joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d56a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
sub esp, 0x1c
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x100554b0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysStringLen
call fcn.100044f2
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x1000d5ef
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ecx], eax
mov eax, 4
push eax
push ecx
push eax
push 0
push str.LastCustomerType
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000d5fd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10025901
mov eax, esi
add esp, 0x14
pop esi
pop ebp
ret

Function at 0x1000d868
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x9c
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
xor esi, esi
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax - 4], 0xc
push esi
push eax
push 1
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x1000d93c
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test eax, eax
jne 0x1000d933
push 2
call fcn.1000e17f
add esp, 4
test al, al
je 0x1000d933
lea ebx, [ebp - 0xa8]
mov ecx, ebx
push 2
push 0x2fa
push str..._.._third_party_ie_to_edge_bho_ie_to_edge_util.cc
call fcn.1000e1c8
push 0x1e
push str.Failed_to_create_mutex_named:
push ebx
call fcn.1000621f
add esp, 0xc
mov ebx, eax
push edi
call fcn.10036d35
add esp, 4
push eax
push edi
push ebx
call fcn.1000621f
add esp, 0xc
push 8
push str._Error:
push eax
call fcn.1000621f
add esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
push eax
call fcn.10002280
lea ecx, [ebp - 0xa8]
call fcn.1000e468
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025901
mov eax, esi
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000d9a3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1005f878]
mov ecx, dword [0x1005ebfc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000d9ed
mov esi, dword [0x1005f874]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025901
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1005f878
call fcn.100249b6
add esp, 4
cmp dword [0x1005f878], 0xffffffff
jne 0x1000d9d3
mov esi, 0xffffffe8
xor edi, edi
mov eax, dword [esi + 0x10055cf4]
mov ecx, dword [esi + str.InternetExplorerIntegrationLevel]
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x14]
push edx
push 0x20119
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000da73
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [esi + 0x10055cf8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 4
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000da68
cmp dword [ebp - 0x14], 4
je 0x1000da7c
test ebx, ebx
je 0x1000da73
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xc
jne 0x1000da0a
xor esi, esi
jmp 0x1000da9c
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 2
sete cl
add ecx, ecx
cmp eax, 1
cmove ecx, eax
mov esi, ecx
test ebx, ebx
je 0x1000da9c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1005f874], esi
push 0x1005f878
call fcn.1002496c
add esp, 4
jmp 0x1000d9d3
Function at 0x1000e468
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add eax, ecx
add eax, 0x1c
lea ebx, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.10001256
mov ecx, ebx
push 0x1005fe34
call fcn.1001f27e
mov edx, dword [eax]
mov ecx, eax
push 0xa
call dword [edx + 0x2c]
mov edi, eax
mov ecx, ebx
call fcn.1000126a
movzx eax, di
mov ecx, esi
push eax
call fcn.10002820
mov ecx, esi
call fcn.10001db0
xor eax, eax
dec eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea edi, [esi + 4]
mov ecx, edi
push ebx
call fcn.1000830e
mov eax, dword [0x1005f954]
test al, 0x10
je 0x1000e505
movzx eax, byte [ebp - 0x11]
test al, al
cmovs eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmovns ecx, ebx
push eax
push ecx
push 0x1005fb08
call fcn.1000621f
add esp, 0xc
mov eax, dword [0x1005f954]
test al, 0x20
je 0x1000e544
cmp dword [0x1005f8e0], 0
je 0x1000e544
lea ecx, [ebp - 0x1c]
movzx eax, byte [ecx + 0xb]
test al, al
cmovs eax, dword [ecx + 4]
cmovs ecx, dword [ecx]
push eax
push ecx
push 0x1005f89c
call fcn.1000621f
add esp, 0xc
cmp dword [esi + 0x88], 2
jl 0x1000e544
mov ecx, 0x1005f89c
call fcn.10001db0
test byte [0x1005f954], 0x40
je 0x1000e567
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1000e567
cmp byte [ebp - 0x11], 0
jns 0x1000e560
mov ebx, dword [ebp - 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi + 0x88], 3
jne 0x1000e576
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp byte [ebp - 0x11], 0
jns 0x1000e587
push dword [ebp - 0x1c]
call fcn.10024ac9
add esp, 4
lea ebx, [esi + 0x38]
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x10052f44
mov dword [esi + 4], 0x10052f50
cmp byte [esi + 0x2f], 0
jns 0x1000e5ae
push dword [esi + 0x24]
call fcn.10024ac9
add esp, 4
mov ecx, edi
call fcn.10001310
mov ecx, edi
call fcn.10001da0
mov ecx, ebx
call fcn.100012de
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025901
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000f850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push 0x1005fe44
call fcn.1001f27e
mov dword [esi + 0x24], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov byte [esi + 0x35], al
cmp dword [esi + 0x2c], 9
jge 0x1000f846
pop esi
pop ebp
ret 4
push str.unsupported_locale_for_standard_input
call fcn.1001ada5
push ebp
mov ebp, esp
xor edx, edx
pop ebp
jmp fcn.1000f952

Function at 0x1000f860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
inc edx
pop ebp
jmp fcn.1000f952
Function at 0x1000fb30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push 0x1005fe4c
call fcn.1001f27e
mov dword [esi + 0x24], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov byte [esi + 0x33], al
cmp dword [esi + 0x2c], 9
jge 0x1000fb26
pop esi
pop ebp
ret 4
push str.unsupported_locale_for_standard_input
call fcn.1001ada5
push ebp
mov ebp, esp
xor edx, edx
pop ebp
jmp fcn.1000fc36

Function at 0x1000fb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
inc edx
pop ebp
jmp fcn.1000fc36

Function at 0x1000fde0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.100360c5
add esp, 0x10
cmp eax, esi
jne 0x1000fe63
cmp ebx, 1
je 0x1000fe05
cmp ebx, 2
mov esi, 0xffffffff
je 0x1000fe66
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.100351e1
add esp, 4
neg eax
sbb esi, esi
jmp 0x1000fe66
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025901
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000fe80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x1000fea4
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.100360c5
add esp, 0x14
jmp 0x1000fed3
test esi, esi
jle 0x1000fecc
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x1000fece
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1000fead
mov edi, esi
jmp 0x1000fece
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1000fee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x1000ff30
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x1000ff39
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.100360c5
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x1000ff32
jmp 0x1000ffc1
xor ebx, ebx
mov esi, ebx
jmp 0x1000ffc1
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x1000ffbe
mov ebx, eax
cmp eax, 3
je 0x1000ffa1
cmp ebx, 1
ja 0x1000ffbe
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.100360c5
add esp, 0x10
cmp eax, esi
jne 0x1000ffbe
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x1000ff44
jmp 0x1000ffb6
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.100360c5
add esp, 0x10
cmp eax, ebx
jne 0x1000ffbe
mov ebx, dword [ebp + 8]
jmp 0x1000ff32
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025901
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x10010010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10010034
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.100360c5
add esp, 0x14
jmp 0x10010064
test esi, esi
jle 0x1001005d
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x1001005f
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1001003d
mov edi, esi
jmp 0x1001005f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10010070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x100100bf
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x100100d7
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.100360c5
add esp, 0x10
cmp eax, 1
je 0x100100c1
xor esi, esi
dec esi
jmp 0x100100c1
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025901
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x100100ba
mov ebx, eax
cmp eax, 3
je 0x1001013f
cmp ebx, 1
ja 0x100100ba
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.100360c5
add esp, 0x10
cmp eax, esi
jne 0x100100ba
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x100100e2
jmp 0x10010158
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.100360c5
add esp, 0x10
cmp eax, ebx
jne 0x100100ba
movzx esi, word [ebp + 8]
jmp 0x100100c1
Function at 0x100146c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x10022e80
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x1001471e
mov dl, byte [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movsx edx, dl
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x10014862
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x1005fe64
call fcn.1001f27e
mov esi, eax
xor edi, edi
dec edi
mov eax, edi
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x10014759
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x30]
push ebx
call eax
movzx edx, byte [ebp - 0x25]
test dl, dl
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov esi, edx
cmovs esi, eax
test esi, esi
je 0x1001483d
mov ecx, ebx
mov ebx, eax
mov dword [ebp - 0x34], edx
test dl, dl
mov esi, ecx
mov eax, ecx
mov dword [ebp - 0x24], edi
cmovs esi, edi
mov ecx, dword [ebp + 0xc]
mov edi, esi
test ecx, ecx
je 0x100147c5
mov bl, byte [edi]
movzx eax, bl
mov edx, dword [ecx + 0x18]
cmp edx, dword [ecx + 0x1c]
je 0x100147d8
lea esi, [edx + 1]
mov dword [ecx + 0x18], esi
mov byte [edx], bl
jmp 0x100147f3
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x24]
mov ecx, ebx
mov ebx, dword [ebp - 0x34]
mov esi, eax
jmp 0x1001480b
mov dword [ebp - 0x24], edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], ecx
push eax
call edx
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
xor esi, esi
cmp eax, 0xffffffff
je 0x100147fc
mov esi, ecx
mov bl, byte [ebp - 0x25]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], esi
lea esi, [ebp - 0x30]
inc edi
test bl, bl
mov eax, esi
mov dword [ebp - 0x24], edx
cmovs esi, edx
mov edx, edi
mov dword [ebp - 0x34], ebx
movzx edi, bl
mov ebx, ecx
cmovs edi, ecx
add edi, esi
cmp edx, edi
mov edi, edx
mov ecx, dword [ebp - 0x20]
jne 0x100147aa
mov edx, dword [ebp - 0x34]
shr dl, 7
mov edi, dword [ebp - 0x24]
jmp 0x10014843
shr dl, 7
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test dl, dl
je 0x10014858
push edi
call fcn.10024ac9
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x100160f0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 4], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x10022ef0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x14]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
push eax
sub esp, 0x18
mov ebx, esp
lea ecx, [ebx + 8]
call fcn.10024810
mov dword [ebx], edi
mov dword [ebx + 4], 0x14
lea eax, [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x18], eax
call fcn.10024400
add esp, 0x1c
mov esp, dword [esi + 4]
mov dword [esi + 0x10], eax
lea edx, [esi + eax]
add edx, 0x50
mov ecx, edi
mov dword [esi + 0xc], edx
mov edi, dword [ebp + 0x10]
push edi
call fcn.10014a8c
add esp, 4
mov dword [esi + 8], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
mov eax, dword [edi + 0x1c]
lea ecx, [esi + 0x1c]
mov dword [ecx], eax
mov dword [esi + 4], eax
lock inc dword [eax + 4]
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
push 0x1005fe3c
call fcn.1001f27e
mov ebx, eax
xor eax, eax
dec eax
mov ecx, dword [esi + 4]
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x100161e1
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov ebx, dword [esi + 0xc]
push ebx
lea edi, [esi + 0x50]
push edi
call eax
mov ecx, dword [esi + 8]
mov eax, ecx
sub eax, edi
cmp ecx, ebx
mov ecx, dword [esi + 0x10]
lea ebx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ebx
movsx edi, byte [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
push ebx
push eax
lea eax, [esi + 0x20]
push eax
call fcn.10014d70
add esp, 0x14
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10016270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x10022f00
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x100162cf
movzx edx, word [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movzx edx, dx
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x10016415
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x1005fe6c
call fcn.1001f27e
mov esi, eax
xor edi, edi
dec edi
mov eax, edi
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x1001630a
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x30]
push ebx
call eax
movzx edx, byte [ebp - 0x25]
test dl, dl
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov esi, edx
cmovs esi, eax
test esi, esi
je 0x100163f0
mov esi, ebx
mov ebx, eax
mov dword [ebp - 0x34], edx
test dl, dl
mov dword [ebp - 0x24], edi
cmovns edi, esi
mov ecx, dword [ebp + 0xc]
mov eax, esi
test ecx, ecx
je 0x10016371
movzx eax, word [edi]
mov esi, dword [ecx + 0x18]
cmp esi, dword [ecx + 0x1c]
je 0x10016384
lea edx, [esi + 2]
mov dword [ecx + 0x18], edx
mov word [esi], ax
jmp 0x100163a2
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x24]
mov ecx, ebx
mov ebx, dword [ebp - 0x34]
mov esi, eax
jmp 0x100163bb
mov dword [ebp - 0x24], edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
movzx eax, ax
mov dword [ebp - 0x20], ecx
push eax
call edx
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
xor esi, esi
cmp ax, 0xffff
je 0x100163ac
mov esi, ecx
mov bl, byte [ebp - 0x25]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], esi
lea esi, [ebp - 0x30]
add edi, 2
test bl, bl
mov eax, esi
mov dword [ebp - 0x24], edx
cmovs esi, edx
mov edx, edi
mov dword [ebp - 0x34], ebx
movzx edi, bl
mov ebx, ecx
cmovs edi, ecx
lea esi, [esi + edi*2]
mov edi, edx
cmp edx, esi
mov ecx, dword [ebp - 0x20]
jne 0x10016357
mov edx, dword [ebp - 0x34]
shr dl, 7
mov edi, dword [ebp - 0x24]
jmp 0x100163f6
shr dl, 7
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test dl, dl
je 0x1001640b
push edi
call fcn.10024ac9
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10022440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10021520
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100214d5
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10021510
cmp dword [edx], ebp
mov cs, word [ebp + 0x68]
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.10021510
pop ecx
jb 0x10022506
invalid
push 0xe06580
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
sbb eax, 0xe36580
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.10021520
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100214d5
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x100225bc
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x100225dc
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x100225f9