joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1423940
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.014239bc
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x142a460], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x142a460]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x142a464], eax
push 0
push 0
push 0
push 4
push dword [0x142a464]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0x142a5f8]
leave
ret
Function at 0x1423a44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x1423a57
xor eax, eax
jmp 0x1423bdb
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x1423a95
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x1423aae
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x1423aae
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x1423abb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x1423af4
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1423ab4
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x1423b94
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x1423b24
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x1423b83
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x1423b3c
jmp 0x1423b1d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x1423b74
jmp 0x1423b81
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x1423b1d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x1423af4
and dword [ebp - 0x14], 0
jmp 0x1423ba1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x1423bd9
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1423b9a
xor eax, eax
leave
ret
Function at 0x1423d7e
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x6c]
push ebx
push esi
push edi
mov esi, dword [eax]
xor edi, edi
call fcn.01423d41
push esi
call fcn.01423f2c
push dword [esp + 0x80]
mov esi, eax
call fcn.01423f2c
push 0x58
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0141bf12
lea eax, [esp + 0x30]
push eax
push 5
push esi
call fcn.01423c5b
mov ebx, eax
add esp, 0x20
cmp ebx, 5
jb 0x1423f13
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call fcn.01423f61
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1423f13
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [esp + 0x14], 0
mov ebp, eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x14]
push eax
push 0x40
push ebx
push esi
push ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1423ef6
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1423edb
lea eax, [edi + 0x2c]
mov ebp, esi
xor ecx, ecx
mov edx, eax
sub ebp, eax
mov al, byte [edx + ebp]
mov byte [edx], al
mov byte [edi + ecx + 0x4c], al
inc ecx
inc edx
cmp ecx, ebx
jb 0x1423e47
lea eax, [ebx + esi]
push eax
lea eax, [ebx + 0x2c]
add eax, edi
push eax
call fcn.01423cfc
mov edx, dword [esp + 0x20]
mov eax, edx
mov ebp, dword [esp + 0x24]
sub eax, esi
pop ecx
pop ecx
mov ecx, esi
sub ecx, edx
cmp edx, esi
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x1423ea5
lea eax, [edi + 0xc]
push edx
push eax
call fcn.01423cfc
pop ecx
sub eax, edi
pop ecx
sub eax, 0xc
push eax
lea eax, [edi + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [edi + 0xc]
jmp 0x1423ea7
mov eax, edx
push eax
push esi
call fcn.01423cfc
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push ebx
push eax
push ebp
mov dword [edi + 4], ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
pop ebp
je 0x1423f07
mov ecx, dword [esp + 0x78]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x1423f13
push 1
push edi
call fcn.01424055
pop ecx
pop ecx
xor edi, edi
push 0x142a46c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
add esp, 0x68
ret
Function at 0x1423f61
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push ebx
xor ebx, ebx
cmp dword [0x142a484], 0x40
jae 0x142404e
mov ecx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebp, 0xfff80000
add esi, ecx
add ecx, dword [esp + 0x5c]
push edi
cmp ecx, 0x80000000
lea edi, [esp + 0x2c]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb ebp, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
cmovb edi, eax
cmp edi, ebp
jae 0x142404b
push 0x1c
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1424026
cmp dword [esp + 0x20], 0x10000
jne 0x1424018
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x142401c
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x142401c
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x142402a
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add edi, eax
cmp edi, ebp
jb 0x1423fc9
test ebx, ebx
je 0x142404b
xor eax, eax
cmp dword [eax*4 + 0x142a488], 0
je 0x142403e
inc eax
cmp eax, 0x40
jb 0x142402c
jmp 0x142404b
inc dword [0x142a484]
mov dword [eax*4 + 0x142a488], ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
Function at 0x1425ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
lea ebx, [eax + ebp]
cmp eax, 8
jbe 0x1425c97
mov edi, dword [esp + 0x120]
lea esi, [ebp + 8]
push 0x800
lea eax, [edi + 0x5410]
push eax
mov eax, ebx
sub eax, esi
push eax
lea eax, [edi + 0x140c]
push esi
push eax
call fcn.01429110
add esp, 0x14
cmp eax, 0xffffff88
ja 0x1425c97
add esi, eax
mov dword [esp + 0x14], 0x1c
mov eax, ebx
sub eax, esi
push eax
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.01425ce0
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x1425c97
mov eax, dword [esp + 0x1c]
cmp eax, 8
ja 0x1425c97
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push eax
lea eax, [edi + 0x804]
push eax
call fcn.01426110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1425c97
add esi, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x18], 0x34
push eax
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.01425ce0
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x1425c97
mov eax, dword [esp + 0x20]
cmp eax, 9
ja 0x1425c97
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xb8]
push eax
lea eax, [edi + 0xc08]
push eax
call fcn.01426110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1425c97
add esi, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x10], 0x23
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.01425ce0
add esp, 0x14
mov dword [esp + 0x28], eax
cmp eax, 0xffffff88
ja 0x1425c97
mov eax, dword [esp + 0x24]
cmp eax, 9
ja 0x1425c97
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x70]
push eax
push edi
call fcn.01426110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x1425c97
add esi, dword [esp + 0x28]
lea eax, [esi + 0xc]
cmp eax, ebx
ja 0x1425c97
sub ebx, esi
xor edx, edx
sub ebx, 0xc
add edi, 0x5c10
nop
mov ecx, dword [esi]
add esi, 4
test ecx, ecx
je 0x1425c97
cmp ecx, ebx
jae 0x1425c97
mov dword [edi], ecx
inc edx
add edi, 4
cmp edx, 3
jl 0x1425c70
sub esi, ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xffffffe2
pop ebx
add esp, 0x10c
ret
Function at 0x1428d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
shr eax, 8
test al, al
je 0x1428d56
mov dword [esp + 0x14], ecx
jmp fcn.01427f60
mov dword [esp + 0x14], ecx
jmp fcn.01427320
Function at 0x10001d40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
xor eax, eax
push esi
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
push edi
mov ecx, 0x3d69a9dc
lea eax, [ebp - 0x218]
mov dword [ebp - 0x244], 0
call fcn.10019360
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
test eax, eax
sete al
test al, al
je 0x10001df3
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x10023830
sub edi, 0x7e80af00
lea esi, [ebp - 0x230]
call fcn.100193e0
lea edx, [ebp - 0x108]
push edx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x234], eax
jmp 0x10001e21
mov ecx, 0x3d69a9dc
lea eax, [ebp - 0x218]
call fcn.10019360
push eax
call esi
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov word [ebp - 0x210], ax
cmp dword [ebp - 0x234], 0
jne 0x10001e58
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x23c]
mov dword [ebx], edx
mov dword [ebx + 4], eax
pop edi
mov dword [ebx + 8], ecx
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x238]
push edx
call esi
mov edi, 0x4bddc679
lea esi, [ebp - 0x230]
mov dword [ebp - 0x238], eax
call fcn.10019420
push eax
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x238]
push 0xc
lea ecx, [ebp - 0x244]
mov esi, eax
xor eax, eax
push ecx
push edx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x21c], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [ebx + 8], edx
mov eax, ebx
pop esi
call fcn.1001d045
mov esp, ebp
pop ebp
ret 4

Function at 0x10002cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002d40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10027888
push 0x1001d689
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1002b018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], 0
lea eax, [edi + 5]
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
lea eax, [edi + 5]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x20]
push ecx
push 0x40
lea eax, [edi + 5]
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
add esi, edi
mov byte [esi], 0xe9
mov eax, ebx
sub eax, esi
lea ecx, [eax + edi - 5]
mov dword [esi + 1], ecx
lea edx, [ebp - 0x1c]
push edx
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebx], 0xe9
mov eax, dword [ebp + 8]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
sub esi, edi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10002e50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0xf
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf
push edi
call ebx
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0xf
push 0x100139b0
call ebx
mov edx, dword [esi]
mov dword [edi], edx
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov cx, word [esi + 8]
mov word [edi + 8], cx
lea eax, [ebp - 4]
push eax
add edi, 0xa
push 0x40
mov edx, esi
sub edx, edi
push 0xa
add edx, 5
push esi
mov byte [edi], 0xe9
mov dword [edi + 1], edx
call ebx
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, 0x100139b0
sub ecx, esi
push 0xa
sub ecx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
call ebx
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [edi - 0xa]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100036b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f40e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x1015ed28], 1
jne 0x1000374b
or dword [0x1015ed28], 1
mov edi, 0x102349c5
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.100197e0
mov esi, eax
mov ecx, 0x102349d9
lea eax, [ebp - 0x1c]
call fcn.10019760
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1001cbc0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1015ed24], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], al
mov dword [ebp - 4], 0xffffffff
push 0
push 0xffffffffffffffff
call dword [0x1015ed24]
test eax, eax
jne 0x10003760
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret
Function at 0x1000a380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e218
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
mov bl, byte [eax + 0x1002438c]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], bl
jns 0x1000a3cf
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x1000a3b2
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
add eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
add eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret 8

Function at 0x1000a420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
mov ecx, 2
xor eax, eax
mov bl, byte [eax + str.KELUD_Xfd]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x34], bl
jns 0x1000a472
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x20
jl 0x1000a455
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x34]
push edx
call eax
imul esi, esi, 0x4c
add eax, dword [ebp + 8]
mov eax, dword [esi + eax + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e1b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 2
xor eax, eax
mov dl, byte [eax + str.KELUD_Xfd]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x34], dl
jns 0x1000a50f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x20
jl 0x1000a4f2
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x34]
push edx
call eax
imul esi, esi, 0x13
add eax, edi
add esi, ebx
lea ecx, [eax + esi*4]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], al
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000a563
cmp dword [ecx], eax
jmp 0x1000a56b
mov edx, dword [ecx]
test edx, edx
je 0x1000a56f
cmp edx, eax
je 0x1000a56f
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e188
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x1f
xor eax, eax
mov bl, byte [eax + str.Vfira_nuINF_OY]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], bl
jns 0x1000a72f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x17
jl 0x1000a712
mov byte [ebp - 0x15], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ab40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x8d
xor eax, eax
mov bl, byte [eax + 0x10025880]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], bl
jns 0x1000ab8f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x1000ab72
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x24]
push edx
call eax
fld dword [ebp + 8]
mov eax, dword [eax + esi + 0xc]
fstp dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret 4

Function at 0x1000abe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e078
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1c
xor eax, eax
nop
mov dl, byte [eax + 0x10025894]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000ac2d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x1000ac10
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x24]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
fld dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret 4