joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd5
mov dword [ebp - 8], 0
jmp 0x10015d92
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x23
jge 0x10015dd1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x4e3e900d]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10015dcc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10015d89
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x23], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10015df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb1
mov dword [ebp - 8], 0
jmp 0x10015e12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x10015e51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x758c28ec]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10015e4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10015e09
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10015e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x3c
mov dword [ebp - 8], 0
jmp 0x10015e92
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jge 0x10015ed1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x5ba80853]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10015ecc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10015e89
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10015ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x16
mov dword [ebp - 8], 0
jmp 0x10015f12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xc
jge 0x10015f51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x520bad8b]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10015f4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10015f09
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10015f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x6d
mov dword [ebp - 8], 0
jmp 0x10015f92
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x24
jge 0x10015fd1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x5964fb8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10015fcc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10015f89
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x24], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10015ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xdb
mov dword [ebp - 8], 0
jmp 0x10016012
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x10016051
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3183aad]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001604c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016009
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10016070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x19
mov dword [ebp - 8], 0
jmp 0x10016092
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x100160d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x4b904773]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100160cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016089
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100160f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf1
mov dword [ebp - 8], 0
jmp 0x10016112
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jge 0x10016151
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6bcdcc7f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001614c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016109
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10016170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xea
mov dword [ebp - 8], 0
jmp 0x10016192
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf
jge 0x100161d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4ce0b66f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100161cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016189
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100161f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x19
mov dword [ebp - 8], 0
jmp 0x10016212
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x10016251
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x177e368c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001624c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016209
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10016270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x92
mov dword [ebp - 8], 0
jmp 0x10016292
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x100162d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x558e071]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100162cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016289
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100162f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x93
mov dword [ebp - 8], 0
jmp 0x10016312
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1a
jge 0x10016351
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3371850f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001634c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016309
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1a], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10016370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x35
mov dword [ebp - 8], 0
jmp 0x10016392
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x100163d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x27f58405]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100163cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016389
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100163f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xab
mov dword [ebp - 8], 0
jmp 0x10016412
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x10016451
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4eaba576]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001644c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016409
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10016470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x5d
mov dword [ebp - 8], 0
jmp 0x10016492
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x100164d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x20c2b356]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100164cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016489
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100164f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x9c
mov dword [ebp - 8], 0
jmp 0x10016512
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x15
jge 0x10016551
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1acc85b1]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001654c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016509
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x15], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100166e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], ecx
jmp 0x100166fb
call fcn.100073f0
movzx eax, al
test eax, eax
je 0x10016732
mov ecx, 0xbcc314c8
push ecx
lea ecx, [ebp - 0x23]
call fcn.10009890
mov dword [ebp - 0x2c], eax
push 0x10
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.10017530
add esp, 0xc
lea ecx, [ebp - 0x23]
call fcn.10038670
lea ecx, [ebp - 1]
call fcn.1002d220
movzx ecx, al
test ecx, ecx
je 0x10016746
jmp 0x100167d9
lea ecx, [ebp - 1]
call fcn.1002d230
mov edx, dword [ebp + 8]
push edx
call sub.MSVCR90.dll_strlen
add esp, 4
test eax, eax
je 0x100167bf
mov byte [ebp - 0x18], 0x43
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x25
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [0x1006f614]
push edx
call fcn.1000c730
add esp, 0x10
lea ecx, [ebp - 1]
call fcn.1002d250
jmp 0x100167d9
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100169e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100486c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x350
mov dword [ebp - 0x35c], ecx
mov dword [ebp - 0x358], 0
lea ecx, [ebp - 0x2c]
call fcn.1000c7e0
mov dword [ebp - 4], 0
mov byte [ebp - 0x244], 0
cmp dword [ebp + 0xc], 0
je 0x10016a58
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
test eax, eax
je 0x10016a58
lea ecx, [ebp - 0x244]
push ecx
push 0x103
mov edx, dword [0x1006f824]
mov eax, dword [edx + 0x140]
call eax
test eax, eax
jne 0x10016a8a
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002000
mov edx, dword [ebp - 0x358]
or edx, 1
mov dword [ebp - 0x358], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002040
mov eax, dword [ebp + 8]
jmp 0x10016ba6
mov ax, word [0x100529dc]
mov word [ebp - 0x30], ax
mov cl, byte [0x100529de]
mov byte [ebp - 0x2e], cl
mov dword [ebp - 0x248], 0
lea edx, [ebp - 0x244]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [ebp - 0x30], cl
push 0x104
lea edx, [ebp - 0x13c]
push edx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x10016b4d
lea ecx, [ebp - 0x13c]
push ecx
call sub.MSVCR90.dll_strlen
add esp, 4
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x104
jae 0x10016b4d
mov edx, dword [ebp - 0x24c]
push edx
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR90.dll_strncmp
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x248], eax
je 0x10016b4d
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x24c]
push edx
lea eax, [ebp - 0x30]
push eax
push str._s_s
lea ecx, [ebp - 0x354]
push ecx
call fcn.10016e70
add esp, 0x10
lea edx, [ebp - 0x354]
push edx
lea ecx, [ebp - 0x2c]
call fcn.1000c830
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
test ecx, ecx
je 0x10016b62
jmp 0x10016b4d
cmp dword [ebp - 0x248], 0
jne 0x10016b79
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10016ab0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002000
mov eax, dword [ebp - 0x358]
or eax, 1
mov dword [ebp - 0x358], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002040
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x10016ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xac
mov dword [ebp - 8], 0
jmp 0x10016ec2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2d
jge 0x10016f01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x39f6f87]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10016efc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10016eb9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2d], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10017020
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x28
push 0xffffffffffffffff
mov ecx, dword [0x1006f824]
mov edx, dword [ecx + 0x1b4]
call edx
test eax, eax
jne 0x1001704e
xor al, al
jmp 0x1001707f
push 2
push 0x10052874
mov eax, dword [ebp - 4]
push eax
call fcn.10016fc0
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x1001706c
xor al, al
jmp 0x1001707f
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x1006f824]
mov ecx, dword [eax + 0x8c]
call ecx
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10017100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0x10]
add eax, 5
push eax
call sub.MSVCR90.dll_malloc
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
push 0x40
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 8]
add ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov byte [edx], 0xe9
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
sub eax, 5
mov ecx, dword [ebp - 8]
mov dword [ecx + 1], eax
mov edx, dword [ebp + 8]
mov byte [edx], 0xe9
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov ecx, dword [ebp + 8]
mov dword [ecx + 1], eax
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100172f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x66
mov dword [ebp - 8], 0
jmp 0x10017312
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x10017351
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x69c1a7ce]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001734c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10017309
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100173b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047410
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [eax], 0x8b55ff8b
je 0x100174b5
call fcn.100073f0
movzx ecx, al
test ecx, ecx
je 0x1001742c
mov edx, 0xbcc300f8
push edx
lea ecx, [ebp - 0x17]
call fcn.10009890
mov dword [ebp - 0x50], eax
mov eax, 0x9ecaaf83
push eax
lea ecx, [ebp - 0x2c]
call fcn.1001e720
mov dword [ebp - 0x54], eax
push 0x10
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x54]
push edx
call fcn.10017530
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.1001db20
lea ecx, [ebp - 0x17]
call fcn.10038670
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001bf70
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100473c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
lea eax, [ebp - 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001c07f
lea ecx, [ebp - 0x1c]
push ecx
push 0x100520d4
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1001c07f
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret