joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10093ba
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1032d6c
call fcn.0102f0a6
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x1002064
xor edi, edi
push 0xa
lea ecx, [esi + 0x34]
mov dword [ebp - 4], edi
call fcn.0102e314
mov ecx, dword [ebp - 0xc]
or dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x2c], edi
mov dword [esi], 0x10020f4
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x10093c5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1032d6c
call fcn.0102f0a6
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x1002064
xor edi, edi
push 0xa
lea ecx, [esi + 0x34]
mov dword [ebp - 4], edi
call fcn.0102e314
mov ecx, dword [ebp - 0xc]
or dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x2c], edi
mov dword [esi], 0x10020f4
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x1015f2b
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x103cae0
jmp 0x1015f20
mov eax, 0x103374c
call fcn.0102f0a6
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.01013ba3
xor eax, eax
push 0xf
mov dword [ebp - 4], eax
mov dword [esi], 0x1003364
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 1
call dword [fcn.01001dfc]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov dword [esi + 0x2c], 0x4b4
mov dword [esi + 0x30], 0x27f
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10047e50
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a56a9
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x1010df64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov eax, dword [0x1010df30]
mov ecx, 0x1010df30
mov byte [ebp - 4], 1
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x128], esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
mov dword [ebp - 0x124], 0
call fcn.10013bd0
mov ecx, eax
call fcn.10013cd0
mov eax, dword [ebp + 8]
mov edi, dword [eax - 0xc]
test edi, edi
jns 0x10047efa
push 0x80070057
call fcn.1008a3b0
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, edi
or ecx, edx
jge 0x10047f17
push edi
lea ecx, [ebp + 8]
call fcn.1008a3b0
mov eax, dword [ebp + 8]
lea ecx, [edi + 1]
push ecx
push eax
call fcn.1008a3b0
mov eax, dword [ebp + 8]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x10047ef0
mov dword [eax - 0xc], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax + edi*2], cx
push dword [ebp + 8]
lea eax, [ebp - 0x120]
push str.wstrUserName_s
push str.IDCRL::DeleteUserAllExtendedProperties
push eax
push str.d:_bt20572clientwlidsspwlidsvccorecredentialbag.cpp_40
lea eax, [ebp - 0x11c]
push 2
push eax
call fcn.1008a3b0
add esp, 0x1c
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], 0
je 0x10048004
lea eax, [ebp - 0x124]
push eax
push 0x20006
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov edi, eax
test edi, edi
je 0x10047fa6
jg 0x10047f95
mov dword [ebp - 0x120], edi
jmp 0x1004800a
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0x120], edi
jmp 0x1004800a
push 0x39
push str.SoftwareMicrosoftMSOIdentityCRLUserExtendedProperties_
lea ecx, [ebp - 0x128]
call fcn.1008a3b0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x128]
push dword [eax - 0xc]
push eax
call fcn.1008a3b0
mov esi, dword [ebp - 0x128]
push esi
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x10047ff8
cmp eax, 2
je 0x10047ff8
test eax, eax
jle 0x10047ff2
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x120], eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 2
call fcn.1008a3b0
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 1
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10048039
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x1004805a
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001e17
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bac0
Capabilities:
Write file on windows

Disassembly:
call fcn.1008a3b0
call fcn.1000ddf0
mov ecx, eax
call fcn.1000d310
mov ecx, dword [0x1011169c]
test ecx, ecx
je 0x1004bb06
push esi
call fcn.1008a3b0
mov esi, dword [0x1011169c]
test esi, esi
je 0x1004bafb
mov ecx, esi
call fcn.1008a3b0
push esi
call fcn.1000863f
add esp, 4
mov dword [0x1011169c], 0
pop esi
jmp fcn.1004de70
Function at 0x1008a3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1008a3bf
pop dword [ebp - 0x3c]
mov eax, 0xfe42ece3
add eax, 0x11c5b6dc
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x64888
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x51f8
xor esi, esi
add esi, eax
mov edx, 0x5afd4e05
add edx, 0xb5155dfb
add edx, dword [ebp - 0x3c]
mov edi, 0x5f195a9
sub edi, 0x269bef26
xor dword [ebp - 0x38], 0xd8a3463f
mov ebx, dword [edx]
sub dword [ebp - 0x20], 0x8ca948a0
sub ebx, edi
xor dword [ebp - 0x38], esi
mov dword [esi], ebx
sub dword [ebp - 0x20], eax
add esi, 4
add edx, 0x2097c16c
add edx, 0xdf683e98
loop 0x1008a415
add eax, 0xd10b8f06
add eax, 0x2ef5abad
xor ebx, ebx
add ebx, eax
add eax, 0x851422c7
sub eax, 0x851422c2
mov ecx, 0x8dfc0d76
add ecx, 0x8203f28a
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4ea477
Capabilities:
Inspect section memory permissions

Disassembly:
inc ebp
loope 0x4ea4d3
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004ea035
push eax
push esi
push dword [ebp + 8]
call fcn.004e9fea
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004ea025
imul ebx, edx, 0x9d889b70
jl 0x4ea4aa
invalid
invalid
invalid
jns 0x4ea49b
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
Function at 0x51e718
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5896f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0051340b
and dword [ebp - 0x14], 0
cmp dword [0x5912cc], 0
mov dword [ebp - 0x18], eax
jne 0x51e7cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x51e873
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x55bda8
push ebx
call edi
test eax, eax
je 0x51e873
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x55bd98
push ebx
mov dword [0x5912cc], eax
call edi
push eax
call esi
push 0x55bd84
push ebx
mov dword [0x5912d0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5912d4], eax
call edi
push eax
call esi
mov dword [0x5912dc], eax
test eax, eax
je 0x51e7cb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5912d8], eax
mov eax, dword [0x5912d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x51e824
cmp dword [0x5912dc], ecx
je 0x51e824
push eax
call esi
push dword [0x5912dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x51e824
test ebx, ebx
je 0x51e824
call edi
test eax, eax
je 0x51e81b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x51e81b
test byte [ebp - 8], 1
jne 0x51e824
or dword [ebp + 0x10], 0x200000
jmp 0x51e857
mov eax, dword [0x5912d0]
cmp eax, dword [ebp - 0x18]
je 0x51e857
push eax
call esi
test eax, eax
je 0x51e857
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x51e857
mov eax, dword [0x5912d4]
cmp eax, dword [ebp - 0x18]
je 0x51e857
push eax
call esi
test eax, eax
je 0x51e857
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5912cc]
call esi
test eax, eax
je 0x51e873
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x51e875
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050baf1
leave
ret

Function at 0x401005
Capabilities:
Access peb ldr_data

Disassembly:
push 0
push 2
push 0x403071
push 0x403053
call dword [sym.imp.Winmm.dll_mciSendStringA]
cmp eax, 0x107
je 0x401021
ret
mov edi, edi
mov esi, 0x402058
mov edi, esi
push 1
push 0x40308f
push 1
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreW]
mov edx, eax
pop ebx
mov ecx, 0x340
mov al, byte [esi]
sub al, bl
stosb byte es:[edi], al
inc esi
loop 0x401045
push dword fs:[0x30]
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp word [eax], 0x5a4d
je 0x40106b
xor eax, eax
mov dword [0x4030a2], eax
add esp, 4
ret
Function at 0x10001ff5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10034378]
jne 0x10001fff
repz ret
jmp fcn.10002e34

Function at 0x1000639f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100020fc
and dword [ebp - 4], 0
cmp dword [0x100360a8], 0
mov ebx, eax
jne 0x10006450
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10006501
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10006501
push eax
call fcn.1000208a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100360a8], eax
call esi
push eax
call fcn.1000208a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100360ac], eax
call esi
push eax
call fcn.1000208a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100360b0], eax
call esi
push eax
call fcn.1000208a
pop ecx
mov dword [0x100360b8], eax
test eax, eax
je 0x10006450
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000208a
pop ecx
mov dword [0x100360b4], eax
mov eax, dword [0x100360b4]
cmp eax, ebx
je 0x100064a8
cmp dword [0x100360b8], ebx
je 0x100064a8
push eax
call fcn.10002105
push dword [0x100360b8]
mov esi, eax
call fcn.10002105
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100064a8
test edi, edi
je 0x100064a8
call esi
test eax, eax
je 0x1000649f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000649f
test byte [ebp - 0xc], 1
jne 0x100064a8
or dword [ebp + 0x10], 0x200000
jmp 0x100064e1
mov eax, dword [0x100360ac]
cmp eax, ebx
je 0x100064e1
push eax
call fcn.10002105
pop ecx
test eax, eax
je 0x100064e1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100064e1
mov eax, dword [0x100360b0]
cmp eax, ebx
je 0x100064e1
push eax
call fcn.10002105
pop ecx
test eax, eax
je 0x100064e1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100360a8]
call fcn.10002105
pop ecx
test eax, eax
je 0x10006501
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10006503
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007860
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10033f30], 0
mov byte [0x10033f34], 0
mov dword [0x10033f24], 0x223a
mov dword [0x10033f2c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jmp 0x100078b6
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x10033f2c], 0
jmp 0x100078e7
mov dword [0x10033f24], 0x23f6
mov eax, dword [0x10033f2c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10033f2c]
add eax, 1
mov dword [0x10033f2c], eax
cmp eax, 0x100
jl 0x100078b6
jmp 0x100078aa
mov dword [0x10033f38], 0
mov eax, dword [0x10033f30]
mov ecx, dword [0x10033f2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov eax, 0x100
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, ecx
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + ecx]
mov ecx, dword [ebp - 0x1c]
add ebx, ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
add ebx, edx
mov dword [0x10033f38], ebx
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x24]
idiv ebx
mov dword [0x10033f30], edx
mov dword [0x10033f24], 0x9d4
mov edx, dword [0x10033f2c]
mov cl, byte [edi + edx]
mov byte [0x10033f34], cl
mov dword [0x10033f24], 0xfffff859
mov edx, dword [0x10033f30]
mov cl, byte [edi + edx]
mov edx, dword [0x10033f2c]
mov byte [edi + edx], cl
mov dword [0x10033f24], 0x1f37
mov cl, byte [0x10033f34]
mov edx, dword [0x10033f30]
mov byte [edi + edx], cl
mov edx, dword [0x10033f24]
add edx, 0xfffffbe3
mov dword [0x10033f24], edx
mov edx, dword [0x10033f2c]
add edx, 1
mov dword [0x10033f2c], edx
cmp edx, 0x100
jl 0x100078e7
jmp 0x100078a2
Function at 0x100079f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
call fcn.100079d0
mov dword [0x10033f24], 0x26c3
mov dword [ebp - 0x34], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jmp 0x10007a81
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x44]
mov dword [esp + 8], ecx
call fcn.10008450
xor eax, eax
mov dword [0x10033f28], 0xe79
mov ecx, dword [ebp - 0x40]
add ecx, 0x74d69
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x145600
mov ecx, dword [ebp - 0x40]
add ecx, 0x2673e
mov dword [edx + 8], ecx
mov ecx, dword [0x10033f28]
add ecx, 0x745
mov dword [0x10033f24], ecx
mov dword [edx + 0xc], 0x1fe0
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
mov esi, eax
add esi, 1
imul edi, eax, 0xc8
mov ebx, edx
add ebx, edi
add ebx, 0xb4
imul eax, eax, 0xc8
add edx, eax
add edx, 0xb8
mov eax, dword [edx]
movzx edx, word [ebx]
xor edx, eax
add edx, ecx
cmp esi, 0x332
mov eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], esi
jne 0x10007a81
lea eax, [0x1000960b]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], ecx
call fcn.10008600
mov dword [0x10033f28], 0x1da2
mov dword [0x10033f24], 0xbcc
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call fcn.100075c0
mov ecx, eax
mov dword [0x10033f44], eax
mov eax, esp
mov edx, dword [ebp - 0x44]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0xc8
mov edi, edx
add edi, esi
add edi, 0xb8
mov esi, eax
add esi, 1
imul ebx, eax, 0xc8
mov dword [ebp - 0x58], eax
mov eax, edx
add eax, ebx
add eax, 0xb4
mov ebx, dword [ebp - 0x40]
add ebx, ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
imul eax, eax, 0xc8
add edx, eax
add edx, 0x5c
mov eax, dword [edi]
mov edx, dword [edx]
mov edi, dword [ebp - 0x5c]
movzx edi, word [edi]
xor edi, eax
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], edi
call fcn.100084f0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x64]
add eax, ecx
mov edx, dword [ebp - 0x60]
cmp edx, 0x332
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
je 0x10007a1d
jmp 0x10007b4b
Function at 0x10008050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, 0x2a
lea ecx, [fcn.10008050]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10008069
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x100080a8
mov eax, dword [ebp - 0xc]
add eax, 0x3c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx], 0x4550
jne 0x100080a8
mov eax, dword [ebp - 0x10]
mov dword [0x10033f24], eax
mov eax, dword [ebp - 0xc]
add esp, 0x14
pop ebp
ret
mov eax, 0x1e0d
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10008069

Function at 0x10008260
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10033f2c], 0
mov dword [0x10033f30], 0
mov dword [0x10033f3c], 0
mov dword [0x10033f28], 0x1d00
mov dword [0x10033f24], 0x24ab
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x100083ba
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x10033f2c]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x10033f2c], edx
mov dword [0x10033f24], 0x11eb
mov esi, dword [0x10033f30]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x10033f30], edx
mov ecx, dword [0x10033f24]
add ecx, 0x1cfe
mov dword [0x10033f28], ecx
mov ecx, dword [0x10033f2c]
mov bl, byte [edi + ecx]
mov byte [0x10033f34], bl
mov dword [0x10033f24], 0x7d5
mov ecx, dword [0x10033f30]
mov bl, byte [edi + ecx]
mov ecx, dword [0x10033f2c]
mov byte [edi + ecx], bl
mov bl, byte [0x10033f34]
mov ecx, dword [0x10033f30]
mov byte [edi + ecx], bl
mov dword [0x10033f28], 0x2207
mov ecx, dword [0x10033f2c]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x10033f30]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x10033f3c], edx
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
add edx, 1
mov esi, dword [ebp - 0x10]
cmp edx, esi
mov dword [ebp - 0x20], edx
jne 0x100082c3
mov eax, dword [0x10033f24]
add eax, 0xfffff597
mov dword [0x10033f24], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008840
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x30
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [0x10033f24], 0x6a9
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x3c]
mov dword [0x10033f28], 0x9a7
mov esi, dword [0x10033f24]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
jmp 0x100088a8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10008927
jmp 0x10008996
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffbee
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
jne 0x10008908
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [0x10033f24], ecx
mov dword [0x10033f28], 0x85f
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
je 0x10008890
jmp 0x10008996
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10008974
jmp 0x10008996
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, dword [ebp - 0x28]
mov edx, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], eax
jl 0x100088a8
jmp 0x100088ca
mov dword [0x10033f28], 0x18d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10008996
mov dword [0x10033f28], 0xfffff24c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10008996
mov dword [0x10033f24], 0x144b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x100088f4
jmp 0x10008996
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x2e], dx
mov eax, 1
mov cx, word [ebp - 0x2e]
cmp cx, 0x6c
mov dword [ebp - 0x34], eax
je 0x1000899d
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1000899d
mov eax, dword [ebp - 0x34]
add esp, 0x30
pop esi
pop ebp
ret