joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039d0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x41b5e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x1c], 0
mov edi, 1
mov dword [esp + 0x168], edi
mov eax, dword [0x42239c]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x174]
push 0x4220d0
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x174], 3
call fcn.00412137
lea ecx, [esp + 0x178]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x174], 4
call fcn.004120d1
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00411eee
lea ecx, [esp + 0x18]
mov byte [esp + 0x168], 3
call fcn.00411eee
cmp esi, 0xffffffff
jne 0x403a93
mov esi, dword [esp + 0x170]
push 0x425a30
mov ecx, esi
call fcn.00411f5c
mov dword [esp + 0x1c], edi
jmp 0x403bf0
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x17c]
test eax, eax
jne 0x403abf
mov edx, dword [esp + 0x20]
and edx, 0x10
cmp dl, 0x10
jne 0x403b25
lea eax, [esp + 0x20]
push eax
push esi
call ebp
mov edi, eax
jmp 0x403b73
mov ecx, dword [esp + 0x20]
and ecx, 0x10
cmp cl, 0x10
je 0x403ada
lea edx, [esp + 0x20]
push edx
push esi
call ebp
mov edi, eax
jmp 0x403b73
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x10]
push eax
call fcn.00411f5c
mov ecx, dword [esp + 0x10]
push 0x422144
push ecx
call fcn.004061ea
add esp, 8
test eax, eax
je 0x403b58
mov edx, dword [esp + 0x10]
push 0x422140
push edx
call fcn.004061ea
add esp, 8
test eax, eax
je 0x403b58
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], 3
call fcn.00411eee
mov eax, dword [esp + 0x180]
push 1
push eax
push ecx
lea edx, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00411f5c
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.004038d0
lea ecx, [esp + 0x20]
push ecx
push esi
call ebp
mov edi, eax
jmp 0x403b73
lea edx, [esp + 0x20]
push edx
push esi
call ebp
lea ecx, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x168], 3
call fcn.00411eee
test edi, edi
jne 0x403a99
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x184]
test eax, eax
je 0x403bd5
mov eax, dword [esp + 0x180]
lea edx, [esp + 0x14]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.00411c63
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.00403520
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x16c], 6
call fcn.00411fdb
lea ecx, [esp + 0x18]
mov byte [esp + 0x168], 3
call fcn.00411eee
mov esi, dword [esp + 0x170]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00411c63
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x168], 2
call fcn.00411eee
lea ecx, [esp + 0x174]
mov byte [esp + 0x168], 1
call fcn.00411eee
lea ecx, [esp + 0x178]
mov byte [esp + 0x168], 0
call fcn.00411eee
mov ecx, dword [esp + 0x160]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x15c
ret 0x18
Function at 0x404350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41b747
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esp + 0xc]
push 0
mov ecx, dword [esi + 0xc0]
push eax
mov dword [esp + 0x28], 0
call fcn.00401b50
mov ebx, 1
push 0
push 0x5c
push ebx
push ecx
mov dword [esp + 0x40], ebx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4221ec
call fcn.00411f5c
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x48], 2
call fcn.00411c63
mov ecx, dword [esi + 0xc0]
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x48], bl
call fcn.004039d0
push 0x4220d0
push 0
push 0x5c
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], 3
call fcn.00411c63
mov ecx, dword [esi + 0xc0]
lea eax, [esp + 0x2c]
push eax
call fcn.00402d00
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x40], 4
call fcn.004120d1
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3c], 5
call fcn.00412137
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 6
call fcn.00411fdb
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 5
call fcn.00411eee
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.00411eee
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.00411eee
push ebx
push 0
push 0
push ebx
mov ecx, dword [esi + 0xc0]
push 0
call fcn.004038a0
lea ecx, [esp + 0x30]
push eax
push ecx
mov ecx, dword [esi + 0xc0]
call fcn.00403770
mov edi, eax
mov ecx, dword [esi + 0xc0]
push 0
push ebx
push 0
push 7
push 5
mov byte [esp + 0x44], 7
call fcn.004038a0
mov ecx, dword [esi + 0xc0]
lea edx, [esp + 0x20]
push eax
push edx
call fcn.00403770
push eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x3c], 8
call fcn.004120d1
push edi
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0x3c], 9
call fcn.004120d1
mov esi, dword [esp + 0x38]
push str..exe
push eax
push esi
mov byte [esp + 0x3c], 0xa
call fcn.00412137
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 9
call fcn.00411eee
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 8
call fcn.00411eee
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 7
call fcn.00411eee
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 3
call fcn.00411eee
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.00411eee
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00411eee
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 4
Function at 0x404560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41b77f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x42239c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], 1
cmp eax, 6
ja case.default.0x40459e
jmp dword [eax*4 + 0x404630]
push str.6c78787429374529364a29364a6873737174373272697829364a756670736b29364a
jmp 0x4045d4
push str.57534a585b455649293947293947516d67767377736a782939472939475b6d7268737b77293947293947477976766972785a6976776d7372293947293947567972
jmp 0x4045d4
push str.4568736669
jmp 0x4045d4
push str.67636d726d7832746c7429374a74636d682937487374697229363a716567293748
jmp 0x4045d4
push str.67637065777832746c7429374a74636d682937487374697229363a716567293748
jmp 0x4045d4
push str.67637374697232746c74
jmp 0x4045d4
push str.7374697232746c7429374a71293748
lea ecx, [esp + 0xc]
call fcn.0041202b
push 4
push 1
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00411c63
mov esi, dword [esp + 0x2c]
mov ecx, dword [edi + 0xc4]
push esi
call fcn.00401170
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.00411eee
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 8

Function at 0x4107e1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410801
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00407787
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x410824
test byte [esp + 8], 2
je 0x410824
call fcn.004077fa
mov dword [eax], 0xd
call fcn.00407803
mov dword [eax], 5
jmp 0x4107fd
xor eax, eax
ret

Function at 0x418540
Capabilities:
Create http request

Disassembly:
mov eax, 0x41b9e8
call fcn.00406ce8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x418578
call fcn.0041a4ca
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x41859d
push eax
push dword [esi + 4]
call fcn.0041919c
jmp 0x4185a9
push esi
push eax
mov ecx, 0x425ce0
call fcn.004185ba
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x41886b
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x41ba47
call fcn.00406ce8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00413e46
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x42239c]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.0041202b
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.0041202b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x41a03e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41a06c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a08a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00419fa4
jmp 0x41a08a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41a08a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00419fa4
test edi, edi
mov eax, edi
jne 0x41a074
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x7ffe5354
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
not eax
not eax
and al, 0xff
push bx
inc esp
inc esp
push eax
pop eax
add al, 4
sub al, 4
push es
pop ds
add al, 4
sub al, 4
inc esi
dec esi
xor eax, ecx
xor eax, ecx
inc esi
dec esi
push bx
inc esp
inc esp
inc esi
dec esi
not eax
not eax
push es
pop ds
pushf
popf
push eax
pop eax
pushf
popf
push eax
pop eax
push bx
inc esp
inc esp
and al, 0xff
xor eax, ecx
xor eax, ecx
push es
pop ds
push bx
inc esp
inc esp
inc esi
dec esi
not eax
not eax
inc esi
dec esi
push bx
inc esp
inc esp
and al, 0xff
push bx
inc esp
inc esp
and al, 0xff
xor eax, ecx
xor eax, ecx
push eax
pop eax
not eax
not eax
add al, 0
not eax
not eax
inc esi
dec esi
add al, 4
sub al, 4
push eax
pop eax
xor eax, ecx
xor eax, ecx
push es
pop ds
add al, 4
sub al, 4
inc esi
dec esi
add al, 4
sub al, 4
inc esi
dec esi
not eax
not eax
inc esi
dec esi
add al, 4
sub al, 4
add al, 0
push es
pop ds
call 0x7ffe53f1
pop edx
inc esi
dec esi
xor dx, dx
push bx
inc esp
inc esp
add al, 0
add al, 4
sub al, 4
push eax
pop eax
add edx, 0xd5e0
push es
pop ds
xor ecx, ecx
and al, 0xff
push bx
inc esp
inc esp
mov cl, 0x1e
add al, 0
and al, 0xff
xor byte [ecx + edx], 0x47
loop 0x7ffe5419
push eax
pop eax
add al, 4
sub al, 4
add al, 0
add al, 4
sub al, 4
push dword fs:[0x24]
inc esi
dec esi
not eax
not eax
pop dword [edx + 0xa]
and al, 0xff
xor eax, ecx
xor eax, ecx
stc
mov cl, 0xff
pushf
popf
push edx
loop 0x7ffe5448
push es
pop ds
xor eax, ecx
xor eax, ecx
and al, 0xff
add al, 0
mov dword [edx + 0x11], 0xffffacbb
push eax
pop eax
and al, 0xff
mov ecx, dword [eax + 0x2c]
and al, 0xff
mov dword [edx + 0x1b], ecx
not eax
not eax
add al, 0
push bx
inc esp
inc esp
push eax
pop eax
mov dword [edx + 0x100], ecx
pushf
popf
inc esi
dec esi
lea esp, [esp]
mov dword [eax + 0x2c], esp
inc esi
dec esi
add al, 4
sub al, 4
stc
push 0
inc esi
dec esi
push 0
push es
pop ds
pushf
popf
add al, 0
add al, 0
push 0
pushal
inc eax
popal
push 0
add al, 4
sub al, 4
push 0x30
inc esi
dec esi
push 0x20
pushf
popf
inc esi
dec esi
push eax
pop eax
push 0
push 0
stc
add edx, 0xffff7f2e
pushf
popf
inc esi
dec esi
not eax
not eax
push edx
inc esi
dec esi
nop
inc esi
dec esi
push edx
add al, 4
sub al, 4
push 0
push eax
pop eax
add al, 4
sub al, 4
and al, 0xff
push es
pop ds
call dword [edx + 0x8215]
and al, 0xff
not eax
not eax
inc esi
dec esi
add esp, 0x3f8
pushal
inc eax
popal
xor eax, eax
push es
pop ds
inc eax
push es
pop ds
ret 0xc
Function at 0x409571
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a344]
jne 0x40957b
repz ret
jmp fcn.0040df5c

Function at 0x41218c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b5ff
and dword [ebp - 0x14], 0
cmp dword [0x45c62c], 0
mov dword [ebp - 0x18], eax
jne 0x41223f
push 0x403784
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4122e7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403778
push ebx
call edi
test eax, eax
je 0x4122e7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403768
push ebx
mov dword [0x45c62c], eax
call edi
push eax
call esi
push 0x403754
push ebx
mov dword [0x45c630], eax
call edi
push eax
call esi
push 0x403738
push ebx
mov dword [0x45c634], eax
call edi
push eax
call esi
mov dword [0x45c63c], eax
test eax, eax
je 0x41223f
push 0x403720
push ebx
call edi
push eax
call esi
mov dword [0x45c638], eax
mov eax, dword [0x45c638]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412298
cmp dword [0x45c63c], ecx
je 0x412298
push eax
call esi
push dword [0x45c63c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412298
test ebx, ebx
je 0x412298
call edi
test eax, eax
je 0x41228f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41228f
test byte [ebp - 8], 1
jne 0x412298
or dword [ebp + 0x10], 0x200000
jmp 0x4122cb
mov eax, dword [0x45c630]
cmp eax, dword [ebp - 0x18]
je 0x4122cb
push eax
call esi
test eax, eax
je 0x4122cb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4122cb
mov eax, dword [0x45c634]
cmp eax, dword [ebp - 0x18]
je 0x4122cb
push eax
call esi
test eax, eax
je 0x4122cb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45c62c]
call esi
test eax, eax
je 0x4122e7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4122e9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409571
leave
ret
Function at 0x4140c0
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.00413760
cmp dword [0x7fc784], 0x37
jne 0x414151
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x403f50
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x403f70
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x7fd368]
mov edx, dword [0x7f97e4]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x101a4410
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x101c811c], 0x1973
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x101c8120]
sub eax, 0x1648
mov dword [0x101c811c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x101a445c
jmp 0x101a45b7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x104
jl 0x101a44a9
jmp 0x101a44db
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x28
pop ebp
ret
mov dword [0x101c811c], 0x401
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
sete dl
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x19]
test al, 1
jne 0x101a457a
jmp 0x101a4457
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x101a44bc
jmp 0x101a44db
mov dword [0x101c8120], 0xe9d
jmp 0x101a44c8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x101a445c
mov dword [0x101c8120], 0x2480
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x101a45bf
mov dword [0x101c8120], 0x9c7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x101a45bd
mov dword [0x101c811c], 0x1f2f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x101a45bb
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax - 0x14]
cmp ecx, 0x64
jne 0x101a45b9
mov dword [0x101c811c], 0x24a3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
je 0x101a447c
jmp 0x101a45b7
mov dword [0x101c8120], 0x1d1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x6c
jne 0x101a45b2
mov dword [0x101c811c], 0x1a60
mov dword [ebp - 4], 1
jmp 0x101a446e
jmp 0x101a4457
jmp 0x101a45b9
jmp 0x101a45bb
jmp 0x101a45bd
jmp 0x101a45bf
mov dword [ebp - 4], 0
jmp 0x101a446e
Function at 0x101a5280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x101c811c], 0x513
mov dword [0x101c8124], 0
mov dword [0x101c8128], 0
mov dword [0x101c8134], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov eax, dword [0x101c811c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, 0x1004
mov dword [0x101c8120], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jae 0x101a5460
mov eax, 0x100
mov dword [0x101c811c], 0x525
mov dword [0x101c8120], 0x2451
mov dword [0x101c8120], 0xda4
mov ecx, dword [0x101c8124]
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x101c8124], edx
mov edx, dword [0x101c8128]
mov esi, dword [0x101c8124]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x101c8128], edx
mov edx, dword [0x101c811c]
add edx, 0x1e48
mov dword [0x101c811c], edx
mov edx, dword [0x101c8124]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov byte [0x101c812c], bl
mov dword [0x101c811c], 0x1607
mov edx, dword [0x101c8128]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov edx, dword [0x101c8124]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov edx, dword [0x101c8120]
add edx, 0x7cc
mov dword [0x101c811c], edx
mov bl, byte [0x101c812c]
mov edx, dword [0x101c8128]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov edx, dword [0x101c8124]
mov esi, dword [ebp - 0x1c]
movzx edx, byte [esi + edx]
mov esi, dword [0x101c8128]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov dword [ebp - 0x20], edx
mov dword [0x101c811c], 0xf7b
mov edx, dword [0x101c811c]
sub edx, 0x35d
mov dword [0x101c8120], edx
mov edx, dword [ebp - 0x20]
mov eax, edx
cdq
idiv ecx
mov dword [0x101c8134], edx
mov dword [0x101c811c], 0x1d88
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
mov esi, dword [0x101c8134]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
xor edx, esi
mov bl, dl
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], bl
mov dword [0x101c811c], 0x627
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x101a52f3
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101a56a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x101c811c]
sub eax, 0x2540
mov dword [ebp - 0xc], eax
lea eax, [fcn.101a56a0]
mov ecx, dword [ebp - 0xc]
mov dword [0x101c811c], ecx
mov dword [ebp - 8], eax
mov dword [0x101c811c], 0x8d2
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x101a56fe
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 8]
cmp dword [edx + ecx], 0x4550
jne 0x101a56fc
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x101a5725
jmp 0x101a56fe
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov al, 1
test al, 1
jne 0x101a56cf
jmp 0x101a571c
mov dword [ebp - 4], 0
jmp 0x101a5725
mov eax, dword [ebp - 4]
add esp, 0x14
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x54e53b81
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
mov eax, str.s0I
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x303314d1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219