joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x6d
mov dword [ebp - 8], 0
jmp 0x1000c112
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x24
jge 0x1000c151
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x5964fb8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c14c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c109
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x24], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xdb
mov dword [ebp - 8], 0
jmp 0x1000c192
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x1000c1d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3183aad]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c1cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c189
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c1f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x19
mov dword [ebp - 8], 0
jmp 0x1000c212
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x1000c251
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x4b904773]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c24c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c209
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf1
mov dword [ebp - 8], 0
jmp 0x1000c292
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jge 0x1000c2d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6bcdcc7f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c2cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c289
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xea
mov dword [ebp - 8], 0
jmp 0x1000c312
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf
jge 0x1000c351
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4ce0b66f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c34c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c309
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x19
mov dword [ebp - 8], 0
jmp 0x1000c392
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x1000c3d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x177e368c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c3cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c389
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x92
mov dword [ebp - 8], 0
jmp 0x1000c412
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x1000c451
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x558e071]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c44c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c409
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x93
mov dword [ebp - 8], 0
jmp 0x1000c492
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1a
jge 0x1000c4d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3371850f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c4cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c489
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1a], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x35
mov dword [ebp - 8], 0
jmp 0x1000c512
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x1000c551
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x27f58405]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c54c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c509
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xab
mov dword [ebp - 8], 0
jmp 0x1000c592
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x1000c5d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4eaba576]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c5cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c589
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x5d
mov dword [ebp - 8], 0
jmp 0x1000c612
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x1000c651
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x20c2b356]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c64c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c609
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x9c
mov dword [ebp - 8], 0
jmp 0x1000c692
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x15
jge 0x1000c6d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1acc85b1]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000c6cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1000c689
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x15], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], ecx
jmp 0x1000c8ab
call fcn.10002e50
movzx eax, al
test eax, eax
je 0x1000c8e2
mov ecx, 0xbcc0d418
push ecx
lea ecx, [ebp - 0x23]
call fcn.10002e70
mov dword [ebp - 0x2c], eax
push 0x10
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.1000cac0
add esp, 0xc
lea ecx, [ebp - 0x23]
call fcn.10012950
lea ecx, [ebp - 1]
call fcn.1001f100
movzx ecx, al
test ecx, ecx
je 0x1000c8f6
jmp 0x1000c989
lea ecx, [ebp - 1]
call fcn.1001f110
mov edx, dword [ebp + 8]
push edx
call sub.MSVCR90.dll_strlen
add esp, 4
test eax, eax
je 0x1000c96f
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x25
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [0x10049614]
push edx
call fcn.100047b0
add esp, 0x10
lea ecx, [ebp - 1]
call fcn.1001f130
jmp 0x1000c989
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100114f0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
lea eax, [ebp - 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100115ff
lea ecx, [ebp - 0x1c]
push ecx
push 0x1002e064
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x100115ff
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10011820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100248e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x470
mov dword [ebp - 0x414], 0
jmp 0x10011859
mov eax, dword [ebp - 0x414]
add eax, 1
mov dword [ebp - 0x414], eax
mov ecx, 0x1004a930
call fcn.10012c70
cmp dword [ebp - 0x414], eax
jae 0x10011a12
mov ecx, dword [ebp - 0x414]
push ecx
mov ecx, 0x1004a930
call fcn.10012c90
mov edx, dword [eax]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x414]
push eax
mov ecx, 0x1004a930
call fcn.10012c90
add eax, 4
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x418]
call fcn.100075a0
push eax
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10011a0d
mov ecx, dword [ebp - 0x410]
push ecx
push 0
mov ecx, dword [ebp - 0x418]
call fcn.10012bc0
push eax
lea edx, [ebp - 0x40c]
push edx
call sub.MSVCR90.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10011a0d
mov eax, 0xbcc0cd44
push eax
lea ecx, [ebp - 0x427]
call fcn.10002e70
mov dword [ebp - 0x468], eax
mov ecx, 0xf66c3a1
push ecx
lea ecx, [ebp - 0x444]
call fcn.10019900
mov dword [ebp - 0x46c], eax
push 0x10
mov edx, dword [ebp - 0x468]
push edx
mov eax, dword [ebp - 0x46c]
push eax
call fcn.1000cac0
add esp, 0xc
lea ecx, [ebp - 0x444]
call fcn.10012d40
lea ecx, [ebp - 0x427]
call fcn.10012950
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1001184a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10011b00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024f48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
jmp 0x10011b2d
call fcn.10011610
push 0
push 0
push 0x10011ab0
push 0x10011490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10049838], eax
push 0
push 0
push 0x10011ab0
push 0x1000db10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1004a240], eax
push 0
push 0
push 0x10011ab0
push 0x10011a20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x10049830]
call fcn.1000c730
test eax, eax
jne 0x10011be1
mov eax, 0xfdb56f6b
push eax
lea ecx, [ebp - 0x41]
call fcn.10019980
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [0x10049828]
call fcn.10001480
push eax
push 0
mov edx, dword [ebp - 0x4c]
push edx
push 0
push 0
mov ecx, dword [0x1004982c]
call fcn.1000c890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41]
call fcn.10012d70
call fcn.10002e50
call fcn.100114f0
mov ecx, dword [0x10049818]
call fcn.10007510
movzx ecx, al
test ecx, ecx
jne 0x10011c1a
mov ecx, dword [0x1004a248]
call fcn.1001e3e0
cmp eax, 1
jle 0x10011c1a
push 0
mov ecx, dword [0x1004a248]
call fcn.1001e020
mov ecx, dword [0x1004a24c]
call fcn.1001af60
mov byte [ebp - 0xd], 0
mov ecx, 0x1002b5ea
call fcn.1000ca70
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1004a248]
call fcn.1001e6a0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10011c62
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0x40
mov eax, dword [0x10049824]
mov ecx, dword [eax + 0x148]
call ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10011c73
mov dword [ebp - 0x18], 0xfffffffe
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [0x10049830]
call fcn.1001da50
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x10011c9c
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [0x10049824]
mov eax, dword [edx + 0x8c]
call eax
mov ecx, dword [0x10049830]
call fcn.1001dd30
call fcn.10001460
movzx ecx, al
test ecx, ecx
je 0x10011cc9
mov ecx, dword [0x10049830]
call fcn.1000ca00
mov ecx, dword [0x10049830]
call fcn.1000ca30
jmp 0x10011cdb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100124c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
push dword [ebp + 4]
pop dword [ebp - 4]
push 4
call sub.MSVCR90.dll___2_YAPAXI_Z
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100124f6
mov ecx, dword [ebp - 0x10]
call fcn.10011a40
mov dword [ebp - 0x2c], eax
jmp 0x100124fd
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x1004983c], ecx
mov ecx, dword [0x1004983c]
call fcn.10011ea0
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov edx, 0x928d5481
push edx
lea ecx, [ebp - 0x23]
call fcn.10019d80
mov dword [ebp - 0x30], eax
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x23]
call fcn.10012920
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x10049818]
call fcn.100074d0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [0x1004983c]
call fcn.10011cf0
push 1
mov ecx, dword [0x10049818]
call fcn.100074d0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10012640
Capabilities:
Create thread
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
jmp 0x10012658
mov eax, dword [0x10049838]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
mov ecx, dword [0x10049838]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1001268b
push 0
mov edx, dword [0x10049838]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x10012695
mov dword [0x10049838], 0
cmp dword [0x10049838], 0
jne 0x1001274e
push 0
push 0
push 0
push 0x1000db10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10049838], eax
push 0x10
mov eax, 0xbcc0cff4
push eax
lea ecx, [ebp - 0xb]
call fcn.10002e70
push eax
push 0x3400152c
lea ecx, [ebp - 0x1f]
call fcn.10019e00
push eax
call fcn.1000cac0
add esp, 0xc
lea ecx, [ebp - 0x1f]
call fcn.100128f0
lea ecx, [ebp - 0xb]
call fcn.10012950
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x1004a240]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
mov edx, dword [0x1004a240]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10012781
push 0
mov eax, dword [0x1004a240]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x1001278b
mov dword [0x1004a240], 0
cmp dword [0x1004a240], 0
jne 0x10012845
push 0
push 0
push 0
push 0x10011490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1004a240], eax
push 0x10
mov ecx, 0xbcc0d034
push ecx
lea ecx, [ebp - 0x47]
call fcn.10002e70
push eax
mov edx, 0xe638bac0
push edx
lea ecx, [ebp - 0x5b]
call fcn.10019e80
push eax
call fcn.1000cac0
add esp, 0xc
lea ecx, [ebp - 0x5b]
call fcn.100128f0
lea ecx, [ebp - 0x47]
call fcn.10012950
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10012857
mov esp, ebp
pop ebp
ret

Function at 0x100137c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbc
mov dword [ebp - 8], 0
jmp 0x100137e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10013821
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x56f545c7]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001381c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100137d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10013840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xe7
mov dword [ebp - 8], 0
jmp 0x10013862
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x100138a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x33a0561c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001389c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10013859
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100138c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xda
mov dword [ebp - 8], 0
jmp 0x100138e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10013921
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4ef54134]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001391c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100138d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10013940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x4b
mov dword [ebp - 8], 0
jmp 0x10013962
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x100139a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x26c724e2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001399c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10013959
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100139c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
jmp 0x100139e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x10013a21
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x342d97a3]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10013a1c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100139d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4