52
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 7
jge 0x10010f91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x6125ddaa]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10010f8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010f49
mov eax, 1
imul ecx, eax, 7
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10010fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xc1
mov dword [ebp - 4], 0
jmp 0x10010fd2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x10011011
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x390d063a]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001100c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010fc9
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10011030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd7
mov dword [ebp - 4], 0
jmp 0x10011052
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x10011091
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x26700b95]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001108c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011049
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100112c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10432764]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x100112d8
pop esi
inc edx
pushf
push 0xa
Function at 0x100112e7
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x100112e5
jmp 0x100112e0
call fcn.100112e7
jae 0x100112e0
add esp, 4
jmp 0x100112ec
dec dword [esp]
jno 0x100112f1
jns 0x100112dc
jp 0x100112f5
add esp, 4
popf
jmp 0x100112fc
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011315
jne 0x10011315
inc edx
jl 0x1001131a
jmp 0x1001131c
je 0x10011317
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011336
jne 0x10011335
call 0x930503bd
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x10011344
add eax, 0x1750374
jne 0x10011344
call 0x35e5590e
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x100113af
jg 0x1001133e
pushf
push 0xa
jae 0x100113bc
jmp 0x100113b7
call 0x100113be
jae 0x100113b7
add esp, 4
jmp 0x100113c3
dec dword [esp]
jno 0x100113c8
jns 0x100113b3
jp 0x100113cc
add esp, 4
popf
jmp 0x100113d3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100113ec
jne 0x100113ec
invalid
jl 0x100113f1
jmp 0x100113f3
je 0x100113ee
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001140d
jne 0x1001140c
call 0x93050494
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001141b
jne 0x1001141b
call 0x9b5c727e
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a016
mov esp, ebp
pop ebp
ret

Function at 0x10011468
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x10011466
jmp 0x10011461
call fcn.10011468
jae 0x10011461
add esp, 4
jmp 0x1001146d
dec dword [esp]
jno 0x10011472
jns 0x1001145d
jp 0x10011476
add esp, 4
popf
jmp 0x1001147d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011496
jne 0x10011496
call 0x1fc147ea
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10011744
Capabilities:
Create thread

Disassembly:
jae 0x10011656
jmp 0x10011651
call fcn.10011658
jae 0x10011651
add esp, 4
jmp 0x1001165d
dec dword [esp]
jno 0x10011662
jns 0x1001164d
jp 0x10011666
add esp, 4
popf
jmp 0x1001166d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011686
jne 0x10011686
call 0x1fc149da
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.100112c0
clc
jae 0x100116a1
retf
pushf
push 0xa
jae 0x100116ae
jmp 0x100116a9
call 0x100116b0
jae 0x100116a9
add esp, 4
jmp 0x100116b5
dec dword [esp]
jno 0x100116ba
jns 0x100116a5
jp 0x100116be
add esp, 4
popf
jmp 0x100116c5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100116de
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x358
jne 0x100116de
jns 0x1001175b
jl 0x100116e3
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x100116e5
je 0x100116e0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100116ff
jne 0x100116fe
call 0x93050786
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001170d
jne 0x1001170d
call 0xffe35f9
push dword [ebx]
rol byte [ebp + 0x750374c0], 0
call 0x10011430
xor eax, eax
test eax, eax
je 0x1001171b
jne 0x1001171a
call 0x930507a2
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
lcall 0x7002, 0x73f8fb74
lcall 0x669a, 0x1750374
pushfd
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10011729
jmp 0x1001172b
je 0x10011726
clc
jae 0x10011730
jo 0x100116ca
je 0x10011735
jne 0x10011735
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10011742
jmp 0x1001173d
call 0x10011744
jae 0x1001173d
add esp, 4
jmp 0x10011749
dec dword [esp]
jno 0x1001174e
jns 0x10011739
jp 0x10011752
add esp, 4
popf
jmp 0x10011759
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011772
jne 0x10011772
call 0x1fc14ac6
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x100114c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10011570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10011110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10012630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ca8d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10432764]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.10007d80
mov eax, dword [ebp + 8]
push eax
call fcn.10003ec0
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100130d0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x100124d0
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.10010660
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
call fcn.10042845
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x100126c5
lea ecx, [ebp - 0x14]
call fcn.1000fcd0
jmp 0x100126d6
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.10039032
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100134d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003a016
mov esp, ebp
pop ebp
ret 4

Function at 0x10014ba0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005cdad
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10432764]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.10007d80
mov eax, dword [ebp + 0xc]
push eax
call fcn.10003ec0
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003ec0
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10014ee0
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x10014a60
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.10010660
push eax
mov eax, dword [ebp - 0x24]
push eax
push 0
push 0
call fcn.10042845
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x10014c4e
lea ecx, [ebp - 0x14]
call fcn.1000fcd0
jmp 0x10014c5f
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.10039032
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10015380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003a016
mov esp, ebp
pop ebp
ret 8
Function at 0x10015670
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ce1d
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x10432764]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x148], 0
push 8
lea ecx, [ebp - 0x18]
call fcn.10007d80
lea ecx, [ebp - 0x18]
call fcn.10015190
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
jne 0x10015708
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.10015160
mov ecx, dword [ebp - 0x148]
or ecx, 1
mov dword [ebp - 0x148], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10015340
mov eax, dword [ebp + 8]
jmp 0x100157ab
mov dword [ebp - 0x140], 0x128
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x144]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10015771
mov ecx, dword [ebp - 0x138]
cmp ecx, dword [ebp + 0xc]
je 0x1001575a
cmp dword [ebp - 0x138], 0x64
jbe 0x1001575a
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x18]
call fcn.100154d0
mov ecx, eax
call fcn.10005790
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10015729
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10015160
mov edx, dword [ebp - 0x148]
or edx, 1
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10015340
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003a016
mov esp, ebp
pop ebp
ret
Function at 0x10016309
Capabilities:
Create thread

Disassembly:
jae 0x10016307
jmp 0x10016302
call fcn.10016309
jae 0x10016302
add esp, 4
jmp 0x1001630e
dec dword [esp]
jno 0x10016313
jns 0x100162fe
jp 0x10016317
add esp, 4
popf
jmp 0x1001631e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10016337
jne 0x10016337
call 0x1fc1968b
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x100161d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001636b
call fcn.10020a80
clc
jae 0x10016370
pushf
pushf
push 0xa
jae 0x1001637d
jmp 0x10016378
call 0x1001637f
jae 0x10016378
add esp, 4
jmp 0x10016384
dec dword [esp]
jno 0x10016389
jns 0x10016374
jp 0x1001638d
add esp, 4
popf
jmp 0x10016394
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100163ad
jne 0x100163ad
bnd jl 0x100163b2
jl 0x100163b2
jmp 0x100163b4
je 0x100163af
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100163ce
jne 0x100163cd
call 0x93055455
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100163dc
jne 0x100163dc
call 0x6ffda96b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x15
mov dword [ebp - 4], 0
jmp 0x10017432
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x21
jge 0x10017471
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2218797d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001746c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10017429
mov eax, 1
imul ecx, eax, 0x21
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018c20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x10018c3e
mov ecx, dword [ebp - 8]
call fcn.1001b860
jmp 0x10018c51
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x10018c51
mov ecx, dword [ebp - 8]
call fcn.1001b6e0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret