joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102ee98
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
movzx eax, byte [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x1035588
xor ebx, ebx
mov dword [ebp - 4], eax
call fcn.0102d879
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.0102dc1a
push dword [ebp + 8]
lea edi, [esi + 0x2c]
push edi
mov ecx, esi
call fcn.0102e855
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x102ef09
push eax
mov ecx, edi
call fcn.0102dcde
lea edi, [eax + 0x208]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi]
cmp eax, dword [ebp - 0x14]
jae 0x102ef3a
push dword [ebp + 0xc]
lea ecx, [esi + 0x2c]
call fcn.0102dcde
mov ebx, dword [eax + 0x20c]
jmp 0x102ef41
push dword [ebp + 8]
lea edi, [esi + 0x1c]
push edi
mov ecx, esi
call fcn.0102e855
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x102ef41
push eax
mov ecx, edi
call fcn.0102dcde
lea edi, [eax + 0x208]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi]
cmp eax, dword [ebp - 0x14]
jb 0x102ef41
mov dword [ebp - 4], 1
mov ecx, esi
call fcn.0102dc37
cmp dword [ebp - 4], 0
je 0x102f08d
test ebx, ebx
jl 0x102f08d
lea ecx, [ebp - 0x10]
call fcn.0102995e
lea ecx, [ebp - 0x88]
call fcn.0102be2b
lea ecx, [ebp - 0x20]
call fcn.0102995e
push dword [ebp + 8]
lea ecx, [ebp - 0x88]
call fcn.0102d85c
push 0x1001878
lea ecx, [ebp - 0x88]
call fcn.0102cdb3
mov ebx, eax
test ebx, ebx
jl 0x102f072
lea eax, [ebp - 0x10]
push eax
push 0xa
lea ecx, [ebp - 0x88]
call fcn.0102cd00
mov ebx, eax
test ebx, ebx
jl 0x102f072
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x88]
call fcn.0102b065
mov ebx, eax
test ebx, ebx
jl 0x102f072
mov ecx, dword [ebp - 0x10]
xor eax, eax
test ecx, ecx
je 0x102efe0
cmp word [ecx], ax
setne al
test al, al
je 0x102f012
lea ecx, [ebp - 0x10]
call fcn.01029a29
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x20]
dec eax
lea edi, [ecx + eax*2]
call fcn.010319c5
cmp word [edi], ax
jne 0x102f012
lea ecx, [ebp - 0x10]
call fcn.01029a29
mov edx, dword [ebp - 0x10]
dec eax
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x10]
call fcn.0102ed47
mov ebx, eax
test ebx, ebx
jge 0x102f072
cmp dword [ebp + 0xc], 0xffffffff
je 0x102f072
mov ecx, esi
call fcn.0102dc1a
push dword [ebp + 8]
lea edi, [esi + 0x2c]
push edi
mov ecx, esi
call fcn.0102e855
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x102f06b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 0xc]
mov ecx, edi
mov ebx, eax
call fcn.0102dcde
push dword [ebp + 0xc]
mov ecx, edi
mov dword [eax + 0x208], ebx
call fcn.0102dcde
mov ebx, dword [eax + 0x20c]
mov ecx, esi
call fcn.0102dc37
lea ecx, [ebp - 0x20]
call fcn.0102a10f
lea ecx, [ebp - 0x88]
call fcn.01028c08
lea ecx, [ebp - 0x10]
call fcn.0102a10f
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x102f7bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x102f8bb
mov edi, dword [ebp + 8]
test edi, edi
je 0x102f8bb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1035570]
mov ebx, 0x1035564
cmp eax, 0xea60
jae 0x102f810
push edi
push ebx
call fcn.0102991a
test al, al
je 0x102f810
mov eax, dword [0x1035560]
mov dword [esi], eax
jmp 0x102f8c2
push esi
push edi
push 0x1005280
push 0x80000002
call fcn.0102f4fc
cmp eax, 3
je 0x102f82b
cmp eax, 2
jne 0x102f864
push esi
push edi
push 0x1005210
push 0x80000001
call fcn.0102f4fc
cmp eax, 3
je 0x102f846
cmp eax, 2
jne 0x102f864
push edi
call fcn.0102ac4f
cmp eax, 0xffffffff
je 0x102f85b
push eax
call fcn.0102f754
mov dword [esi], eax
jmp 0x102f862
mov dword [ebp - 4], 0xc00d0fda
xor eax, eax
test eax, eax
je 0x102f877
jle 0x102f874
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x102f8c2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jae 0x102f8c2
push 5
push ebx
lea ecx, [ebp - 0x10]
call fcn.01029a07
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x10]
call fcn.0102a161
mov eax, dword [esi]
mov dword [0x1035560], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
mov dword [0x1035570], eax
call fcn.0102a10f
jmp 0x102f8c2
mov dword [ebp - 4], 0x80004003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x102f94b
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x102fa38
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x102fa38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xea60
cmp eax, dword [0x1035584]
jae 0x102f99e
push ebx
push 0x1035578
call fcn.0102991a
test al, al
je 0x102f99e
mov eax, dword [0x1035574]
mov dword [edi], eax
jmp 0x102fa3f
push edi
push ebx
push 0x1005280
push 0x80000002
call fcn.0102f629
test eax, eax
je 0x102f9f6
push edi
push ebx
push 0x1005210
push 0x80000001
call fcn.0102f629
mov esi, eax
test esi, esi
je 0x102f9f6
push ebx
call fcn.0102ac4f
cmp eax, 0xffffffff
je 0x102f9df
push eax
call fcn.0102f788
mov dword [edi], eax
jmp 0x102f9f6
test esi, esi
jle 0x102f9ef
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 4], esi
test esi, esi
jl 0x102fa3f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jae 0x102fa3f
push 5
push 0x1035578
lea ecx, [ebp - 0x10]
call fcn.01029a07
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x10]
call fcn.0102a161
mov eax, dword [edi]
mov dword [0x1035574], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x10]
mov dword [0x1035584], eax
call fcn.0102a10f
jmp 0x102fa3f
mov dword [ebp - 4], 0x80004003
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x102fc9f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp byte [0x10354c8], bl
jne 0x102fce5
push esi
push ebx
push ebx
push ebx
push 0x102fb52
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x102fcdc
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
cmp byte [0x10354c8], bl
je 0x102fd2b
lea ecx, [ebp - 0xc]
call fcn.0102995e
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.0102a161
test eax, eax
jl 0x102fd23
lea ecx, [ebp - 0xc]
call fcn.01029a50
push dword [ebp - 0xc]
mov ecx, 0x1035508
call fcn.01031147
test al, al
je 0x102fd23
lea ecx, [ebp - 0xc]
call fcn.0102a10f
mov al, 1
jmp 0x102fd2d
lea ecx, [ebp - 0xc]
call fcn.0102a10f
xor al, al
pop ebx
leave
ret 4

Function at 0x103025b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 8], 3
mov ecx, dword [ebp - 4]
jne 0x1030295
cmp ecx, edi
jne 0x1030295
push 2
pop eax
cmp eax, edi
jne 0x10302cd
shr ecx, 1
push ecx
call fcn.010297db
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp eax, edi
je 0x10302cd
mov ecx, dword [ebp - 4]
mov dword [ebp + 0x10], ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x10302c7
mov al, 1
jmp 0x10302cf
push ebx
call fcn.01029805
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10303fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103044e
push edi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
jmp 0x1030450
xor al, al
pop esi
leave
ret 0xc
Function at 0x1031694
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
xor ebx, ebx
mov dword [ebp - 8], ecx
cmp byte [ecx + 0x10], bl
jne 0x10317b0
push ebx
push 0x20019
push 0x1007458
mov byte [ecx + 0x10], 1
push 0x80000002
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.01026849
test eax, eax
je 0x10316e1
lea ecx, [ebp - 0x34]
call fcn.010267d6
jmp 0x10317b0
push esi
push edi
xor edi, edi
mov esi, 0x104
jmp 0x1031782
lea ecx, [ebp - 0x10]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
mov eax, edi
push eax
push dword [ebp - 0x34]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x103179e
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x103171f
cmp word [ecx], bx
setne al
cmp al, bl
je 0x103177a
cmp dword [ebp - 4], ebx
je 0x103177a
lea ecx, [ebp - 0x28]
call fcn.0102995e
mov eax, dword [ebp - 0x1c]
push 0x2e
pop ecx
cmp cx, word [eax]
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
jne 0x1031743
add eax, 2
push eax
call fcn.0102a161
mov ecx, dword [ebp - 0x28]
xor eax, eax
cmp ecx, ebx
je 0x1031758
cmp word [ecx], bx
setne al
cmp al, bl
je 0x1031772
push ecx
call fcn.0102abc4
cmp eax, 0xffffffff
jne 0x1031772
push dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
call fcn.01031367
lea ecx, [ebp - 0x28]
call fcn.0102a10f
lea ecx, [ebp - 0x1c]
call fcn.0102a10f
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call fcn.0102995e
push esi
lea ecx, [ebp - 0x1c]
call fcn.0102a119
test eax, eax
jge 0x10316ef
lea ecx, [ebp - 0x1c]
call fcn.0102a10f
lea ecx, [ebp - 0x34]
call fcn.010267d6
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1042000
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
nop
push 0xd09a1
pop ecx
nop
nop
push 0x1042020
pop esi
nop
push 0x598
pop edx
nop
nop
xor dword [edx + esi], ecx
nop
dec edx
sub edx, 3
nop
nop
jne 0x1042018
dec ecx
je 0x1042033
add byte [ecx - 0x5efff2f7], ah
or dword [0xf99d101], ecx
add byte [ecx + 0x7b000ee1], ah
in al, 0xe
add byte [ecx + 0x5e000fb9], ah
div dl
dec dword [ebp + 0x1d010d19]
daa
push cs
add dword [edi], eax
daa
push cs
add dword [ebp + 0x14], ecx
push cs
add byte [ebx], bl
daa
push cs
add byte [0x8d000e27], al
or eax, 0xb56d000d
out dx, eax
ja 0x1041fec
xor eax, 0xbd977ee
or eax, 0xd094100
add byte [ecx - 0x5efff2f7], ah
or dword [0xd19fd00], ecx
add dword [edi - 0x36b31542], esp
or dword [eax + eax], ecx
iretd
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4058bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4058cc
pop dword [ebp - 0x3c]
mov eax, 0xd2cfb9b2
add eax, 0x2d709f1a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x669fb46b
sub dword [ebp - 0x4c], 0x184d6f20
mov dword [ebp - 0x48], 0xb0e76d63
add dword [ebp - 0x48], 0x814bdee2
mov dword [ebp - 0x44], 0x3c73554e
add dword [ebp - 0x44], 0xfd8eee0
mov dword [ebp - 0x40], 0x574fa433
sub dword [ebp - 0x40], 0x574fa433
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x62d43c06
add eax, 0x9d6c944e
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xf2ea8e47
add dword [ebp - 0x4c], 0x8187db0f
mov dword [ebp - 0x48], 0x4b74b0bc
add dword [ebp - 0x48], 0xf5f7b0b9
mov dword [ebp - 0x44], 0x1418183
sub dword [ebp - 0x44], 0x9dd21517
mov dword [ebp - 0x40], 0x56e42d
sub dword [ebp - 0x40], 0x56e42d
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xeefb62ef
sub eax, 0xeeba92a3
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bee0
push 0
call eax
mov ecx, 0xfce4357b
sub ecx, 0xfce3e3f3
xor ebx, ebx
add ebx, eax
mov esi, 0x8a8604aa
add esi, 0x75bbab56
add esi, dword [ebp - 0x3c]
mov edi, 0xcbedfe84
sub edi, 0x328b25e9
sub dword [ebp - 4], eax
mov edx, dword [esi]
xor dword [ebp - 8], ebx
sub edx, edi
xor dword [ebp - 0x2c], 0xc272a031
mov dword [ebx], edx
xor dword [ebp - 0x38], ebx
add ebx, 0xc57ced8a
add ebx, 0x3a83127a
add esi, 4
loop 0x4059f0
add eax, 0xe86e3a72
add eax, 0x1792fe81
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x932b5e66
sub ecx, 0x92eb5e66
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10001200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0xc], 0
jmp 0x10001271
jmp 0x10001250
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x10001271
mov eax, esp
mov dword [eax], 0xde9
mov eax, dword [sym.imp.KERNEL32.dll_SetHandleCount]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
jmp 0x10001302
cmp dword [ebp - 8], 0xa
jne 0x10001364
jmp 0x1000139f
mov eax, esp
mov dword [eax + 4], 0x375
mov dword [eax], 0xe91d0c
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
jmp 0x100013a1
cmp dword [ebp - 0xc], 0x12a
setne al
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x19]
test al, 1
jne 0x1000128a
jmp 0x100013b0
mov eax, esp
mov dword [eax], 0x334
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x3cd
je 0x10001311
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, 0x38e38e39
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov edx, dword [ebp - 0x2c]
mul edx
shr edx, 2
imul eax, edx, 0x12
sub ecx, eax
mov eax, ecx
sub eax, 9
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
je 0x10001224
jmp 0x100012e9
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x38], eax
jne 0x10001302
jmp 0x100012f6
mov eax, dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
call eax
jmp 0x10001224
jmp 0x10001304
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x100012a6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov eax, 0xcc29786d
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, ecx
mov edx, dword [ebp - 0x40]
mul edx
shr edx, 8
imul eax, edx, 0x141
sub ecx, eax
mov eax, ecx
sub eax, 6
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x10001250
jmp 0x10001347
mov eax, dword [ebp - 0x44]
sub eax, 0x3e
mov dword [ebp - 0x4c], eax
je 0x1000120f
jmp 0x10001358
mov dword [ebp - 8], 0
jmp 0x1000123e
mov eax, esp
mov dword [eax], 0x558
mov eax, dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x628a2a
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x50], eax
call ecx
sub esp, 4
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x1000123e
jmp 0x100013a1
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call eax
mov dword [ebp - 0x58], eax
jmp 0x10001211
add esp, 0x60
pop ebp
ret

Function at 0x10211e40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1028cde0]
jne 0x10211e4a
repz ret
jmp fcn.10213cbc
Function at 0x10215253
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10210e48
and dword [ebp - 4], 0
cmp dword [0x1028e17c], 0
mov ebx, eax
jne 0x10215304
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x102153b5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x102153b5
push eax
call fcn.10210dd6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1028e17c], eax
call esi
push eax
call fcn.10210dd6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1028e180], eax
call esi
push eax
call fcn.10210dd6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1028e184], eax
call esi
push eax
call fcn.10210dd6
pop ecx
mov dword [0x1028e18c], eax
test eax, eax
je 0x10215304
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10210dd6
pop ecx
mov dword [0x1028e188], eax
mov eax, dword [0x1028e188]
cmp eax, ebx
je 0x1021535c
cmp dword [0x1028e18c], ebx
je 0x1021535c
push eax
call fcn.10210e51
push dword [0x1028e18c]
mov esi, eax
call fcn.10210e51
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1021535c
test edi, edi
je 0x1021535c
call esi
test eax, eax
je 0x10215353
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10215353
test byte [ebp - 0xc], 1
jne 0x1021535c
or dword [ebp + 0x10], 0x200000
jmp 0x10215395
mov eax, dword [0x1028e180]
cmp eax, ebx
je 0x10215395
push eax
call fcn.10210e51
pop ecx
test eax, eax
je 0x10215395
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10215395
mov eax, dword [0x1028e184]
cmp eax, ebx
je 0x10215395
push eax
call fcn.10210e51
pop ecx
test eax, eax
je 0x10215395
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1028e17c]
call fcn.10210e51
pop ecx
test eax, eax
je 0x102153b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x102153b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10216940
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.10216940]
mov ecx, dword [0x1028c354]
add ecx, 0x334
mov dword [0x1028c354], ecx
mov dword [ebp - 8], eax
mov eax, dword [0x1028c354]
sub eax, 0x18bb
mov dword [0x1028c354], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10216999
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax], 0x4550
jne 0x10216997
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x102169d6
jmp 0x10216999
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov eax, dword [0x1028c354]
sub eax, 0xc52
mov dword [0x1028c354], eax
mov al, 1
test al, 1
jne 0x10216970
jmp 0x102169c0
mov eax, dword [0x1028c358]
add eax, 0x621
mov dword [0x1028c354], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 8
pop ebp
ret
Function at 0x10216fc0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x1028c358], 0x23f7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x10217052
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop ebp
ret
mov dword [0x1028c358], 0xad6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x1021702c
jmp 0x1021713e
jmp 0x10217136
mov eax, dword [0x1028c354]
add eax, 0x187b
mov dword [0x1028c358], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x102170ad
jmp 0x1021713c
cmp dword [ebp - 0x10], 0x104
jge 0x1021707d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x1021706e
jmp 0x1021707d
jmp 0x10217070
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10217052
mov dword [0x1028c354], 0x1dbc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax - 0x1a]
cmp ecx, 0x6c
je 0x10217006
jmp 0x10217140
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
sete dl
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x19]
test al, 1
jne 0x102170cc
jmp 0x1021713a
mov eax, dword [0x1028c354]
sub eax, 0x1352
mov dword [0x1028c354], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
movzx eax, word [ecx + eax*2 - 0x12]
cmp eax, 0x64
jne 0x10217138
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x10217136
mov eax, dword [0x1028c354]
sub eax, 0x1c8b
mov dword [0x1028c358], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x10217027
mov dword [ebp - 4], 1
jmp 0x10216ff8
jmp 0x10217138
jmp 0x1021713a
jmp 0x1021713c
jmp 0x1021713e
jmp 0x10217140
mov dword [ebp - 4], 0
jmp 0x10216ff8
Function at 0x1009192a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1017ba90], 0
mov byte [0x1017ba94], 0
mov edi, dword [0x1017ba84]
add edi, 0xe84
mov dword [0x1017ba88], edi
mov dword [0x1017ba8c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10091992
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x1017ba8c], 0
mov dword [ebp - 0x20], eax
jmp 0x100919c4
mov eax, dword [ebp - 0x1c]
mov dword [0x1017ba88], 0x8b8
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1017ba8c]
add eax, 1
mov dword [0x1017ba8c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10091992
jmp 0x10091981
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1017ba98], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x1017ba90]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1017ba98], esi
mov dword [0x1017ba84], 0x233b
mov eax, esi
cdq
idiv ecx
mov dword [0x1017ba90], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x1017ba94], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x1017ba94]
mov esi, dword [0x1017ba90]
mov byte [ebx + esi], cl
mov esi, dword [0x1017ba8c]
add esi, 1
mov dword [0x1017ba8c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x100919c4
jmp 0x10091979
Function at 0x10091c1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x10176785]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x1017ba84], 0x1540
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.1009188f
mov dword [0x1017ba84], 0x1b9e
call fcn.10091ec0
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1009176b
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jne 0x10091c99
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebp
ret
mov dword [0x1017ba84], 0x505
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1017ba84], 0x1847
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.10091af9
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x1017ba84], 0x14d0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x10], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x58], ecx
mov dword [0x1017ba88], 0xc82
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x10091c8f
mov eax, dword [ebp - 0x44]
add eax, 0x20f9
mov ecx, dword [0x1017ba84]
add ecx, 0x2182
mov dword [0x1017ba84], ecx
mov dword [ebp - 0x40], eax
jmp 0x10091c8f