joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007ef00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100de7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x10131c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1007e1a0
cmp dword [ebp - 0x14], 0x10
jb 0x1007ef52
push dword [ebp - 0x28]
call fcn.1003a540
add esp, 4
mov eax, dword [ebp + 0x24]
lea esi, [edi + 0x60]
mov ecx, dword [ebp + 0x20]
sub eax, ecx
push eax
push ecx
push esi
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
call fcn.1007e480
push esi
call fcn.1007e540
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0x10
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.1000a750
movdqu xmm0, xmmword [edi + 0xb8]
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp + 8]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], 0xf
movdqu xmmword [ebx], xmm0
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x4c], 0
call fcn.10008240
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x34]
call fcn.10035e10
mov byte [ebp - 4], 4
lea esi, [edi + 0x40]
mov eax, dword [esi]
mov edi, dword [eax]
lea eax, [ebp - 0x4c]
push eax
push dword [edi + 4]
push edi
call fcn.100812c0
mov edx, eax
mov ecx, 0x5d1745c
mov eax, dword [esi + 4]
sub ecx, eax
cmp ecx, 1
jae 0x1007f02b
push str.list_T__too_long
call fcn.100b4bbb
inc eax
mov ecx, esi
mov dword [esi + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov eax, dword [esi]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.10081000
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x1007f074
push eax
call fcn.1003a540
add esp, 4
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x38], 0x10
jb 0x1007f085
push dword [ebp - 0x4c]
call fcn.1003a540
add esp, 4
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.10080bb0
push ebx
mov esi, eax
call fcn.1003a540
add esp, 4
cmp dword [ebp + 0x1c], 0x10
jb 0x1007f0ac
push dword [ebp + 8]
call fcn.1003a540
add esp, 4
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
test eax, eax
je 0x1007f0ce
push eax
call fcn.1003a540
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b54bf
mov esp, ebp
pop ebp
ret 0x24
Function at 0x10081330
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor al, al
push edi
xor ecx, ecx
lea ecx, [ecx]
mov byte [ecx + esi], al
inc al
movzx ecx, al
cmp ecx, 0x100
jl 0x10081340
xor bl, bl
mov word [esi + 0x100], 0
xor bh, bh
xor edi, edi
nop
cmp dword [ebp + 0x20], 0x10
lea ecx, [ebp + 0xc]
mov eax, edi
cmovae ecx, dword [ebp + 0xc]
xor edx, edx
div dword [ebp + 0x1c]
inc bl
movzx eax, byte [edx + ecx]
add al, byte [edi + esi]
mov cl, byte [edi + esi]
add bh, al
movzx edx, bh
movzx eax, byte [edx + esi]
mov byte [edi + esi], al
movzx edi, bl
mov byte [edx + esi], cl
cmp edi, 0x100
jl 0x10081360
cmp dword [ebp + 0x20], 0x10
pop edi
pop esi
pop ebx
jb 0x100813ac
push dword [ebp + 0xc]
call fcn.1003a540
add esp, 4
pop ebp
ret 0x1c

Function at 0x100813b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
je 0x100814f9
push edi
mov edi, dword [ebp + 0x10]
push esi
nop
mov ecx, dword [ebp + 8]
inc byte [ecx + 0x100]
movzx esi, byte [ecx + 0x100]
add esi, ecx
movzx eax, byte [esi]
add byte [ecx + 0x101], al
movzx edx, byte [ecx + 0x101]
add edx, ecx
mov cl, byte [esi]
movzx eax, byte [edx]
mov byte [esi], al
mov byte [edx], cl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x100]
movzx ecx, byte [edx + 0x101]
movzx eax, byte [eax + edx]
add al, byte [ecx + edx]
mov ecx, dword [ebp + 0xc]
movzx eax, al
mov ecx, dword [ecx]
mov al, byte [eax + edx]
xor al, byte [ecx + ebx]
lea ecx, [ebp - 1]
mov byte [ebp + 0x13], al
mov byte [ebp - 1], al
mov eax, dword [edi + 4]
cmp ecx, eax
jae 0x10081493
mov esi, dword [edi]
cmp esi, ecx
ja 0x10081493
mov edx, dword [edi + 8]
mov ebx, ecx
sub ebx, esi
cmp eax, edx
jne 0x10081480
mov ecx, edx
sub ecx, eax
cmp ecx, 1
jae 0x10081480
mov ecx, esi
sub ecx, eax
dec ecx
cmp ecx, 1
jb 0x10081500
sub eax, esi
sub edx, esi
mov esi, edx
or ecx, 0xffffffff
shr esi, 1
inc eax
sub ecx, esi
cmp ecx, edx
jae 0x10081471
xor edx, edx
jmp 0x10081473
add edx, esi
cmp edx, eax
mov ecx, edi
cmovb edx, eax
push edx
call fcn.1000ae00
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1008148e
mov eax, dword [edi]
mov al, byte [ebx + eax]
mov byte [ecx], al
mov ebx, dword [ebp - 8]
jmp 0x100814e0
mov edx, dword [edi + 8]
cmp eax, edx
jne 0x100814d4
mov ecx, edx
sub ecx, eax
cmp ecx, 1
jae 0x100814d4
mov esi, dword [edi]
mov ecx, esi
sub ecx, eax
dec ecx
cmp ecx, 1
jb 0x10081500
sub eax, esi
sub edx, esi
mov esi, edx
or ecx, 0xffffffff
shr esi, 1
inc eax
sub ecx, esi
cmp ecx, edx
jae 0x100814c5
xor edx, edx
jmp 0x100814c7
add edx, esi
cmp edx, eax
mov ecx, edi
cmovb edx, eax
push edx
call fcn.1000ae00
mov eax, dword [edi + 4]
test eax, eax
je 0x100814e0
mov cl, byte [ebp + 0x13]
mov byte [eax], cl
mov ecx, dword [ebp + 0xc]
inc ebx
inc dword [edi + 4]
mov dword [ebp - 8], ebx
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
cmp ebx, eax
jb 0x100813d0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.vector_T__too_long
call fcn.100b4bbb
int3
Function at 0x10083d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df1b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
push 0
mov dword [esi], vtable.PDFAnnotList.0
push 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1000b180
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10085640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df563
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x4c]
mov dword [esi], vtable.PDFFontDescriptor.0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp ecx, eax
je 0x100856e9
push 0xffffffffffffffff
push 0
push eax
call fcn.10008240
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x38], eax
mov eax, dword [ecx]
mov dword [esi + 0x3c], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x40], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x44], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x64], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x68], eax
mov eax, esi
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x10089340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dfdf3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x3c]
mov dword [esi], vtable.PDFLink.0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
push 0x17
push str.0.86491_0.03421_0.02591
movsd xmm0, qword [eax]
cvtpd2ps xmm0, xmm0
movss dword [esi + 0x2c], xmm0
movsd xmm0, qword [eax + 8]
cvtpd2ps xmm0, xmm0
movss dword [esi + 0x30], xmm0
movsd xmm0, qword [eax + 0x10]
subsd xmm0, qword [eax]
addsd xmm0, qword [eax]
cvtpd2ps xmm0, xmm0
movss dword [esi + 0x34], xmm0
movsd xmm0, qword [eax + 0x18]
subsd xmm0, qword [eax + 8]
addsd xmm0, qword [eax + 8]
cvtpd2ps xmm0, xmm0
movss dword [esi + 0x38], xmm0
call fcn.100084d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1008cda0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e0557
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
push 0
mov dword [esi], vtable.PDFOutline.0
push 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1000b180
mov dword [esi + 0x2c], eax
lea edx, [esi + 0x50]
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
lea edi, [esi + 0x68]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], eax
mov byte [edi], al
lea ecx, [esi + 0x80]
call fcn.10079040
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
cmp edx, eax
je 0x1008ce90
push 0xffffffffffffffff
push 0
push eax
mov ecx, edx
call fcn.1000ac10
mov eax, dword [ebp + 0xc]
cmp edi, eax
je 0x1008cea3
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.10008240
mov eax, esi
mov byte [esi + 0x4c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1008ed20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df1b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.PDFPages.0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1008f7c0
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1008fe70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e0ba3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [esi + 0x2c], vtable.PDFDeviceColorSpace.0
mov dword [esi + 0x34], 2
mov dword [esi + 0x30], 3
mov dword [ebp - 4], 0
mov dword [esi], vtable.PDFPattern.0
mov dword [esi + 0x54], 0xf
mov dword [esi + 0x50], 0
mov byte [esi + 0x40], 0
push 0
mov byte [ebp - 4], 1
push 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
call fcn.100348c0
mov dword [esi + 0x60], eax
push 0
mov byte [ebp - 4], 2
lea ebx, [esi + 0x7c]
push 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.100348c0
mov dword [ebx], eax
mov dword [esi + 0x98], 0xf
mov dword [esi + 0x94], 0
mov byte [esi + 0x84], 0
push 0
mov byte [ebp - 4], 4
push 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
call fcn.100348c0
mov dword [esi + 0x9c], eax
lea edi, [esi + 0xa4]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 6
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x3c], 1
mov dword [esi + 0x58], 1
mov dword [esi + 0x5c], 2
cmp ecx, eax
je 0x1008ffc6
mov eax, dword [eax]
push eax
push dword [eax]
call fcn.10086460
movsd xmm0, qword [ebp + 0x1c]
lea ecx, [esi + 0x9c]
mov eax, dword [ebp + 0x2c]
movsd qword [esi + 0x68], xmm0
movsd xmm0, qword [ebp + 0x24]
movsd qword [esi + 0x70], xmm0
cmp ecx, eax
je 0x1008fff1
mov eax, dword [eax]
push eax
push dword [eax]
call fcn.10086460
mov eax, dword [ebp + 0x30]
cmp ebx, eax
je 0x10090004
mov eax, dword [eax]
mov ecx, ebx
push eax
push dword [eax]
call fcn.10086460
mov eax, dword [ebp + 0x34]
cmp edi, eax
je 0x10090017
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.10008240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x10092af0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df1b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
push 0
mov dword [esi], vtable.PDFRoot.0
push 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
call fcn.10092fa0
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x2c], eax
mov eax, esi
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x40], 2
mov dword [esi + 0x44], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100931d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e1173
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [esi + 0x2c], 0
mov dword [ebp - 4], 0
push 0
mov dword [esi], vtable.PDFStream.0
push 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.1000b180
mov dword [esi + 0x30], eax
mov byte [ebp - 4], 1
cmp byte [0x10137a28], 0
je 0x10093270
mov byte [0x10137a28], 1
mov ecx, 0x10135350
jmp 0x1009327c
mov byte [0x10137a28], 0
mov ecx, 0x1013cf2c
call fcn.10097c50
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100939b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e12e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.PDFTaggedInfo.0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10034ad0
mov dword [esi + 0x2c], eax
mov byte [ebp - 4], 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
call fcn.1008f7c0
mov dword [esi + 0x34], eax
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10095cd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100dd6b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10131c40]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov eax, dword [0x10131c40]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 0
mov byte [esp + 8], 0
lea eax, [esp + 8]
mov dword [esp + 0x30], 0
push eax
call fcn.100949d0
push dword [esp + 0x18]
cmp dword [esp + 0x20], 0x10
lea edx, [esp + 0xc]
mov eax, dword [esi]
mov ecx, esi
cmovae edx, dword [esp + 0xc]
push 0
push edx
call dword [eax + 0x14]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp dword [esp + 0x1c], 0x10
jb 0x10095d65
push dword [esp + 8]
call fcn.1003a540
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.100b54bf
mov esp, ebp
pop ebp
ret 4

Function at 0x100965e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e17d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10131c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0xf
mov dword [esi + 0x24], 0
mov byte [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
push 0
mov dword [esi], vtable.PDFWArray.0
push 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10034900
mov dword [esi + 0x2c], eax
sub esp, 8
mov byte [ebp - 4], 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
call fcn.10072370
mov dword [esi + 0x34], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10099a60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xc8]
test edx, edx
jne 0x10099a73
xor eax, eax
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10099a6d
mov eax, dword [ebp + 0x10]
push esi
test eax, eax
js 0x10099aa2
mov esi, dword [ebp + 0xc]
test esi, esi
js 0x10099aa2
test eax, eax
je 0x10099aa2
push edx
push eax
lea eax, [ecx + esi]
push 1
push eax
call fcn.100b7b1e
add esp, 0x10
pop esi
pop ebp
ret 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x10099ab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x24]
mov ebx, dword [ebp + 8]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1000a750
test edi, edi
jle 0x10099ae8
push dword [esi + 0xc8]
push edi
push 1
push dword [ebx]
call fcn.100b7b1e
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x1009d040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
lea esp, [esp]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x74]
add eax, esi
sub ebx, dword [edi + 0x6c]
cmp dword [edi + 0x6c], eax
jb 0x1009d0c9
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.100ba600
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
jmp 0x1009d090
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1009d09f
sub eax, esi
jmp 0x1009d0a1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x1009d090
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1009d0bf
sub eax, esi
jmp 0x1009d0c1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x1009d0b0
add ebx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x1009d121
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
push ebx
push eax
push ecx
call fcn.1009d480
add dword [edi + 0x74], eax
add esp, 0xc
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x1009d10d
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x1009d121
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x1009d050
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1009d760
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1009d76c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.1009d780
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x408a51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x408a60
pop dword [ebp - 0x50]
mov eax, 0xfba0c0a7
add eax, 0x49fc9b9
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xe71d151e
sub dword [ebp - 0x60], 0x98cacfd3
mov dword [ebp - 0x5c], 0xd7ce732
add dword [ebp - 0x5c], 0x24b66513
mov dword [ebp - 0x58], 0x25f34888
sub dword [ebp - 0x58], 0xd9a7045a
mov dword [ebp - 0x54], 0x133eefd0
sub dword [ebp - 0x54], 0x133eefd0
lea eax, [ebp - 0x60]
push eax
mov eax, 0xa95b0d4c
add eax, 0x56e5c308
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xd3ae4ffa
add dword [ebp - 0x60], 0xa0c4195c
mov dword [ebp - 0x5c], 0xf23a99b4
add dword [ebp - 0x5c], 0x4f31c7c1
mov dword [ebp - 0x58], 0x4228d7bb
sub dword [ebp - 0x58], 0xdeb96b4f
mov dword [ebp - 0x54], 0xcbdb6667
add dword [ebp - 0x54], 0x34249999
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38867
push 0
call eax
mov ecx, 0xbc30ef37
add ecx, 0x43cf54d4
mov esi, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x50]
mov edi, 0xfbc8866c
add dword [ebp - 0x4c], 0x761b4274
mov ebx, dword [edx]
add ebx, edi
xor dword [ebp - 8], edx
mov dword [esi], ebx
add esi, 0x3c6fddbc
sub esi, 0x3c6fddb8
add edx, 0xa2a72811
add edx, 0x5d58d7f3
loop 0x408b71
add eax, 0xee61dd3
add eax, 0xf11ae52c
xor ebx, ebx
add ebx, eax
add eax, 0x68287cea
add eax, 0x97d7831b
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret