joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478760
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.00499310
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x47878c
cmp ecx, 0x61
jne 0x4787e1
cmp word [edx + 2], bx
jne 0x4787e1
cmp word [edi], bx
jne 0x4787e1
cmp word [eax], bx
jne 0x4787e1
cmp word [esi], bx
jne 0x4787e1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x4787c2
cmp byte [ebp + 0xea], bl
jne 0x4787c2
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4787c2
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x4787d5
cmp esi, ebx
je 0x4787d5
mov dword [ebp + 0xc4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x478806
cmp word [edi], bx
jne 0x478806
cmp word [eax], bx
jne 0x478806
cmp word [esi], bx
jne 0x478806
mov eax, ebp
call fcn.00478960
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x4ac274
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.00479430
test eax, eax
je 0x478917
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov ecx, dword [esp + 0x11c88]
mov edx, dword [esp + 0x11c8c]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ecx
mov dword [esp + 0x184c], edx
je 0x478923
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x4788ef
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x478917
cmp byte [ebp + 0xea], bl
jne 0x4788e8
mov eax, dword [esp + 0x102c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4788e8
mov ecx, dword [esp + 0x102c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x478917
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x478908
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.00479890
push ebx
lea edx, [esp + 0x14]
push edx
call fcn.00479950
test eax, eax
jne 0x478933
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea eax, [esp + 0x10]
push eax
push 0x4789d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x47894d
cmp eax, ebx
je 0x47894d
mov dword [ebp + 0xc4], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x479890
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x47994e
mov eax, dword [esi]
test eax, eax
je 0x47994e
push edi
test al, 1
jne 0x4798ba
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x4798d6
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4798d6
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x4798f1
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x47992f
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x47992f
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.004500f0
add esp, 4
test eax, eax
jne 0x47992f
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x47994e
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x47a190
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.00499310
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x47a23d
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x47a8d0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x4ac274
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x47a23d
mov ecx, dword [0x4c49ac]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x47a23d
push 1
push eax
call fcn.00401360
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x47a250
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47a26c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c49ac]
push eax
push esi
mov ecx, edi
call fcn.0047a710
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x47a2a3
test eax, eax
jne 0x47a2a7
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.0047a360
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x47a326
test esi, esi
je 0x47a326
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401360
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x47a305
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x47a305
push 1
push 0x8000012f
call fcn.00401360
add esp, 8
push esi
call edi
test eax, eax
jne 0x47a2e0
mov edx, dword [0x4c49ac]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47a31e
push 1
push eax
call fcn.00401360
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x47a340
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.0047a360
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.0047a4e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x47a4e0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.00499310
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x47a660
xor cl, cl
mov eax, edi
call fcn.0047a680
test eax, eax
jne 0x47a515
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c49ac]
push eax
push ebp
mov ecx, edi
call fcn.0047a710
test eax, eax
je 0x47a538
xor eax, eax
mov dword [0x4ca5b8], eax
jmp 0x47a53d
mov eax, dword [0x4ca5b8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x4ac274
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x47a583
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x47a58b
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4ca5b4]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x47a7e0
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x47a638
lea ecx, [esp + 0x10]
push ecx
push 0x479240
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x47a5f5
mov edx, dword [esp + 0x1848]
call fcn.00479e20
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.00478230
mov edx, dword [esp + 0x1848]
call fcn.00479e20
mov edx, dword [0x4c49ac]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47a660
push 1
push eax
call fcn.00401360
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4ca5b8]
cmp eax, ebx
je 0x47a660
cmp eax, 1
setg al
mov dword [0x4ca5b8], ebx
cmp al, bl
je 0x47a660
mov edx, ebp
call fcn.00479e20
push ebx
mov ecx, edi
call fcn.0047a4e0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x4943e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3d70]
jne 0x4943f0
repz ret
jmp fcn.00498d3f

Function at 0x4970d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c3d70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004915a2
and dword [ebp - 0x14], 0
cmp dword [0x4c6bfc], 0
mov dword [ebp - 0x18], eax
jne 0x497183
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49722b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a0fd8
push ebx
call edi
test eax, eax
je 0x49722b
mov esi, dword [fcn.0048d830]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c6bfc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c6c00], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c6c04], eax
call edi
push eax
call esi
mov dword [0x4c6c0c], eax
test eax, eax
je 0x497183
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c6c08], eax
mov eax, dword [0x4c6c08]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048d834]
cmp eax, ecx
je 0x4971dc
cmp dword [0x4c6c0c], ecx
je 0x4971dc
push eax
call esi
push dword [0x4c6c0c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4971dc
test ebx, ebx
je 0x4971dc
call edi
test eax, eax
je 0x4971d3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4971d3
test byte [ebp - 8], 1
jne 0x4971dc
or dword [ebp + 0x10], 0x200000
jmp 0x49720f
mov eax, dword [0x4c6c00]
cmp eax, dword [ebp - 0x18]
je 0x49720f
push eax
call esi
test eax, eax
je 0x49720f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49720f
mov eax, dword [0x4c6c04]
cmp eax, dword [ebp - 0x18]
je 0x49720f
push eax
call esi
test eax, eax
je 0x49720f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c6bfc]
call esi
test eax, eax
je 0x49722b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49722d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004943e6
leave
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5b3b082e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x39106903
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x589c1ae0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2208743e
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x101117e9
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101b594c], 0
mov byte [0x101b5950], 0
mov dword [0x101b5940], 0x19f5
mov dword [0x101b5948], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101118f2
mov dword [0x101b5944], 0x2635
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x101b5954], 0
add eax, 0xffffe1b1
mov dword [0x101b5944], eax
mov eax, dword [0x101b594c]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + ecx]
add ebx, eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x2c], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov dword [0x101b5954], ebx
mov eax, ebx
cdq
idiv esi
mov dword [0x101b594c], edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x101b5950], bl
mov esi, dword [ebp - 0x2c]
add esi, 0xffffe791
mov dword [0x101b5944], esi
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x101b5950]
mov ecx, dword [0x101b594c]
mov byte [esi + ecx], bl
mov ecx, dword [0x101b5948]
add ecx, 1
mov dword [0x101b5948], ecx
cmp ecx, 0x100
mov dword [ebp - 0x30], ecx
jl 0x1011195a
jmp 0x10111833
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101b5940]
add eax, 0x1e60
mov dword [0x101b5944], eax
mov esi, dword [0x101b5948]
add esi, 1
mov dword [0x101b5948], esi
cmp esi, 0x100
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], esi
jl 0x101118f2
mov dword [0x101b5940], 0x1a82
mov eax, 0x1a82
xor ecx, ecx
mov dword [0x101b5948], 0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x10111845
mov eax, dword [0x101b5944]
mov dword [ebp - 0x38], eax
mov eax, dword [0x101b5940]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x10111845
Function at 0x10111d97
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [0x101b5940], 0xea1
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x101b5940], 0x12cc
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x10111e6c
mov eax, 0x19cd
mov ecx, dword [ebp - 0x18]
add ecx, 1
cmp ecx, 0x104
mov edx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], ecx
jl 0x10111e6c
jmp 0x10111e3d
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x28], eax
jne 0x10111f0c
xor eax, eax
mov dword [0x101b5940], 0xffffe770
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x28], eax
je 0x10111ed1
jmp 0x10111f0c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dword [0x101b5944], ecx
mov dword [0x101b5940], 0x6b6
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x10111e8f
jmp 0x10111f0c
mov eax, dword [ebp - 0x14]
mov ecx, 0x1bd2
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], esi
je 0x10111e3d
jmp 0x10111ddb
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x28], eax
jne 0x10111f0c
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x28], eax
jne 0x10111f0c
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x28], eax
je 0x10111dfe
jmp 0x10111f0c
mov dword [0x101b5940], 0x251c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x2a], dx
xor eax, eax
mov cx, word [ebp - 0x2a]
cmp cx, 0x6c
mov dword [ebp - 0x28], eax
jne 0x10111f0c
mov eax, 1
mov dword [0x101b5944], 0x369d
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x10111f15
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x28]
mov edx, dword [0x101b5940]
add edx, 0xffffef19
mov dword [0x101b5944], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10111986
lea ecx, [0x1011228b]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x40], edx
mov dword [esp + 0x2c], 0x132600
mov edx, dword [0x101b592c]
mov dword [esp + 0x34], edx
mov edx, dword [0x101b5930]
mov dword [esp + 0x28], edx
mov edx, dword [0x101b5934]
mov dword [esp + 0x30], edx
mov edx, dword [0x101b5938]
mov dword [esp + 0x50], edx
mov edx, dword [0x101b593c]
mov dword [esp + 0x7c], edx
mov dword [0x101b5944], 0x717
mov dword [0x101b5940], 0x127a
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x10111fd4
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], ecx
je 0x10111fe8
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10111fb1
mov eax, dword [esp + 0x18]
mov dword [esp + 0x68], eax
mov dword [0x101b5940], 0x25db
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x5c], edx
call fcn.10111d97
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
jne 0x1011205e
lea eax, [esp + 0x80]
mov dword [0x101b5940], 0xf39
add eax, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.1011260f
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x101120ef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101b5948], 0
mov dword [0x101b594c], 0
mov dword [0x101b5958], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, 0x2448
mov dword [0x101b5940], 0x2448
mov edx, dword [ebp - 0x10]
cmp edx, 0
mov esi, eax
mov edi, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
je 0x10112283
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov edi, 0x100
mov dword [0x101b5944], 0x264a
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x101b5948], edx
mov ecx, dword [ebp - 0x34]
add ecx, 0xffffffa9
mov dword [0x101b5940], ecx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x101b594c], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101b5950], cl
mov dword [0x101b5944], 0x20ef
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x101b5950]
mov edx, dword [0x101b594c]
mov byte [edi + edx], cl
mov edx, dword [0x101b5940]
mov ebx, edx
add ebx, 0xffffe99b
mov dword [0x101b5944], ebx
mov ebx, dword [0x101b5948]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x101b594c]
movzx ecx, byte [edi + ecx]
add ecx, ebx
and ecx, 0xff
mov dword [0x101b5958], ecx
mov dword [0x101b5944], 0x1562
mov cl, byte [edi + ecx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [ebx + esi]
add edx, 0x5a6
mov dword [0x101b5944], edx
xor ch, cl
mov dword [0x101b5940], 0x6a8
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x3c], esi
je 0x10112283
mov eax, dword [0x101b5940]
mov ecx, dword [0x101b5948]
mov edx, dword [0x101b594c]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], esi
jmp 0x1011215e
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10112426
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x101b5940], 0x15d2
mov dword [0x101b5944], 0x1167
mov dword [ebp - 0x10], eax
call fcn.10111348
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10112476
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [0x101b5944], 0xfffffc1e
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x101b5940], 0x901
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x101125ae
jmp 0x10112517
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x101b5944], 0x1d20
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x34], edx
jmp 0x101125ae
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x10112579
jmp 0x1011254d
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x101b5944], 0x1167
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edx
jmp 0x101124ec
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x101124ec
mov al, byte [ebp - 0x46]
test al, 1
jne 0x101124c2
jmp 0x10112586
xor eax, eax
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov edx, dword [ebp - 0x38]
add edx, 2
mov esi, dword [ebp - 0x30]
cmp ecx, esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x34], eax
jb 0x10112527
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret