joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40452e
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x405098
call fcn.00404740
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x404582
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x404582
movzx ecx, word [eax + 0x400018]
cmp ecx, 0x10b
je 0x40459a
cmp ecx, 0x20b
je 0x404587
mov dword [ebp - 0x1c], ebx
jmp 0x4045b1
cmp dword [eax + 0x400084], 0xe
jbe 0x404582
xor ecx, ecx
cmp dword [eax + 0x4000f8], ebx
jmp 0x4045ab
cmp dword [eax + 0x400074], 0xe
jbe 0x404582
xor ecx, ecx
cmp dword [eax + 0x4000e8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x406554], edi
mov dword [0x406558], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x406550]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x40654c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40655c], eax
call fcn.0040473a
cmp dword [0x40603c], ebx
jne 0x40460e
push fcn.0040473a
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00404728
push 0x405094
push 0x405090
call sub.msvcrt.dll__initterm
mov eax, dword [0x406548]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x406544]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x40508c
push 0x405088
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x404699
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x404679
cmp cl, 0x22
jne 0x40466a
cmp byte [eax], 0x22
jne 0x404682
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x40468d
cmp cl, 0x20
jbe 0x40467e
test byte [ebp - 0x54], 1
je 0x4046a4
movzx ecx, word [ebp - 0x50]
jmp 0x4046a7
cmp byte [eax], 0x20
jbe 0x404682
inc eax
mov dword [ebp - 0x20], eax
jmp 0x404699
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00403fec
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x4046c5
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x404701
mov eax, esi
jmp 0x404715
call fcn.0040477b
ret
Function at 0x1000d53a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000d549
pop dword [ebp - 0x28]
mov eax, 0xe2c237e6
add eax, 0x2d3e9d63
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x47e71e5a
add dword [ebp - 0x38], 0x66b26f1
mov dword [ebp - 0x34], 0x5ac2f6fa
sub dword [ebp - 0x34], 0x288faab5
mov dword [ebp - 0x30], 0x80d566bc
add dword [ebp - 0x30], 0xcb76dd72
mov dword [ebp - 0x2c], 0x3e35863c
add dword [ebp - 0x2c], 0xc1ca79c4
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xe335aa1e
add dword [ebp - 0x38], 0x913cbf38
mov dword [ebp - 0x34], 0xd978551f
sub dword [ebp - 0x34], 0x980bf3aa
mov dword [ebp - 0x30], 0x656b2dc0
sub dword [ebp - 0x30], 0x1fbc154
mov dword [ebp - 0x2c], 0x617fe117
sub dword [ebp - 0x2c], 0x617fe117
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3c6b2
push 0
call eax
mov ecx, 0x44e0
mov edx, eax
mov esi, 0x1003ae00
add esi, dword [ebp - 0x28]
mov ebx, 0xf2b9328f
sub ebx, 0x7c169085
xor dword [ebp - 0x1c], edi
mov edi, dword [esi]
add dword [ebp - 4], 0x7b8a425a
sub edi, ebx
xor dword [ebp - 8], 0x45417746
mov dword [edx], edi
add edx, 0xff9927ca
sub edx, 0xff9927c6
add esi, 4
loop 0x1000d655
add eax, 0x10653
mov ebx, eax
add eax, 0xbb07a22f
sub eax, 0xbb07a22a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10013126
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x1002ba70
call fcn.1002a480
lea edi, [ecx + 0x164]
xor ebx, ebx
push 0x100064ac
mov ecx, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
call fcn.1000d53a
test eax, eax
je 0x1001326c
push 0x100064c0
lea ecx, [ebp - 0x10]
call fcn.1000d53a
push 0x10006530
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1000d53a
push 0x100062f4
lea ecx, [ebp - 0x10]
call fcn.1000d53a
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.1000d53a
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
lea ecx, [ebp - 0x10]
call fcn.10020bd7
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x1001325e
cmp dword [ebp - 0x14], ebx
je 0x1001325e
push 0x100062d0
mov ecx, edi
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x1c], ebx
call fcn.1000d53a
test eax, eax
jne 0x10013216
mov eax, 0x100054b6
mov esi, ebx
mov dword [ebp - 0x18], eax
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x10013202
mov eax, dword [ebp - 0x18]
add eax, 0x3fc
inc esi
mov dword [ebp - 0x18], eax
cmp eax, 0x100064a6
jl 0x100131dd
jmp 0x10013216
imul esi, esi, 0x3fc
add esi, 0x100052b8
push esi
mov ecx, edi
call fcn.1000d53a
mov ecx, edi
call fcn.10020bd7
mov ecx, edi
test eax, eax
je 0x1001324b
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
call fcn.10020bd7
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10013255
cmp dword [ebp - 0x1c], eax
setne al
mov dword [ebp - 0x20], eax
jmp 0x10013255
push 0x100064ac
call fcn.1000d53a
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.1002161e
mov ebx, dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
call fcn.1002a558
ret 8
Function at 0x10013779
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x58
mov eax, 0x1002bb11
call fcn.1002a4e9
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
or dword [edi + 4], 0xffffffff
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [edi], 0x1000641c
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetVersion]
cmp eax, 0x80000000
sbb esi, esi
mov ecx, ebx
neg esi
call fcn.10020bd7
push eax
lea ecx, [ebp - 0x64]
call dword [sym.imp.mfc100.dll_Ordinal_306]
push 0
push 0x80
neg esi
push 3
sbb esi, esi
push 0
and esi, 4
or esi, 1
push esi
push SysReAllocString
push dword [eax]
call dword [sym.imp.kernel32.dll_CreateFileA]
lea ecx, [ebp - 0x64]
mov dword [edi + 4], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp dword [edi + 4], 0xffffffff
jne 0x100138e4
and dword [ebp - 0x58], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
mov esi, eax
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.1000d53a
movzx eax, ax
push eax
push esi
push 0
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageA]
push 1
mov esi, 0x1802
push esi
lea ecx, [ebp - 0x5c]
call fcn.1000d53a
and dword [ebp - 4], 0
call fcn.1000d53a
movzx eax, ax
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x5c]
push esi
call fcn.1000d53a
push 0x40
lea ecx, [ebp - 0x5c]
call fcn.10020bd7
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.1000d53a
add esp, 0xc
mov ecx, ebx
call fcn.10020bd7
push eax
lea ecx, [ebp - 0x54]
call dword [sym.imp.mfc100.dll_Ordinal_306]
push 0x10006430
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
mov esi, dword [ebp - 0x54]
call fcn.1000d53a
movzx eax, ax
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxExA]
push dword [ebp - 0x58]
call dword [sym.imp.kernel32.dll_LocalFree]
and dword [ebp - 0x58], 0
mov ecx, edi
call fcn.100139d5
lea ecx, [ebp - 0x54]
call dword [sym.imp.mfc100.dll_Ordinal_901]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1002161e
jmp 0x10013930
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
push ebx
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [edi + 8], eax
test eax, eax
je 0x10013929
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [edi + 0xc], eax
test eax, eax
je 0x10013929
push ebx
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetFileSize]
push eax
push dword [edi + 0xc]
call fcn.1000d53a
mov dword [edi + 0x10], eax
test eax, eax
jne 0x10013930
mov ecx, edi
call fcn.100139d5
mov eax, edi
call fcn.1002a56c
ret 8
Function at 0x10018e95
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x1002bda3
call fcn.1002a51f
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x10019069
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.1000d53a
add esp, 0xc
test eax, eax
js 0x10019063
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x10018f31
push esi
call fcn.100158b3
pop ecx
test al, al
je 0x10018f31
mov eax, esi
call fcn.1002a74c
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x10018f3d
push esi
lea ecx, [ebp - 0x428]
call fcn.1000d53a
push 3
push esi
push edi
push eax
call fcn.1000d53a
test eax, eax
je 0x10019063
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x10018f71
call fcn.10015ac7
mov esi, eax
jmp 0x10019048
push dword [ebp - 0x424]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x10018f94
call fcn.10015ac7
jmp 0x1001903f
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x10018f8a
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x420], esi
cmp eax, esi
jae 0x10018fc4
mov esi, 0x8007000e
jmp 0x10019041
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000d53a
mov dword [ebp - 4], 1
jmp 0x10019003
cmp dword [ebp - 0x418], 0
je 0x10018fbd
push esi
push dword [ebp - 0x424]
push esi
push dword [ebp - 0x418]
call fcn.1000d53a
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1000d53a
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10019083
lea ecx, [ebp - 0x418]
call fcn.1001914a
jmp 0x10019083
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1001907e
lea ecx, [ebp - 0x418]
call fcn.1001914a
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.1000cc87
mov eax, esi
lea esp, [ebp - 0x444]
call fcn.1002a578
ret 0x10
Function at 0x4018c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x403464], eax
mov edi, 0
mov ecx, 0xa
push edi
loop 0x4018dd
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [0x403464]
mov dword [ebp - 0x1c], edx
lea ecx, str.contents
mov dword [ebp - 8], ecx
lea eax, section..text
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x66
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x403464]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403474], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403474]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019a6
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40198d
pop ebp
ret 0x10

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x1017f2bd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10188680], 0
mov byte [0x10188684], 0
mov dword [0x10188678], 0x33f9
mov dword [0x10188674], 0x9a0
mov dword [0x1018867c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1017f3c8
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10188688], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10188674], 0x2391
mov edi, dword [0x10188680]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10188688], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x10188680], edx
mov dword [0x10188674], 0x1197
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10188684], cl
mov dword [0x10188674], 0xd5c
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x10188684]
mov esi, dword [0x10188680]
mov byte [ebx + esi], cl
mov dword [0x10188674], 0xcb9
mov esi, dword [0x1018867c]
add esi, 1
mov dword [0x1018867c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1017f311
jmp 0x1017f40c
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1018867c]
add eax, 1
mov dword [0x1018867c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1017f3c8
xor eax, eax
mov dword [0x10188678], 0x1f91
mov dword [0x1018867c], 0
mov dword [ebp - 0x20], eax
jmp 0x1017f311
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1017f7de
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x2c
mov dword [0x10188678], 0x1825
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10188674], 0x262b
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1017f877
mov dword [0x10188674], 0xffffde32
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1017f85f
jmp 0x1017f949
mov dword [0x10188674], 0x35
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1017f920
jmp 0x1017f949
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1017f8f7
jmp 0x1017f949
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1017f8ae
mov dword [0x10188678], 0x2454
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x1017f877
mov eax, dword [ebp - 0x20]
mov dword [0x10188674], 0xca2
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1017f949
mov dword [0x10188674], 0xffffe703
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x6f
je 0x1017f81f
jmp 0x1017f949
mov dword [0x10188674], 0xb28
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dx, word [eax + ecx*2 - 0x12]
mov word [ebp - 0x26], dx
mov ax, word [ebp - 0x26]
cmp ax, 0x64
je 0x1017f83d
jmp 0x1017f949
mov eax, 0x1438
mov ecx, 1
mov dword [0x10188674], 0x166f
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
je 0x1017f958
mov eax, 0x1f59
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
jmp 0x1017f958
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [0x10188674], ecx
add esp, 0x2c
pop esi
pop ebp
ret
Function at 0x1017fb17
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.1017ee69
mov ecx, eax
mov dword [0x10188678], 0x11a4
mov edx, dword [eax + 0x3c]
mov dword [0x10188674], 0x828
mov edx, dword [eax + edx + 0x78]
mov dword [0x10188678], 0x1376
mov esi, ecx
add esi, dword [eax + edx + 0x20]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov dword [0x10188674], 0x4d3
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edi, dword [edx + esi + 0x18]
cmp edi, 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
je 0x1017fc7c
jmp 0x1017fba1
mov al, byte [ebp - 0x29]
test al, 1
jne 0x1017fc4d
jmp 0x1017fc23
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x29], cl
je 0x1017fb91
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x29]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x44], eax
jne 0x1017fbcd
jmp 0x1017fb91
xor eax, eax
mov ecx, dword [ebp - 0x3c]
add ecx, 2
mov edx, dword [ebp - 0x38]
add edx, 1
mov esi, dword [ebp - 0x20]
cmp edx, esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], eax
jb 0x1017fbb3
jmp 0x1017fc7c
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10188678], 0x14e4
mov edx, dword [ebp - 0x18]
add edx, ecx
mov dword [0x10188674], 0x674
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1017fd47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x10188678]
mov dword [0x1018867c], 0
mov dword [0x10188680], 0
mov dword [0x1018868c], 0
mov ebx, edi
add ebx, 0xfffff40b
mov dword [0x10188674], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, dword [ebp - 0x24]
mov esi, eax
mov edi, eax
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ebx
je 0x1017fee4
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov edi, 0x100
add ecx, 1
mov dword [ebp - 0x3c], eax
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x1018867c], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x40]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x44], edx
cdq
idiv edi
mov dword [0x10188680], edx
mov ecx, esi
add ecx, 0xffffff04
mov dword [0x10188678], ecx
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x44]
mov cl, byte [ecx + edi]
mov byte [0x10188684], cl
add esi, 0xffffe8d2
mov dword [0x10188674], esi
mov esi, dword [ebp - 0x1c]
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov cl, byte [0x10188684]
mov edx, dword [0x10188680]
mov byte [esi + edx], cl
mov dword [0x10188674], 0xfea
mov edx, dword [0x1018867c]
movzx edx, byte [esi + edx]
mov ebx, dword [0x10188680]
movzx ebx, byte [esi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1018868c], ebx
mov cl, byte [esi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x3c]
mov ch, byte [edx + ebx]
mov dword [0x10188678], 0xd1
xor ch, cl
mov byte [0x10188690], ch
mov dword [0x10188674], 0x538
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x48], ebx
je 0x1017fedc
mov eax, dword [0x1018867c]
mov ecx, dword [0x10188680]
mov edx, dword [0x10188674]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], esi
jmp 0x1017fdca
mov eax, dword [0x10188678]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add eax, 0xffffefe2
mov dword [0x10188674], eax
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret