joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015d3b2
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x79b6ef9b
or bp, 0x732f
mov ebp, 0xbaae2306
mov ebp, dword [esp]
call fcn.10091716
push edi
pushfd
mov edi, 0x1965e05
xor edi, 0x8c19219e
jbe fcn.1015d3b2
push ebp
mov dword [esp + 0xc], 0x9d3a56a5
mov edi, dword [esp + 8]
jl 0x100356a0

Function at 0x10168df2
Capabilities:
Encode data using xor

Disassembly:
call fcn.1002e611
cmp al, 0xf6
pop esp
and al, 4
je 0x1015376c
mov dword [esp + esi + 0x4ac9cf0a], ecx
jl 0x1002dc20
fmul st(3)
xor eax, dword [eax - 4]
wait
cwde
pushal
pop ds
mov dword [0x679fdcb4], eax
pushal
fdivr qword [edi + 0xf748cd7]
jbe 0x10168de3
dec edx
mov dl, 0xff
pop ecx
loope 0x10168e93
jg 0x10168e2e
mov eax, dword [0xf1659d11]
mov esi, 0x8cf295ac
salc
mov esi, ss
retf 0xaf26
pop ebx
invalid

Function at 0x10169c14
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd1bf108a
lea ecx, [ecx + ecx*8 + 0x6d3f0535]
call fcn.100ecdd4
int3
mov al, 6
xor edx, dword [eax]
mov dword [esp + edx - 0x64e5273f], 0xc83368d
mov edx, dword [esp + edx - 0x64e5272f]
mov edx, dword [edx]
ja 0x10035590
mov esi, dword [esp + 0x3c]
sub dword [esp + 0x40], 0xe688fcb4
xor dword [esp + 0x24], 0xe2374634
mov dword [esp + 0x40], 0xe1a52b0d
jle 0x100f9dec
mov dh, 0x96
imul edx, dword [ecx], 0xffffff8f
scasb al, byte es:[edi]
xor byte [edi - 0x52201eff], bh
jae 0x100ed194
dec edi
cmpsd dword [esi], dword es:[edi]
cwde
mov ss, ecx
and byte [edi - 0x64], bl
xor dword [ecx + 0x4f], 0x46
clc
lea edx, [ecx + 0x39]
cmpsd dword [esi], dword es:[edi]
mov dh, 0xeb
outsb dx, byte [esi]
rol eax, cl
ja 0x100ed1f5
test byte [edx], bh
sbb eax, 0x1b84acc6
salc
mov edi, 0xc38afb18
add bl, al
cmp al, 0xc6
test edx, eax
push cs
mov dl, 0xdc
ret
mov dword [esp + 0x18], 0x9d0b9c31
xor dword [esp + 0x18], 0x8d20ffbc
push dword [esp + 0x2c]
popfd
lea esp, [esp + 0x54]
ret
and dword [esp + 0x40], ecx
xor cl, byte [esp + 0x30]
sub dword [esp + 0xc], 0x4fb425b9
test ecx, ecx
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x30], 0xb2
jne 0x100ed1b2
call 0xdc8703d9
mov bl, 0xdb
mov al, 0x48
pop ss
stosd dword es:[edi], eax
fdiv dword [eax - 0x2f93d029]
wait
pause
push 0xd562d377
test al, 4
xlatb
pop esp
nop
invalid

Function at 0x1016b501
Capabilities:
Encode data using xor

Disassembly:
not bl
not dx
push dword [esp + edx*4 - 0x2e736f4]
popfd
mov dword [esp + 0x18], ebp
push edx
not dl
pushfd
lea edx, [ebx + edx*8 + 0x3cdac5bf]
not dl
add byte [esp + edx - 0x742ff60c], bh
mov edi, dword [esp + ebx - 0x3186c74c]
add dword [esp + 0x1c], 0x196ae
test bx, 0x6b33
push ecx
mov ebp, dword [esp + edi*2 - 0x1739b0c]
call fcn.100d5726
or dl, byte [ecx]
lodsd eax, dword [esi]
invalid
Function at 0x101752bc
Capabilities:
Encode data using xor

Disassembly:
push edx
cli
pop edi
dec ecx
in eax, dx
add ebp, esp
rep outsb dx, byte [esi]
bound edi, qword fs:[ecx + 0xc104d67]
push ss
adc byte [esi + edx], cl
xor eax, 0x7b6d5e14
or eax, 0xa4d70dc
jae 0x10175214
outsd dx, dword [esi]
invalid
test byte [0xefedb08b], dh
or dword [ebx + edi + 8], ebp
lea ebx, [edx - 0x550f518]
add al, 0xb0
xchg ecx, eax
mov dl, 0xf1
lodsb al, byte [esi]
inc eax
pushfd
js 0x10175222
scasd eax, dword es:[edi]
pop es
stosd dword es:[edi], eax
aaa
retf
jle fcn.100ec034
jns 0x100a77f5
jg 0x1017524b
pop ds
adc eax, 0xfe2f30ab
mov al, byte [0x5f00d946]
jmp dword [ebx + 0x7a]
Function at 0x101e3f48
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov ecx, esi
sub ecx, eax
cmp ecx, 0x104
jmp 0x101e134b
jl 0x101f2d03
jmp 0x1019797f
mov eax, dword [ebp - 0xc]
bt cx, 0x92
rol ecx, cl
mov ecx, dword [ebp + 0x10]
btr si, di
or esi, 0xca3a77bb
lea esi, [edi + ebx]
sar esi, 1
mov eax, dword [eax + esi*4]
push ecx
sbb ecx, esi
setb cl
add ch, cl
mov ecx, dword [ebp + 0xc]
jmp 0x10280678
jmp 0x101f2cfb
test ecx, ecx
jmp 0x102190cd
jle 0x10197975
mov ecx, dword [ebp - 4]
jmp 0x101c21cd
mov eax, dword [edx + 0x3c]
test di, cx
add eax, edx
stc
cmp dword [eax], 0x4550
jmp 0x10229368
inc esi
cmc
test cl, cl
jmp 0x101f8146
je 0x101ae9d2
sub eax, eax
movzx esi, bp
pop esi
jmp 0x10261458
jmp 0x101f2d03
jae 0x101f814c
mov esi, dword [ecx + edx + 0x1c]
stc
lea eax, [esi + eax*4]
stc
test ebx, ebx
clc
mov eax, dword [eax + edx]
stc
test eax, eax
je 0x101f814c
cmp eax, ecx
jmp 0x101e43ea
push esi
cmc
test edx, edx
je 0x101bb430
mov esi, dword [ebp + 0xc]
stc
test bh, 0x87
test esi, esi
je 0x101bb430
mov eax, 0x5a4d
cmp bp, 0xacbc
cmp word [edx], ax
jmp 0x101bb42a
jae 0x101f814c
sub edi, edi
jmp 0x101a0c7d
push ebp
mov dx, ax
dec bp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x114
jmp 0x101de8e7
jb 0x101e7664
mov esi, dword [ebp - 0x10]
cmc
cmp dh, 0xb5
lea esi, [esi + ecx]
stc
clc
cmp eax, esi
jmp 0x10227fc8
pop edi
jmp 0x102513fc
mov edx, dword [ebp - 4]
rcl ch, cl
mov eax, dword [ebp + 8]
bt cx, cx
sal ecx, cl
mov ecx, dword [edx + eax + 0x24]
sub dx, cx
lea edx, [ecx + esi*2]
or cx, sp
test esp, 0xbe21bd92
bts cx, dx
movzx eax, word [edx + eax]
add dx, sp
adc cl, 0xb8
and dl, 9
mov ecx, dword [ebp - 4]
bswap edx
mov edx, dword [ebp + 8]
clc
mov dword [ebp - 8], eax
sbb eax, 0x91ada89f
mov eax, dword [ebp - 8]
test ax, sp
clc
cmp eax, dword [ecx + edx + 0x14]
jmp 0x101c478c
jne 0x10275b39
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x1025a7d0
call fcn.1026b6cc
add esp, 4
clc
stc
test dl, ch
test eax, eax
jmp 0x1027d5ee
push edi
mov dword [ebp - 0x10], eax
jmp 0x101fd0c3
jae 0x101e7664
mov cl, byte [eax + edx]
inc si
adc si, di
lea eax, [eax + edx]
mov esi, eax
clc
test cl, cl
jmp 0x10275b33
jne 0x101bb430
mov ecx, dword [eax + 0x78]
cmp ch, bh
cmp esp, 0xb31671b6
test edi, 0xfa8443b4
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x101bb430
mov eax, dword [eax + 0x7c]
push ebx
jmp 0x10218593
je 0x1018fa4c
mov cl, byte [esi + 1]
jmp 0x101af543
jmp 0x102760fe
mov edi, dword [ecx + edx + 0x18]
test si, si
test si, 0x2c01
clc
test edi, edi
je 0x101f2d03
mov eax, dword [ecx + edx + 0x20]
jmp 0x10280efa
ja 0x10243e96
mov eax, esi
stc
sub eax, dword [ecx + edx + 0x10]
jmp 0x1019af71
je 0x101f814c
cmp cl, 0x2e
jmp 0x10229428
jle 0x101f2cc0
lea ebx, [esi + 1]
shld dx, sp, 0x35
bts dx, bx
inc dl
cmp ebx, edi
mov edx, dword [ebp + 8]
jmp 0x101a828c
jge 0x102760ea
lea edi, [esi - 1]
jmp 0x10230963
add eax, edx
jmp 0x10216d9e
dec edi
clc
test bx, 0xe414
add eax, edx
test si, 0x42e
cmc
sub ebx, ebx
stc
mov dword [ebp - 0xc], eax
clc
cmp di, ax
test edi, edi
jmp 0x101907e8

Function at 0x101e572d
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov esp, 0xf816af84
call fcn.101b52d9
invalid
Function at 0x102028e4
Capabilities:
Encode data using xor

Disassembly:
mov dx, word [esi + 2]
shr cl, 0x47
mov cl, byte [esi + 4]
jns 0x102401de
add al, al
jmp 0x146eb335
sub dword [edx - 0x46], eax
lodsd eax, dword [esi]
adc dword [edx], ebx
jb 0x102028fd
stc
test byte [edx + 5], 0x6d
push ss
out dx, al
test eax, 0x617a1215
cdq
xchg byte [edx + 0x15], dh
pop es
das
adc ch, byte fs:[esi]
xor eax, 0x49c93aa
xor eax, 0x49c93aa
out 0xc2, al
xchg ecx, eax
mov dl, 0x2f
test al, 0xdf
add bl, bh
mov edi, 0x86ea8048
jbe 0x10202979
mov bl, 0x7a
jmp 0x102028e7
sbb al, 0x8c
jp 0x10202910
mov edi, 0xf7937740
scasb al, byte es:[edi]
sahf
push edi
mov bl, 0x7a
dec eax
nop
pop edi
dec edi
jp 0x102029ae
fcmovne st(0), st(3)
in eax, dx
mov word [ebx], ds
xor ah, byte [esi + 0x1189bf30]
xor byte [edx], dl
lodsd eax, dword [esi]
out 0x90, al
cmp cl, byte [esi]
mov esi, 0xf73ee9f3
movsb byte es:[edi], byte [esi]
push ecx
add ecx, esi
and eax, 0xe016ce4a
in al, dx
loopne 0x10202967
rol ch, cl
scasd eax, dword es:[edi]
jb 0x10202964
cwde
imul esi, dword [esi], 0x1223684e
and ecx, edx
cmp al, 0x5a
mov ss, word [esi]
fnstcw word [edi + 0x51e9b784]
leave
dec ebp
cld
das
inc edx
jbe 0x102029e7
cmp al, 8
cmp eax, 0x8d05d97
sub dword [edx - 0x541364cd], ecx
fisttp dword [edx + 0x3a]
jl 0x10202945
mov dh, byte [edx + 0xd]
mov cl, 0xf2
fbstp tbyte [ebx]
or eax, 0x33dff2b1
invalid
sar dword [ecx - 0x6b], 0xe1
or ecx, esi
or eax, 0xc9f824b5
jecxz 0x10202a4f
jmp 0x1020299c
adc eax, 0xa25065bf
adc bl, byte [esi + 0x5456f266]
popal
push ecx
jo 0x10202ab0
retf
or esi, dword [edi]
fdivr dword [ebx]
imul dword [ecx + 0x7867c333]
mov al, 0xfa
iretd
js 0x101fd83d
adc esi, 4
shrd ax, dx, cl
mov word [esi], ax
mov dword [esp], 0xc3975b0e
lea esp, [esp + 4]
jmp fcn.10251477

Function at 0x10221f18
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x101e1433
push 0xbb8ad318
lea esp, [esp + 0x14]
je 0x101e146a
mov eax, 0x12721b4
xor al, 0xb2
neg eax
mov eax, dword [ebp + ebx*4]
push 0x2889f09
mov dword [esp], eax
push 0x71047b35
neg byte [esp]
dec ebx
lea esp, [esp + 4]
jne 0x101e1442
call fcn.101e5d2e
call fcn.10210dcc
mov ebx, edx
mov edx, 0x86950036
mov edx, ebx
sal edx, 2
mov eax, 0xd221979b
mov dword [esp + 8], eax
dec ax
mov eax, ebp
mov dword [esp + 0xc], 0x562b1b1f
add eax, edx
jmp 0x101bf0b9
Function at 0x10268b54
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x59174112
add esi, 2
sal dx, cl
jmp 0x10268b4b
inc ecx
pop edi
pop ebx
not edi
inc ecx
mov dword [edi], edi
jmp 0x101f1205
rol bx, 0xe3
dec eax
lea ebx, [0xfffdd0e9]
inc ecx
mov edi, 0xe8a05eb6
inc cx
sub edi, 0xf450133
mov dh, 0x3a
push 0x11804c01
inc esp
xor edi, edi
inc ecx
and edi, 0xff
inc esi
mov edi, dword [ebx + edi*4]
dec eax
shl dword [esp], 0x5e
shr edi, 8
inc ecx
xor edi, edi
push 0xfeaf8781
dec ecx
inc edx
dec dword [esp]
xor edi, 0x3713ef87
not byte [esp + 4]
dec eax
dec esi
dec eax
lea esp, [esp + 0x10]
jne 0x101b807f
jmp 0x101a6617
jmp fcn.10253503
mov ebx, 0xb906a724
inc ecx
push edi
jmp 0x101b8074
mov word [esi], dx
call 0x101a820e
push 0xd6082382
dec eax
lea esp, [esp + 0x18]
je 0x101a661a
push 0x5f3b9910
dec eax
mov dword [esp], ebx
jmp 0x1025a192
Function at 0x101c1dc2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x101c1dfc
jmp 0x101c1e83
mov eax, dword [ebp - 0x18]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
cmp eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ecx
je 0x101c1dfc
jmp 0x101c1ed9
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x30], eax
mov word [ebp - 0x32], dx
mov word [ebp - 0x34], di
jb 0x101c1e54
mov ax, word [ebp - 0x32]
mov word [ebp - 0x34], ax
mov ax, word [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov byte [ebp - 0x35], bl
jne 0x101c1fa0
jmp 0x101c1f6d
mov dword [0x101fa448], 0x25ed
mov dword [0x101fa444], 0x14fc
mov ecx, dword fs:[0x18]
mov dword [0x101fa444], 0xffffeafc
mov eax, dword [ecx + 0x30]
mov dword [0x101fa448], 0xffffd3cf
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x20]
mov byte [ebp - 0x36], cl
mov dword [ebp - 0x1c], edx
jmp 0x101c1e07
mov dword [0x101fa444], 0xe77
mov eax, dword [ebp - 0x24]
add eax, 0x24
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x28]
mov esi, dword [ecx + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x36]
and bh, bl
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x41], bh
mov al, byte [ebp - 0x41]
test al, 1
jne 0x101c1f16
jmp 0x101c1f2c
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff8
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
jmp 0x101c1dfc
mov eax, dword [ebp - 0x3c]
mov cx, word [eax]
mov dword [0x101fa444], 0x26b6
shr cx, 1
movzx edx, cx
cmp cx, 0
sete bl
mov dword [ebp - 0x4c], edx
mov byte [ebp - 0x4d], bl
xor eax, eax
mov cl, byte [ebp - 0x4d]
test cl, 1
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], eax
jne 0x101c1e07
jmp 0x101c1e20
mov dword [0x101fa444], 0x667
mov eax, dword [ebp - 0x30]
add eax, 1
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
setb dl
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x55], dl
mov al, byte [ebp - 0x55]
test al, 1
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x28], ecx
jne 0x101c1e20
jmp 0x101c1fa0
mov al, byte [ebp - 0x35]
test al, 1
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
jne 0x101c1fb2
jmp 0x101c1e07
mov dword [0x101fa448], 0xffffc994
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
jmp 0x101c1dfc
Function at 0x101c2402
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101fa450], 0
mov byte [0x101fa454], 0
mov dword [0x101fa444], 0x1f87
mov dword [0x101fa44c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101c2464
xor eax, eax
mov dword [0x101fa444], 0xd51
mov dword [0x101fa44c], 0
mov dword [ebp - 0x20], eax
jmp 0x101c248c
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101fa44c]
add eax, 1
mov dword [0x101fa44c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101c2464
jmp 0x101c2449
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101fa458], 0
mov dword [0x101fa444], 0x17de
mov edx, dword [0x101fa450]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x101fa458], edi
mov dword [0x101fa448], 0x51e
mov dword [0x101fa444], 0xffffe312
mov eax, edi
cdq
idiv ecx
mov dword [0x101fa450], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x101fa454], cl
mov dword [0x101fa444], 0x1980
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov ecx, dword [0x101fa444]
add ecx, 0x1ff7
mov dword [0x101fa448], ecx
mov cl, byte [0x101fa454]
mov edx, dword [0x101fa450]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x101fa444], 0x5e6
mov edx, dword [0x101fa448]
add edx, 0xfffffd1a
mov dword [0x101fa448], edx
mov edx, dword [0x101fa44c]
add edx, 1
mov dword [0x101fa44c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x101c248c
mov dword [0x101fa444], 0x1e31
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101c29af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x101fa448], 0x26de
mov dword [ebp - 0x10], eax
call fcn.101c1fc7
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov dword [0x101fa448], 0xe73
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x101c29ff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101fa444], 0x16bd
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x101c2a76
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax + ecx + 0x24]
mov dword [ebp - 0x34], edx
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x34]
add ecx, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
jmp 0x101c2a81
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101fa444], 0x22a3
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x52], cl
je 0x101c2aec
mov eax, dword [ebp - 0x50]
add eax, 1
mov cl, byte [ebp - 0x51]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x52]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x101c2a9b
mov al, byte [ebp - 0x52]
test al, 1
jne 0x101c2a53
jmp 0x101c2af9
mov eax, dword [ebp - 0x40]
add eax, 2
mov dword [ebp - 0x58], eax
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov edx, dword [ebp - 0x2c]
cmp ecx, edx
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], esi
jb 0x101c2a81
jmp 0x101c2a76
Function at 0x101c2b81
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [0x101fa444], 0x1927
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x101c2bea
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x101c2cab
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x101c2c35
jmp 0x101c2bb7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x101c2c90
jmp 0x101c2bb7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
je 0x101c2bc1
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [0x101fa444], 0x9f6
cmp eax, 0x104
setl cl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], cl
mov al, byte [ebp - 0x25]
test al, 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
jne 0x101c2bea
jmp 0x101c2bc1
mov dword [0x101fa444], 0x21a9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x101c2bb7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101c2bb7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x101c2bb7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x101c2bd5
jmp 0x101c2bb7
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x14], eax
jne 0x101c2bb7
mov eax, dword [ebp - 0x14]
add esp, 0x28
pop ebp
ret
Function at 0x101c2cb3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x101c2d90
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x101fa444]
add ecx, 0xffffdbc9
mov dword [0x101fa444], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.101c22f3
xor eax, eax
mov ecx, dword [0x101fa444]
add ecx, 0xffffe005
mov dword [0x101fa448], ecx
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], ecx
mov dword [0x101fa444], 0x19c4
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x50], ecx
add ecx, 0x104c
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x101c2d87
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x101c4528]
mov dl, byte [eax + 0x101c44f9]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x101c2d90
lea eax, [ebp - 0x24]
mov dword [0x101fa444], 0x1372
mov dword [ebp - 0x44], eax
call fcn.101c33d3
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
call fcn.101c212d
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, 0
je 0x101c2cd0
jmp 0x101c2cd8
Function at 0x101c2f0a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101fa44c], 0
mov dword [0x101fa450], 0
mov dword [0x101fa45c], 0
mov edi, dword [0x101fa448]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffff338
mov dword [0x101fa444], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
je 0x101c3092
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x101fa444], 0x20d1
mov dword [0x101fa448], 0x7e7
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101fa44c], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x101fa450], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101fa454], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x101fa454]
mov edx, dword [0x101fa450]
mov byte [edi + edx], cl
mov dword [0x101fa448], 0x2664
mov edx, dword [0x101fa44c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101fa450]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101fa45c], ebx
mov dword [0x101fa444], 0x1fb1
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov byte [0x101fa461], ch
mov byte [0x101fa462], cl
xor ch, cl
mov byte [0x101fa460], ch
mov dword [0x101fa444], 0x251f
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov dword [0x101fa448], 0x13d3
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x3c], ebx
je 0x101c3092
mov eax, dword [0x101fa44c]
mov ecx, dword [0x101fa450]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
jmp 0x101c2f7f
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret