joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c244
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x1c353
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x16258]
call fcn.000133b8
mov ebx, eax
mov dl, 1
mov eax, dword [0x16258]
call fcn.000133b8
mov esi, eax
lea edx, [ebp - 8]
xor eax, eax
call fcn.00012778
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00016a54
mov byte [ebp - 1], 1
mov eax, ebx
call fcn.000164d4
push edx
push eax
mov eax, dword [0x22960]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x1c2b1
cmp eax, dword [esp]
pop edx
pop eax
jae 0x1c2f0
jmp 0x1c2b5
pop edx
pop eax
jge 0x1c2f0
xor ecx, ecx
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, dword [0x22960]
xor edx, edx
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.00016674
mov edx, dword [0x22908]
mov eax, esi
call fcn.00016980
mov byte [ebp - 1], 0
jmp 0x1c315
push 0
mov eax, dword [0x22908]
call fcn.00014054
push eax
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00012778
mov eax, dword [ebp - 0xc]
call fcn.00014054
push eax
call sub.kernel32.dll_CopyFileA
cmp byte [ebp - 1], 1
jne 0x1c320
call fcn.0001afd8
mov eax, dword [0x22908]
call fcn.0001b46c
mov eax, ebx
call fcn.000133e8
mov eax, esi
call fcn.000133e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1c35a
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00013cf4
ret

Function at 0x1c364
Capabilities:
Copy file
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1c42a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x2294c]
call fcn.0001b314
push 0x1c438
push 0
push 0
call fcn.00014d4c
mov dword [0x22940], eax
push 0
mov eax, dword [0x22940]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x1c3b6
push 0
call sub.kernel32.dll_ExitProcess_1
push 0xffffffffffffffff
mov eax, dword [0x22904]
call fcn.00014054
push eax
lea edx, [ebp - 8]
xor eax, eax
call fcn.00012778
mov eax, dword [ebp - 8]
call fcn.00014054
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x22904]
call fcn.0001b46c
call fcn.0001add8
mov dword [0x22960], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1c11c
push 0
push 0
call sub.kernel32.dll_CreateThread
mov ebx, eax
call fcn.0001c1ec
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1c431
lea eax, [ebp - 8]
call fcn.00013cd0
ret
Function at 0x1c588
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
add esp, 0xfffffde8
mov esi, eax
push 0xff
lea eax, [esp + 0x119]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0xff
lea eax, [esp + 0x2d]
push eax
mov eax, dword [0x22934]
call fcn.00014054
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov ebx, 0xf
xor edx, edx
mov eax, dword [esp]
and eax, ebx
shl ebx, 4
mov ecx, edx
shl ecx, 2
shr eax, cl
cmp eax, 0xa
jl 0x1c5eb
sub eax, 0xa
add eax, 0x41
jmp 0x1c5ee
add eax, 0x30
mov ecx, 7
sub ecx, edx
mov byte [esp + ecx + 0xc], al
inc edx
cmp edx, 8
jne 0x1c5cf
mov byte [esp + 0x14], 0
mov eax, esi
lea edx, [esp + 0xc]
mov ecx, 9
call fcn.00013e3c
add esp, 0x218
pop esi
pop ebx
ret

Function at 0x1c620
Capabilities:
Create process on windows
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1c7c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x1c7d4
mov edx, dword [0x2292c]
call fcn.00013ea0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00012ae4
lea eax, [ebp - 0x1d0]
call fcn.00012880
call fcn.00012610
push 0x1c7e8
push dword [0x22928]
push 0x1c844
push dword [0x2292c]
push 0x1c86c
push dword [0x22908]
push 0x1c884
lea eax, [ebp - 0x228]
mov edx, 7
call fcn.00013f14
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x1d0]
call fcn.000141e8
call fcn.0001321c
call fcn.00012610
push 0x1c894
push dword [0x22928]
push 0x1c8f0
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.00013f14
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x1d0]
call fcn.000141e8
call fcn.0001321c
call fcn.00012610
mov edx, 0x1c900
lea eax, [ebp - 0x1d0]
call fcn.000141e8
call fcn.0001321c
call fcn.00012610
lea eax, [ebp - 0x1d0]
call fcn.00012ba0
call fcn.00012610
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00012bf8
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00014054
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x1c79a
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1c7c7
lea eax, [ebp - 0x22c]
mov edx, 2
call fcn.00013cf4
lea eax, [ebp - 4]
call fcn.00013cd0
ret
Function at 0x1c920
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014044
mov eax, dword [ebp - 8]
call fcn.00014044
xor eax, eax
push ebp
push 0x1c9e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00014054
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 8]
call fcn.00014054
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1c9c3
cmp byte [ebp - 0x120], 0x2e
je 0x1c9b2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x250]
push eax
push 0x104
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetFullPathNameA
mov eax, esi
lea edx, [ebp - 0x250]
mov ecx, 0x104
call fcn.00013e3c
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x1c97b
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1c9eb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00013cf4
ret
Function at 0x1d750
Capabilities:
Copy file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00014044
xor eax, eax
push ebp
push 0x1d966
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00014054
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1d950
lea eax, [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize_1
cmp eax, 0x6400000
jge 0x1d94a
push 0
push 0
sub eax, 4
push eax
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, 4
push 0
lea edx, [ebp - 0x10]
push edx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
xor dword [ebp - 0x14], 0x12345678
cmp dword [ebp - 0x14], 0x4b6d113f
jne 0x1d7f1
push ebx
call sub.kernel32.dll_CloseHandle_1
jmp 0x1d950
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dl, 1
mov eax, dword [0x16258]
call fcn.000133b8
mov ebx, eax
mov dl, 1
mov eax, dword [0x16258]
call fcn.000133b8
mov esi, eax
mov dl, 1
mov eax, dword [0x16258]
call fcn.000133b8
mov dword [ebp - 0xc], eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00016a54
push 0
push 0
mov eax, ebx
call fcn.000164d4
mov edx, eax
mov ecx, 0x1d97c
mov eax, dword [ebx + 4]
call fcn.000183cc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00019fc0
test al, al
jne 0x1d87c
mov eax, ebx
call fcn.000133e8
mov eax, esi
call fcn.000133e8
mov eax, dword [ebp - 0xc]
call fcn.000133e8
jmp 0x1d950
push 0
mov eax, dword [ebp - 4]
call fcn.00014054
push eax
mov eax, dword [0x22904]
call fcn.00014054
push eax
call sub.kernel32.dll_CopyFileA
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x10]
lea edx, [ebp - 0xc]
mov ecx, 0x1d990
mov eax, dword [ebp - 4]
call fcn.00019a54
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00016a54
mov cx, 2
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, ebx
call fcn.000164d4
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.00016674
mov eax, ebx
call fcn.000164d4
xor eax, 0x12ff34
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, esi
call fcn.00016654
mov cx, 2
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
mov dword [ebp - 0x1c], 0x59594747
lea edx, [ebp - 0x1c]
mov ecx, 4
mov eax, esi
call fcn.00016654
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00016980
mov eax, ebx
call fcn.000133e8
mov eax, esi
call fcn.000133e8
mov eax, dword [ebp - 0xc]
call fcn.000133e8
jmp 0x1d950
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1d96d
lea eax, [ebp - 4]
call fcn.00013cd0
ret
Function at 0x100b1424
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100e4890]
jne 0x100b142e
repz ret
jmp fcn.100b330f

Function at 0x100b2d5a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100b1664
and dword [ebp - 4], 0
cmp dword [0x100e6904], 0
mov ebx, eax
jne 0x100b2e0b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100b2ebc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100b2ebc
push eax
call fcn.100b15f2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100e6904], eax
call esi
push eax
call fcn.100b15f2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100e6908], eax
call esi
push eax
call fcn.100b15f2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100e690c], eax
call esi
push eax
call fcn.100b15f2
pop ecx
mov dword [0x100e6914], eax
test eax, eax
je 0x100b2e0b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100b15f2
pop ecx
mov dword [0x100e6910], eax
mov eax, dword [0x100e6910]
cmp eax, ebx
je 0x100b2e63
cmp dword [0x100e6914], ebx
je 0x100b2e63
push eax
call fcn.100b166d
push dword [0x100e6914]
mov esi, eax
call fcn.100b166d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100b2e63
test edi, edi
je 0x100b2e63
call esi
test eax, eax
je 0x100b2e5a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100b2e5a
test byte [ebp - 0xc], 1
jne 0x100b2e63
or dword [ebp + 0x10], 0x200000
jmp 0x100b2e9c
mov eax, dword [0x100e6908]
cmp eax, ebx
je 0x100b2e9c
push eax
call fcn.100b166d
pop ecx
test eax, eax
je 0x100b2e9c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100b2e9c
mov eax, dword [0x100e690c]
cmp eax, ebx
je 0x100b2e9c
push eax
call fcn.100b166d
pop ecx
test eax, eax
je 0x100b2e9c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100e6904]
call fcn.100b166d
pop ecx
test eax, eax
je 0x100b2ebc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100b2ebe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100c12a9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [0x100e479c], 0xb
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [0x100e479c]
add edx, 0xffffd9ce
mov dword [0x100e47a0], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x100e479c], 0x15bd
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x100c1346
mov dword [0x100e479c], 0xe97
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x100c13f0
jmp 0x100c1423
mov eax, dword [ebp - 0x18]
mov dword [0x100e479c], 0x10c9
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x100c139c
jmp 0x100c1423
mov eax, dword [ebp - 0x1c]
add esp, 0x2c
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
je 0x100c131d
jmp 0x100c137c
mov dword [0x100e47a0], 0x8e7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x100c12fb
jmp 0x100c1423
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x104
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
jl 0x100c1346
jmp 0x100c131d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
sete dl
mov byte [ebp - 0x25], dl
mov al, byte [ebp - 0x25]
test al, 1
jne 0x100c13b8
jmp 0x100c1423
mov dword [0x100e47a0], 0x80e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x28], dx
mov ax, word [ebp - 0x28]
cmp ax, 0x61
jne 0x100c1423
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x100c135e
jmp 0x100c1423
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff9
mov dword [0x100e47a0], 0x113b
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x2c], ecx
mov eax, 1
mov ecx, dword [ebp - 0x2c]
cmp word [ecx], 0x6c
mov dword [ebp - 0x1c], eax
je 0x100c133e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100c133e
Function at 0x100c142d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [0x100e479c], 0x234d
call fcn.10001087
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
jne 0x100c1496
lea eax, [esp + 0x40]
mov dword [0x100e479c], 0x1e2a
mov dword [esp + 0x28], eax
call fcn.100c12a9
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x100c14a0
jmp 0x100c15b1
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x100c151e
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.100c17a0
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x84], ecx
mov ecx, dword [0x100e479c]
add ecx, 0xdd
mov dword [0x100e47a0], ecx
mov dword [esp + 0x80], 0x126200
mov ecx, dword [0x100e4788]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x18], eax
lea eax, [0x100c1247]
mov ecx, dword [0x100e478c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [0x100e4790]
mov dword [esp + 0x44], ecx
mov ecx, dword [0x100e4794]
mov dword [esp + 0x4c], ecx
mov ecx, dword [0x100e4798]
mov dword [esp + 0x54], ecx
mov dword [0x100e479c], 0xffffe6c3
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
jne 0x100c147f
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp dword [eax], 0x4550
jne 0x100c147f
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x58], ecx
mov edx, dword [esp + 0x14]
mov esi, dword [ecx + edx + 0x50]
add eax, 0x1c
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
mov esi, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.100c1d59
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x100e479c], 0x239d
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
jmp 0x100c1496
Function at 0x100c1a7b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.100c2138
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x100c1ab7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x100e47a0], 0x1657
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x100e479c], 0x91
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x100c1bf4
mov eax, dword [ebp - 0x24]
add eax, 0x24
mov dword [ebp - 0x34], eax
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x34]
add ecx, dword [ecx + edx]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jmp 0x100c1b21
mov al, byte [ebp - 0x3d]
test al, 1
jne 0x100c1b40
jmp 0x100c1b93
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edx
jmp 0x100c1bc2
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x100e479c], 0x1802
mov dword [ebp - 0x30], edi
jmp 0x100c1bf4
mov al, byte [ebp - 0x51]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x58]
add edx, 1
mov ah, byte [ebp - 0x3d]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x50], edx
jne 0x100c1bc2
jmp 0x100c1b18
mov eax, dword [ebp - 0x48]
add eax, 2
mov dword [ebp - 0x5c], eax
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov edx, dword [ebp - 0x2c]
cmp ecx, edx
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], eax
jb 0x100c1b21
jmp 0x100c1bf4
mov eax, dword [ebp - 0x50]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x3d], cl
je 0x100c1b18
jmp 0x100c1b68
mov eax, dword [ebp - 0x30]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100c1d59
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x100e47a0], 0x15d4
mov dword [0x100e479c], 0x407
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x100c1e4e
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.100c15ed
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x3c], 0xc0
mov dword [edx + 0xc0], 0x4550
add edx, 0xffc00000
mov esi, dword [ebp - 0x2c]
mov dword [esi + 0x10], edx
mov edx, dword [ebp - 0x38]
mov dword [esi + 0x20], edx
mov dword [0x100e479c], 0xeda
cmp edx, 0
mov dword [ebp - 0x40], eax
je 0x100c1e45
jmp 0x100c1e7a
lea eax, [ebp - 0x24]
mov dword [0x100e47a0], 0x161a
mov dword [ebp - 0x44], eax
call fcn.100c2420
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
call fcn.100c1fcb
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], ecx
jne 0x100c1d8a
mov eax, dword [ebp - 0x40]
add esp, 0x54
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x100c473e]
mov dh, byte [eax + 0x100c470f]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
je 0x100c1e0e
jmp 0x100c1e4e
mov eax, dword [ebp - 0x38]
add eax, 0x24b5
mov dword [0x100e47a0], 0xffffe86e
mov dword [0x100e479c], 0x443
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
jmp 0x100c1e45
Function at 0x100c2282
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [0x100e47a0]
add edi, 0xfffffc50
mov dword [0x100e479c], edi
mov dword [0x100e47a8], 0
mov byte [0x100e47ac], 0
mov dword [0x100e47a0], 0x1e29
mov dword [0x100e47a4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x100c2399
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x100e47b0], 0
mov edx, dword [0x100e47a8]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x100e47b0], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x100e47a8], edx
mov dword [0x100e479c], 0x13cc
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x100e47ac], cl
mov dword [0x100e479c], 0x1ae6
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x100e47ac]
mov edx, dword [0x100e47a8]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x100e47a0]
add edx, 0xffffe7b0
mov dword [0x100e479c], edx
mov edx, dword [0x100e47a4]
add edx, 1
mov dword [0x100e47a4], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x100c22de
jmp 0x100c23fa
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x100e47a0]
mov esi, eax
add esi, 0xffffe676
mov dword [0x100e479c], esi
mov esi, dword [0x100e47a4]
add esi, 1
mov dword [0x100e47a4], esi
cmp esi, 0x100
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], esi
jl 0x100c2399
mov eax, dword [ebp - 0x28]
add eax, 0xfffff1df
mov dword [0x100e479c], eax
mov dword [0x100e47a4], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100c22de
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret